Formally based semi-automatic implementation of an open security protocol

Journal of Systems and Software

Volumn 85, Issue 4, 2012, Pages 835-849

  Pironti, Alfredo ^a   Pozza, Davide ^a   Sisto, Riccardo ^a  

^a POLITECNICO DI TORINO   (Italy)

Author keywords

Automatic code generation; Model driven development; Security protocols; Spi2Java

Indexed keywords

ABSTRACT LEVELS; AUTOMATIC CODE GENERATIONS; EXECUTION TIME; JAVA IMPLEMENTATION; MODEL DRIVEN APPROACH; MODEL-DRIVEN-DEVELOPMENT; SECURITY PROTOCOLS; SEMI-AUTOMATICS; SPI2JAVA; THIRD PARTIES; TRANSPORT LAYER PROTOCOLS;

EXPERIMENTS; INTERNET PROTOCOLS; NETWORK SECURITY;

SYSTEMS ANALYSIS;

EID: 84857355689     PISSN: 01641212     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.jss.2011.10.052     Document Type: Article

References (42)

1. Abadi, M.; Gordon, A.D.; 1998. A calculus for cryptographic protocols: the spi calculus. Research Report 149.
2. Bangerter, E.; Camenisch, J.; Krenn, S.; Sadeghi, A.-R.; Schneider, T.; 2008. Automatic generation of sound zero-knowledge protocols, cryptology ePrint archive. Report 2008/471.
3. Barthe G.; Burdy L.; Charles J.; Grégoire B.; Huisman M.; Lanet J.-L.; Pavlova M.; and Requet A. JACK: a tool for validation of security and behaviour of Java applications International Symposium on Formal Methods for Components and Objects, LNCS 5382 2007 Springer 152 174 (Pubitemid 351152888)
4. Basin D.; Doser J.; and Lodderstedt T. Model driven security: from UML models to access control infrastructures ACM Transactions on Software Engineering and Methodology 15 1 2006 39 91 (Pubitemid 43947939)
5. Beckert B.; Hähnle R.; and Schmitt P.H. Verification of Object-Oriented Software: The KeY Approach, LNCS 4334 2007 Springer
6. Bengtson J.; Bhargavan K.; Fournet C.; Gordon A.D.; and Maffeis S. Refinement types for secure implementations ACM Transactions on Programming Languages and Systems 33 2011 1 45
7. Bhargavan K.; Fournet C.; Gordon A.D.; and Tse S. Verified interoperable implementations of security protocols Computer Security Foundations Workshop 2006 IEEE Computer Society 139 152 (Pubitemid 46499723)
8. Bhargavan K.; Fournet C.; and Gordon A.D. Verified reference implementations of WS-security protocols Web Services and Formal Methods, LNCS 4184, 2006 Springer 88 106 (Pubitemid 44849753)
9. Bhargavan K.; Corin R.; Fournet C.; and Zlinescu E. Cryptographically verified implementations for TLS Computer and Communications Security 2008 ACM 459 468
10. Bhargavan K.; Corin R.; Deniélou P.-M.; Fournet C.; and Leifer J.J. Cryptographic protocol synthesis and verification for multiparty sessions Computer Security Foundations Symposium 2009 IEEE Computer Society 124 140
11. Bhargavan K.; Fournet C.; and Gordon A.D. Modular verification of security protocol code by typing Symposium on Principles of Programming Languages 2010 ACM 445 456
12. Blanchet B.; and Pointcheval D. Automated security proofs with sequences of games International Cryptology Conference, LNCS 4117 2006 Springer 537 554 (Pubitemid 44532137)
13. Blanchet B.; Abadi M.; and Fournet C. Automated verification of selected equivalences for security protocols Journal of Logic and Algebraic Programming 75 1 2008 3 51 (Pubitemid 351172997)
14. Bhargavan B. An efficient cryptographic protocol verifier based on prolog rules Computer Security Foundations Workshop 2001 IEEE Computer Society 82 96
15. Blanchet B. From secrecy to authenticity in security protocols International Static Analysis Symposium, LNCS 2477 2002 Springer 342 359
16. Blanchet B. A computationally sound mechanized prover for security protocols IEEE Transactions on Dependable and Secure Computing 5 4 2008 193 207
17. Dolev D.; and Yao A.C.-C. On the security of public key protocols IEEE Transactions on Information Theory 29 2 1983 198 207
18. Durante L.; Sisto R.; and Valenzano A. Automatic testing equivalence verification of spi calculus specifications ACM Transactions on Software Engineering and Methodology 12 2 2003 222 284 (Pubitemid 44159309)
19. Escobar S.; Meadows C.; and Meseguer J. Maude-NPA: cryptographic protocol analysis modulo equational properties Foundations of Security Analysis and Design, LNCS 5705 2009 Springer 1 50
