Automatic authentication protocol verification method based on PCL

Abstract

The invention provides a PCL-based authentication protocol automatic verification method, and belongs to the technical field of protocol automatic verification. The problems that an existing logic method does not describe time concepts, time-related protocols cannot be reasonably analyzed, semantics are insufficient, and conclusions are unreliable are solved. The authentication protocol is a protocol used for identity authentication and key negotiation between a party A and a party B. The method comprises the following steps that attackers are modeled in a formalized mode through PCL, including eavesdropping attack formalized modeling, man-in-the-middle attack formalized modeling and replay attack formalized modeling, so that the security of the authentication protocol in different attack scenes is automatically verified; automatic verification: realizing automatic verification of eavesdropping attack, automatic verification of man-in-the-middle attack and automatic verification of replay attack through the constructed eavesdropping attack formalized modeling, man-in-the-middle attack formalized modeling and replay attack formalized modeling; the method and the device are applied to authentication protocol security verification.

Description

Technical Field

[0001] The invention provides a PCL-based authentication protocol automatic verification method, belonging to the technical field of protocol automatic verification. Background Art

[0002] With the development of the information society, the importance of authentication protocols in the field of information security has become increasingly prominent. However, designing and analyzing authentication protocols has always been a huge challenge. Since the 1980s, academia and industry have proposed various analysis methods, mainly including model checking, theorem proving and logic analysis methods. Model checking methods use Petr nets, finite state machines and communication sequential processes to analyze the correctness of the system, but often encounter state explosion problems when dealing with complex protocols. Theorem proving methods verify the security properties of protocols through mathematical means. Although they provide strict security guarantees, they have high implementation costs and low automation, making it difficult to cope with changing security requirements. Logical analysis methods also play an important role in the analysis of authentication protocols. Classic BAN logic and various BAN-like logics based on BAN, such as GNY logic, AT logic, MB logic, etc., verify the various security properties in the protocol through formal logical reasoning. Although the accuracy of protocol analysis has been improved, there are limitations in verifying the authentication of security protocols. It does not have the characterization of the concept of time, cannot reasonably analyze time-related protocols, and has insufficient semantics and unreliable conclusions. To make up for these shortcomings, scholars have proposed methods based on temporal logic, such as CKT5 logic and GS logic. These methods can better handle the time-dependent properties in the protocol by introducing temporal operators.

[0003] Protocol Combination Logic (PCL) is a logic method that supports protocol combination and is widely used in the analysis of wireless network protocols. It not only supports the addition of time order, but also is similar to the construction idea of ​​sequential logic, and can solve the security proof of some time-related protocols. Moreover, PCL also supports protocol composition, allowing different parts of the protocol to be combined and interact, providing a more comprehensive and systematic analysis method. Although logical methods have made significant progress in improving the accuracy of protocol analysis, with the increasing complexity of authentication protocols, existing logical methods do not have the ability to characterize the concept of time, and cannot reasonably analyze time-related protocols. In addition, the semantics are insufficient and the conclusions are unreliable, and further refinement and improvement are still needed to adapt to the ever-changing formalization requirements. Summary of the invention

[0004] In order to overcome the deficiencies in the prior art, the present invention aims to solve the technical problem of providing an improved automatic verification method for an authentication protocol based on PCL.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: an automatic verification method of an authentication protocol based on PCL, wherein the authentication protocol is a protocol for identity authentication and key negotiation between parties A and B, and the method comprises the following steps:

[0006] S1: Attacker model construction: Use PCL to formally model attackers, including eavesdropping attack formal modeling, man-in-the-middle attack formal modeling, and replay attack formal modeling, to automatically verify the security of the authentication protocol under different attack scenarios;

[0007] The formal modeling of eavesdropping attack, man-in-the-middle attack and replay attack is used to simulate how an attacker attacks when two parties A and B establish a connection.

[0008] S2: Automated verification, through the constructed eavesdropping attack formal modeling, man-in-the-middle attack formal modeling and replay attack formal modeling, the automated verification of eavesdropping attacks, the automated verification of man-in-the-middle attacks and the automated verification of replay attacks are realized.

