Notes

Outline

CSP tools for verification of Sec Prot Overview of the lecture The Casper interface Refinement checking and FDR Model checking Theorem proving Safe simplifying transformations

The Casper interface Casper is essentially a compiler

Refinement checking and FDR

Refinement checking and FDR The notion of refinement The implementation should be a refinement of the specification, in the sense of preserving its properties. Hence, less nondeterministic Refinement checking: checking that the implementation is indeed a refinement of the specification Obviously, the notion of refinement depends on the intended semantic. In CSP traditionally we consider 3 kinds of semantics: Traces Failures Failures and Divergences

Refinement checking and FDR Traces The set of the sequences of visible actions in all possible runs Example:    A  =   a -> b -> c -> Stop [] b -> c -> a -> Stop    Tr(A)  =  { a.b.c, b.c.a }    B  =   a -> Stop ||| b -> c -> Stop    Tr(A)  =  { a.b.c, b.a.c, b.c.a } Note that A is less nondeterministic than B: A represents only a subset of the possible runs of B

Refinement checking and FDR We want to define formally the notion of refinement wrt trace semantics, in such a way that it captures the concept of “less nondeterministic”. Question: what should be the formal definition of “A is a refinement of B” in terms of their traces?

Refinement checking and FDR Limits of trace semantics: It is not compositional. Namely, trace refinement is not preserved under contexts. This means that the analysis based on traces cannot be performed modularly: it must be performed on the whole system at once. Example A = a -> (b -> Stop [] c -> Stop) B  =  a -> Stop [] a -> c -> Stop

Refinement checking and FDR Stronger, compositional semantics Failures: this semantics encodes the brancing structure of a process by representing, after each partial trace, the set of actions that are not allowed Example: The notion of refinement is defined in such a way that A is a refinement of B, but not vice versa This notion of refinement is preserved under closure on possible contexts

Refinement checking and FDR Stronger, compositional semantics Failures and Divergences: This semantics encodes all the information of Failure semantics, plus additional information about divergences (livelocks). As such, it is suitable also for the analysis of liveness properties (not only safety) Example: It is considered the standard model of CSP FDR means: Failure and Divergences Refinement Automatic refinement check for finite state systems (they can have infinite computations, but the number of states is finite)

Model checking Model checking basics The security property we want to verify is expressed as a temporal logic formula F The protocol is expressed as a system S of processes (the processes involved with the protocol and, possibly, the intruder) S is represented as a labeled transition system T, which is seen as an interpretation of F Model checking consists in showing that T is a model of F, namely that T validates F Always possible with Finite State systems Also possible for some restricted cases of Infinite State systems

Model checking Example A  =  a -> b -> A B  =  c -> d -> B S  =   A ||| B Temporal operators: F : forever E : eventually Some formulae F E (a or c) F E a E F (a or c)

Theorem proving Based on a set of inference rules that model a satisfiability relation S sat P Example: parallel rule Forall  i.  (Si sat (R precedes T)) (|||i Si ) sat (R precedes T) Properties of the inference system: Semiautomatic (invariant needed for recursive definitions) Sound and relatively complete All the properties of the Yahalom protocol seen in previous lecture can be easily verified using this system (see proofs in the book of Ryan and Schneider)