ISSN 1-9825 CODEN RUXUEW E-mil jos@iscsccn Journl of Softwre Vol17 No1 Jnury 26 pp148 156 http//wwwjosorgcn DOI 1136/jos17148 Tel/Fx 86-1-62562563 26 by Journl of Softwre ll rights reserved ( 2196) nlysis of Security Protocols sed on uthentiction Test YNG Ming LUO Jun-Zhou (Networ Lbortory Deprtment of Computer Science nd Engineering Southest University Nnjing 2196 Chin) Corresponding uthor Phn 86-25-837911 Fx 86-25-83794838 E-mil yngming22@seueducn http//wwwseueducn Yng M Luo JZ nlysis of security protocols bsed on uthentiction test Journl of Softwre 2617(1) 148 156 http//wwwjosorgcn/1-9825/17/148htm bstrct uthentiction Test is new type of nlysis nd design method of security protocols bsed on Strnd spce model nd it cn be used for most types of the security protocols However s Strnd spce model it is inclined to be used for the proof of correctness nd is reltively weer for incorrectness nlysis This pper proposes the concepts of Enhnced uthentiction Test (ET) nd the correspondence function tht cn solve the problem Compred with the originl concept the new pproch is more forml nd cn me protocol nlysis esier both by hnd nd utomticlly ey words networ security; protocol nlysis; Strnd spce model; uthentiction test; uthentiction logic Strnd ; Strnd ET(enhnced uthentiction test) Correspondence ; ;Strnd ; ; TP39 (enhnced uthentiction test ET) Correspondence (correspondence ) 1 Supported by the Ntionl Nturl Science Foundtion of Chin under Grnt No941214 ( ); the Jingsu Provincil ey Lbortory of Networ nd Informtion Security under Grnt NoM2321 ( ); the Jingsu Provincil High-Tech Reserch Progrm under Grnt NoG2436 ( ) Received 24-6-3; ccepted 25-7-28
149 2 (uthentiction tests T) 3 ET Correspondence 4 erberos OR erberos OR ET Correspondence 1 11 Strnd [12] (Strnd spce model SSM) Thyer FàbregHerzog Guttmn 1998 Strnd Strnd Strnd ; Strnd (bundle) [3] Strnd [45] Strnd - ( ) ( ) [4] - Guttmn Thyer Fàbreg 3 Incoming Test(IT)Outgoing Test(OT) Unsolicited Test(UT)T [6] ; Strnd Strnd T ET Correspondence Strnd ET Strnd ; ET [7] ( ) 12 Strnd (1) Strnd Songerezin Perrig then [89] Strnd then ;(2) Strnd Pul Syverson [1] Strnd N N ;(3) Strnd CervestoDurginnovich Scedrov [11] (first-order liner logic) Strnd ;(4) Strnd [12] Strnd (GSSM) Orcle Strnds Strnd
15 Journl of Softwre Vol17 No1 Jnury 26 Strnd ET Correspondence ET 3 [13] ( N [14] ) ( [11] ) ( Strnd ) Strnd ET N 2 Strnd [12] [45] 21 1( Component) t t t t t t t t t t 1 t 1 1 t n= si t term(n) n= si (j<i) 2(Trnsformed Edge Trnsforming Edge) si sj Trnsformed Edge si sj ; si sj Trnsforming Edge si sj 3( Test Component Test) t = { h} n t t n ; t Strnd Σ (Strnd N Fresh ) n n n 1 Trnsformed Edge n n1 4(outgoing test OT) 1 n n 1 t = { h} OT (i) n n1 ;(ii) P ;(iii) n t ;(iv) t n 5(incoming test IT) n n 1 t = { h} IT (i) n n1 ;(ii) P ;(iii) t n1 6(unsolicited test UT) ( ) n t = {h} UT (i) t n ;(ii) P 22 3 T1 C Strnd (bundle) n C n n t OT (i) m m C t m m m Trnsforming Edge;(ii) 1 = t m t 1 { h 1 } 1 t ( ) 1 1 1 P
