Dolev-Yao Adversary Research Articles

A robust and effective 3-factor authentication protocol for smart factory in IIoT

Smart factory, as an intelligent application of industrial internet of things (IIoT), significantly enhances the efficiency of industrial processes while also reducing resource waste. In a system where security is crucial, the user authentication mechanism is essentially designed to prevent a range of security issues, including production failures caused by illegal intrusions from hackers. To verify the user’s identity and ensure data be accessed with a secure session key, a large number of authentication protocols have been provided for IIoT. However, existing newly alternatives show deficiency either in terms of superior performance or robust security. To get a better balance of security and efficiency, this paper designs a robust and effective 3-factor user authentication protocol. Then this paper shows the detailed security analyses and automated verification by the Proverif tool, where the ProVerif tool used in this paper can detect whether the eCK adversary with stronger attack ability can break the protocol, while the general ProVerif can only detect threat of the Dolev–Yao adversary with weaker attack ability to the protocol security. Subsequently, this paper presents performance comparison which indicates that the proposed protocol can be superior to those newly alternatives. Especially, the comparison results show that the computation cost consumed in the proposed protocol can be reduced by 62.2% than the average cost of all six compared alternatives. Lastly, the evaluation results on the energy consumption and the network delay indicate the practicability of proposed protocol for smart factory.

Security Analysis and Enhancement of INTERBUS Protocol in ICS Based on Colored Petri Net

The integration of buses in industrial control systems, fueled by advancements such as the Internet of Things (IoT), has led to their widespread adoption, significantly enhancing operational efficiency. However, with the increasing interconnection of systems, ensuring the security of bus communications and protocols has become an urgent priority. This paper focuses on addressing the specific security concerns associated with the widely adopted INTERBUS protocol—a fieldbus protocol. Our approach leverages the theory of colored Petri nets (CPN) for modeling, enabling a comprehensive analysis of the protocol’s security. Rigorous formal verification and analysis of the security protocol are conducted by employing the Dolev–Yao adversary model. Our investigation reveals the presence of three critical vulnerabilities: replay attacks, tampering, and impersonation. To fortify the security of the protocol, we propose the introduction of a key distribution center and the utilization of hash values. Through meticulous analysis and verification, our proposed enhancements effectively reinforce the security performance of the INTERBUS protocol.

Evaluation and Improvement of Internet Printing Protocol Based on HCPN Model Detection Method

The Internet Printing Protocol (IPP) is a bridge between hosts and printers, and is supported by more than 98 percent of printers today. In addition to supporting local use, the IPP protocol also supports online use. Although this can expand the scope of its application, it has also introduced potential risks to user data. IPP has security components that should be able to guarantee confidentiality, integrity, and non-repudiation. In order to verify whether its security components can achieve this goal, this study modeled the 0-RTT authentication process of the IPP protocol based on Petri net theory and CPN Tools, introducing the improved Dolev–Yao adversary model to perform security evaluation on the protocol model. The result showed that the server could not resist the adversary’s replay attacks on early data. Accordingly, we proposed an improved authentication scheme that introduced a random number signature to enhance the server’s anti-replay capability. Using the same attack model to verify, the result proved that the new scheme was feasible and effective. The method used in this article could easily observe the movement of the security protocol message flow and the specific actions of each participant (including the adversary), which ensured researchers could easily locate the protocol defects and make improvements.

Extremely Lightweight PUF-based Batch Authentication Protocol for End-Edge-Cloud Hierarchical Smart Grid

Smart grid is gradually replacing traditional grid with two-way communication and improved management. Besides the efficiency and reliability it brings, the smart grid is inevitably fraught with rampant physical and cyber-attack. Although several physical unclonable function (PUF)-based schemes have been proposed, they are unsuited to the end-edge-cloud hierarchical smart grid. This paper proposes a PUF-based batch authentication and key agreement protocol, which protects both meters and gateways and provides end-to-end authentication between meters and the server. By offloading heavy operations from field devices to the server, the computation overhead is reduced substantially. Moreover, we innovatively devolve batch authentication and access control to the gateway, which additionally decreases downlink communication and signaling cost, and is superior to most recent schemes. Our protocol is proved by Tamarin under extended Dolev–Yao adversary and the Real-or-Random model and is evaluated to be secure against various attacks. Using extremely lightweight operations, our protocol is implemented on the MSP430FR5969 microcontroller.

Lightweight Anonymous Authentication and Key Agreement Protocol Based on CoAP of Internet of Things.