[0009] The eavesdropping attack formal modeling performs clue calculation on the entire action sequence in the process of establishing a connection between the two normal communicating parties A and B, thereby completing the eavesdropping on the data transmitted by the two communicating parties A and B on the channel and obtaining the behavior sequence of the eavesdropping attacker.

[0010] The man-in-the-middle attack formal modeling performs clue calculation on the entire action sequence in the process of establishing a connection between the two normal communicating parties A and B. The attacker replaces the messages sent by the communicating parties with the parameters calculated by himself to obtain the behavior sequence of the man-in-the-middle attacker.

[0011] The replay attack formal modeling performs clue calculation on the entire action sequence in the process of establishing a connection between two normal communicating parties A and B. The attacker replaces the message sent by one communicating party with the communicating party's own historical message to obtain the replay attacker's behavior sequence.

[0012] Before automated verification, the authentication protocol is modularized according to the number of messages transmitted by the communicating parties on the channel. It can be divided into Algorithm 1, Algorithm 2, ..., Algorithm n, where Algorithm 1 is used to simulate the complete eavesdropping attack process, Algorithm 2-Algorithm n-1 are used to simulate the messages transmitted by the communicating parties on the channel from the first time to the n-1th time, respectively, and Algorithm n is used to calculate the session key. The steps of Algorithm 1 to simulate the complete eavesdropping attack process are as follows:

[0013] The attacker selects possible input sequences from the existing knowledge base and gradually tries to crack the security of the protocol. The attacker first uses the initial input combination in the output sequence after the end of Algorithm 2 to execute Algorithm 1 and perform preliminary session key calculation; then, the attacker enters the second loop, and uses all the combinations in the output sequence after the end of Algorithm 3 in the second loop to execute Algorithm 2, further simulates the protocol and tries to crack more details; then, the attacker enters the third loop, and uses all the combinations in the output sequence after the end of Algorithm 4 in the third loop to execute Algorithm 3, and uses the intermediate results to perform complex calculations to try to break through the security layer of the protocol; the above loops are performed in sequence until entering the n-2th loop, which is the innermost loop, and in the n-2th loop, all the combinations in the output sequence after the end of Algorithm n-1 are used to execute Algorithm n-2, and the session key is generated through the calculation of the final stage; and in the loop of each stage, Algorithm n is executed to verify and compare the session key; if the attacker successfully calculates that the session key matches the real key, it is recorded as a successful attack.

[0014] Before conducting a man-in-the-middle attack, you need to conduct an eavesdropping attack to expand your knowledge base. The man-in-the-middle attack process is as follows:

[0015] First, the key information on the first path in the attacker's trace tree is obtained. Then, the attacker obtains the message in the network. Finally, the communicating parties obtain the required messages from the network respectively and perform the protocol parameter verification process. If the verification is successful, the field of whether the protocol is successfully executed in the result table is updated to Yes, and the session key is continued to be calculated. The attacker also calculates the attacker's session key based on his own knowledge base; otherwise, the field of whether the protocol is successfully executed in the result table is updated to No, and the communication is ended directly, and this round of man-in-the-middle attack ends; compare the session key calculated by the attacker himself with the session keys of the communicating parties. If they are equal, the field of whether the protocol attack is successful in the result table is updated to Yes, otherwise it is No.

[0016] The replay attack process is the same as the man-in-the-middle attack, except that when performing message replacement, the replay attack replaces the message of one party of the communication.

[0017] The beneficial effects of the present invention compared with the prior art are as follows:

[0018] 1. The present invention reduces the workload of manually analyzing security protocols and greatly improves the analysis efficiency;

[0019] 2. Through automated verification, potential vulnerabilities in security protocols can be detected more comprehensively, thereby enhancing the security of protocol design;

[0020] 3. The present invention reduces the possibility of human error and improves the reliability of security protocol verification;

[0021] 4. The present invention provides a systematic way to build and verify the security properties of the protocol through PCL, ensuring that the execution of each step will not undermine the security of the overall protocol;

[0022] 5. The present invention emphasizes the composability of protocol modules through PCL, allowing different parts of the protocol to be combined and interact, making it possible to perform logical analysis of large and complex protocols;

