1. A Logic of Belief and a Model Checking Algorithm for Security Protocols joint work with Massimo Benerecetti Fausto Giunchiglia University of Trento fausto@cs.unitn.it

2. Logics of Beliefs for Security Protocols ê BAN Logic (Borrows, Abadi & Needham) ç Concentrate on beliefs of trustworthy principals and on their evolution as consequence of communication

3. Logics of Beliefs for Security Protocols ê BAN Logic (Borrows, Abadi & Needham) ç Concentrate on beliefs of trustworthy principals and on their evolution as consequence of communication ê Some Extensions ç Abadi & Tuttle (AT Logic) ç Gong, Needham & Yahalom (GNY Logic) ç Boyd & Mao

4. Logics of Beliefs for Security Protocols ê BAN Logic (Borrows, Abadi & Needham) ç Concentrate on beliefs of trustworthy principals and on their evolution as consequence of communication ê Some Extensions ç Abadi & Tuttle (AT Logic) ç Gong, Needham & Yahalom (GNY Logic) ç Boyd & Mao ê Attempts to automate reasoning in BAN ç Kindred & Wing (Theory Building)

5. The Approach ê Define a Logic of Belief and Time

6. The Approach ê Define a Logic of Belief and Time ê A Model Checking Algorithm for this logic

7. The Approach ê Define a Logic of Belief and Time ê A Model Checking Algorithm for this logic ê Built on top of CTL model checking

8. ê ê Define a Logic of Belief and Time ê ê A Model Checking Algorithm for this logic ê ê Built on top of CTL model checking Integration with existing tools (e.g. NuSMV)  The Approach

9. Example: The Andrew Protocol 1 A  B : {N A } K AB 2 B  A : {N A, N B } K AB 3 A  B : {N B } K AB 4 B  A : {K AB, N B } K AB

10. Example Property : at the end of the protocol session, A believes that B believes that K ’ AB is a "good shared key" for communication between them. Example: The Andrew Protocol 1 A  B : {N A } K AB 2 B  A : {N A, N B } K AB 3 A  B : {N B } K AB 4 B  A : {K AB, N B } K AB

11. 1  A  B : {N A } K AB 2  B  A : {N A, N B } K AB 3  A  B : {N B } K AB 4  B  A : {K AB, N B } K AB Example: Attack to the Andrew Protocol

12. 1  A  B : {N A } K AB 2  B  A : {N A, N B } K AB 3  A  B : {N B } K AB 4  B  A : {K AB, N B } K AB 1  A  B : {N  A } K ab 2  B  A : {N A, N  B } K ab 3  A  B : {N  B } K AB 4  I(B)  A : {K AB, N B } K AB Example: Attack to the Andrew Protocol

13. Outline of the Talk ê Intuitions

14. Outline of the Talk ê Intuitions ê MultiAgent Temporal Logic (MATL) ê MultiAgent Finite State Machine (MAFSM) ê The Model Checking Algorithm (MAMC)

15. Outline of the Talk ê Intuitions ê MultiAgent Temporal Logic (MATL) ê MultiAgent Finite State Machine (MAFSM) ê The Model Checking Algorithm (MAMC) ê Model of the Andrew Protocol in MAFSM

16. Outline of the Talk ê Intuitions ê MultiAgent Temporal Logic (MATL) ê MultiAgent Finite State Machine (MAFSM) ê The Model Checking Algorithm (MAMC) ê Model of the Andrew Protocol in MAFSM ê Conclusion and Future Work

17. Intuitions

18. Intuitions Principals have two orthogonal aspects: ê Temporal Evolution: when we consider the temporal evolution (CTL), formulae expressing beliefs are treated as atomic propositions.

19. Intuitions Principals have two orthogonal aspects: ê Temporal Evolution: when we consider the temporal evolution (CTL), formulae expressing beliefs are treated as atomic propositions. ê Beliefs: "a principal ascribing beliefs to another one" means that it has access to a representation of the second principal as a process.

