Novel Logical Method for Security Analysis of Electronic Payment Protocols. Technology, No.47, Yanwachi street, Changsha, Hunan, China

Transcription

1 Novl Logicl thod for Scurity Anlysis of Elctronic Pymnt Protocols Yi Liu, Xingtong Liu, Li Zhng, Jin Wng nd hojing Tng ollg of Elctronic Scinc nd Enginring, Ntionl Univrsity of Dfns Tchnology, No.47, Ynwchi strt, hngsh, Hunn, hin Abstrct Elctronic pymnt protocols ply vitl rol in lctronic commrc scurity, which is ssntil for scur oprtion of lctronic commrc ctivitis. Forml mthod is n ffctiv wy to vrify th scurity of protocols. But currnt forml mthod lcks th dscription nd nlysis of timlinss in lctronic pymnt protocols. In ordr to improv nlysis bility, novl pproch to nlyz scurity proprtis such s ccountbility, firnss nd timlinss in lctronic pymnt protocols is proposd in this ppr. This pproch xtnds n xisting logicl mthod by dding concis tim xprssion nd nlysis mthod. It nbls to dscrib th vnt tim, nd xtnds th tim chrctristics of logicl infrnc ruls. W nlyzd th Ntbill protocol with th nw pproch nd found tht th firnss of th protocol is not stisfid, du to timlinss problm. Th rsult illustrts th nw pproch is bl to nlyz th ky proprtis of lctronic pymnt protocols. Furthrmor, th nw pproch cn b introducd to nlyz othr tim proprtis of cryptogrphic protocols. Kywords: lctronic pymnt protocol; forml nlysis; ccountbility; firnss; timlinss; logic rsoning; 1

2 1. Introduction In rcnt yrs, n xplosion of srvics providd ovr th Intrnt hs grt importnc of humn dily lif. Ths srvics r incrsingly trnsfrring customrs privt nd finncil informtion ovr th ntwork. A novl proof mthodology to vrify scur routing protocols hs bn proposd by hn (hn t l. 2015). Anothr ctgory of ntwork protocols to protct lgitimt intrsts btwn trdrs lso nd to b vrifid with dditionl scurity proprtis. Elctronic pymnt protocols provid tchnicl ssurnc for scurity of lctronic commrc. Snsitiv informtion such s crdit crd numbrs nd pssword dpnds on th scurity of lctronic pymnt protocols. Th nlysis nd rsrch on th scurity of lctronic pymnt protocols hs bcom n importnt issu in th fild of informtion scurity (Ptrick t l. 2016). omprd with othr scurity protocols, ccountbility, firnss nd timlinss r dditionl scurity proprtis in lctronic pymnt protocols. Accountbility cn provid sufficint vidnc to rsolv possibl futur disputs ftr th xcution of protocol. It mns tht ll prtis cnnot rpudit wht thy hv don. Firnss nsurs tht no on cn gin n dvntg ovr othr prticipnts by misbhving, which mns ithr both th prticipnts rciv wht thy xpct or nothing. Timlinss provids constrint of intrvls during vry stp in protocol rgultion to void th tim diffrnc utilizing by ttckrs. Forml nlysis is n ffctiv mthod to vrify lctronic pymnt protocols thnks to its strict nd ffctiv chrctristics. But currnt forml mthods for nlysis of lctronic pymnt protocols lck th dscription nd nlysis of timlinss. Our pproch focuss on th dscription nd nlysis of thr scurity proprtis bov. W dd concis tim xprssion nd nlysis mthod to xisting logicl mthod. Th logic 2

