Formal security policy models for smart card evaluations

  • Authors:
  • Gerd Beuster;Karin Greimel

  • Affiliations:
  • Fachhochschule Wedel, Wedel, Germany;NXP Semiconductors Austria GmbH, Gratkorn, Austria

  • Venue:
  • Proceedings of the 27th Annual ACM Symposium on Applied Computing
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

For high security ICs, a security evaluation by an independent institution is of great importance to strengthen the confidence in the security of the product. Common Criteria (CC) is a widely used evaluation method for security products. In many countries, CC evaluations are required by law for certain IT products. For high assurance, CC requires a formal model of the implemented security policies. We show how such a formal security policy model based on temporal logic and model checking can be developed for the real world evaluation of a Security IC. We argue that temporal logics and model checking is suitable for the formal requirements of a CC Evaluation Assurance Level 6 evaluation, because models and security requirements can be developed by anybody with moderate knowledge of formal methods. Additionally, proofs (or refutations) are generated automatically.