20. Intuitions Principals have two orthogonal aspects: ê Temporal Evolution: when we consider the temporal evolution (CTL), formulae expressing beliefs are treated as atomic propositions. ê Beliefs: "a principal ascribing beliefs to another one" means that it has access to a representation of the second principal as a process.

21. Intuitions Principals have two orthogonal aspects: ê Temporal Evolution: when we consider the temporal evolution (CTL), formulae expressing beliefs are treated as atomic propositions. ê Beliefs: "a principal ascribing beliefs to another one" means that it has access to a representation of the second principal as a process.

22. Intuitions BB?BB? Principals have two orthogonal aspects: ê Temporal Evolution: when we consider the temporal evolution (CTL), formulae expressing beliefs are treated as atomic propositions. ê Beliefs: "a principal ascribing beliefs to another one" means that it has access to a representation of the second principal as a process.

23. Intuitions ?? BB?BB? Principals have two orthogonal aspects: ê Temporal Evolution: when we consider the temporal evolution (CTL), formulae expressing beliefs are treated as atomic propositions. ê Beliefs: "a principal ascribing beliefs to another one" means that it has access to a representation of the second principal as a process.

24. MultiAgent Temporal Logic (MATL)

25. .........  BABAB BBBABBBA BBBBBBBB BABBBABB BABABABA... To each level of nesting of beliefs we associate a Representation of a process evolving over time. MATL: Views

26. .........  BABAB BBBABBBA BBBBBBBB BABBBABB BABABABA... Each Representation is called a View MATL: Views To each level of nesting of beliefs we associate a Representation of a process evolving over time.

27. Views represent the beliefs about a principal's evolution during the protocol  View  the protocol as seen by the external observer (the analyser's point of view)  View B A   's beliefs about the evolution of principal A.  View B B   's beliefs about the evolution of principal B.  View B A B B  (  's beliefs about) A's beliefs about the evolution of principal B é.... MATL: Views

28. .  BABA B BBBABBBA BBBBBBBB BABBBABB BABABABA........  * is the set of (possibly empty) strings of the form B X 1 ···B X n

29. MATL: Language ê We associate to each view a language ê The language of each view allows for expressing properties of the process associated with that view

30. ............  BABAB BBBABBBA BBBBBBBB BABBBABB BABABABA  MATL: Language

31. ............  BABAB BBBABBBA BBBBBBBB BABBBABB BABABABA BBBB 

32. ............  BABAB BBBABBBA BBBBBBBB BABBBABB BABABABA BABBBABB BBBB 

33. ............  BABAB BBBABBBA BBBBBBBB BABBBABB BABABABA BABBBABB BBBB  BBBABBBA BABA 

34. To each view  we associate the smallest CTL language containing:  a finite set of Propositional Atoms    the set of Atoms    = {B X  |  is a formula of  B X } that is the Belief Atoms of the form B X  for each formula  of view  B X

35. MATL: Language To each view  we associate the smallest CTL language containing:  a finite set of Propositional Atoms    the set of Atoms    = {B X  |  is a formula of  B X } that is the Belief Atoms of the form B X  for each formula  of view  B X Example AG(B A B B P) is a formula of view 

36. MATL: Language Definition: Given a family {   } of sets of propositional atoms, the family of MATL languages on   is the family of CTL languages {   }

37. MATL: Language Definition: Given a family {   } of sets of propositional atoms, the family of MATL languages on   is the family of CTL languages {   } A MATL formula  belonging to   is denoted by  Example  AG(B A B B P) denotes the formula AG(B A B B P) of view 

38. MultiAgent Finite State Machine (MAFSM)

39. MAFSM: Intuitions ê Model Checking employs Finite State Machines ê We extend the notion of FSM to accommodate beliefs ê We associate the Finite State Machine of a process to each view

40. MAFSM: Intuitions ê Model Checking employs Finite State Machines ê We extend the notion of FSM to accommodate beliefs ê We associate the Finite State Machine of a process to each view Restriction: ê We consider only a finite number of views

