Abstract:To develop trustworthy distributed systems, verification techniques and formal methods, including lightweight and practical approaches, have been employed to certify the design or implementation of security protocols. Lightweight formal methods offer a more accessible alternative to traditional fully formalised techniques by focusing on simplified models and tool support, making them more applicable in practical settings. The technical advantages of formal verification over manual testing are increasingly recognised in the cybersecurity community. However, for practitioners, formal modelling and verification are often too complex and unfamiliar to be used routinely. In this paper, we present an Eclipse IDE for the design, verification, and implementation of security protocols and evaluate its effectiveness, including feedback from users in educational settings. It offers user-friendly assistance in the formalisation process as part of a Model-Driven Development approach. This IDE centres around the Alice & Bob (AnB) notation, the AnBx Compiler and Code Generator, the OFMC model checker, and the ProVerif cryptographic protocol verifier. For the evaluation, we identify the six most prominent limiting factors for formal method adoption, based on relevant literature in this field, and we consider the IDE's effectiveness against those criteria. Additionally, we conducted a structured survey to collect feedback from university students who have used the toolkit for their projects. The findings demonstrate that this contribution is valuable as a workflow aid and helps users grasp essential cybersecurity concepts, even for those with limited knowledge of formal methods or cryptography. Crucially, users reported that the IDE has been an important component to complete their projects and that they would use again in the future, given the opportunity.

Verification of CERT Secure Coding Rules: Case Studies.

A Framework for the Verification of Certifying Computations

Embedding Secure Coding Instruction into the IDE: A Field Study in an Advanced CS Course.

C Code Verification Based on the Extended Labeled Transition System Model

Practical and Scalable Security Verification of Secure Architectures

Scalable Verification Framework for C Program

Verifying Security Vulnerabilities in Large Software Systems using Multi-Core k-Induction

sec-certs: Examining the security certification practice for better vulnerability mitigation

VeriCHERI: Exhaustive Formal Security Verification of CHERI at the RTL

Finding Security Vulnerabilities in Network Protocol Implementations

Checking security compliance between models and code

Industrial-Strength Verification of Solid State Interlocking Programs

Apply Formal Methods in Certifying the SyberX High-Assurance Kernel

The role of model checking in software engineering

Lessons from Formally Verified Deployed Software Systems (Extended version)

A Security Assurance Framework Combining Formal Verification and Security Functional Testing

Pragmatic Formal Verification of Sequential Error Detection and Correction Codes (ECCs) used in Safety-Critical Design

When Regression Verification Meets CEGAR.

A Practical Approach to Formal Methods: An Eclipse Integrated Development Environment (IDE) for Security Protocols

Model Checking a C++ Software Framework, a Case Study

Synthesizing verified components for cyber assured systems engineering