Automated Analysis of Security-Sensitive Protocols

The sheer number and variety of security protocols for Internet applications under development makes it difficult to be sure that any one protocol is 100 per cent secure from attack. Now an automated tool can systematically validate these security-sensitive protocols and applications.

“The AVISPA software tool enables a security protocol designer to input the protocol and the language he/she wishes to use, then feeds back information on this protocol including any known bugs or security weaknesses,” says Professor Alessandro Armando of the University of Genoa’s Artificial Intelligence Laboratory (DIST) and coordinator of the IST programme-backed Future and Emerging Technologies project AVISPA. “Previously such protocol designers had no automated support to help them in their design role – that is the purpose of the AVISPA tool."

Secure protocols are a vital element in carrying out safe online interactions between a user’s Web browser and a company Web server, for example a bank’s Web server in an online banking application. Though such protocols might look simple, they can often be extremely difficult to get absolutely right, such as with no bugs or weaknesses in the protocol.

Armando quotes the classic example of the Needham-Schroeder public-key protocol, which was first published in 1978 as a means of mutual authentication between two parties using public-key cryptography. The protocol was eventually found to be vulnerable to simple attacks in 1996, eighteen years later!

AVISPA participants aimed to develop a push-button, industrial-strength technology for the analysis of such security-sensitive Internet protocols and applications. The project finished in July 2005 with the release of the AVISPA tool, which is a simple software application that runs on a PC or via a Web interface. It can be accessed online, and offers both a Basic and an Expert mode.

The consortium partners believe that this new tool will help speed the development of the next generation of security protocols, and improve their security in the process.

Project partner Siemens has already discovered a weakness in one of its own protocols using the tool, and has revised the protocol and issued a new patent accordingly. The partners have also been joined by SAP and submitted the AVISPA results for inclusion into a potential new IST project AVACOSS which will analyse more complex security-sensitive applications.

PLEASE MENTION IST RESULTS AS THE SOURCE OF THIS STORY AND, IF PUBLISHING ONLINE, PLEASE HYPERLINK TO: http://istresults.cordis.lu/

Contact: Tara Morris, +32-2-2861985, tmorris at gopa-cartermill.com

Author:  

Email:    

Topic:    

Content:

Related Articles

• Comodo Heats up the Desktop Security Space by Releasing Enterprise Strength Personal Firewall Free of Charge
  22 October 2005



• Study Reveals End-User Encounters With Security Threats Increasing in Smaller Organizations
  20 October 2005



• CSIA Applauds House of Representatives for its Support of National Cyber Security Awareness Month
  19 October 2005



• PC World Publishes 'Special PC Security Issue'
  19 October 2005



• Worry-Free Security And Data Protection - Symantec
  19 October 2005



• SecureWorks Inducted into FIRST, the Elite Forum of Incident Response and Security Teams
  18 October 2005



• SRC Technologies, "SRC Corp" Network Security and Productivity Software Released for Businesses Today
  18 October 2005



• Webcasts on Travel Security and Identity Theft for Female Executives
  16 October 2005



• Astaro Boosts Virus Scanning Speed Of Award-Winning, Unified Threat Management Security Appliance
  12 October 2005



• Symantec Managed Security Services First to Offer Vendor Independent Vulnerability Data Correlation Service
  12 October 2005