Inductive Verification of Protocols.ppt

Inductive Verification of Protocols Anupam Datta CMU Fall 2007-08 Logistics This Friday at 2PM (CIC 1301) Section on PRISM, a probabilistic model-checker Analysis of Crowds, a protocol for anonymous communication [Reiter, Rubin] Previous sections: Murphi, AVISPA Future: MOCHA, Theorem-proving Sign up for project discussion slots Protocol Analysis Techniques Recall: protocol state space Participant + attacker actions define a state transition graph A path in the graph is a trace of the protocol Graph can be Finite if we limit number of agents, size of message, etc. Infinite otherwise Analysis using theorem proving Correctness instead of bugs Use higher-order logic to reason about possible protocol executions No finite bounds Any number of interleaved runs Algebraic theory of messages No restrictions on attacker Mechanized proofs Automated tools can fill in parts of proofs Proof checking can prevent errors in reasoning Inductive proofs Define set of traces Given protocol, a trace is one possible sequence of events, including attacks Prove correctness by induction For every state in every trace, no security condition fails Works for safety properties only Proof by induction on the length of trace Inductive Definitions Example: The set of natural numbers, N 0 ? N If n ? N then successor(n) ? N Nothing else is in N, i.e. N is the least set closed under these operations Inductive definitions are widely used in Computer Science, e.g. in defining syntax and semantics of programming languages Two forms of induction Usual form for ?n?Nat. P(n) Base case: P(0) Induction step: P(x) ? P(x+1) Conclusion: ?n?Nat. P(n) Minimial counterexample form Assume: ?x [ ?P(x) ? ?yx. P(y) ] Prove: contradiction Conclusion: ?n?Nat. P(n) Use second form Sample Protocol Goals Authenticity: who sent it? Fails if A receives message from B but thinks it is from C Integrity: has it been altered? Fails if A receives message from B but message is not what B sent Secrecy: who can receive it?