3 rsoning prt in th procss of th objctiv proof is bsd on Qin-Zhou logic mthod (Qing 2005; Zhou t l. 2001), nd th tim clculus prt utilizs th mthod of lgbr nd st thory. Th logicl mthod nd th lgbric mthod r two indpndnt prts. Thy will not intrfr with ch othr or undrmin th corrctnss of th originl mthod. Th Ntbill protocol is nlysd with th our mthod, nd th rsult shows tht th protocol dos not stisfy firnss du to timlinss problm. Thn w lbortd tht th dfct cn b fixd with crful spcifiction of vnt tim nd witing tim. Th rst of this ppr is orgnizd s follows. Sction 2 introducs rltd work in this r. Sction 3 dscribs th concpts nd dfinitions of th novl logicl mthod. Th logic nlysis procdur is introducd in Sction 4. Th nlysis procss of th Ntbill protocol is illustrtd in Sction 5. Sction 6 concluds this ppr nd outlins our futur studis. 2. Rltd work Forml mthods hv lrdy bn usd for scurity nlysis of lctronic pymnt protocols for dcds (Kilr 1996). Thy cn b dividd into thr ctgoris s logic rsoning, modl chcking nd thorm proving. 2.1 Logic rsoning Logic rsoning is n importnt forml nlysis mthod of lctronic pymnt protocols up to prsnt. Kilr logic (Kilr 1996) is th first nlysis mthod dsignd for lctronic pymnt protocols, which is minly usd to nlys ccountbility. But it ignord firnss in lctronic pymnt protocols. Volkr xtndd Autlog logic to b bl to nlys ccountbility (Volkr nd Hik 1998). Th fmous Pyword nd SET protocol r nlysd s xmpls. Qing-Zhou logic ws proposd for th nlysis of ccountbility nd firnss togthr (Qing 2005; Zhou t l. 2001). Li ddd th tim 3

4 fctor in SVO logic to mk it bl to nlys th timlinss of protocols (Li nd Luo 2006). Wn put forwrd modling nd nlysis mthod of lctronic pymnt protocols bsd on gm logic (Wn t l. 2007). hn combind logic rsoning with strnd spc modl, introducing nw logic nlysis mthod of lctronic pymnt protocols (hn 2010). A mthod pplying Kilr logic in compositionl nlysis is prsntd by Go for nlysing th ccountbility nd firnss of lctronic pymnt protocols (Go t l. 2013). 2.2 odl chcking Th chrctristic of modl chcking is sy to mnipult. Krmr pply modlchckr OHA which supports th ltrnting trnsition systms nd th ltrnting tmporl logic to nlys ccountbility (Stv 2004). Xi utilizd finit utomton to nlys ISI protocol nd IBS protocol (Xi nd Zhng 2004). Guo combind communiction finit stt mchin with som nw logic ruls bsd on Qing-Zhou logic to nlys scurity proprtis of lctronic pymnt protocols (Guo t l. 2010). Liu proposd n xtndd dtrministic finit utomton which cn lso nlys scurity proprtis such s ccountbility nd firnss (Liu t l. 2013). Nvrthlss, du to th stt spc of th modl chcking mthod is limitd, vn if no ttck mthod hs bn found, it dos not mn th corrctnss of protocols. 2.3 Thorm proving Thorm proving is rgrdd s n ccurt mthod for scurity of cryptogrphic protocols. Pp intgrtd logic with procss clculi for nlysing lctronic pymnt protocols (Pp t l. 2001). hun usd olourd Ptri Nts to nlyz th Intrnt Opn Trding Protocol (hun nd Jonthn 2004). Bll nlysd th purchs protocol of SET with Isbll nd th inductiv mthod (Gimpolo t l. 2006). Guttmn 4

5 pplid strnd spc mthod to nlys th firnss of fir xchng protocols (Guttmn 2012). Guo proposd tchniqu for modlling nd vrifying fir-chng lctronic pymnt protocols (Guo t l. 2009). On th othr hnd, thorm proving mthod is complictd nd difficult to vrify complx protocols. 3. oncpts nd dfinitions Th dfinitions nd symbols usd in th nw pproch r dnotd s follows: Tbl 1. Bsic symbols A,B Prtis prticipt in protocol. { m } K iphrtxt of mssg m ncryptd with scrt ky K. TTP Trustd third prty. K Dul ky of K. m ssg trnsfrrd in protocol. (m, n) K EOO T Th public ky of prty A, which is usd to vrify th digitl signtur of A. Th non-rpudition vidnc tht is providd to th rcivr in lctronic pymnt protocols, which is usd to prov tht th sndr hs snt th mssg. Tim of vnt. 3.1 Tim systm 1 K EOR ssg m is combind with mssg n. Th privt ky corrsponding to K. Th non-rpudition vidnc tht is providd to th sndr in lctronic pymnt protocols, which is usd to prov tht th rcivr hs rcivd th mssg. W dnot th tim whn vnt occurs by dding condition in th formul lngug, lik A m. T is tim xprssion. This dfinition introducd th dscription of th occurrnc tim of snding nd rciving mssg. Th tim xprssion is dfind s follows: 1. x stnds for constnt tim lmnt. 2. X stnds for vribl tim lmnt. 3. X TS mns tim binding xprssion, whil TS is th scop of X. 4. [T] is tim xprssion, whil T is tim binding xprssion. 5