41. MultiAgent Finite State Machine.  BABA B BBBABBBA BBBBBBBB BABBBABB BABABABA........  * is the set of (possibly empty) strings of the form B X 1 ···B X n

42. MultiAgent Finite State Machine.  BABA B BBBABBBA BBBBBBBB BABBBABB BABABABA........ nn

43. .  BABA B BBBABBBA BBBBBBBB BABBBABB BABABABA........ nn  n is a finite subset of strings in  *

44. MultiAgent Finite State Machine We associate the Finite State Machine of a process to each view in  n  BABAB B A B B BBBABBBA

45. MultiAgent Finite State Machine We associate the Finite State Machine of a process to each view in  n  BABAB B A B B BBBABBBA Problem: there's a infinite number of Belief Atoms in each view!

46. Explicit Belief Atoms Solution: chose a finite number of Belief Atoms (Explicit Beliefs Atoms) as state variables of the FSM of a view.  s s's'' BXBX BXBX

47. Explicit Belief Atoms Explicit Belief Atoms induce a Compatibility Relation among states in different views.  s s's'' BXBX  BXBX

48. Implicit Belief Atoms Implicit Belief Atoms are the infinite set of Belief Atoms which are not Explicit  BXBX BXBX BXBX  BXBX

49. Implicit Belief Atoms Satisfiability of Implicit Belief Atims in a state is computed via Compatibility Relation  BXBX  BXBX BXBX       BXBX

50. Implicit Belief Atoms Explicit Belief Atoms are used to assess the truth of Implicit Belief Atoms  BXBX BXBX BXBX       Satisfiability of Implicit Belief Atims in a state is computed via Compatibility Relation  BXBX 

51. MultiAgent Finite State Machine A MAFSM is a set of FSMs plus compatibility relations induced by Explicit Belief Atoms among them.  BABAB B A B B BBBABBBA

52. MAFSM: From Trees to Graphs The definition of MAFSM as a Tree of FSMs (one for each view): ê does not allow for arbitrary nesting of beliefs: ç “a priori” bound on the length of each branch of the tree.

53. MAFSM: From Trees to Graphs The definition of MAFS as a Tree of FSMs (one for each view): ê does not allow for arbitrary nesting of beliefs: ç “a priori” bound on the length of each branch of the tree. ê needs a distinct specification of each view even when it is not necessary: ç often in security protocol we can safely assume that the protocol is publicly known and each (honest) principal behaviour is completely known to the other principals; ç in some cases distinct views of that principal could be modelled by the same process (FSM).

54. MAFSM: From Trees to Graphs Solution: ê allow for cycles in MAFSM; ê a MAFSM becomes a Graph of views

55. MultiAgent Finite State Machine A MAFSM is a set of FSMs plus compatibility relations induced by Explicit Belief Atoms among them.  B BABA

56. Model Checking Algorithm (MAMC)

57. MultiAgent Model Checking Algorithm To check the formula  in view , the algorithm performs three steps: 1 recursively descend the tree of views performing Steps 2 and 3 on the sub-formulas inside the BDI atoms at each step.

58. MultiAgent Model Checking Algorithm To check the formula  in view , the algorithm performs three steps: 1 recursively descend the tree of views performing Steps 2 and 3 on the sub-formulas inside the BDI atoms at each step.  compute for each state s the BDI atoms occurring in  true at s.

59. MultiAgent Model Checking Algorithm To check the formula  in view , the algorithm performs three steps: 1 recursively descend the tree of views performing Steps 2 and 3 on the sub-formulas inside the BDI atoms at each step.  compute for each state s the BDI atoms occurring in  true at s. 3 call the standard CTL model checking algorithm (treating BDI atoms as atomic formulas).

