Recursive protocol security verification method, device and equipment based on constraint solving
Through the method based on constraint solution, new messages in the recursive protocol and a constraint system are symbolized, the problem of security verification of recursive protocols is solved, and effective security verification of recursive protocols is achieved.
Patent Information
- Application Number
- CN202411796181.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-09
- Publication Date
- 2025-03-11
- Estimated Expiration
- 2044-12-09
AI Technical Summary
It is difficult for the prior art to effectively verify the security of a recursive protocol that includes recursive operations, especially when multiple entities perform recursive operations on the same message, message leakage is prone to occur.
The method based on constraint solution is adopted, by obtaining known information from the recursive protocol, establishing enemy derivation rules, symbolizing new messages, building a constraint system, and using simplified rules to simplify the constraint system, solving first-order formulas to verify security attributes.
The security verification of the recursive protocol is realized, which can effectively detect whether the opponent can destroy security attributes and ensure the confidentiality of the protocol and the satisfaction of other security attributes.
Smart Images
Figure CN119276762B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of information network security technology, and in particular to a method, device and equipment for recursive protocol security verification based on constraint solving. Background Art
[0002] With the development of information technology, more and more infrastructures transmit business information through the network. In order to ensure the security of network communications, a large number of security protocols are designed for use in network communications to ensure the confidentiality of transmitted information, the reliability of identity authentication, and the non-repudiation of electronic payments. Researchers have also proposed many methods to verify whether the security protocol can achieve the security claimed at the time of design. At present, the most systematic and comprehensive technology is the protocol formal analysis technology. Protocol formal analysis is a technology that uses mathematical methods to describe, reason and analyze whether the security protocol meets its declared security. Assisted by computer automatic reasoning and verification technology, it can automatically or assist in proving the security of the security protocol or discover its existing security risks.
[0003] Among many security protocols, there is a class of recursive protocols that contain recursive operations, such as secure routing protocols and group protocols. In secure routing protocols, nodes need to verify the validity of received routing messages by checking the signature of the other party of their routing. In group protocols, servers usually need to process requests containing contributions from different nodes, which are then used to generate group shared keys. The security risk of this type of security protocol is that multiple entities perform recursive operations on the same message, and a large number of fresh messages appear during the execution of the protocol, causing message leakage in the input and output of the protocol.
[0004] Recursive operations generally involve complex calculations, and it is difficult to construct recursive primitives (cryptographic primitives that include recursive operators), so there are few security verification methods for recursive protocols. Existing formal analysis methods for protocols are only for security verification of recursive protocols in special cases (equivalence tests and key construction are prohibited or labels must be added to mapping tables), and there is no general security verification method. Summary of the invention
[0005] Based on this, it is necessary to provide a constraint-solving-based recursive protocol security verification method, device and equipment that can implement security verification for the recursive protocol in order to address the above technical problems.
[0006] A recursive protocol security verification method based on constraint solving, the method comprising:
[0007] Obtain known information of the recursive protocol; establish adversary derivation rules, deduce known messages according to adversary derivation rules, and obtain new messages;
[0008] The new message constructed by the adversary at a certain stage of the recursive protocol execution is symbolized as a variable, and the infinite number of possible execution traces of the security protocol are abstracted into a set of derivation constraints. The adversary constructs a constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol.
[0009] The constraint system is simplified according to the preset simplification rules to obtain a simple constraint system; the security attribute to be verified is modeled as a first-order formula, and security verification is achieved by determining whether the adversary can destroy the security attribute by solving whether the simple constraint system and the first-order formula have a common solution.
[0010] A recursive protocol security verification device based on constraint solving, the device comprising:
[0011] The adversary derivation module is used to obtain known information of the recursive protocol; establish adversary derivation rules, and derive known messages according to the adversary derivation rules to obtain new messages;
[0012] The constraint system construction module is used to symbolize the new message constructed by the adversary at a certain stage of the recursive protocol execution into variables, abstract the infinite number of possible execution traces of the security protocol into a set of derivation constraints, and the adversary constructs the constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol;
[0013] The security verification module is used to simplify the constraint system according to pre-set simplification rules to obtain a simple constraint system; the security attribute to be verified is modeled as a first-order formula, and security verification is achieved by determining whether the adversary can destroy the security attribute by solving whether the simple constraint system and the first-order formula have a common solution.
