Abstract:Security protocols are distributed programs designed to ensure secure communication in a network controlled by an adversary. They are widely used today for securing on-line services such as personal communication and electronic voting. Their design is notoriously error-prone, and a great deal of research has been devoted to their analysis. In this thesis we provide two main contributions towards the automated analysis of such protocols: algorithms for the symbolic analysis of equivalence properties, and a symbolic probabilistic framework for security protocol analysis. We consider the problem of verifying two equivalence properties relevant in protocol analysis: static equivalence and trace equivalence. Both notions model the property that an attacker cannot distinguish between two protocol executions, and they have been used to model security goals such as off-line guessing, electronic voting anonymity, and RFID untraceability. Static equivalence is concerned with an attacker who passively eavesdrop on a network and then tries to distinguish between possible executions by performing off-line computations. Trace equivalence is used in the analysis of security properties against an attacker who may participate actively in protocol execution. We present an efficient decision procedure for static equivalence under equational theories generated by subterm convergent rewriting systems. This class of theories encompasses the most common cryptographic primitives, including symmetric and asymmetric encryption and decryption, hash functions and digital signatures. Our algorithm achieves a better asymptotic complexity than competing algorithms, albeit with a narrower scope. We discuss its implementation in the FAST tool and show that it indeed performs much more efficiently than other existing tools for the same task. We also present a procedure for deciding the trace equivalence of bounded simple processes under equational theories generated by convergent rewriting systems and for which a finitary unification algorithm exists. Although we do not have a termination result, our procedure is correct for the largest class of equational theories handled by any existing procedure for deciding trace equivalence and, together with the work by Cheval et. al [64], it is the only one to handle non-trivial else branches. Finally, we introduce a symbolic probabilistic framework for the analysis of security protocols. Our framework provides a general method for expressing weak-

Secrecy Analysis of Security Protocol Based on Reachability Relation

The Research on Definition of Multilevel Security Based on the Construction of Covert Channels.

A New Security Protocol Modeling Approach Based on Π T Calculus

Security Theorems via Model Theory

DeepSec: Deciding Equivalence Properties for Security Protocols -- Improved theory and practice

A method for symbolic analysis of security protocols

Composing security protocols: from confidentiality to privacy

Model Checking Analysis of Needham-Schroeder Public-Key Protocol

A New Enforcement on Declassification with Reachability Analysis

Equivalence Properties and Probabilistic Reasoning in Symbolic Security Protocol Analysis

Formal Verification of Authentication and Confidentiality for TACACS+ Security Protocol using Scyther

Heuristic Methods for Security Protocols

Advancing Security Protocol Verification: A Comparative Study of Scyther, Tamarin

Photon counting statistics using a digital oscilloscope

Combined Analysis Method for Security Protocols

A Security Calculus of Concurrent Objects for Verifying Ad Hoc Network Protocols

Security Formalizations and Their Relationships for Encryption and Key Agreement in Information-Theoretic Cryptography

I Can Read Your Mind: Control Mechanism Secrecy of Networked Dynamical Systems under Inference Attacks

Towards Quantifying the (in)security of Networked Systems.

Quantifying pervasive authentication: the case of the Hancke-Kuhn protocol

VeriReach: A Formally Verified Algorithm for Reachability Analysis in Virtual Private Cloud Networks