6 Th constnt tim lmnt is rprsntd by lowr cs t, nd th vrint tim lmnt is rprsntd by cpitl lttr T. Tim binding xprssion is vribl tim lmnt X with crtin vlu of constnt tim lmnt s t( t TS). In logicl formul, th tim xprssion [X I] cn b bbrvitd to [X], nd [X {x}] cn b bbrvitd to [x], whr x is constnt tim lmnt or vribl tim lmnt with bound vlu. Th vlu of vribl tim lmnt is bound to th first oprtion in its formul. 3.2 Protocol nd nvironmnt TTP(Trustd third prty) is spcil prty, which is rgrdd s fir trustd third prty. Th bnk or th rbitrtion orgniztion cn ct s TTP. In gnrl, w ssum tht ll prtis r dishonst xcpt for TTP. Thy my intrrupt th xcution of protocols rbitrrily. ommuniction chnnl is ithr rlibl or unrlibl, dpnding on th spcific oprting nvironmnt. Usully, th communiction chnnl btwn gnrl prtis is unrlibl, whil it btwn th TTP nd othr prtis is rcovrbl which mns th mssg will b trnsmittd vntully. Protocol sttmnt dfins wht mssg should b snt nd rcivd by prtis in th currnt round s follows: A B : m mns A snt mssg m to B. 3.3 Possssion st O stnds for th possssion st of prty A prticipting in protocol. Assuming th protocol bgins from T 0, th initil possssion st of A is O ( T 0 ). Whn protocol runs to T, th possssion st of A bcoms O ( T ). Bsids, w dfin O ( T ) is th finl x x possssion st of A t th nd of protocol. Th possssion st of A contins th 6

7 informtion inhritd from lst stp nd th mssg which is rcivd or gnrtd t prsnt. It vris conscutivly with th xcution of protocol until O O ( T ). Th possssion st of A chngs from O( Ty) to O( Tx) ( Ty Tx ), which mns T y is th momnt bfor T x. It follows th following ruls: (1) Whn th xcution of protocol sttmnt is A B : m x, O ( T ) O ( T ) { m} if m is nw mssg gnrtd by A, which mns m O ( T ). x y Othrwis, O ( T ) O ( T ) if m is not nw mssg gnrtd by A nd m O ( T ). x y (2) Whn th xcution of protocol sttmnt is B A : m x whil m O ( T ), O ( T ) O ( T ) { m}. Othrwis, O ( T ) O ( T ). x y 4. Logic nlysis mthod 4.1 Logic componnt x y Our mthod consists of th following fiv logic componnts: (1) A x. A cn mk othrs bliv in formul x by prforming sris of oprtions without lking ny scrt; (2) A m. A snds mssg m. Th following impliction is stblishd in th procss of nlysis: A ( m, n) => A m (1) It mns, A snds mssg m whil A snds mssg (m, n). (3) A m. A posssss mssg m. (4) A m. A rcivd mssg m. Th following impliction is stblishd s th scond componnt: A ( m, n) => A m (2) y y y 7

8 K (5) A. K is th public ky of A, which is usd to vrify th mssg signd by its privt ky 4.2 Axiom systm 1 K. Th xiom systm consists of 1 infrnc rul nd 6 xioms. Th infrnc rul is s follows: ( ) ( ( ) ) => (3) It illustrts cn b obtind from nd ( ). rprsnts cn b dducd from th formul sts. indicts is thorm, which mns is stblishd ll th tim. Th infrnc rul bov indicts tht is thorm if is thorm nd contins. Th 6 xioms r s follows: A1. A x A y => A ( x y) A2. A x (x=>y) => A y A3. A { m} 1 x A K b K b B t x T => A B m t [ T T T ] Y Y X A4. A B { m} k x A B k Y => A B m t mx( TX, T Y) A5. A m => A m A6. A { m} K A K => A m Th proof procdur of protocol proprtis is dividd into two prts. Th first prt is clld logicl rsoning nd th scond prt is clld tim clculus. Th purpos of this procdur is to prov tht th rsult obtind from logic rsoning stisfis th tim constrints spcifid in tim clculus. 4.3 Protocol nlysis procdur Protocol nlysis consists of 5 stps s shown in Figur 1. 8

