Secure Interaction with an Client

Transcription

1 Secure Interaction with an Client Bernhard Beckert Gerd Beuster Universität Koblenz-Landau June 15th, 2006

2 Verisoft Consortium Beckert Beuster (UKL) Secure Client June 15th, / 32

3 Verisoft Consortium Goal: Pervasively Verified Systems Beckert Beuster (UKL) Secure Client June 15th, / 32

4 Academic System Overview Client (User Interface) Signature Module Application Software Com piler Mail Server (SMTP) TCP/IP Networking / Communication Operating System Micro kernel Memory Manage ment System Software Tools Network Screen Keyboard File System Processor Host System Hardware Beckert Beuster (UKL) Secure Client June 15th, / 32

5 Our Involvement & This Talk Our Involvement Development of a Secure Client PhD thesis about secure user interfaces This talk Demo of the System Formalizing UI security feature Beckert Beuster (UKL) Secure Client June 15th, / 32

6 Verisoft System Demo Demo Beckert Beuster (UKL) Secure Client June 15th, / 32

7 Formalizing HCI Security The user should know what the system is doing. Consistency Correspondence between system state and user s opinion about system state Not guaranteed even if... the system does show the relevant information (state display conformance). the user interprets the information correctly. Asynchronous updates can lead to inconsistencies! Beckert Beuster (UKL) Secure Client June 15th, / 32

8 Formalizing HCI Security The user should know what the system is doing. Consistency Correspondence between system state and user s opinion about system state Not guaranteed even if... the system does show the relevant information (state display conformance). the user interprets the information correctly. Asynchronous updates can lead to inconsistencies! Beckert Beuster (UKL) Secure Client June 15th, / 32

9 Formalizing HCI Security The user should know what the system is doing. Consistency Correspondence between system state and user s opinion about system state Not guaranteed even if... the system does show the relevant information (state display conformance). the user interprets the information correctly. Asynchronous updates can lead to inconsistencies! Beckert Beuster (UKL) Secure Client June 15th, / 32

10 Example: Client Result of latest command: No new arrived foo edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

11 Example: Client Result of latest command: No new arrived foo edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

12 How to Guarantee Consistency? We need... a formal method to describe HCI a formal definition of consistency formal model(s) of interaction(s) Beckert Beuster (UKL) Secure Client June 15th, / 32

13 Formal Method Formal Method Describe user and application by IOLTS s σ! s σ! 1 2 s 3 σ? Σ? Σ! s 0 σ? s 4 σ! s 5 σ! s 6 Define security properties by LTL formulae. Beckert Beuster (UKL) Secure Client June 15th, / 32

14 Formal Method Formal Method Describe user and application by IOLTS s σ! s σ! 1 2 s 3 σ? Σ? Σ! s 0 σ? s 4 σ! s 5 σ! s 6 Define security properties by LTL formulae. (see also B. Beckert and G. Beuster, A Method for Formalizing, Analyzing, and Verifying Secure User Interfaces at ICFEM 2006) Beckert Beuster (UKL) Secure Client June 15th, / 32

15 Basic Model Basic Model Application User AppOut CMD Beckert Beuster (UKL) Secure Client June 15th, / 32

16 Formal definition of consistency The user knows what the system is doing. Let... critical hold in all critical states of the application a 0,..., a n represent critical properties of the application u 0,..., u n representing the user s assumptions about these properties Then consistency is defined as... G(critical ((a 0 u 0 ) (a 1 u 1 ) (a n u n ))) Beckert Beuster (UKL) Secure Client June 15th, / 32

17 Formal definition of consistency The user knows what the system is doing. Let... critical hold in all critical states of the application a 0,..., a n represent critical properties of the application u 0,..., u n representing the user s assumptions about these properties Then consistency is defined as... G(critical ((a 0 u 0 ) (a 1 u 1 ) (a n u n ))) Beckert Beuster (UKL) Secure Client June 15th, / 32