[0023] 6. Through automated verification, the present invention can complete multiple rounds of testing and verification of security protocols in a relatively short period of time, thus speeding up the R&D cycle. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The present invention will be further described below in conjunction with the accompanying drawings:

[0025] Figure 1 is a flow chart of the method of the present invention;

[0026] Figure 2 The present invention provides a flow chart of a session in the identity authentication and key negotiation phase between a smart meter and a gateway. DETAILED DESCRIPTION

[0027] like Figure 1 As shown, the present invention provides an automated verification method for an authentication protocol based on Protocol Composition Logic (PCL), wherein the authentication protocol is a protocol for identity authentication and key negotiation between parties A and B, and the method comprises the following steps:

[0028] S1: Attacker model construction: Use PCL to formally model attackers, including eavesdropping attack formal modeling, man-in-the-middle attack formal modeling, and replay attack formal modeling, to automatically verify the security of the authentication protocol under different attack scenarios;

[0029] The formal modeling of eavesdropping attack, man-in-the-middle attack and replay attack is used to simulate how an attacker attacks when two parties A and B establish a connection.

[0030] S2: Automated verification, through the constructed eavesdropping attack formal modeling, man-in-the-middle attack formal modeling and replay attack formal modeling, the automated verification of eavesdropping attacks, the automated verification of man-in-the-middle attacks and the automated verification of replay attacks are realized.

[0031] The eavesdropping attack formal modeling performs clue calculation on the entire action sequence in the process of establishing a connection between the two normal communicating parties A and B, thereby completing the eavesdropping on the data transmitted by the two communicating parties A and B on the channel and obtaining the behavior sequence of the eavesdropping attacker.

[0032] The man-in-the-middle attack formal modeling performs clue calculation on the entire action sequence in the process of establishing a connection between the two normal communicating parties A and B. The attacker replaces the messages sent by the communicating parties with the parameters calculated by himself to obtain the behavior sequence of the man-in-the-middle attacker.

[0033] The replay attack formal modeling performs clue calculation on the entire action sequence in the process of establishing a connection between two normal communicating parties A and B. The attacker replaces the message sent by one communicating party with the communicating party's own historical message to obtain the replay attacker's behavior sequence.

[0034] Before automated verification, the authentication protocol is modularized according to the number of messages transmitted by the communicating parties on the channel. It can be divided into Algorithm 1, Algorithm 2, ..., Algorithm n, where Algorithm 1 is used to simulate the complete eavesdropping attack process, Algorithm 2-Algorithm n-1 are used to simulate the messages transmitted by the communicating parties on the channel from the first time to the n-1th time, respectively, and Algorithm n is used to calculate the session key. The steps of Algorithm 1 to simulate the complete eavesdropping attack process are as follows:

[0035] The attacker selects possible input sequences from the existing knowledge base and gradually tries to crack the security of the protocol. The attacker first uses the initial input combination in the output sequence after the end of Algorithm 2 to execute Algorithm 1 and perform preliminary session key calculation; then, the attacker enters the second loop, and uses all the combinations in the output sequence after the end of Algorithm 3 in the second loop to execute Algorithm 2, further simulates the protocol and tries to crack more details; then, the attacker enters the third loop, and uses all the combinations in the output sequence after the end of Algorithm 4 in the third loop to execute Algorithm 3, and uses the intermediate results to perform complex calculations to try to break through the security layer of the protocol; the above loops are performed in sequence until entering the n-2th loop, which is the innermost loop, and in the n-2th loop, all the combinations in the output sequence after the end of Algorithm n-1 are used to execute Algorithm n-2, and the session key is generated through the calculation of the final stage; and in the loop of each stage, Algorithm n is executed to verify and compare the session key; if the attacker successfully calculates that the session key matches the real key, it is recorded as a successful attack.

[0036] Before conducting a man-in-the-middle attack, you need to conduct an eavesdropping attack to expand your knowledge base. The man-in-the-middle attack process is as follows:

[0037] First, the key information on the first path in the attacker's trace tree is obtained. Then, the attacker obtains the message in the network. Finally, the communicating parties obtain the required messages from the network respectively and perform the protocol parameter verification process. If the verification is successful, the field of whether the protocol is successfully executed in the result table is updated to Yes, and the session key is continued to be calculated. The attacker also calculates the attacker's session key based on his own knowledge base; otherwise, the field of whether the protocol is successfully executed in the result table is updated to No, and the communication is ended directly, and this round of man-in-the-middle attack ends; compare the session key calculated by the attacker himself with the session keys of the communicating parties. If they are equal, the field of whether the protocol attack is successful in the result table is updated to Yes, otherwise it is No.