20. Grandy H.; Bischof M.; Stenzel K.; Schellhorn G.; and Reif W. Verification of Mondex electronic purses with KIV: from a security protocol to verified code Formal Methods, LNCS 5014 2008 Springer 165 180
21. Hubbers E.; Oostdijk M.; and Poll E. Implementing a formally verifiable security protocol in Java Card Security in Pervasive Computing, LNCS 2802 2003 Springer 213 226
22. Jürjens J. Automated security verification for crypto protocol implementations: verifying the Jessie project Electronic Notes in Theoretical Computer Science 250 2009 123 136 ISSN 1571-0661, doi:10.1016/j.entcs.2009.08. 009
23. Jürjens J. Secure Systems Development with UML 2005 Springer
24. Jeon C.-W.; Kim I.-G.; and Choi J.-Y. Automatic generation of the C# code for security protocols verified with Casper/FDR International Conference on Advanced Information Networking and Applications 2005 IEEE Computer Society 507 510 (Pubitemid 43804079)
25. Kiyomoto S.; Ota H.; and Tanaka T. A security protocol compiler generating C source codes International Conference on Information Security and Assurance 2008 IEEE Computer Society 20 25
26. Lowe G. A hierarchy of authentication specifications Computer Security Foundations Workshop 1997 IEEE Computer Society 31 43
27. Lowe G. Casper: a compiler for the analysis of security protocols Journal of Computer Security 6 1-2 1998 53 84
28. Mödersheim S.; and Vigan L. The open-source fixed-point model checker for symbolic analysis of security protocols Foundations of Security Analysis and Design, LNCS 5705 2009 Springer 166 194
29. Marché C.; Paulin-Mohring C.; and Urbain X. The Krakatoa tool for certification of Java/Java Card programs annotated in JML Journal of Logic and Algebraic Programming 58 1-2 2004 89 106
30. McDermott J. Visual security protocol modeling Workshop on New Security Paradigms 2005 ACM 97 109 (Pubitemid 43990981)
31. Moebius N.; Stenzel K.; Grandy H.; and Reif W. SecureMDD: A model-driven development method for secure smart card applications International Conference on Availability, Reliability and Security 2009 IEEE Computer Society 841 846
32. O'Shea N. Using Elyjah to analyse Java implementations of cryptographic protocols Foundations of Computer Security, Automated Reasoning for Security Protocol Analysis and Issues in the Theory of Security 2008
33. Pironti A.; and Sisto R. An experiment in interoperable cryptographic protocol implementation using automatic code generation IEEE Symposium on Computers and Communications 2007 IEEE Computer Society 839 844
34. Pironti A.; and Sisto R. Soundness conditions for message encoding abstractions in formal security protocol models Availability, Reliability and Security 2008 IEEE Computer Society 72 79
35. Pironti A.; and Sisto R. Provably correct Java implementations of spi calculus security protocols specifications Computers & Security 29 3 2010 302 314
36. Pironti, A.; Pozza, D.; Sisto, R.; 2011. Resources about Spi2Java and the SSH-TLP case study. http://spi2java.polito.it.
37. Pironti, A.; 2010. Sound automatic implementation generation and monitoring of security protocol implementations from verified formal specifications. Ph.D. thesis. Politecnico di Torino, Italy. http://alfredo. pironti.eu/research/sites/default/files/Pironti-Dissertation.pdf.
38. Pozza D.; Sisto R.; and Durante L. Spi2Java: automatic cryptographic protocol Java code generation from spi calculus International Conference on Advanced Information Networking and Applications 2004 IEEE Computer Society 400 405
39. Song D.X.; Perrig A.; and Phan D. AGVI - automatic generation, verification, and implementation of security protocols International Conference on Computer Aided Verification 2001 Springer 241 245 (Pubitemid 33312919)
40. Tobler B.; and Hutchison A. Generating network security protocol implementations from formal specifications Certification and Security in Inter-Organizational E-Services 2004 Springer Toulouse, France
41. Ylonen, T.; Lonvick, C.; 2006. The secure shell (SSH) protocol architecture, RFC 4251 (proposed standard). http://www.ietf.org/rfc/rfc4251.txt.
42. Ylonen, T.; Lonvick, C.; 2006. The secure shell (SSH) transport layer protocol, RFC 4253 (proposed standard). http://www.ietf.org/rfc/rfc4253.txt.