9 (1)List th initil possssion sts of ch prty in protocol. (2)List th initil Assumptions of th protocol. (3)List EOO nd EOR, nd nlys whthr thy mt th rquirmnt of ccountbility. (4)Anlys whthr EOO O is st b( T) EOR O( T) up t th nd of protocol. (5)Anlys whthr t th nd. T EOO O ( T ) if nd only if EOR O ( T ) b 5. Th Ntbill Protocol nlysis Figur 1. Procdur of protocol nlysis Th Ntbill protocol is n lctronic pymnt protocol proposd by Profssor J.D.Tygr in rngi llon Univrsity for trding digitl goods, including thr prticipnts: customr, mrchnt nd th Ntbill srvr (Sirbu nd Tygr 1995). Its min stps r s follows: (1) : T ( ),{ PRD, TID} K 1 (2) :{ ProductID, Pric, TID} K 2 (3) : T ( ),{ TID} K 3 (4) :{ Goods } k,{ h({ Goods } k ), EPOID } K 4 (5) : T ( ),{{ EPO} 1} K 5 (6) N : TN ( ),{{{ EPO} 1, Acct, k} 1} K N 6 (7) N :{{ Rcipt} 1,{ EPOID, Acct} } 7 KN K K K KN KN (8) :{{ Rcipt} 1,{ EPOID, Acct} } 8 KN KN K 9

10 , nd N rprsnt th customr, th mrchnt nd th Ntbill srvr rspctivly. T ( ) is usd to prov to, nd to stblish shrd sssion ky K. Th function of TN ( ) is similr to T ( ). PRD(Product Rqust Dt) is product rqust dt. TID is trnsction s ID nd ProductID is product s ID. Pric stnds for th pric th mrchnt rquird. Goods is th spcific contnt of trnsmittd goods. EPO is lctronic purchs ordr, th plin prt of which compriss customr idntifiction idntity, ProductID, Pric,, h({ Goods} k ) nd h(prd). h(m) stnds for th hsh vlu of m. Th ncryption prt includs pymnt instruction which cn only b rd by th Ntbill srvr such s th customr ccount. EPOID is lctronic pymnt ID, which is th globlly uniqu idntifir nd will b usd to uniquly idntify th trnsction in th dtbs of Ntbill. Acct nd Acct stnd for th customr nd mrchnt s ccount rspctivly. Rcipt includs th Rsult whthr to ccpt this pymnt or not, which is rturnd from th Ntbill srvr. Th nlysis procdur of th Ntbill protocol is dtild in th nxt subsction. 5.1 List th initil possssion sts. At th initil tim of protocol oprtion, th initil stts of nd r 1 O ( T0 ) { K, K, K, KN, K, KN} 1 ( 0) {,,, N,, N} K K K K O T K K K K K K N N (, N,, N) N N ( K, K N, K, K N) 5.2 List th crdibl ssumptions T1: A N k A B k Assum tht th Ntbill srvr is fully in ccordnc with th protocol rgultion nd will not do nything hrmful to ny prty. If A cn prov tht N hs snt k to him, h cn prov tht th othr prty B hs snt k. 10