151 T2 C n n n t IT m m C t m m m Trnsforming Edge T3 C n n t = { h} UT ( ) m C t m 3 ET Correspondence 31 Strnd NS NSL ; Init Strnd 2 NSL NS 1 [4] NSL 2 Init Strnd Tble 1 nlysis of NS nd NSL protocol using T 1 T NS NSL Protocol Difference Conclusion with T Extr nlysis results NSL {NNb} Exists corresponding regulr Strnd height=3 Init (NNb) NS {NNb} Exists corresponding regulr Strnd height=3 Init (*NNb) Chllenge-Response T1~T3 N NSL NS believes response recently believes response to recently NS T Strnd Strnd 3 Nonce Nonce Nonce ; nonce ( ) nonce IT OT; 22 UT Nonce T Strnd Nonce t = { h} T T x Strnd x t x = Strnd Strnd T (S ) S S Nonce S ( ) ( ) (nonce) Strnd Nonce
152 Journl of Softwre Vol17 No1 Jnury 26 7( id) Strnd Σ t S t = t = t P t = S t P t S id(s) Strnd Σ t S t= t S id(s) 2 S Strnd X S T X = S X S 2 1 Chllenge ( s ) T S Response S Type Tble 2 Correspondence of Strnd s principl prmeters 2 Strnd 1 2 3 4 5 6 NULL s 1 s 1 s 1 NULL IT/UT O[R] R 2 s OT O[C] O[C/R] O[C/R] O[C/R] 3 1 IT/UT O[C/R] R 4 5 s 1 6 s OT C O[C/R] C C/R C id(xs) ( [2] g} { iff 1 g = = { g} ) Chllenge ;R id(xs) Response ;O X= s 1 id(s); ( X ) ; 1 2 S S s IT UT( ) s S S id(s) S ( S S ) ( Strnd ) Strnd Nonce 3 S (i) Nonce S ;(ii) 2 S ;(iii) Strnd 3 Strnd NS { N } { NNb} { Nb} { N } { NNb} { Nb} ) ( { N N } b { N b} OT 2 (64) C id ( ) { N N } b id ( ) id( ) { N N } b id( ) = N id( ) = N N b id ( ) = N ; N N 1 N b 7 N N { N } N N NS b b
153 32 (ET) Strnd ET ET 1 C Strnd n C n n t OT m m C t m m m Trnsforming Edge; Strnd T n n m m ET 2 C n n n t IT m m C t m m m Trnsforming Edge; Strnd T n n m m ET 3 C n n t = {h} UT ( ) m C t m ; Strnd T n m 33 Correspondence ET Correspondence 8(Correspondence ) Strnd Correspondence Correspondence = ; Correspondence =n> Strnd 1 n ( Correspondence ) Correspondence Strnd (OTIT UT) i j ET n (n=12 3) Correspondence =(j>correspondence )?j Correspondence j>correspondence Correspondence =j Correspondence M 4 M ( ) = Correspondence M ( ) = height( Strnd( )) = 1 Strnd ( 1 ) M1M2 Mn 2 1 Mi i Mi (OT IT) Mi UT Mi Strnd ; ii Mi Strnd Mi Strnd ET 3 2 erberos OR ET Correspondence Strnd
154 Journl of Softwre Vol17 No1 Jnury 26 1 S S1 2 {TsLb{TsLb} bs } s S2 3 {TsLb} bs {T} b 1 4 {T1} b 2 Fig1 Strnd grph of erberos protocol 1 erberos Strnd 41 erberos erberos S sbs S TsT L S S erberos Strnd (i) Nonce TsT;(ii) blbs s;(iii) S S 1 S 2 term( 2 )={TsLb{TsLb} bs } s Ts( ) Strnd term( 2 ) Ts ; s P 2 Ts UT term( 2 ) 2 (12) S ; Lb ET3 S 2 S2 CorrespondenceS=2 3 4 T OT 2 (22) b ET1 3 4 Correspondence =2 1 2 1 {TsLb}bs {T}b Ts Strnd P P 1 Ts T UT S bs b 2 (12) S ; L b ET3 Strnd mimniml S2 Correspondence S =2 S 1 b ET3 1 3 Correspondence =3
