CSE503 Design Charette

1
CSE503 Design Charette

• Mattias Engblom Robert Franzén
• Johan Hesselberg Raphael Hoffman
• Ramy Shahin

2
Presentation Overview

• Introduction
• Design overview
• Models

3
Introduction

• Chosen area Security
• Known security techniques
• What we decided to implement
• Privacy
• Integrity
• Authentication

4
Problem Frames (1/2)

• Context Diagrams

5
Problem Frames (2/2)

• Usefulness of Problem Frames
• Shared Phenomena
• Idea of system participants
• Derive requirements
• Being able to focus on specific parts

6
Cryptographic Techniques

• Symmetric Cryptography
• Asymmetric Cryptography
• Hashes and message digests

7
Design Overview
8
Design Common modules
9
Sending a Secure Message
10
Receiving a Secure Message
11
Design UserManager module
12
Models

• Privacy and Authentication in Communication with
  Mail Server(SRP Protocol)
• Privacy and Authentication in Email Communication
• Secure Distribution Centers

Spin
Alloy
13
Design Logon algorithm

• The Logon sequence diagram

14
Privacy and Authentication in Communication with
Mail Server
Variables involved
C, n, g, s, P, x, v, u, a, b, A, B, K, M1, M2
15
Privacy and Authentication in Communication with
Mail Server
Client
Server
Intruder
16
Privacy and Authentication in Communication with
Mail Server
n,g,a,P,C
n,g,b,s,v
Client
Server
Initial Knowledge
Initial Knowledge
Intruder
Initial Knowledge
n,g
17
Privacy and Authentication in Communication with
Mail Server
If x1,x2,x3 is known, then x4 can be computed
rule extraction
define updateMyKnowledge(arr) \ if \
(arrserverDB arrC) -gt arrs 1
arrv1 \ else skip \ fi \ if \
(arrs arrC arrP) -gt arrx 1 \
else skip \ fi \ if \ (arrn
arrg arra) -gt arrA 1 \ else
skip \ fi \ if \ (arrn arrv
arrg arrb) -gt arrB 1 \ ...
18
Privacy and Authentication in Communication with
Mail Server
n,g,a,C
n,g,b,C,s,v
C
Client
Server
Update knowledge based on observed data and prior
knowledge, and rules
Intruder
n,g,C
19
Privacy and Authentication in Communication with
Mail Server
proctype Intruder(mtype self mtype party)
mtype msg / initialize knowledge of
Intruder/ knowledgeOfIntruderg 1
knowledgeOfIntrudern 1 / can only send
that information it knows / do
knowledgeOfIntruderC -gt net ! self, party, C
knowledgeOfIntrudern -gt net ! self, party,
n knowledgeOfIntruderg -gt net ! self,
party, g knowledgeOfIntruders -gt net !
self, party, s knowledgeOfIntruderP -gt
net ! self, party, P knowledgeOfIntruderx
-gt net ! self, party, x knowledgeOfIntruder
v -gt net ! self, party, v
knowledgeOfIntrudera -gt net ! self, party, a
knowledgeOfIntruderb -gt net ! self, party,
b knowledgeOfIntruderA -gt net ! self,
party, A knowledgeOfIntruderB -gt net !
self, party, B knowledgeOfIntruderK -gt
net ! self, party, K knowledgeOfIntruderM1
-gt net ! self, party, M1
knowledgeOfIntruderM2 -gt net ! self, party,
M2 / if intruder doesn't know, it can send
junk / net ! self, party, junk net ?
eval(party), eval(self), msg -gt
knowledgeOfIntrudermsg 1
updateMyKnowledge(knowledgeOfIntruder) od
Intruder
send random messages
learn new values
20
Privacy and Authentication in Communication with
Mail Server

• Modeled and verified three scenarios
• Intruder cannot learn session key based on prior
  knowledge, observed data and rules
• Intruder cannot impersonate the server
• Intruder cannot impersonate the client
• Assumptions
• Rules are complete, etc.

21
Q A
22
Privacy and Authentication in Email Communication
CertificateServer
A
B
A wants to send a secret message to B
Intruder
23
Privacy and Authentication in Email Communication
proctype Intruder (mtype self) ... do /
write random messages based on knowledge /
atomic if sender A
sender B sender KeyServer fi
if receiver A receiver
B receiver KeyServer fi
if msg learned1 msg
learned2 msg PKC ... a !
sender, receiver, msg, enc, sign / try
to learn something new / a ? peer, _, x1,
x2, x3 -gt if (x2nil x2PKC)
-gt if learned1 x1
intruderLearned(x1) learned2 x1
intruderLearned(x1) fi
Intruder
send random messages
learn new values
24
Privacy and Authentication in Email Communication

• In our first scenario, A did not verify the
  signature of the response from the Certificate
  Server
• SPIN detected a possible attack

Certificate Server
B
A
Request PK(B)
send PK(B)
encrypt M with PK(B)
decrypt M with PK(B)
25
Secure Distribution Servers
Mailing Lists
Client
A B C
D
Client
D
DistributionServer
Client
Client
Client
26
Secure Distribution Servers

• Problem Cycles in Mailing Lists

F G H
E
I J K
G
A B E
D
D O P
N
L M N
K
27
Secure Distribution Servers

• Solution Introduce a TTL (Time to live) field
  inside an email message, that is decremented each
  time the message reaches a distribution server
• We modeled our system in Alloy and showed that
  with the above extension no infinite cycles are
  possible anymore.