60. MultiAgent Model Checking Algorithm  B BABA AG (B A B B  )

61. MultiAgent Model Checking Algorithm  B BABA Implicit Belief Atom AG (B A B B  )

62. MultiAgent Model Checking Algorithm  B BABA Implicit Belief Atom AG (B A B B  ) B B 

63. MultiAgent Model Checking Algorithm  B BABA AG (B A B B  ) B B  

64. MultiAgent Model Checking Algorithm  B BABA AG (B A B B  ) B B  

65. MultiAgent Model Checking Algorithm  B BABA AG (B A B B  ) B B  

66. AG (B A B B  ) MultiAgent Model Checking Algorithm  B BABA B B  

67. AG (B A B B  ) MultiAgent Model Checking Algorithm  B BABA B B  

68. Model of the Andrew Protocol

69. Beliefs in Security Protocols ê Each Principal is seen as a process able to have Beliefs about other principal  B X  means that principal "X believes  " to be true

70. Beliefs in Security Protocols ê Each Principal is seen as a process able to have Beliefs about other principal  B X  means that principal "X believes  " to be true ê Beliefs evolve over time (as messages are sent/received)

71. Beliefs in Security Protocols ê Each Principal is seen as a process able to have Beliefs about other principal  B X  means that principal "X believes  " to be true ê Beliefs evolve over time (as messages are sent/received) ê Beliefs can be nested Example (from BAN) At the end of the protocol session: A believes that B believes that K ' AB is a "good shared key" for communication between them.

72. Beliefs in Security Protocols ê Each Principal is seen as a process able to have Beliefs about other principal  B X  means that principal "X believes  " to be true ê Beliefs evolve over time (as messages are sent/received) ê Beliefs can be nested Example (from BAN) At the end of the protocol session: A believes that B believes that K ' AB is a "good shared key" for communication between them. rec A {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB

73. Model of the Andrew Protocol ê External Observer a process (the protocol) ascribing beliefs to agents A and B ê Agent A a process ascribing beliefs to agent B ê Agent B a process ascribing beliefs to agent A 1 A  B : {N A } K AB 2 B  A : {N A, N B } K AB 3 A  B : {N B } K AB 4 B  A : {K AB, N B } K AB

74. Model of the Andrew Protocol All these entities are modeled as processes accessing other agents' representations (views). ê External Observer a process (the protocol) ascribing beliefs to agents A and B ê Agent A a process ascribing beliefs to agent B ê Agent B a process ascribing beliefs to agent A 1 A  B : {N A } K AB 2 B  A : {N A, N B } K AB 3 A  B : {N B } K AB 4 B  A : {K AB, N B } K AB

75. Model of the Andrew Protocol  B A   B B B A B B   B A B B  (B B B A, B A ) (i.e. B B B A and B A are modelled by the same process)  (B A B B, B B ) (i.e. B A B B and B B are modelled by the same process)

76. Model of the Andrew Protocol To specify a MAFSM we need to specify the following elements: ê Propositional Atoms ê Message variables ê Freshness variables

77. Model of the Andrew Protocol To specify a MAFSM we need to specify the following elements: ê Propositional Atoms ê Message variables ê Freshness variables ê Explicit Belief Atoms

78. Model of the Andrew Protocol To specify a MAFSM we need to specify the following elements: ê Propositional Atoms ê Message variables ê Freshness variables ê Explicit Belief Atoms ê How Atoms’ truth values vary during the protocol execution

79. Propositional Atoms : Message Variables ê We need to model principal sending and receiving messages

80. Propositional Atoms : Message Variables ê We need to model principal sending and receiving messages ê Boolean varibles

81. Propositional Atoms : Message Variables ê We need to model principal sending and receiving messages ê Boolean varibles View B A send {N A } K AB rec {N A,N B } K AB... rec {K' AB,N' B } K AB

82. Propositional Atoms : Message Variables View B B rec {N A } K AB send {N A,N B } K AB... send {K' AB,N' B } K AB View B A send {N A } K AB rec {N A,N B } K AB... rec {K' AB,N' B } K AB ê We need to model principal sending and receiving messages ê Boolean varibles

83. Propositional Atoms : Message Variables View  rec A {N A } K AB send AB {N A,N B } K AB... send AB {K' AB,N' B } K AB View B A send {N A } K AB rec {N A,N B } K AB... rec {K' AB,N' B } K AB View B B rec {N A } K AB send {N A,N B } K AB... send {K' AB,N' B } K AB ê We need to model principal sending and receiving messages ê Boolean varibles