[0038] The replay attack process is the same as the man-in-the-middle attack, except that when performing message replacement, the replay attack replaces the message of one party of the communication.

[0039] The following is based on the specific Figure 2 The authentication and key negotiation process between the smart meter and the gateway is formally modeled and automatically verified.

[0040] The functions of the PCL logical framework are as follows: PCL provides a systematic approach specifically for the security analysis and verification of cryptographic protocols. It expresses protocol operations and properties and describes logical relationships by using actions, predicates, and modal formulas. The "Cords" calculus is used to accurately model the operational logic of the protocol, including parallel and sequential combinations. It emphasizes the composability of protocol modules, allowing different parts of the protocol to be combined and interact. The introduction of temporal expressions allows the order of actions in the protocol to be accurately described and analyzed, which helps to solve the security proof of time-related protocols. Using string space as the basis for proof, it focuses on the actual execution path of the protocol, thereby improving the accuracy and reliability of formal analysis.

[0041] PCL terminology and basic syntax are shown in Table 1 below:

[0042]

[0043] Table 1.

[0044] The implementation steps of the automatic verification method of the present invention are as follows:

[0045] S1: Attacker model construction: Formal modeling of attackers through PCL, including formal modeling of eavesdropping attacks, formal modeling of man-in-the-middle attacks, and formal modeling of replay attacks, to automatically verify such as Figure 2 The security of the authentication protocol shown under different attack scenarios.

[0046] According to the following Figure 2The process of identity authentication and key negotiation between the smart meter (A) and the NAN gateway (B) given in the embodiment is used to illustrate the clue calculation process of the specific implementation of the formal modeling of eavesdropping attack, the formal modeling of man-in-the-middle attack and the formal modeling of replay attack. Figure 2 Meaning of parameters during communication between smart meter (A) and NAN gateway (B).

[0047]

[0048] Table 2.

[0049] The formal modeling of eavesdropping attacks simulates how the attacker attacks during the process of establishing a connection between two parties A / B in a normal communication protocol, that is, the attack process. The clue calculation process of the formal modeling of eavesdropping attacks is as follows:

[0050]

[0051] In the above clue calculation, E represents the eavesdropping attacker. The difference between adding a sharp sign and not adding one is that the former represents the message or parameter manipulated or tampered by the attacker, while the latter represents the attacker's own operation behavior. They represent the message participants A, B and E, respectively, intercepted by the eavesdropper. Msg1 represents the first message sent by A to B, including RID A , T A and u A , match is the clue language in PCL, which can be understood as the meaning of the equal sign, u A Represents the random number generated by A, used to calculate and verify the key, r E represents the random number generated by the eavesdropping attacker E, T E It represents the timestamp generated by the eavesdropping attacker E, which is used to record the time when the message was sent. E represents the private key of the eavesdropping attacker E, ID E represents the identifier of the eavesdropping attacker E, P E represents the public key of the eavesdropping attacker E, h represents a security parameter in elliptic curve cryptography, and t E represents the temporary key or intermediate value calculated by the eavesdropping attacker E, Z E It represents the hash value generated by the eavesdropping attacker E, which participates in verification and key generation. Msg2 represents the message sent by B to A. klen represents the key length parameter. Msg3 represents the message sent by A to B for the second time.