[0014] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:
[0015] Obtain known information of the recursive protocol; establish adversary derivation rules, deduce known messages according to adversary derivation rules, and obtain new messages;
[0016] The new message constructed by the adversary at a certain stage of the recursive protocol execution is symbolized as a variable, and the infinite number of possible execution traces of the security protocol are abstracted into a set of derivation constraints. The adversary constructs a constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol.
[0017] The constraint system is simplified according to the preset simplification rules to obtain a simple constraint system; the security attribute to be verified is modeled as a first-order formula, and security verification is achieved by determining whether the adversary can destroy the security attribute by solving whether the simple constraint system and the first-order formula have a common solution.
[0018] The above-mentioned constraint-solving-based recursive protocol security verification method, device and equipment, the present application, when formally analyzing the recursive protocol containing recursive operations, abstracts the protocol execution trace into a recursive language constraint system, constructs simplified rules to simplify the constraint system, solves the simple constraint system, and uses a combination strategy to generate sufficient solutions to the constraint system to achieve security verification of the recursive protocol. The present application also has a complete representation of the adversary's knowledge, and can verify the general security of protocols with recursive primitives, such as confidentiality, and is also effective when processing other security attributes such as checking routing feasibility and authentication. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] Figure 1 A schematic diagram of a flow chart of a recursive protocol security verification method based on constraint solving in one embodiment;
[0020] Figure 2 It is a structural block diagram of a recursive protocol security verification device based on constraint solving in one embodiment;
[0021] Figure 3 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION
[0022] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0023] In one embodiment, Figure 1 As shown, a recursive protocol security verification method based on constraint solving is provided, comprising the following steps:
[0024] Step 102, obtain known information of the recursive protocol; establish an adversary derivation rule, and derive the known message according to the adversary derivation rule to obtain a new message.
[0025] The execution of the recursive protocol depends on the repeated transmission and operation of messages. First, all known information of the recursive protocol must be collected. This information includes the initial message, the signature and key of each node, etc. For example, the protocol message is represented by term algebra:
[0026] ;
[0027] in, , , They represent symmetric encryption function, asymmetric encryption function and hash function respectively. Indicates signature, Indicates pairing, represents the chain constructor, Represents an empty chain, and Respectively represent nodes The public and private keys of and Respectively represent nodes A The signing key and verification key of the .
[0028] By obtaining this known information, the source of messages in the protocol that can be used or deduced by the adversary is clarified. One of the complexities of recursive protocols lies in the continuous generation and transmission of messages, so accurately obtaining the known information in the protocol execution is the basis for building the entire security verification. By clarifying the known messages, the subsequent steps can simulate how the adversary deduces new messages.
[0029] The adversary's capabilities are analyzed using protocol formalization, and the adversary's derivation rules are as follows:
[0030] ① ;
[0031] ② ;
[0032] ③ ;
[0033] ④ ;
[0034] ⑤ ;
[0035] ⑥ ;
[0036] in, Representing Item Sets Derivable Items ; Indicates item pair, Indicates and Symmetric key pair encryption, Indicates The private key pair Asymmetric encryption, express The above derivation rules represent the adversary's ability to derive new messages from known messages. ① is an axiom, ②, ③, ⑤ are composition rules, and ④, ⑥ are decomposition rules. The composition rules describe that the adversary can synthesize messages by pairing, encryption, and signing messages after obtaining the key. The decomposition rules describe that the adversary can deduce or decompose messages when they have the decryption key. For signatures, since the adversary can verify whether a signature matches a message but cannot generate a new message, the adversary's derivation rules do not need to establish signature rules.