84. Propositional Atoms : Message Variables Message Variables Evolution ê Once they become true they remain stable View B A send B {N A } K AB rec {N A,N B } K AB... rec {K' AB,N' B } K AB View B B rec {N A } K AB send A {N A,N B } K AB... send A {K' AB,N' B } K AB View  rec A {N A } K AB send AB {N A,N B } K AB... send AB {K' AB,N' B } K AB

85. Propositional Atoms : Message Variables View B A send B {N A } K AB rec {N A,N B } K AB... rec {K' AB,N' B } K AB View B B rec {N A } K AB send A {N A,N B } K AB... send A {K' AB,N' B } K AB View  rec A {N A } K AB send AB {N A,N B } K AB... send AB {K' AB,N' B } K AB Message Variables Evolution ê Once they become true they remain stable ê Evolve following the order of messages in the protocol

86. Example: Evolution of Message Variables  send {N A } K AB  rec {N A,N B } K AB Message variables evolve following the order of messages in the protocol A has not sent/received any message

87. Example: Evolution of Message Variables send {N A } K AB  rec {N A,N B } K AB Message variables evolve following the order of messages in the protocol A has sent Message 1  send {N A } K AB  rec {N A,N B } K AB

88. Example: Evolution of Message Variables send {N A } K AB rec {N A,N B } K AB Message variables evolve following the order of messages in the protocol send {N A } K AB  rec {N A,N B } K AB  send {N A } K AB  rec {N A,N B } K AB A has received Message 2

89. Propositional Atoms : Freshness Variables ê We need to express basic properties of messages: freshness ê Boolean varibles View B A fresh N A... fresh{K' AB,N' B } K AB shk K' AB

90. Propositional Atoms : Freshness Variables View B A fresh N B... fresh{K' AB,N' B } K AB shk K' AB View B A fresh N A... fresh{K' AB,N' B } K AB shk K' AB ê We need to express basic properties of messages: freshness ê Boolean varibles

91. Propositional Atoms : Freshness Variables View B A fresh N A … fresh{K' AB,N' B } K AB shk K' AB View  fresh N A... fresh{K' AB,N' B } K AB shk K' AB View B B fresh N B... fresh{K' AB,N' B } K AB shk K' AB ê We need to express basic properties of messages: freshness ê Boolean varibles

92. Propositional Atoms : Freshness Variables Freshness Variables Evolution ê Once they become true they remain stable View B A fresh N A … fresh{K' AB,N' B } K AB shk K' AB View B B fresh N B... fresh{K' AB,N' B } K AB shk K' AB View  fresh N A... fresh{K' AB,N' B } K AB shk K' AB

93. Propositional Atoms : Freshness Variables View B A fresh N A... fresh{K' AB,N' B } K AB shk K' AB View B B fresh N B... fresh{K' AB,N' B } K AB shk K' AB View  fresh N A... fresh{K' AB,N' B } K AB shk K' AB Freshness Variables Evolution ê Once they become true they remain stable ê Must satisfy some additional contraints

94. Evolution of Freshness Variables   fresh {N A, N B } K AB  fresh N A  fresh N B...

95. Evolution of Freshness Variables ê B A fresh {N A, N B } K AB  (fresh N A  fresh N B )  rec{N A, N B } K AB fresh {K' AB,N' B } K AB  (fresh K' AB  fresh N' B )  rec{K' AB,N' B } K AB …   fresh {N A, N B } K AB  fresh N A  fresh N B...

96. Evolution of Freshness Variables   fresh {N A, N B } K AB  fresh N A  fresh N B... ê B A fresh {N A, N B } K AB  (fresh N A  fresh N B )  rec{N A, N B } K AB fresh {K' AB,N' B } K AB  (fresh K' AB  fresh N' B )  rec{K' AB,N' B } K AB.. ê B B fresh {K' AB,N' B } K AB  (fresh K' AB  fresh N' B )  rec{K' AB,N' B } K AB fresh {K' AB,N' B } K AB   shk K' AB...