To solve the problem regarding the lack of a lightweight and secure authentication and key agreement protocol in the Constrained Application Protocol of the Internet of Things environment, we explore the security flaws and applicability problems in the current related research. Then, we propose a new lightweight authentication and key agreement protocol based on the CoAP framework. The scheme adopts shared secret and elliptic curve public key technology, which ensures the anonymity of the communicators and provides strong security and anti-attack capacity. In terms of security analysis, the Dolev–Yao Adversary model and a security model checking analysis method based on CPN Tools are improved, in order to verify the correctness and security of the proposed scheme. Compared with other schemes, regarding communication overhead, computational cost, and security, the proposed scheme provides a robust and comprehensive security guarantee, although it is not the lightest.

Security Analysis and Improvement of Vehicle Ethernet SOME/IP Protocol.

The combination of in-vehicle networks and smart car devices has gradually developed into Intelligent Connected Vehicles (ICVs). Through the vehicle security protocol, ICVs can quickly realize communication transmission. However, with the more frequent connections between smart in-vehicle devices and the network, the relationship between intelligent cars and external systems is becoming more and more complicated, and in-vehicle networks are gradually facing many security issues. Strengthening the security of in-vehicle protocols has become particularly important. This paper uses the model building method based on the Colored Petri Net (CPN) theory to model the Scalable service-Oriented MiddlewarE over IP (SOME/IP) protocol of the vehicle Ethernet. The security protocol is formally verified and analyzed by combining it with the Dolev–Yao adversary model detection method. After verification, the protocol is subject to three attack vulnerabilities: replay, tampering, and deception. We introduce timestamps and random numbers to strengthen the protocol security. After the final analysis and verification, the improved scheme in this paper can effectively improve the security performance of the protocol.

A Provably Secure and Efficient Remote Password Authentication Scheme Using Smart Cards

Communication technology has advanced dramatically amid the 21^st century, increasing the security risk in safeguarding sensitive information. The remote password authentication (RPA) scheme is the simplest cryptosystem that serves as the first line of defence against unauthorised entity attacks. Although the literature contains numerous RPA schemes, to the best of the authors’ knowledge, only few schemes based on the integer factorisation problem (IFP) and the discrete logarithm problem (DLP) that provided a provision for session key agreement to ensure proper mutual authentication. Furthermore, none of the previous schemes provided formal security proof using the random oracle model. Therefore, this study proposed an improved RPA scheme with session key establishment between user and server. The design of the proposed RPA scheme is based on the widely established Dolev-Yao adversary model. Moreover, as the main contribution, a novel formal security analysis based on formal definitions of IFP and DLP under the random oracle model was presented. The proposed scheme's performance was compared to that of other similar competitive schemes in terms of the transmission/computational cost and time complexity. The findings revealed that the proposed scheme required higher memory storage costs in smart cards. Nonetheless, the proposed scheme is more efficient regarding the transmission cost of login and response messages and the total time complexity compared to other scheme of similar security attributes. Overall, the proposed scheme outperformed the other RPA schemes based on IFP and DLP. Finally, the potential application of converting the RPA scheme to a user identification (UI) scheme is considered for future work. Since RPA and UI schemes are similar, the proposed approach can be expanded to develop a provably secure and efficient UI scheme based on IFP and DLP.

Secure memory erasure in the presence of man-in-the-middle attackers

Memory erasure protocols serve to clean up a device’s memory before the installation of new software. Although this task can be accomplished by direct hardware manipulation, remote software-based memory erasure protocols have emerged as a more efficient and cost-effective alternative. Existing remote memory erasure protocols, however, still rely on non-standard adversarial models to operate correctly, thereby requiring additional hardware to restrict the adversary’s capabilities. In this work, we provide a formal definition of secure memory erasure within a symbolic security model that utilizes the standard Dolev–Yao adversary. Our main result consists of a restriction on the Dolev–Yao adversary that we prove necessary and sufficient to solve the problem of finding a protocol that satisfies secure memory erasure. We also provide a description of the resulting protocol using standard cryptographic notation, which we use to analyze the security and communication complexity trade-off commonly present in this type of protocols.

Demystifying Attestation in Intel Trust Domain Extensions via Formal Verification

In August 2020, Intel asked the research community for feedback on the newly offered architecture extensions, called Intel Trust Domain Extensions (TDX), which give more control to Trust Domains (TDs) over processor resources. One of the key features of these extensions is the remote attestation mechanism, which provides a unified report verification mechanism for TDX and its predecessor Software Guard Extensions (SGX). Based on our experience and intuition, we respond to the request for feedback by formally specifying the attestation mechanism in the TDX using ProVerif's specification language. Although the TDX technology seems very promising, the process of formal specification reveals a number of subtle discrepancies in Intel's specifications that could potentially lead to design and implementation flaws. After resolving these discrepancies, we also present fully automated proofs that our specification of TD attestation preserves the confidentiality of the secret and authentication of the report by considering the state-of-the-art Dolev-Yao adversary in the symbolic model using ProVerif. We have submitted the draft to Intel, and Intel is in the process of making the changes.