11 T2: A B h( m) A B m According to th protocol, th sndr snds h(m) for th chcksum of mssg m. Th sndr is bl to clcult th chcksum only whn th sndr owns th mssg m. So if A cn prov tht B hs snt h(m), thn A cn prov tht B hs snt mssg m. 5.3 List EOO nd EOR: EOO= ({ h({ Goods} )},{ k} ) k K 1 KN EOR= ({ h({ Goods} )},{ k} ) k K 1 1 K N Assum tht EOO O ( T ) is stblishd t th nd of protocol. Thn ({ h({ Goods} )},{ k} ) O ( T ) is stisfid, which mns { h({ Goods } k)} K k K 1 K N t T nd {} k 1 K N. K Sinc { h({ Goods } k)} K, nd xiom A3, thn h({ Goods} k ) t [ T T T ]. According to T2, w obtin { Goods} k t [ T T T ] (4) Sinc {} k 1, K N K N N nd xiom A3,thn N k t [ T T T ]. According to th crdibl ssumption T1, w obtin k t [ T T T ] (5) Du to formul (4), (5) nd xiom A4, w will gt Goods t mx( T, T ) [ T T T ] [ T T T ] (6) Assum tht EOR O ( T ) is stisfid t th nd of th protocol, which mns { h({ Goods} )} nd {} k 1 r stisfid. Thn ccording to k 1 K K N K N N, xiom A3 nd crdibl ssumption T1, w obtin 11

12 k t [ T T T ] (7) Sinc K, xiom A3 nd crdibl ssumption T2, w will gt { Goods} k t [ T T T ]. Du to formul (7) nd xiom A6, w will gt Goods t mx( T, T ) [ T T T ] [ T T T ] (8) Thrfor, th dsign of EOO nd EOR in th Ntbill protocol cn mt th rquirmnt of ccountbility. 5.4 Anlysis of ccountbility Vrify whthr nd cn obtin th pproprit vidnc t th nd of protocol. Aftr th fourth stp of th protocol, O T O T h Goods [ T 4 T 4 T ], thn { h({ Goods } )} O ( T ). ( 4) ( 3) { ({ } k )} K k K Whn th lst stp of th protocol is finishd, O T O T Rcipt [ T 8 T 8 T ]. Bcus of K, w obtin ( 8) ( 7) {{ } 1} K K N { Rcipt} O ( T ), nd { k} 1 O ( T ). Thn EOO O ( T ) is stisfid. 1 KN KN Similrly, ccording to th fifth stp of th protocol, w will gt { h({ Goods} )} O ( T ). And { k} 1 O ( T ) will b obtind ftr th svnth k 1 K KN stp. Thn w will gt EOR O ( T ). Thrfor, EOO O ( T ) EOR O ( T ) is stisfid whn th protocol finishs. (5)Anlysis of firnss Th firnss objctiv is: EOO O ( T ) if nd only if EOR O ( T ) k All prtis in protocol will wit for th nxt stp ftr th lst on. If thr is no rspons, th protocol will trmint ftr crtin priod of tim t nd clr th k 12

13 protocol rcords bfor. For chiving firnss, th following conditions hv to b stisfid: k x {} k 1 y ( T x T y T x t ) (9) {{ } 1} K K N K N { h({ Goods} )} x {} k 1 y ( T x T y T x t ) (10) k 1 K K N t is th witing tim ftr th xcuts th 6th stp of th protocol. t is th witing tim ftr xcuts th 5th stp. Sinc N is in full ccordnc with th rgultion of protocol, formul (9) must b stblishd. In formul (10), Tx = T 5, Ty = T7 T5 t5 t6, t 5 nd t 6 r th tim dly ftr th 5th stp nd th 6th stp. So w must mk t 5 t 6 t to mk formul (10) stblishd. But thr is no rstrict bout th rltionship mong t 5, t 6 nd t. Thr is possibility to mk t 5 t 6 t no mttr wht th constnt t is spcifid. For xmpl, if prforms th 5th stp in ccordnc with th rgultion, could snd {{ EPO} 1} K N to N ftr it is timout nd cquir th vidnc to prov hs rcivd th product Goods. But hs dltd { Goods bcus of timout. Evn though hs rcivd Rcipt } k nd th ky k, h couldn t dcrypt th ciphrtxt to obtin th product Goods. Thn th fomul (10) cn t b stblishd, which mns th protocol cn t chiv th firnss objctiv. Th min rson is tht th implmnttion of th protocol dos not hv spcific constrints on th rlvnt vnt tim in th procss. In ordr to mk up for th dfct, w should crfully rgult th vnt tim nd th witing tim of th xcution of protocol. 5 onclusion Th nlysis rsult of Ntbill protocol show tht th protocol dos not stisfy firnss bcus of timlinss problm. Th procss illustrts how th nw pproch is pplid K 13

