Verification of security protocols using LOTOS-method and application

Abstract

We explain how the formal language LOTOS can be used to specify security protocols and cryptographic operations. We describe how security properties can be modelled as safety properties and how a model-based verification method can be used to verify the robustness of a protocol against attacks of an intruder. We illustrate our technique on a concrete registration protocol. We find an attack, correct the protocol, propose a simpler yet secure protocol, and finally a more sophisticated protocol that allows a better discrimination between intruder's attacks and classical protocol errors.

Introduction

With the development of the Internet and especially with the birth of electronic commerce, the security of communications between computers becomes a crucial point. All these new applications require reliable protocols able to perform secure transactions. The environment of these operations is very hostile because no transmission channel can be considered safe. Formal descriptions and verifications can be used to obtain the assurance that a protocol cannot be threatened by an intruder.

Our approach consists of using a generic formal language (LOTOS) and its associated verification methods and tools to verify security protocols. We explain how LOTOS can be used to specify security protocols and cryptographic operations, and show how security properties can be modelled as safety properties and checked automatically by a model-based verification tool. In our method a simple and powerful intruder process is explicitly added to the specification, so that the verification of the security properties guarantees the robustness of the protocol against attacks of such an intruder.

Our approach is similar to [24], [25] where authentication protocols were specified in CSP [17] and checked by the FDR tool by verifying the trace inclusion relation between the system and the property. This tool and the one we have used are not classical model-checkers but rather equivalence or preorder checkers. Model-checkers (e.g. [26], [30]) have also been used in similar ways.

The model-based methods are extremely powerful at finding subtle flaws in protocols, but are less adequate to prove correctness when no bug is found. This is because they are applied on simplified, though realistic, models of the systems. On the other hand, theorem provers [2], [7], [19], [32] can provide such proofs and can also deal more easily with infinite-state systems. However, the proofs are usually less automated, and when no proof has been derived for a given property, it is not easy to know whether the property is wrong or whether the tool simply did not find it. In particular, an attack that falsifies the property is not provided automatically.

We illustrate our technique on a concrete registration protocol which is a part of the Equicrypt protocol [21] designed in the ACTS OKAPI project. We have already verified and corrected the subscription protocol [22], [23] and the registration protocol [13], [14] of Equicrypt. This paper extends our previous work in two ways: firstly, we present a more complete picture of our approach and secondly, we propose an enhanced design in two steps: we find a simpler registration protocol that remains secure, and a more sophisticated protocol that allows a better discrimination between intruder's attacks and classical protocol errors.

The paper is organized as follows: in Section 2, we will show that the LOTOS language is appropriate to handle the specification of security protocols at a high level of abstraction. With its flexibility, a wide range of cryptographic operations can be modelled. We will describe the establishment of security properties and the associated verification process in Section 3. The verification is quite automatic and allows one to certify that an intruder cannot break a cryptographic protocol with different kinds of attacks. An application of our method on a concrete protocol will be presented in Section 4. We will also point out that it is possible to tune a protocol in order to obtain new properties and improve its behaviour. Finally, we compare our approach with related work.