Editorial for special issue on security, trust, and privacy in internet of things: Challenges and solutions

Editorial for special issue on security, trust, and privacy in internet of things: Challenges and solutions

Design and Formal Analysis of an Authentication Protocol, eWMDP on Wearable Devices

For wearable devices, this paper proposes an authentication protocol eWMDP. We formally model and analyze it. In the execution model of the protocol, a Dolev-Yao adversary is constituted. With the above, various security properties can be defined for measuring security performance. Our protocol can achieve the injective-auth property, in which case it surpasses another existing wearable authentication protocol—WMDP. In addition, our analysis work is confirmed by Scyther and tamain-prover, and the two protocols are implemented on PC and on Ti CC3200 LAUNCHPAD widely used in wearable devices in the meanwhile. The results of experiments highlight the higher transmission efficiency of eWMDP under various configurations, including different platforms, sorts of combinations of encryption algorithms and hash algorithms, and sending packets in different sizes.

A Systematic Analysis Method for 5G Non-Access Stratum Signalling Security

This paper proposes a systematic analysis method for 5G Non-Access Stratum Signalling security based on formal analysis, which has identified 10 new 5G protocol vulnerabilities, and an improved PKI security mechanism targeted at eliminating these vulnerabilities. Firstly, the 5G system, state transition properties and security properties were abstracted from 3GPP specifications. To mimic an attacker’s behavior, a Dolev-Yao adversary model was constructed in the 5G model by empowering it with NAS signalling security testing knowledge and reasonable security capabilities in the wireless channel. Then we used the TAMARIN prover to verify all the abstracted properties one by one and discovered some protocol vulnerabilities based on the counterexamples found. We further verified these vulnerabilities on the testbed and identified 10 new 5G protocol vulnerabilities. Moreover, we analyzed the root cause of these vulnerabilities and concluded that all of them were caused by the unconditional trust between UE and gNodeB. Therefore, we propose an improved PKI mechanism based on the existing asymmetric encryption of 5G. Besides the existing public-private key pair of the home network, we introduce a new pair of asymmetric keys in the gNodeB to encrypt and sign the signalling message sent to UE. The gNodeB can be connected only when the verification succeeds and then the RRC connection can be initiated. This mechanism can effectively avoid all the vulnerabilities found in this paper.

Using contextual co-presence to strengthen Zero-Interaction Authentication: Design, integration and usability

Zero-Interaction Authentication (ZIA) refers to approaches that authenticate a user to a verifier (terminal) without any user interaction. Currently deployed ZIA solutions are predominantly based on the terminal detecting the proximity of the user’s personal device, or a security token, by running an authentication protocol over a short-range wireless communication channel. Unfortunately, this simple approach is highly vulnerable to low-cost and practical relay attacks which completely offset the usability benefits of ZIA. The use of contextual information, gathered via on-board sensors, to detect the co-presence of the user and the verifier is a recently proposed mechanism to resist relay attacks.In this paper, we systematically investigate the performance of different sensor modalities for co-presence detection with respect to a standard Dolev–Yao adversary. First, using a common data collection framework run in realistic everyday settings, we compare the performance of four commonly available sensor modalities (WiFi, Bluetooth, GPS, and audio) in resisting ZIA relay attacks, and find that WiFi is better than the rest. Second, we show that, compared to any single modality, fusing multiple modalities improves resilience against ZIA relay attacks while retaining a high level of usability. Third, we motivate the need for a stronger adversarial model to characterize an attacker who can compromise the integrity of context sensing itself. We show that in the presence of such a powerful attacker, each individual sensor modality offers very low security. Positively, the use of multiple sensor modalities improves security against such an attacker if the attacker cannot compromise multiple modalities simultaneously.Finally, based on our analysis, we integrate our contextual co-presence detection system with a real-world ZIA application, BlueProximity [1], so as to enhance its security against relay attacks. We describe the design of the BlueProximity++ application and present results from a small-scale user study that evaluated its effectiveness.

Bounded memory Dolev–Yao adversaries in collaborative systems

In a collaborative system, the agents collaborate to achieve a common goal, but they are not willing to share some sensitive private information.The question is how much damage can be done by a malicious participant sitting inside the system.We assume that all the participants (including internal adversaries) have bounded memory – at any moment, they can store only a fixed number of messages of a fixed size. The Dolev–Yao adversaries can compose, decompose, eavesdrop, and intercept messages, and create fresh values (nonces), but within their bounded memory.We prove that the secrecy problem is PSPACE-complete in the bounded memory model where all actions are balanced and a potentially infinite number of the nonce updates is allowed.We also show that the well-known security protocol anomalies (starting from the Lowe attack to the Needham–Schroeder protocol) can be rephrased within the bounded memory paradigm with the explicit memory bounds.