[0052] The formal modeling of man-in-the-middle attack simulates how the attacker attacks during the process of establishing a connection between two parties A / B in the normal communication protocol, that is, the attack process. The clue calculation process of the formal modeling of man-in-the-middle attack is as follows:

[0053]

[0054] In the above clue calculation, M represents the middleman attacker, Msg1 represents the first message sent by A to B, including RID A , T A and u A , It represents a new random number forged by the middleman attacker M to deceive the legitimate communication party. Indicates the timestamp of A in a new session, which is used to mark the time when the message is sent. Indicates that in a new communication session, the random value generated by A is used for key calculation, r M represents the random number generated by the middleman attacker, T M represents the timestamp generated by the middleman attacker M, used to pretend to be a legitimate participant to deceive the other party, d M Represents the private key of the middleman attacker M, who is involved in calculating intermediate values ​​and forging keys, ID M represents the identifier of the man-in-the-middle attacker M, It indicates the message that has been tampered or forged by the middleman attacker. Msg2 indicates the message that B sends to A. Indicates the timestamp of B in the new session. It represents a new random number forged by the middleman attacker M. Represents the hash value in the new session, P M represents the public key of the middleman attacker M, h represents, t M represents the temporary key or intermediate value calculated by the middleman attacker M, Z M represents the hash value generated by the middleman attacker M, It indicates the message that has been tampered or forged by the middleman attacker. Msg3 indicates the message that A sends to B for the second time. Represents the hash value generated in the new session. Represents a message that has been tampered with or forged by a man-in-the-middle attacker.

[0055] Clue calculus for replay attack modeling:

[0056] Since the behavior sequence of a replay attack is similar to that of a man-in-the-middle attack, except that in a man-in-the-middle attack, the attacker replaces the message sent by the communicating party with parameters calculated by himself, while in a replay attack, the attacker replaces the message with the communicating party's own historical messages, the behavior sequence of a replay attacker is similar to that of a man-in-the-middle attacker, and will not be repeated here.

[0057] S2: Automated verification, including automated verification of eavesdropping attacks, automated verification of man-in-the-middle attacks, and automated verification of replay attacks. The specific implementation process is as follows.

[0058] S2.1: Automated Verification of Eavesdropping Attacks

[0059] Since the attacker is not capable enough to modify the messages transmitted by the protocol during an eavesdropping attack, the protocol will run successfully. The following automated verification of eavesdropping attacks is based on the fact that the protocol has run successfully and relevant historical parameters have been recorded.

[0060] As shown below, the protocol is divided into four modules using the composability of PCL modules, represented by algorithms 1, 2, 3, and 4 respectively, and the input and output of the algorithms are used to simulate the operation of the protocol. Some parameters are explained as follows:

[0061] al1 sequence : Output sequence after Algorithm 2 ends;

[0062] al2 sequence : Output sequence after the end of Algorithm 3;

[0063] al3 sequence : Output sequence after the end of Algorithm 4;

[0064] al4 sequence : The output sequence after Algorithm 5 ends.

[0065] Algorithm 1 is the complete eavesdropping attack simulation process.

[0066] The execution process of Algorithm 1 is as follows:

[0067] Input: Attacker knowledge base base )

[0068] Output: Attack results and session key calculated by the attacker

[0069]

[0070] Algorithm 1 simulates the process of eavesdropping attack, in which the attacker selects possible input sequences from the existing knowledge base and gradually tries to decipher the security of the protocol. The attacker first uses al1 sequence The initial input combination in executes Algorithm 1 and performs preliminary session key calculation. Then, enter al2 sequence In the second loop, we execute Algorithm 2 to further simulate the protocol and try to crack more details. Then, in al3 sequenceIn the third loop, Algorithm 3 is executed, and the intermediate results are used to perform complex calculations in an attempt to break through the security layer of the protocol. sequence In the innermost loop of , Algorithm 4 is executed to generate the session key through the calculation in the final stage. In the loop of each stage, Algorithm 6 is executed to verify and compare the session key. If the attacker successfully calculates that the session key matches the real key, it is recorded as a successful attack.

