E-learning, Virtual University, Online Learning: Education Embraces Technology

We present the use of a method – and its corresponding tool set – for compositional verification of applet interactions on an industrial smart card case study. The case study, an electronic purse, is provided by smart card producer Gemplus as a test case for formal methods for smart cards. The verification method focuses on the possible interactions between different applets, co–existing on the same card, and provides a technique to specify and detect illicit interactions between these applets. The method is compositional, thus supporting post–issuance loading of applets. Motivation The growing market for smart cards and other small personal devices has increased the need to use formal validation and verification techniques in industry. These devices often contain privacy–sensitive information; this is the case in typical usages for smart cards such as health care information systems and electronic purses. Therefore strong security guarantees are needed for their wide–spread acceptance. With the acceptance of evaluation schemes such as Common Criteria3, industry has come to realise that the only way to achieve such high guarantees is to adopt the use of formal methods in industrial practice. Various work has been done, aiming at the verification of different kinds of properties of smart card applications. Properties under study are for example functional correctness, confidentiality, availability and restrictions on information flow. Full paper available as [3]. Research partially supported by the EU as part of the VerifiCard project IST-2000-26328. Research done while at INRIA Sophia Antipolis, partially supported by ERCIM Fellowship No. 2002-10. See http://www.commoncriteria. com. Checking Absence of Illicit Applet Interactions THE EASST NEWSLETTER Often this work focuses on the correctness of a single applet, or of a set of applets that is known in advance. However, future generations of smart cards are expected to allow post–issuance loading of applets, where newly installed applets interact with the applets already present on the card. As a consequence, at the time the card is issued, it is not known which applets it might contain. Therefore, a compositional approach is needed, where one can state minimal requirements for the applets that can be loaded later on the card, while it is verified at loading time that the applets actually respect these requirements. Only then, existing applets can safely communicate with new applets, without corrupting the security of the card. We focus on a particular kind of properties to ensure the security of the card, namely the absence of illicit control flow between the different applets. For multi–application smart cards, certain control flow paths can be undesirable because of general platform–dependent restrictions, like the recommendation to avoid recursion due to limited resources, or due to application–specific restrictions, like undesirable information flow caused by illicit applet interactions. Program model and verification method We consider sequential applets without concurrent threads (as in Java Card) and model their sequential control flow as push–down automata, abstracting from all data–related aspects. We have developed an algorithmic compositional verification technique for control flow safety properties of applets (described in detail in [5]), specified in a temporal logic language. These properties can be either structural, interpreting formulae over the control flow graph of an applet, or behavioural, interpreting formulae over applet behaviour. Our approach is compositional in that it allows global control flow properties of the whole system to be inferred from local control flow properties of the individual applets. However, while the global properties can be behavioural or structural, we require the local properties to be structural; our technique does not allow global behavioural properties to be inferred from local behavioural ones. An important asset of our method is that the verification tasks involved can be solved algorithmically: once the local applet properties and the global illicit applet interaction are specified, all verifications can be done automatically, using push–button technology. Technically, our method is inspired by the work of Grumberg and Long [2]. It is based on the construction of maximal applets w.r. t. structural safety properties. An applet is maximal w.r. t. a property if it simulates all applets respecting this property. More concretely, suppose we want to prove that the composition of applets A and B respects a security property, formulated as behavioural safety property φ. We specify structural properties σA and σB for which we construct maximal applets θIA(σA) and θIB(σB), respectively (where IA and IB are the interfaces of the applets A and B). We show, using existing model checking techniques for push–down automata, that their composition respects the behavioural safety property φ, i.e. θIA(σA)] θIB(σB) |= φ. Since the simulation pre–order is preserved under applet composition and logical properties are preserved by simulation, from the validity of this assertion we can conclude that A ] B |= φ holds for any two applets A and B satisfying σA and σB , respectively. Later, when we get concrete implementations for A and B, it remains to verify, using existing finite-state model checking techniques, whether they respect σA and σB , respectively. Checking Absence of Illicit Applet Interactions THE EASST NEWSLETTER Applet Analyser Maximal model constructor Applet Graphs CCS process CWB Alfred PDA Model generator YES/NO YES/NO Structural specification