155 S S 4 2 2 Correspond ence( erberos S) = 3 2 2 2 Correspondence S =2 Correspondence =2 b S ; 42 OR OR ET Correspon- dence 2 Correspond ence( OR S) = 4 2 2 b S 2 ; b S ; S b b OR 1 M{NM} s 1 2 M{NM} s {NbM} bs S S1 3 M{Nb} s {Nbb} bs S2 2 M{Nb} s Fig2 4 Strnd grph of OR protocol 2 OR Strnd 5 Strnd Strnd T Strnd ET T Strnd Correspondence ; ET
156 Journl of Softwre Vol17 No1 Jnury 26 References [1] Fàbreg FJT Herzog JC Guttmn JD Strnd spces Why is security protocol correct? In Proc of the 1998 IEEE Symp on Security nd Privcy Los lmitos IEEE Computer Society Press 1998 16 171 http//ieeexploreieeeorg/iel4/5528/14832/ 674832pdf?tp=&rnumber=674832&isnumber=14832 [2] Fàbreg FJT Herzog JC Guttmn JD Strnd spces Proving security protocols correct Journl of Computer Security 1999 7(2 3)191 23 [3] Pulson LC The inductive pproch to verifying cryptogrphic protocols Journl of Computer Security 19986(1)85 128 [4] Guttmn JD Fàbreg FJT uthentiction tests In Proc of the 2 IEEE Symp on Security nd Privcy Los lmitos IEEE Computer Society Press 2 96 19 http//ieeexploreieeeorg/iel5/6864/18435/848448pdf?tp=&rnumber=848448& isnumber=18435 [5] Guttmn JD Fàbreg FJT uthentiction tests nd the structure of bundles Theoreticl Computer Science 22283(2)333 38 [6] Guttmn JD Security protocol design vi uthentiction tests In Proc of the 22 IEEE Computer Security Foundtions Worshop Los lmitos IEEE Computer Society Press 22 92 13 http//ieeexploreieeeorg/iel5/7957/21985/12189pdf? tp=&rnumber=12189&isnumber=21985 [7] Woo TYC Lm SS semntic model for uthentiction protocols In Proc of the 1993 IEEE Computer Society Symp on Reserch in Security nd Privcy Los lmitos IEEE Computer Society Press 1993 178 194 http//ieeexploreieeeorg/iel2/ 92/7168/287633pdf?tp=&rnumber=287633&isnumber=7168 [8] Song DXD then new efficient utomtic checer for security protocol nlysis In Proc of the 12th IEEE Computer Security Foundtions Worshop Los lmitos IEEE Computer Society Press 1999 192 22 http//ieeexploreieeeorg/iel5/6332/16921/ 779773pdf?tp=&rnumber=779773&isnumber=16921 [9] Song D erezin S Perrig then novel pproch to efficient utomtic security protocol nlysis Journl of Computer Security 219(1)47 74 [1] Syverson P Towrds strnd semntics for uthentiction logic Electronic Notes in Theoreticl Computer Science 19992 143 157 http//citeseeristpsuedu/syverson99towrdshtml [11] Cervesto I Durgin N novich M Scedrov Interpreting strnds in liner logic In Veith H Heintze N Clr E eds Proc of the 2 Worshop on Forml Methods nd Computer Security Chicgo 2 http//theorystnfordedu/~ilino/ppers/fmcs psgz [12] Ji QG Qing SH Zhou Y Feng DG Study on strnd spce model theory Journl of Computer Science nd Technology 23 18(5)553 57 [13] Fn H Feng DG Security Protocol Theory nd Method eijing Science Press 23 41 42 (in Chinese) [14] urrows M bdi M logic of uthentiction CM Trns on Computer Systems 1998(1)18 36 [13] 2341 42 (1979 ) (196 ) CCF