[0071] The execution process of Algorithm 2 is as follows:

[0072]

[0073] The input of Algorithm 2 is Z B , r A , d A , ID E , RID A (Some parameters are present in both input and output because there are two situations. The first situation is the parameter calculated by oneself, and the second situation is the parameter obtained through eavesdropping, so the parameter is also added in the input place). Since the attacker cannot obtain Z B , r A , d A , ID A , can only get RID A , T A ,u A (It can be obtained through eavesdropping attacks. These parameters are the first message sent by A to B, such as Figure 2 As shown in the figure, the message sent on the channel is the content that may be eavesdropped), so the parameter that the attacker needs to enter at this time is Z E , r E , d E (Parameters simulated by the attacker), since the user ID cannot be known A , so you need to enter your ID E , but the attacker currently has the knowledge RID obtained through eavesdropping A , so the attacker has two input sequences, the first one is Z E , r E , d E Series, the second one is ID A , RID A Series, due to the fixed writing setting in Algorithm 1 (i.e., calculating the relevant parameters according to the input order of the parameters), we need to calculate all the different input sequences of the attacker, that is, Different input sequences are used for input, and 12 different output sequences are obtained. This is the entire automated verification process of Algorithm 2. At this point, the attacker tries to directly calculate the session key and compare it with the session keys of the communicating parties, and updates the result to the database table.

[0074] The execution process of Algorithm 3 is as follows:

[0075]

[0076] Before executing Algorithm 3, the attacker has already learned the relevant knowledge, so the execution of Algorithm 3 is based on Algorithm 2. There are two inputs to Algorithm 3. The first is that the attacker uses his own r E , d E To calculate R A , R B The second is based on the wiretapped R A , R B For subsequent calculations, both cases should be considered. Let's first discuss the first case, where the attacker needs to input the parameter RID A ,u A , R A , R B , Z E , r E , d E , where RID A ,u A The parameter in Msg1, RID ANEW ,u ANEW The result of running Algorithm 2 for the attacker. Next, we start to calculate the attacker's input sequence and find RID A , RID ANEW The arrangement is u A ,u ANEW The arrangement is Z E , r E , d E The arrangement is The total input sequence is 2*2*6=24; let’s discuss the second case, Z E , r E , d E The arrangement is RID A , RID ANEW The arrangement is R A , R B The arrangement is The total number of input sequences is 2*2*6=24. Combining cases one and two, there are 48 permutations in total. Using these input sequences as input, 48 different output sequences are obtained, which is the entire automated verification process of Algorithm 3. At this point, the attacker tries to calculate the session key and compare it with the session keys of the communicating parties, and updates the result to the database table.

[0077] The execution process of Algorithm 4 is as follows:

[0078]

[0079] Before executing Algorithm 4, the attacker has already learned the relevant knowledge, so the execution of Algorithm 4 is based on Algorithms 2 and 3. The parameter that the attacker needs to input is R A , R B , R ANEW2 , R BNEW2 , Z E , r E , d E , S B , where R A , R B is the parameter in Msg2, R ANEW2 , R BNEW2 is the result of the attacker running Algorithm 3. Next, we start to calculate the attacker’s input sequence, R A , R ANEW2 The arrangement is R B , R BNEW2 The arrangement is Z E , r E , d E The arrangement is The total number of input sequences is 2*2*6=24. Using these input sequences as input, 24 different output sequences are obtained, which is the entire automated verification process of Algorithm 4. At this point, the attacker tries to directly calculate the session key and compare it with the session keys of the communicating parties, and then updates the result to the database table.

[0080] The execution process of Algorithm 5 is as follows:

[0081]

[0082] Before executing Algorithm 5, the attacker has already learned relevant knowledge, so the execution of Algorithm 5 is based on Algorithms 2, 3, and 4. The parameter that the attacker needs to input is R A , R B , R ANEW2 , R BNEW2 , Z E , rE , d E , S B , where R A , R B is the parameter in Msg2, R ANEW2 , R BNEW2 The result of the attacker running Algorithm 4. Since the attack sequence of Algorithm 5 is the same as that of Algorithm 4, the specific calculation process will not be repeated, so the total input sequence is 2*2*6=24. Using these input sequences for input, 24 different output sequences are obtained, which is the entire automated verification process of Algorithm 5. At this time, the attacker tries to directly calculate the session key and compare it with the session keys of the communicating parties, and updates the result to the database table.

[0083] The session key is calculated using Algorithm 6.

