Secure Interaction with an Email Client Bernhard Beckert Gerd Beuster Universität Koblenz-Landau June 15th, 2006
Verisoft Consortium Beckert Beuster (UKL) Secure Email Client June 15th, 2006 2 / 32
Verisoft Consortium Goal: Pervasively Verified Systems Beckert Beuster (UKL) Secure Email Client June 15th, 2006 2 / 32
Academic System Overview Email Client (User Interface) Signature Module Application Software Com piler Mail Server (SMTP) TCP/IP Networking / Communication Operating System Micro kernel Memory Manage ment System Software Tools Network Screen Keyboard File System Processor Host System Hardware Beckert Beuster (UKL) Secure Email Client June 15th, 2006 3 / 32
Our Involvement & This Talk Our Involvement Development of a Secure Email Client PhD thesis about secure user interfaces This talk Demo of the Email System Formalizing UI security feature Beckert Beuster (UKL) Secure Email Client June 15th, 2006 4 / 32
Verisoft Email System Demo Demo Beckert Beuster (UKL) Secure Email Client June 15th, 2006 5 / 32
Formalizing HCI Security The user should know what the system is doing. Consistency Correspondence between system state and user s opinion about system state Not guaranteed even if... the system does show the relevant information (state display conformance). the user interprets the information correctly. Asynchronous updates can lead to inconsistencies! Beckert Beuster (UKL) Secure Email Client June 15th, 2006 6 / 32
Formalizing HCI Security The user should know what the system is doing. Consistency Correspondence between system state and user s opinion about system state Not guaranteed even if... the system does show the relevant information (state display conformance). the user interprets the information correctly. Asynchronous updates can lead to inconsistencies! Beckert Beuster (UKL) Secure Email Client June 15th, 2006 6 / 32
Formalizing HCI Security The user should know what the system is doing. Consistency Correspondence between system state and user s opinion about system state Not guaranteed even if... the system does show the relevant information (state display conformance). the user interprets the information correctly. Asynchronous updates can lead to inconsistencies! Beckert Beuster (UKL) Secure Email Client June 15th, 2006 6 / 32
Example: Email Client Result of latest command: No new email arrived foo edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 8 / 32
Example: Email Client Result of latest command: No new email arrived foo edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 10 / 32
How to Guarantee Consistency? We need... a formal method to describe HCI a formal definition of consistency formal model(s) of interaction(s) Beckert Beuster (UKL) Secure Email Client June 15th, 2006 11 / 32
Formal Method Formal Method Describe user and application by IOLTS s σ! s σ! 1 2 s 3 σ? Σ? Σ! s 0 σ? s 4 σ! s 5 σ! s 6 Define security properties by LTL formulae. Beckert Beuster (UKL) Secure Email Client June 15th, 2006 12 / 32
Formal Method Formal Method Describe user and application by IOLTS s σ! s σ! 1 2 s 3 σ? Σ? Σ! s 0 σ? s 4 σ! s 5 σ! s 6 Define security properties by LTL formulae. (see also B. Beckert and G. Beuster, A Method for Formalizing, Analyzing, and Verifying Secure User Interfaces at ICFEM 2006) Beckert Beuster (UKL) Secure Email Client June 15th, 2006 12 / 32
Basic Model Basic Model Application User AppOut CMD Beckert Beuster (UKL) Secure Email Client June 15th, 2006 13 / 32
Formal definition of consistency The user knows what the system is doing. Let... critical hold in all critical states of the application a 0,..., a n represent critical properties of the application u 0,..., u n representing the user s assumptions about these properties Then consistency is defined as... G(critical ((a 0 u 0 ) (a 1 u 1 ) (a n u n ))) Beckert Beuster (UKL) Secure Email Client June 15th, 2006 14 / 32
Formal definition of consistency The user knows what the system is doing. Let... critical hold in all critical states of the application a 0,..., a n represent critical properties of the application u 0,..., u n representing the user s assumptions about these properties Then consistency is defined as... G(critical ((a 0 u 0 ) (a 1 u 1 ) (a n u n ))) Beckert Beuster (UKL) Secure Email Client June 15th, 2006 14 / 32
Formal definition of consistency The user knows what the system is doing. Let... critical hold in all critical states of the application a 0,..., a n represent critical properties of the application u 0,..., u n representing the user s assumptions about these properties Then consistency is defined as... G(critical ((a 0 u 0 ) (a 1 u 1 ) (a n u n ))) Beckert Beuster (UKL) Secure Email Client June 15th, 2006 14 / 32
