Formal Modeling and Verification of Security Protocols on Cloud Computing Systems Based on UML 2.3
Kunding Fang,Xiaohong Li,Jianye Hao,Zhiyong Feng
DOI: https://doi.org/10.1109/trustcom.2016.0148
2016-01-01
Abstract:Cloud computing, as a kind of internet-based computing, has to entrust data which are managed by external parties on remote servers. One of the critical security challenges on cloud computing is to ensure data security and privacy. In order to perform rigorous formal analysis for cloud-based applications, we use UML, an industry-adopted modeling language to build an abstraction of a system. In this paper, we extend class/profile diagram, sequence diagram and state diagram in UML 2.3 that contains sufficient information to model security protocols in cloud-based systems. Following that, a method is proposed to automatically translate UML models to pi calculus specification, which allows us to verify the data secrecy and confidentiality of security protocols using the existing protocol verifier - ProVerif. Our methodology is applied on ConfiChair, a security protocol in cloud computing system, to prove the effectiveness and feasibility of our approach.