14 to nlys th tmporl rltion btwn vnts in lctronic pymnt protocols. It is not simpl logic mthod, but n intgrtd pproch. Th nw pproch is pproprit to guid th dsign of lctronic pymnt protocols nd fix th dfcts of originl protocols. Th nxt stp of our rsrch is to nlys othr lctronic pymnt protocols with our mthod which r widly usd in lctronic commrc. At th sm tim, w will furthr study utomtd nlysis tools to mk it convnint for dsign nd nlysis of lctronic pymnt protocols. Acknowldgmnts This work ws sponsord by th Ntionl Nturl Scinc Foundtion of hin (Projct No ). Rfrncs hun, O., Jonthn, B., An Improvd Forml Spcifiction of th Intrnt Opn Trding Protocol. In: Procdings of th 2004 A symposium on Applid computing. Nicosi, yprus hn, L., Nw Logic of Anlyzing Elctronic ommrc Scurity Protocols. omputr Scinc 37 (10), hn,., Ji, L., Xu, Ho., Luo,., Zhou, W., Loo, B., A Progrm Logic for Vrifying Scur Routing Protocols. Logicl thods in omputr Scinc 11 (4), Gimpolo, B., Fbio,., Lwrnc,.P., Vrifying th SET Purchs Protocols. Journl of Automtd Rsoning 36 (2), Guo, Y., Ding, L., Zhou, Y., Guo, L., Anlysis for E-commrc Protocols Bsd on ProVrif. Journl on ommunictions 30 (3),

15 Guo, H., Li, Z., Zhung, L., Ji, H., Nw Approch for Anlyzing of E-commrc Protocol. omputr Scinc 37 (8), Guttmn, J.D., Stt nd Progrss in Strnd Spcs: Proving Fir Exchng. Journl of Automtd Rsoning Go, Y., Png D., Tng, P., A Forml Anlysis thod for Optimistic Fir Exchng Protocol. Journl of onvrgnc Informtion Tchnology 8 (3), Kilr, R., Accountbility in lctronic pymnt protocols. IEEE Trnsction on Softwr Enginring 22 (5), Stv, K., Forml Anlysis of Optimistic Fir Exchng Protocols. Univrsit Libr d Bruxlls, Brussls, Blgium. Sirbu,., Tygr, J., NtBill: n intrnt commrc systm optimizd for ntwork dlivrd srvics. IEEE Prsonl ommunictions 2 (4), Li, B., Luo, J., Forml Anlysis of Timlinss in Non-Rpudition Protocols. Journl of Softwr 17 (7), Liu, W.,, S., Si, Y., H, G., A ombining Dtrministic Finit Automton with Logic Ruls Approch for Anlyzing of E-commrc Protocol. Journl of hins omputr Systms 34 (3), Pp,., Brmr, O., Hl, J., Shnoi, S., Forml Anlysis of E-ommrc Protocols. In: Procdings of th 5th Intrntionl Symposium on Autonomous Dcntrlizd Systms Ptrick,., Simk, F.S., Fng, H., Rfund ttcks on Bitcoin's Pymnt Protocol. In: Procdings of th 20th Finncil ryptogrphy nd Dt Scurity. Brbdos. Qing, S., A Forml thod for Anlyzing Elctronic pymnt protocols. Journl of Softwr 16 (10),

16 Volkr, K., Hik, N., A Sound Logic for Anlysing Elctronic pymnt protocols. In: th 5th Europn Symposium on Rsrch in omputr Scurity Louvin-l-Nuv. Brlin, Hidlbrg Wn, J., Zhng,., Zhng, H., Forml Anlysis of Elctronic Pymnt Protocols Bsd on Gm Logic. icrolctronics omputr 24 (9), Xi, X., Zhng, H., Firnss Rsrch of Elctronic ommrc Pying Protocols Bsd on Finit Automton odl. omputr Applictions 24 (6), Zhou, D., Qing, S., Zhou Z., A nw pproch for th nlysis of lctronic pymnt protocols. Journl of Softwr 12 (9),