Automated Formal Verification of Application-specific Security Properties
In the past, formal verification of security properties of distributed applications has been mostly targeted to security protocols and generic security properties, like confidentiality and authenticity.
At ESSOS 2010, Moebius et. al. presented an approach for developing Java applications with formally verified application-specific security properties. That method, however, is based on an interactive theorem prover, which is not automatic and requires considerable expertise. This paper shows that a similar result can be achieved in a fully automated way, using a different model-driven approach and state-of-the-art automated verification tools. The proposed method splits the verification problem into two independent sub-problems using compositional verification techniques and exploits one tool for analyzing the security protocol under active attackers and another tool for verifying the application logic. The same case study that was verified in the previous work is used here in order to show how the new approach works.
Unable to display preview. Download preview PDF.
- 1.Patel, R., Borisaniya, B., Patel, A., Patel, D., Rajarajan, M., Zisman, A.: Comparative analysis of formal model checking tools for security protocol verification. In: Meghanathan, N., Boumerdassi, S., Chaki, N., Nagamalai, D. (eds.) CNSA 2010. CCIS, vol. 89, pp. 152–163. Springer, Heidelberg (2010)CrossRefGoogle Scholar
- 4.Blanchet, B.: An Efficient Cryptographic Protocol Verifier Based on Prolog Rules. In: 14th IEEE workshop on Computer Security Foundations, p. 82 (2001)Google Scholar
- 5.Avalle, M., Pironti, A., Sisto, R., Pozza, D.: The Java SPI framework for security protocol implementation. In: Sixth International Conference on Availability, Reliability and Security (ARES), pp. 746–751 (2011)Google Scholar
- 6.Avalle, M., Pironti, A., Sisto, R.: Formal verification of security protocol implementations: a survey. In: Formal Aspects of Computing (to appear)Google Scholar
- 9.Borek, M., Moebius, N., Stenzel, K., Reif, W.: Model-driven development of secure service applications. In: Proceedings of the 35th Annual IEEE Software Engineering Workshop (SEW), pp. 62–71. IEEE (2012)Google Scholar
- 12.Jürjens, J.: Developing high-assurance secure systems with UML: a smartcard-based purchase protocol. In: 8th IEEE International Conference on High Assurance Systems Engineering, pp. 231–240 (2004)Google Scholar
- 16.Pozza, D., Sisto, R., Durante, L.: Spi2Java: automatic cryptographic protocol Java code generation from spi calculus. In: 18th International Conference on Advanced Information Networking and Applications, 2004, vol. 1, pp. 400–405 (2004)Google Scholar