18 Formal definition of consistency The user knows what the system is doing. Let... critical hold in all critical states of the application a 0,..., a n represent critical properties of the application u 0,..., u n representing the user s assumptions about these properties Then consistency is defined as... G(critical ((a 0 u 0 ) (a 1 u 1 ) (a n u n ))) Beckert Beuster (UKL) Secure Client June 15th, / 32

19 Application Model Application Model Exit quit [out of memory] Run Mode Command Mode H Send Mode Sent send [SUCCESS] Signed sign H [SUCCESS] insert pub. key Unsigned generate key pair edit view quit viewing quit editing Edit Not Changed Changed typing move cursor Receive Mode Checked H check [SUCCESS] Not Checked edit view quit viewing editing Edit Pub. Key Not Changed Changed poll / new arrived typing move cursor Beckert Beuster (UKL) Secure Client June 15th, / 32

20 Basic Model Basic Model Application User AppOut CMD Beckert Beuster (UKL) Secure Client June 15th, / 32

21 Basic Model with Application Basic Model with Application Application User AppOut Run Mode Command Mode Send Mode H insert pub. key generate key pair Sent [SUCCESS] send Signed sign [SUCCESS] Unsigned quit Receive Mode Checked [SUCCESS] check H Not Checked poll / new arrived H edit view quit viewing quit editing edit view quit viewing editing Exit [out of memory] Edit Not Changed Changed typing move cursor Edit Pub. Key Not Changed Changed typing move cursor CMD Beckert Beuster (UKL) Secure Client June 15th, / 32

22 Basic Model with Main Loops insert pub. key generate key pair send [SUCCESS] sign [SUCCESS] check [SUCCESS] quit poll / new arrived edit view quit viewing quit editing edit view quit viewing editing typing typing [out of memory] move cursor move cursor Application Execution Cycle Get Result Exec. CMD! AppOut AppOut? Show Result CMD? AppOut! Get CMD CMD CMD AppOut Application Logic Run Mode Command Mode Send Mode H Receive Mode H Sent Signed Unsigned Checked Not Checked H Exit Edit Not Changed Changed Edit Pub. Key Not Changed Changed Act CMD? CMD! Wait AppOut? CMD Decide Classify AppOut! User Execution Cycle AppOut User Logic Beckert Beuster (UKL) Secure Client June 15th, / 32

23 Example: Client Result of latest command: No new arrived foo edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

24 Example: Client Result of latest command: No new arrived foo Problem: How does the user know if command execution is completed? edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

25 Example: Client Result of latest command: No new arrived foo Problem: How does the user know if command execution is completed? Add a status line! edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

26 Example: Client System: Waiting for input... Result of latest command: No new arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

27 Example: Client System: Waiting for input... Result of latest command: No new arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

28 Example: Client System: Waiting for input... Result of latest command: No new arrived Problem: A status line is not enough... edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

29 Example: Client System: Waiting for input... Result of latest command: No new arrived Problem: A status line is not enough... Add a status key! edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

30 Example: Client System: Waiting for input... Result of latest command: No new arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

31 Example: Client System: Waiting for input... Result of latest command: No new arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

32 Example: Client System: Ready! Result of latest command: No new arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Client June 15th, / 32

33 A Better Model Application Execution Cycle Get Result Exec. AppOut Act Decide CMD! AppOut!= Processing CMD? AppOut? CMD! AppOut! Show Result CMD? Status Busy Begin Wait ESC AppOut! User Execution Cycle AppOut!= Ready! AppOut?= Processing Status! Get CMD AppOut?= Ready! Show Status CMD End Wait Classify CMD?= Status AppOut? Processing Application Logic CMD AppOut CMD AppOut User Logic Beckert Beuster (UKL) Secure Client June 15th, / 32

34 Conclusion Summary Developed formal model of HCI describing TTY applications Defined consistency Showed that common implementations are not consistent Proposed a consistent alternative Integrated with other methods (not shown in this presentation) Beckert Beuster (UKL) Secure Client June 15th, / 32