Model-Based Verification of a Security Protocol for Conditional Access to Services

Authors:
G. Leduc;O. Bonaventure;L. Léonard;E. Koerner;C. Pecheur
Affiliations:
Université de Liège, Institut d‘Electricité Montefiore, B 28, B-4000 Liège 1, Belgium. leduc@montefiore.ulg.ac.be;Université de Liège, Institut d‘Electricité Montefiore, B 28, B-4000 Liège 1, Belgium;Université de Liège, Institut d‘Electricité Montefiore, B 28, B-4000 Liège 1, Belgium;Université de Liège, Institut d‘Electricité Montefiore, B 28, B-4000 Liège 1, Belgium;Université de Liège, Institut d‘Electricité Montefiore, B 28, B-4000 Liège 1, Belgium
Venue:
Formal Methods in System Design
Year:
1999

Citing 18
Cited 3

Communicating sequential processes

Communicating sequential processes
The Interrogator: Protocol Secuity Analysis

IEEE Transactions on Software Engineering - Special issue on computer security and privacy
Introduction to the ISO specification language LOTOS

Computer Networks and ISDN Systems - Special Issue: Protocol Specification and Testing
A practical zero-knowledge protocol fitted to security microprocessor minimizing both transmission and memory

Lecture Notes in Computer Science on Advances in Cryptology-EUROCRYPT'88
Communication and concurrency

Communication and concurrency
A logic of authentication

ACM Transactions on Computer Systems (TOCS)
Use of a formal description technique in the specification of authentication protocols

Computer Standards & Interfaces
Safety for branching time semantics

Proceedings of the 18th international colloquium on Automata, languages and programming
An attack on the Needham-Schroeder public-key authentication protocol

Information Processing Letters
An approach to the formal verification of cryptographic protocols

CCS '96 Proceedings of the 3rd ACM conference on Computer and communications security
A calculus for cryptographic protocols: the spi calculus

Proceedings of the 4th ACM conference on Computer and communications security
A method for obtaining digital signatures and public-key cryptosystems

Communications of the ACM
A Computer Aided Design of a Secure Registration Protocol

FORTE X / PSTV XVII '97 Proceedings of the IFIP TC6 WG6.1 Joint International Conference on Formal Description Techniques for Distributed Systems and Communication Protocols (FORTE X) and Protocol Specification, Testing and Verification (PSTV XVII)
Breaking and Fixing the Needham-Schroeder Public-Key Protocol Using FDR

TACAs '96 Proceedings of the Second International Workshop on Tools and Algorithms for Construction and Analysis of Systems
Formal Verification of Cryptographic Protocols: A Survey

ASIACRYPT '94 Proceedings of the 4th International Conference on the Theory and Applications of Cryptology: Advances in Cryptology
CADP - A Protocol Validation and Verification Toolbox

CAV '96 Proceedings of the 8th International Conference on Computer Aided Verification
Towards a Mechanization of Cryptographic Protocal Verification

CAV '97 Proceedings of the 9th International Conference on Computer Aided Verification
A Semantic Model for Authentication Protocols

SP '93 Proceedings of the 1993 IEEE Symposium on Security and Privacy

Using SPIN and eclipse for optimized high-level modeling and analysis of computer network attack models

SPIN'05 Proceedings of the 12th international conference on Model Checking Software
A framework based approach for formal modeling and analysis of multi-level attacks in computer networks

FORTE'05 Proceedings of the 25th IFIP WG 6.1 international conference on Formal Techniques for Networked and Distributed Systems
Verification of security protocols using LOTOS-method and application

Computer Communications

Quantified Score

Hi-index	0.00

Visualization

Abstract

We use the formal language LOTOS to specify and verify therobustness of the Equicrypt protocol under design in the EuropeanOKAPI project for conditional access to multimedia services. We statesome desired security properties and formalize them. We describe ageneric intruder process and its modelling, and show that someproperties are falsified in the presence of this intruder. Thediagnostic sequences can be used almost directly to exhibit thescenarios of possible attacks on the protocol. Finally, we propose animprovement of the protocol which satisfies our properties.