We propose a modeling framework for generating security protocol specifications. The generated protocol specifications rely on the use of a sequential and a semantical component. The first component defines protocol properties such as preconditions, effects, message sequences and it is developed as a WSDL-S specification. The second component defines the semantic aspects corresponding to the messages included in the first component by the use of ontological constructions and it is developed as an OWL-based specification. Our approach was validated on 13 protocols from which we mention: the ISO9798 protocol, the CCITTX.509 data transfer protocol and the Kerberos symmetric key protocol.
An approach that aims at the automatic implementation of security protocols is given in @cite_11 . This approach uses a formal description as a specification which is executed by participants. The proposed specification does not make use of Web service technologies, because of which inter-operability of systems executing the given specifications becomes a real issue. In addition, because our approach uses the ontology model, it benefits of several properties specific to ontologies, such as semantic properties, extendability or reusability of ontologies developed by others.
@cite_11
2098496390 1508967933 2121697735 2615622384
We present an automatic implementation system of security protocols based in formal description techniques. A sufficiently complete and concise formal specification that has allowed us to define the state machine that corresponds to a security protocol has been designed to achieve our goals. This formal specification makes it possible to incorporate in a flexible way the security mechanisms and functions (random numbers generation, timestamps, symmetric-key encryption, public-key cryptography, etc). Our solution implies the incorporation of an additional security layer LEI (Logical Element of Implementation) in the TCP IP architecture. This additional layer be able both to interpret and to implement any security protocol from its formal specification. Our system provides an applications programming interface (API) for the development of distributed applications in the Internet like the e-commerce, bank transfers, network management or distribution information services that makes transparent to them the problem of security in the communications. Since the 1980s, two approaches have been developed for analyzing security protocols. One of the approaches relies on a computational model that considers issues of complexity and probability. This approach captures a strong notion of security, guaranteed against all probabilistic polynomial-time attacks. The other approach relies on a symbolic model of protocol executions in which cryptographic primitives are treated as black boxes. Since the seminal work of Dolev and Yao, it has been realized that this latter approach enables significantly simpler and often automated proofs. However, the guarantees that it offers have been quite unclear. In this paper, we show that it is possible to obtain the best of both worlds: fully automated proofs and strong, clear security guarantees. Specifically, for the case of protocols that use signatures and asymmetric encryption, we establish that symbolic integrity and secrecy proofs are sound with respect to the computational model. The main new challenges concern secrecy properties for which we obtain the first soundness result for the case of active adversaries. Our proofs are carried out using Casrul, a fully automated tool. Annotation with security-related metadata enables discovery of resources that meet security requirements. This paper presents the NRL Security Ontology, which complements existing ontologies in other domains that focus on annotation of functional aspects of resources. Types of security information that could be described include mechanisms, protocols, objectives, algorithms, and credentials in various levels of detail and specificity. The NRL Security Ontology is more comprehensive and better organized than existing security ontologies. It is capable of representing more types of security statements and can be applied to any electronic resource. The class hierarchy of the ontology makes it both easy to use and intuitive to extend. We applied this ontology to a Service Oriented Architecture to annotate security aspects of Web service descriptions and queries. A refined matching algorithm was developed to perform requirement-capability matchmaking that takes into account not only the ontology concepts, but also the properties of the concepts. Over the last decade, a globalization of the software industry took place, which facilitated the sharing and reuse of code across existing project boundaries. At the same time, such global reuse also introduces new challenges to the software engineering community, with not only components but also their problems and vulnerabilities being now shared. For example, vulnerabilities found in APIs no longer affect only individual projects but instead might spread across projects and even global software ecosystem borders. Tracing these vulnerabilities at a global scale becomes an inherently difficult task since many of the existing resources required for such analysis still rely on proprietary knowledge representation. In this research, we introduce an ontology-based knowledge modeling approach that can eliminate such information silos. More specifically, we focus on linking security knowledge with other software knowledge to improve traceability and trust in software products (APIs). Our approach takes advantage of the Semantic Web and its reasoning services, to trace and assess the impact of security vulnerabilities across project boundaries. We present a case study, to illustrate the applicability and flexibility of our ontological modeling approach by tracing vulnerabilities across project and resource boundaries.