97. Explicit Beliefs Atoms View B A B B send A {K' AB,N' B } K AB... ê We need to express beliefs about (other) principal sending/receiving messages ê Boolean varibles

98. Explicit Beliefs Atoms ê We need to express beliefs about (other) principal sending/receiving messages ê Boolean varibles View B A B B send A {K' AB,N' B } K AB... View B B B A send B {N A } K AB...

99. Explicit Belief Atoms ê We need to express beliefs about (other) principal sending/receiving messages ê Boolean varibles View B A B B send A {K' AB,N' B } K AB... View B B B A send B {N A } K AB … View  B A rec {K' AB,N' B } K AB B B send A {K' AB,N' B } K AB...

100. Explicit Belief Atoms Explicit Belief Atoms Evolution ê Once they become true they remain stable ê Must satisfy some additional contraints View  B A rec {K' AB,N' B } K AB B B send A {K' AB,N' B } K AB … View B A B B send A {K' AB,N' B } K AB... View B B B A send B {N A } K AB …

101. Evolution of Explicit Belief Atoms   rec A {K' AB,N' B } K AB   B A rec {K' AB,N' B } K AB …

102. Evolution of Explicit Belief Atoms   rec A {K' AB,N' B } K AB  B A rec {K' AB,N' B } K AB... ê B A r ec {K' AB,N' B } K AB  B B send A {K' AB,N' B } K AB fresh {K' AB,N' B } K AB  B B fresh {K' AB,N' B } K AB …

103. Evolution of Explicit Belief Atoms   rec A {K' AB,N' B } K AB   B A rec {K' AB,N' B } K AB... ê B A rec {K' AB,N' B } K AB   B B send A {K' AB,N' B } K AB fresh {K' AB,N' B } K AB   B B fresh {K' AB,N' B } K AB... ê B B rec {N B } K AB  B A send B {N B } K AB fresh {N B } K AB  B A fresh {N B } K AB...

104. Checking the Andrew Protocol  B BABA AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB ) A security property for the Andrew Protocol

105. Checking the Andrew Protocol  B BABA B B shk K' AB shk K' AB AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB )

106. Checking the Andrew Protocol  B B B shk K' AB shk K' AB fresh {K' AB,N' B } K AB  shk K' AB AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB ) BABA

107. Checking the Andrew Protocol  B B B shk K' AB shk K' AB rec {K' AB,N' B } K AB  B B send A {K' AB,N' B } K AB fresh {K' AB,N' B } K AB  B B fresh {K' AB,N' B } K AB (fresh K' AB  fresh N' B )  rec {K' AB,N' B } K AB  fresh {K' AB,N' B } K AB AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB ) BABA

108. Checking the Andrew Protocol  B B B shk K' AB shk K' AB rec {K' AB,N' B } K AB  B B send A {K' AB,N' B } K AB fresh {K' AB,N' B } K AB  B B fresh {K' AB,N' B } K AB (fresh K' AB  fresh N' B )  rec {K' AB,N' B } K AB  fresh {K' AB,N' B } K AB AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB ) BABA

109. Checking the Andrew Protocol  B B B shk K' AB shk K' AB AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB ) BABA rec A {K' AB,N' B } K AB  B A rec {K' AB,N' B } K AB

110. Checking the Andrew Protocol  B B B shk K' AB shk K' AB AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB ) BABA rec A {K' AB,N' B } K AB  B A rec {K' AB,N' B } K AB The property doesn’t hold of the Andrew Protocol

111. Conclusions A Model-Checking based Verification Procedure for Security Protocols ê Logic of Beliefs ê MultiAgent Finite State Machine ê Model Checking Algorithm

112. Conclusions A Model-Checking based Verification Procedure for Security Protocols ê Logic of Beliefs ê MultiAgent Finite State Machine ê Model Checking Algorithm Future Work ê Implementation (ongoing work) ê Experimental Analysis ê Extension of the logic and comparison with other logics