Formal verification of application-specific security properties in a model-driven approach

  • Authors:

  • Nina Moebius;Kurt Stenzel;Wolfgang Reif

  • Affiliations:

  • Institute for Software and Systems Engineering, University of Augsburg, Augsburg, Germany;Institute for Software and Systems Engineering, University of Augsburg, Augsburg, Germany;Institute for Software and Systems Engineering, University of Augsburg, Augsburg, Germany

  • Venue:
  • ESSoS'10 Proceedings of the Second international conference on Engineering Secure Software and Systems
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

We present a verification method that allows to prove security for security-critical systems based on cryptographic protocols. Designing cryptographic protocols is very difficult and error-prone and most tool-based verification approaches only consider standard security properties such as secrecy or authenticity. In our opinion, application-specific security properties give better guarantees. In this paper we illustrate how to verify properties that are relevant for e-commerce applications, e.g. 'The provider of a copying service does not lose money'. This yields a more complex security property that is proven using interactive verification. The verification of this kind of application-specific property is part of the SecureMDD approach which provides a method to model a security-critical application with UML and automatically generates executable code as well as a formal specification for interactive verification from the UML models.