Security protocol deployment risk

  • Authors:
  • Simon N. Foley;Giampaolo Bella;Stefano Bistarelli

  • Affiliations:
  • Department of Computer Science, University College Cork, Ireland;SAP Research, Mougins, France and Dipartimento di Matematica e Informatica, Università di Catania, Italy;Dipartimento di Scienze, Università degli Studi "G. D'Annunzio", Pescara, Italy and Istituto di Informatica e Telematica, CNR, Pisa, Italy

  • Venue:
  • Security'08 Proceedings of the 16th International conference on Security protocols
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Security protocol participants are software and/or hardware agents that are -- as with any system -- potentially vulnerable to failure. Protocol analysis should extend not just to an analysis of the protocol specification, but also to its implementation and configuration in its target environment. However, an in-depth formal analysis that considers the behaviour and interaction of all components in their environment is not feasible in practice. This paper considers the analysis of protocol deployment rather than implementation. Instead of concentrating on detailed semantics and formal verification of the protocol and implementation, we are concerned more with with the ability to trace, at a practical level of abstraction, how the protocol deployment, that is, the configuration of the protocol components, relate to each other and the overall protocol goals. We believe that a complete security verification of a system is not currently achievable in practice and seek some degree of useful feedback from an analysis that a particular protocol deployment is reasonable.