Application Model Application Model Exit quit [out of memory] Run Mode Command Mode H Send Mode Sent send [SUCCESS] Signed sign H [SUCCESS] insert pub. key Unsigned generate key pair edit view quit viewing quit editing Edit Email Not Changed Changed typing move cursor Receive Mode Checked H check [SUCCESS] Not Checked edit view quit viewing editing Edit Pub. Key Not Changed Changed poll / new email arrived typing move cursor Beckert Beuster (UKL) Secure Email Client June 15th, 2006 15 / 32
Basic Model Basic Model Application User AppOut CMD Beckert Beuster (UKL) Secure Email Client June 15th, 2006 16 / 32
Basic Model with Application Basic Model with Application Application User AppOut Run Mode Command Mode Send Mode H insert pub. key generate key pair Sent [SUCCESS] send Signed sign [SUCCESS] Unsigned quit Receive Mode Checked [SUCCESS] check H Not Checked poll / new email arrived H edit view quit viewing quit editing edit view quit viewing editing Exit [out of memory] Edit Email Not Changed Changed typing move cursor Edit Pub. Key Not Changed Changed typing move cursor CMD Beckert Beuster (UKL) Secure Email Client June 15th, 2006 17 / 32
Basic Model with Main Loops insert pub. key generate key pair send [SUCCESS] sign [SUCCESS] check [SUCCESS] quit poll / new email arrived edit view quit viewing quit editing edit view quit viewing editing typing typing [out of memory] move cursor move cursor Application Execution Cycle Get Result Exec. CMD! AppOut AppOut? Show Result CMD? AppOut! Get CMD CMD CMD AppOut Application Logic Run Mode Command Mode Send Mode H Receive Mode H Sent Signed Unsigned Checked Not Checked H Exit Edit Email Not Changed Changed Edit Pub. Key Not Changed Changed Act CMD? CMD! Wait AppOut? CMD Decide Classify AppOut! User Execution Cycle AppOut User Logic Beckert Beuster (UKL) Secure Email Client June 15th, 2006 18 / 32
Example: Email Client Result of latest command: No new email arrived foo edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 20 / 32
Example: Email Client Result of latest command: No new email arrived foo Problem: How does the user know if command execution is completed? edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 20 / 32
Example: Email Client Result of latest command: No new email arrived foo Problem: How does the user know if command execution is completed? Add a status line! edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 20 / 32
Example: Email Client System: Waiting for input... Result of latest command: No new email arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 22 / 32
Example: Email Client System: Waiting for input... Result of latest command: No new email arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 24 / 32
Example: Email Client System: Waiting for input... Result of latest command: No new email arrived Problem: A status line is not enough... edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 24 / 32
Example: Email Client System: Waiting for input... Result of latest command: No new email arrived Problem: A status line is not enough... Add a status key! edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 24 / 32
Example: Email Client System: Waiting for input... Result of latest command: No new email arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 26 / 32
Example: Email Client System: Waiting for input... Result of latest command: No new email arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 28 / 32
Example: Email Client System: Ready! Result of latest command: No new email arrived edit (m)ail (s)end mail (f)etch mail Beckert Beuster (UKL) Secure Email Client June 15th, 2006 30 / 32
A Better Model Application Execution Cycle Get Result Exec. AppOut Act Decide CMD! AppOut!= Processing CMD? AppOut? CMD! AppOut! Show Result CMD? Status Busy Begin Wait ESC AppOut! User Execution Cycle AppOut!= Ready! AppOut?= Processing Status! Get CMD AppOut?= Ready! Show Status CMD End Wait Classify CMD?= Status AppOut? Processing Application Logic CMD AppOut CMD AppOut User Logic Beckert Beuster (UKL) Secure Email Client June 15th, 2006 31 / 32
Conclusion Summary Developed formal model of HCI describing TTY applications Defined consistency Showed that common implementations are not consistent Proposed a consistent alternative Integrated with other methods (not shown in this presentation) Beckert Beuster (UKL) Secure Email Client June 15th, 2006 32 / 32