摘要
当前安全协议形式化分析工具发展迅速,针对不同的安全协议、不同的安全模型挑选合适的工具进行分析,不仅可以提高分析结果的可信度和准确性,还可以大大提高协议分析的效率.为此,对当前主流的9种形式化分析工具的性能进行梳理,从使用界面、分析效率、安全模型等综合角度来看,Scyther工具有着较大的优势;为方便国内协议分析者使用和研究,剖析Scyther的底层算法,将其交互界面进行汉化,并增添了时间计算功能,对分析时间进行计算和输出;最后以网络安全协议TLS为例,利用优化后的Scyther工具分别在Delov-Yao模型和强安全模型下对其进行形式化分析.对研究工作者准确、有效地选择和使用形式化分析工具有着理论意义和实践价值.
As formal verification tools for security protocols develop rapidly,picking a suitable tool,according to the target protocols and the security models,can improve not only the reliability and accuracy of protocol analysis,but also the efficiency of it.With these considerations,we compare the properties of 9 kinds of the formal verification tools in detail and we find that the Scyther tool can be an optimal choice in terms of interface interactivity,analysis efficiency and security model validity.In an attempt to facilitate using and researching of the tool for analysts in China,we study and analyze the underlying algorithm of Scyther and translate the interface into Chinese;we also update Scyther by adding a timer that can count and output the analysis time.Finally,we use the updated Scyther to make a formal analysis of the network security protocol TLS within the Delov-Yao model and strong security model.The current study is of theoretical and practical value for it helping researchers to select and use formal analysis tools more accurately and effectively.
作者
韩旭
陆思奇
程庆丰
Han Xu;Lu Siqi;and Cheng Qingfeng(Luoyang University of Foreign Languages,Luoyang,Henan 471003;State Key Laboratory of Cryptology,Beijing 100878;School of Computer Science and Technology,Xidian University,Xi'an 710071)
出处
《信息安全研究》
2016年第3期272-279,共8页
Journal of Information Security Research
基金
密码科学技术国家重点实验室开放课题(MMKFKT2015014)
洛阳外国语学院科研基金项目(2015XYQ004)
作者简介
韩旭,硕士研究生,主要研究方向为密码学和信息安全.my_hanxu@sina.com;陆思奇,硕士,助教,主要研究方向为密码学和信息安全.080lusiqi@sina.com;通信作者:程庆丰博士,副教授,主要研究方向为密码学和信息安全,qingfengc2008@sina.com