[0084] The execution process of Algorithm 6 is as follows:

[0085]

[0086] S2.2: Automated verification of man-in-the-middle attacks

[0087] In a man-in-the-middle attack, the attacker can modify the messages sent by the communicating parties and forward them to the communicating parties. In each round of man-in-the-middle attack, this embodiment assumes that the parameters inside the communicating parties are not updated, that is, in each round of communication, both communicating parties use the historical version parameters. Algorithm 7 simulates the entire man-in-the-middle attack process. It should be noted that the man-in-the-middle attack requires the attacker to first perform an eavesdropping attack to expand his own knowledge base.

[0088] Algorithm 7: Man-in-the-middle attack simulation

[0089]

[0090] After the eavesdropping attack is completed, 346,188 pieces of data have been stored in the attacker's knowledge base (Algorithms 2-5 have 12, 48, 24, and 24 possible input sequences respectively. Combined with these four attack paths, all cases are 12+12*48+12*48*24+12*48*24*24=346,188: these combinations represent all possible strategies that the attacker may take in the process of trying to calculate the session key), and then execute Algorithm 7. First, obtain the key information on the first path in the attacker's trace tree (a complete path in the trace tree constructed in the attacker's knowledge base, which represents a possible behavior sequence of the attacker during the protocol operation. Specifically, this path includes all the steps and decisions performed by the attacker during the eavesdropping attack.) Secondly, the attacker obtains the message in the network: Since the attacker replaces parameters randomly, in order to traverse all situations, this embodiment applies the calculation method for the number of "full traces" in CSP. The parameters of all messages in the above network are regarded as a set, and its subsets are calculated. In this way, the elements in each subset correspond to the parameters replaced by the attacker. The number of parameters in a communication network is 8, so the number of its subsets, including true subsets and empty sets, is 2 in total. 8 = 256, the attacker replaces the message in the network according to the corresponding parameters. Finally, the two communicating parties obtain the required messages from the network respectively and perform the protocol parameter verification process. If the verification is successful, the field of whether the protocol is successfully executed in the result table is updated to Yes, and the session key is continued to be calculated. The attacker also calculates the attacker's session key based on his own knowledge base; otherwise, the field of whether the protocol is successfully executed in the result table is updated to No, and the communication is ended directly. This round of man-in-the-middle attack ends. Compare the session key calculated by the attacker himself with the session keys of the two communicating parties. If they are equal, the field of whether the protocol attack is successful in the result table is updated to Yes, otherwise it is No. Next, the number of man-in-the-middle attacks is calculated. For a message in the attacker's knowledge base, there are 256 different replacement sequences, so there are 256*346188=88624128 attacks in total.

[0091] S2.3: Automated Verification of Replay Attacks

[0092] Through the above analysis, we know that the implementation of the replay attack algorithm is the same as the man-in-the-middle attack, except that when replacing the message, the replay attack replaces the message of one party of the communication, that is, msgRID. So the number of subsets is 2. 4 = 16, and the rest of the steps are the same as the man-in-the-middle attack. Algorithm 8 simulates the process of replay attack.

[0093] Algorithm 8: Replay attack simulation

[0094]

[0095] The method of the present invention can also be applied to the automated verification of all security authentication protocols. This embodiment only provides specific simulated attacks such as Figure 2 The identity authentication and key negotiation process is carried out, and the protocol is divided into four modules for simulated attacks. For different security authentication protocols, multiple granularities can be divided to make the protocol resistant to attacks. The most detailed one can also set a row as one granularity. This embodiment does not limit how to divide the protocol during the simulated attack process.

[0096] The present invention achieves the following advantages in attack simulation by combining the PCL tool:

[0097] 1. PCL introduces timing operators, so that the time sequence of each action in the protocol can be accurately described and analyzed;

[0098] 2. PCL allows different parts of the protocol to be combined and interacted, thus enabling systematic analysis of complex protocols;

[0099] 3. PCL enhances the semantic expression ability of formal analysis and improves the reliability of analysis conclusions through a stronger logical foundation and precise processing of time sequence.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A PCL-based authentication protocol automated verification method, Features: The authentication protocol is a protocol used for identity authentication and key negotiation between parties A and B. The method comprises the following steps: S1: Attacker model construction: Use PCL to formally model attackers, including eavesdropping attack formal modeling, man-in-the-middle attack formal modeling, and replay attack formal modeling, to automatically verify the security of the authentication protocol under different attack scenarios; The formal modeling of eavesdropping attack, man-in-the-middle attack and replay attack is used to simulate how an attacker attacks when two parties A and B establish a connection. S2: Automated verification, through the constructed eavesdropping attack formal modeling, man-in-the-middle attack formal modeling and replay attack formal modeling, the automated verification of eavesdropping attacks, the automated verification of man-in-the-middle attacks and the automated verification of replay attacks are realized.

