Paper Info
Title
Security Analysis of Crypto-based Java Programs using Automated Theorem Provers
Abstract
Determining the security properties satisfied by software using cryptography is difficult: Security requirements such as secrecy, integrity and authenticity of data are notoriously hard to establish, especially in the context of cryptographic interactions. Nevertheless, little attention has been paid so far to the verification of such implementations with respect to the secure use of cryptography. We propose an approach to use automated theorem provers for first-order logic to formally verify crypto-based Java implementations, based on control flow graphs. It supports an abstract and modular security analysis by using assertions in the source code. Thus large software systems can be divided into small parts for which a formal security analysis can be performed more easily and the results composed. The assertions are validated against the program behavior in a run-time analysis. Our approach is supported by the tool JavaSec available as open-source and validated in an application to a Java Card implementation of the Common Electronic Purse Specifications and the Java implementation Jessie of SSL.
Year
DOI
Venue
2006
10.1109/ASE.2006.60
ASE
Keywords
DocType
ISSN
formal security analysis,security property,crypto-based java programs,java card implementation,security analysis,java implementation jessie,secure use,modular security analysis,run-time analysis,large software system,security requirement,java implementation,automated theorem provers,java card,control flow graph,first order logic,source code,theorem prover,software systems,satisfiability,formal specification,data integrity,theorem proving,formal verification,data privacy,cryptography,java
Conference
1527-1366
ISBN
Citations 
PageRank 
0-7695-2579-2
23
1.35
References 
Authors
15
1
Name
Order
Citations
PageRank
Jan Jurjens116916.07