Sjouke Mauw

Foundations of attack trees

Attack trees have found their way to practice because they have proved to be an intuitive aid in threat analysis. Despite, or perhaps thanks to, their apparent simplicity, they have not yet been provided with an unambiguous semantics. We argue that such a formal interpretation is indispensable to precisely understand how attack trees can be manipulated during construction and analysis. We provide a denotational semantics, based on a mapping to attack suites, which abstracts from the internal structure of an attack tree, we study transformations between attack trees, and we study the attribution and projection of an attack tree.

An Algebraic Semantics of Basic Message Sequence Charts

Message Sequence Charts are a widely used technique for the visualization of the communications between system components. We present a formal semantics of Basic Message Sequence Charts, exploiting techniques from process algebra. This semantics is based on the semantics of the full language as being proposed for standardization in the International Telecommunication Union.

High-level Message Sequence Charts

Publisher Summary This chapter includes a definition of the semantics of the sublanguage high-level message sequence charts (HMSCs) of MSC96, based on the recommended process algebra semantics of MSC92. The chapter discusses the use of HMSC by studying the well-known Alternating Bit Protocol (ABP) from different views. This case study motivates to extend MSC96 with gates on HMSC nodes. HMSC is mainly used for vertical decomposition and for displaying alternative scenarios. The chapter presents two views of the ABP: an overall description expressing the control flow and an instance-oriented description. The HMSC specification of the ABP benefits from the possibility to consider complete message sequence charts (MSCs) as a node in an HMSC specification rather than as a reference. The possibility to switch among different views within the same language fits very well with the variety of uses of the MSC language. A thorough study on the relation among these different views is an important step toward the (semi-) automatic derivation of Specification and Description Language (SDL) code from MSC scenarios.

Foundations of attack-defense trees

We introduce and give formal definitions of attack-defense trees. We argue that these trees are a simple, yet powerful tool to analyze complex security and privacy problems. Our formalization is generic in the sense that it supports different semantical approaches. We present several semantics for attack-defense trees along with usage scenarios, and we show how to evaluate attributes.

Test Generation for Intelligent Networks Using Model Checking

We study the use of model checking techniques for the generation of test sequences. Given a formal model of the system to be tested, one can formulate test purposes. A model checker then derives test sequences that fulfill these test purposes. The method is demonstrated by applying it to a specification of an Intelligent Network with two features.

Attack–defense trees

The advent of the information age has notably amplified the importance of security. Unfortunately security considerations still widely occur as an afterthought. For many companies, security is not a requirement to conduct business and is therefore readily neglected. However the lack of security may obstruct, impede and even ruin an otherwise flourishing enterprise. Only when internal computer networks shut down, web portals are inaccessible, mail servers are attacked, or similar incidents affect the day to day business of an enterprise, security enters into the field of vision of companies. As such, security by design is only slowly becoming accepted practice. Amongst security researchers, there is no dispute that a reasonable approach to- wards uninterrupted business activities includes security measures and controls from the beginning. To support these efforts, many security models have been developed. Graphical security models are a type of security model that help illus- trate and guide the consideration of security throughout the lifecycle of a product, system or company. Their visual properties are especially well-suited to elucidate security requirements and corresponding security measures. During the last four years, we have developed a new graphical security model called attack–defense trees. The new framework, presented in this thesis, generalizes the well-known attack trees model. Attack–defense trees formally extend attack trees and enhance them with defenses. To be able to deploy attack–defense trees as a security support tool, we have equipped them with three different syntaxes: A visually appealing, graph-based syntax that is dedicated to representing security problems, an algebraic, term-based syntax that simplifies correct, formal and quantitative analysis of security scenarios and a textual syntax that is a compromise between succinct, visual representation and easy, computerized input. We have also equipped attack–defense trees with a variety of semantics. This became necessary, since different applications require different interpretations of attack–defense trees. Besides the very specific and problem oriented propositional, De Morgan and multiset semantics, we have introduced equational semantics. The latter semantics is, in fact, an alternative, unified presentation of semantics based on equational theory. We have expressed the propositional and the multiset seman- tics in terms of the equational semantics. This facilitates algorithmic treatment since the two different semantics have a unified formal foundation. To be able to perform quantitative security analysis, we have introduced the notion of an attribute for attack–defense trees. To guarantee that the evaluation of an attribute on two or more semantically equal attack–defense trees results in the same value, we have introduced the notion of a compatibility condition between semantics and attributes. We have also provided usability guidelines for attributes. These guidelines help a user to specify security-relevant questions that can unambiguously be answered using attributes. We have performed several case studies that allowed us to test and improve the attack–defense tree methodology. We have provided detailed explanations for our design choices during the case studies as well as extensive applicability guidelines that serve a prospective user of the attack–defense tree methodology as a user manual. We have demonstrated the usefulness of the formal foundations of attack–defense trees by relating attack–defense terms to other scientific research disciplines. Con- cretely, we have shown that attack–defense trees in the propositional semantics are computationally as complex as propositional attack trees. Moreover, we have described how to merge Bayesian networks with attack–defense trees and have il- lustrated that attack–defense trees in the propositional semantics are equivalent to a specific class of games frequently occurring in game theory. Concluding the thesis, we have related the attack–defense tree methodology to other graphical security models in an extensive literature overview over similar methodologies.

Untraceability of RFID protocols

We give an intuitive formal definition of untraceability inthe standard Dolev-Yao intruder model, inspired by existing definitionsof anonymity. We show how to verify whether communication protocolssatisfy the untraceability property and apply our methods to knownRFID protocols. We show a previously unknown attack on a publishedRFID protocol and use our framework to prove that the protocol is notuntraceable.

Model Checking for Managers

Model checking is traditionally applied to computer system design. It has proven to be a valuable technique. However, it requires detailed specifications of systems and requirements, and is therefore not very accessible. In this paper we show how model checking can be applied in the context of business modeling and analysis by people that are not trained in formal techniques. Spin is used as the model checker underlying a graphical modeling language, and requirements are specified using business requirements patterns, which are translated to LTL. We illustrate our approach using a business model of an insurance company.

A Formalization of Anonymity and Onion Routing

The use of formal methods to verify security protocols with respect to secrecy and authentication has become standard practice. In contrast, the formalization of other security goals, such as privacy, has received less attention. Due to the increasing importance of privacy in the current society, formal methods will also become indispensable in this area. Therefore, we propose a formal definition of the notion of anonymity in presence of an observing intruder. We validate this definition by analyzing a well-known anonymity preserving protocol, viz. onion routing.

A framework for compositional verification of security protocols

Automatic security protocol analysis is currently feasible only for small protocols. Since larger protocols quite often are composed of many small protocols, compositional analysis is an attractive, but non-trivial approach. We have developed a framework for compositional analysis of a large class of security protocols. The framework is intended to facilitate automatic as well as manual verification of large structured security protocols. Our approach is to verify properties of component protocols in a multi-protocol environment, then deduce properties about the composed protocol. To reduce the complexity of multi-protocol verification, we introduce a notion of protocol independence and prove a number of theorems that enable analysis of independent component protocols in isolation. To illustrate the applicability of our framework to real-world protocols, we study a key establishment sequence in WiMAX consisting of three subprotocols. Except for a small amount of trivial reasoning, the analysis is done using automatic tools.