Bounded memory protocols

It is well-known that the Dolev–Yao adversary is a powerful adversary. Besides acting as the network, intercepting, decomposing, composing and sending messages, he can remember as much information as he needs. That is, his memory is unbounded. We recently proposed a weaker Dolev–Yao like adversary, which also acts as the network, but whose memory is bounded. We showed that this Bounded Memory Dolev–Yao adversary, when given enough memory, can carry out many existing protocol anomalies. In particular, the known anomalies arise for bounded memory protocols, where although the total number of sessions is unbounded, there are only a bounded number of concurrent sessions and the honest participants of the protocol cannot remember an unbounded number of facts or an unbounded number of nonces at a time. This led us to the question of whether it is possible to infer an upper-bound on the memory required by the Dolev–Yao adversary to carry out an anomaly from the memory restrictions of the bounded protocol. This paper answers this question negatively (Theorem 8).

Safe abstractions of data encodings in formal security protocol models

Abstract When using formal methods, security protocols are usually modeled at a high level of abstraction. In particular, data encoding and decoding transformations are often abstracted away. However, if no assumptions at all are made on the behavior of such transformations, they could trivially lead to security faults, for example leaking secrets or breaking freshness by collapsing nonces into constants. In order to address this issue this paper formally states sufficient conditions, checkable on sequential code, such that if an abstract protocol model is secure under a Dolev–Yao adversary, then a refined model, which takes into account a wide class of possible implementations of the encoding/decoding operations, is implied to be secure too under the same adversary model. The paper also indicates possible exploitations of this result in the context of methods based on formal model extraction from implementation code and of methods based on automated code generation from formally verified models.

Modeling Adversaries in a Logic for Security Protocol Analysis

Logics for security protocol analysis require the formalization of an adversary model that specifies the capabilities of adversaries. A common model is the Dolev-Yao model, which considers only adversaries that can compose and replay messages, and decipher them with known keys. The Dolev-Yao model is a useful abstraction, but it suffers from some drawbacks: it cannot handle the adversary knowing protocol-specific information, and it cannot handle probabilistic notions, such as the adversary attempting to guess the keys. We show how we can analyze security protocols under different adversary models by using a logic with a notion of algorithmic knowledge. Roughly speaking, adversaries are assumed to use algorithms to compute their knowledge; adversary capabilities are captured by suitable restrictions on the algorithms used. We show how we can model the standard Dolev-Yao adversary in this setting, and how we can capture more general capabilities including protocol-specific knowledge and guesses.

Modeling and Reasoning about an Attacker with Cryptanalytical Capabilities

We propose a probabilistic framework for the analysis of security protocols. The proposed framework allows one to model and reason about attackers that extend the usual Dolev-Yao adversary with explicit probabilistic statements representing properties of cryptographic primitives and the attacker's (partial) information about secret messages. The expressive power of these probabilistic statements is illustrated, namely by representing a standard security notion like indistinguishability under chosen plaintext attacks. We present an entropy-based approach to estimate the probability of a successful attack on a protocol given the prescribed knowledge of the attacker. We prove that, for an attacker whose knowledge increases with the security parameter, computing this quantity is NP-hard in the security parameter. However, we are still able to analyze a few meaningful and illustrative examples. Finally, we obtain a result which may be used to prove that a certain amount of probabilistic knowledge (about the properties of the cryptography being used) is not enough for allowing an attacker to correctly uncover a secret with non-negligible probability.

A computational interpretation of Dolev–Yao adversaries

The Dolev–Yao model is a simple and useful framework in which to analyze security protocols, but it assumes that the adversary is extremely limited. We show that it is possible for the results of this model to remain valid even if the adversary is given additional power. In particular, we show that there exist situations in which Dolev–Yao adversary can be viewed as a valid abstraction of all realistic adversaries. We do this in a number of steps: (1) The Dolev–Yao model places strong assumptions on the adversary. We capture those assumptions in the computational model (an alternate framework with a very powerful adversary) as a non-malleability property of public-key encryption. (2) We prove an Abadi–Rogaway-style indistinguishability property (J. Cryptol. 15(2) (2002) 103–127) for the public-key setting. That is, we show that if two Dolev–Yao expressions are indistinguishable to the Dolev–Yao adversary, then their computational interpretations (via a chosen-ciphertext secure encryption scheme) are computationally indistinguishable. (3) We show that any encryption scheme that satisfies the indistinguishability property also satisfies our (more natural) non-malleability property.

Weakening the perfect encryption assumption in Dolev–Yao adversaries

We consider secrecy and authentication in a simple process calculus with cryptographic primitives. The standard Dolev–Yao adversary is enhanced so that it can guess the key required to decrypt an intercepted message. We borrow from the computational complexity approach the assumptions that guessing succeeds with a given negligible probability and that the resources available to adversaries are polynomially bounded. Under these hypotheses we prove that the standard Dolev–Yao adversary is as powerful as the enhanced one.