Resource-Aware Authorization Policies for Statically Typed Cryptographic Protocols

Authors:
Michele Bugliesi;Stefano Calzavara;Fabienne Eigner;Matteo Maffei
Affiliations:
-;-;-;-
Venue:
CSF '11 Proceedings of the 2011 IEEE 24th Computer Security Foundations Symposium
Year:
2011

Citing 0
Cited 3

Secure recharge of disposable RFID tickets

FAST'11 Proceedings of the 8th international conference on Formal Aspects of Security and Trust
Logical foundations of secure resource management in protocol implementations

POST'13 Proceedings of the Second international conference on Principles of Security and Trust
Union, intersection and refinement types and reasoning about type disjointness for secure protocol implementations

Journal of Computer Security - Foundational Aspects of Security

Quantified Score

Hi-index	0.01

Visualization

Abstract

Type systems for authorization are a popular device for the specification and verification of security properties in cryptographic applications. Though promising, existing frameworks exhibit limited expressive power, as the underlying specification languages fail to account for powerful notions of authorization based on access counts, usage bounds, and mechanisms of resource consumption, which instead characterize most of the modern online services and applications. We present a new type system that features a novel combination of affine logic, refinement types, and types for cryptography, to support the verification of resource-aware security policies. The type system allows us to analyze a number of cryptographic protocol patterns and security properties, which are out of reach for existing verification frameworks based on static analysis.