2. According to the PCL-based authentication protocol automatic verification method described in claim 1, Features: The eavesdropping attack formal modeling performs clue calculation on the entire action sequence in the process of establishing a connection between the two normal communicating parties A and B, thereby completing the eavesdropping on the data transmitted by the two communicating parties A and B on the channel and obtaining the behavior sequence of the eavesdropping attacker.

3. According to the PCL-based authentication protocol automated verification method of claim 1, Features: The man-in-the-middle attack formal modeling performs clue calculation on the entire action sequence in the process of establishing a connection between the two normal communicating parties A and B. The attacker replaces the messages sent by the communicating parties with the parameters calculated by himself to obtain the behavior sequence of the man-in-the-middle attacker.

4. According to claim 1, a PCL-based authentication protocol automated verification method, Features: The replay attack formal modeling performs clue calculation on the entire action sequence in the process of establishing a connection between two normal communicating parties A and B. The attacker replaces the message sent by one communicating party with the communicating party's own historical message to obtain the replay attacker's behavior sequence.

5. According to the PCL-based authentication protocol automated verification method of claim 1, Features: Before automated verification, the authentication protocol is modularized according to the number of messages transmitted by the communicating parties on the channel. It can be divided into Algorithm 1, Algorithm 2, ..., Algorithm n, where Algorithm 1 is used to simulate the complete eavesdropping attack process, Algorithm 2-Algorithm n-1 are used to simulate the messages transmitted by the communicating parties on the channel from the first time to the n-1th time, respectively, and Algorithm n is used to calculate the session key. The steps of Algorithm 1 to simulate the complete eavesdropping attack process are as follows: The attacker selects possible input sequences from the existing knowledge base and gradually tries to crack the security of the protocol. The attacker first uses the initial input combination in the output sequence after the end of Algorithm 2 to execute Algorithm 1 and perform preliminary session key calculations; then, the attacker enters the second loop, and uses all the combinations in the output sequence after the end of Algorithm 3 in the second loop to execute Algorithm 2, further simulates the protocol and tries to crack more details; then, the attacker enters the third loop, and uses all the combinations in the output sequence after the end of Algorithm 4 in the third loop to execute Algorithm 3, and uses the intermediate results to perform complex calculations to try to break through the security layer of the protocol; the above loops are performed in sequence until entering the n-2 loop, which is the innermost loop, and in the n-2 loop, all the combinations in the output sequence after the end of Algorithm n-1 are used to execute Algorithm n-2, and the session key is generated through the calculation of the final stage; and in the loop of each stage, Algorithm n is executed to verify and compare the session key; If the attacker successfully calculates the session key and it matches the real key, the attack is recorded as successful.

6. According to claim 5, a PCL-based authentication protocol automated verification method, Features: Before conducting a man-in-the-middle attack, you need to conduct an eavesdropping attack to expand your knowledge base. The man-in-the-middle attack process is as follows: First, the attacker obtains the key information on the first path in the trace tree. Then, the attacker obtains the message in the network. Finally, the two communicating parties obtain the required messages from the network respectively and perform the protocol parameter verification process. If the verification is successful, the field of whether the protocol is successfully executed in the result table is updated to Yes, and the session key is continued to be calculated. The attacker also calculates the attacker's session key based on his own knowledge base; otherwise, the field of whether the protocol is successfully executed in the result table is updated to No, and the communication is terminated directly. This round of man-in-the-middle attack ends. Compare the session key calculated by the attacker with the session keys of the communicating parties. If they are equal, the field indicating whether the protocol attack is successful in the update result table is set to Yes, otherwise it is set to No.

7. According to claim 6, a PCL-based authentication protocol automated verification method, Features: The replay attack process is the same as the man-in-the-middle attack, except that when performing message replacement, the replay attack replaces the message of one party of the communication.

Images