[0037] In protocol security analysis, the adversary can observe, intercept, modify, and generate messages, so the adversary's behavior needs to be described through derivation rules. These derivation rules include rules based on cryptographic operations (such as decryption, combining messages, using public key encryption, etc.), which can simulate the adversary's possible actions in protocol interactions. The security risk of recursive protocols lies in the recursive operations of multiple entities on messages. By constructing adversary derivation rules, it is possible to systematically analyze whether the adversary can derive sensitive information through a series of operations. This step ensures that the new messages generated in the recursive operation can be mathematically represented, which is convenient for subsequent symbolization and analysis.
[0038] Step 104, symbolize the new message constructed by the adversary at a certain stage of the recursive protocol execution into a variable, abstract the infinite number of possible execution traces of the security protocol into a set of derivation constraints, and construct the constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol.
[0039] The constraint system symbolizes the messages that the adversary may construct at a certain stage of the protocol execution into variables, abstracts the infinite number of possible execution traces of the security protocol into a set of derivation constraints, and the adversary constructs the constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol. The resulting constraint system can be regarded as the protocol trace that the adversary can construct in the protocol. The constraint system is represented by binary pairs. express, is the empty set ⊥ or the union of a finite number of derivation constraints , , .in, To constrain the antecedent, To constrain the subsequent condition, is a non-empty set of names. The constraint antecedent and constraint consequent satisfy the following two conditions:
[0040] • ;
[0041] •if , then there exists Make , .
[0042] in, express variables, express The second condition indicates that the new variable is introduced as a constraint consequence. Usually, the constraint antecedent represents the message sent in the network, and the constraint consequence represents the message that the participant wants to receive. In order to enhance the adversary's ability, it is assumed that the adversary knows all the name sets The existing constraint system does not consider recursive operations, so the language constraint system with recursive form is extended. Definition For a recursive language, the associated constraint system of The language constraint system is expressed as , ,in Indicates item of Language expansion.
[0043] During the execution of the protocol, the adversary will gradually derive new messages. In order to deal with this complex derivation process, the new messages constructed by the adversary are symbolized as variables, and the execution process of the entire protocol is abstracted into a set of derivation constraints. These constraints reflect the causal relationship of message transmission in the protocol and the information that the adversary may obtain at each stage. The infinite number of possible execution paths in the recursive protocol makes it almost impossible to directly analyze all situations. By symbolizing the messages and abstracting the recursive process into derivation constraints, the recursive operation can be converted into a set of finite mathematical conditions, thereby simplifying the analysis. This can effectively handle the complex situation of constantly generating new messages in the recursive protocol. By collecting the adversary's initial knowledge and the derivation constraints in the interaction with the protocol, a constraint system is constructed, which reflects the execution logic of the protocol and the possible behavior of the adversary. Since the messages and operations generated in the recursive protocol make the system complicated, it is necessary to introduce simplification rules to simplify the constraint system and simplify the complex derivation relationship into a form that is easy to handle. The large number of new messages and complex operations in the recursive protocol can easily lead to state space explosion, and direct analysis will be too complicated. Simplifying rules can reduce redundant deductions and simplify the system to its core structure, making the analysis more operational and reducing the computational complexity caused by recursion.
[0044] Step 106, simplify the constraint system according to the preset simplification rules to obtain a simple constraint system; model the security attribute to be verified as a first-order formula, and determine whether the adversary can destroy the security attribute to achieve security verification by solving whether the simple constraint system and the first-order formula have a common solution.
[0045] Simplify the complex constraint system into a simple constraint system. The simplified simple constraint system not only maintains all possible solutions of the original constraint system, but also the simple constraint system always has a solution. u 1, u The maximum normalization operator of 2 is , the simplification rules include the first simplification rule , the second simplified rule , the third simplified rule , the fourth simplified rule The four rules are:
[0046] ;
[0047] The rule indicates that the logical consequences of smaller constraints can be removed as redundant constraints, that is, when Available from When derived, the constraint system can be Simplified to .
[0048] The rule means that the permutation can be substituted into the constraint system, that is, the permutation Substitute the constraint system The constraint antecedent Constrained Consequence ， Restraint system Simplified to .
[0049] The rule indicates that when the constraint antecedent and the constraint consequent have no common variables, the constraint system can be simplified to an empty constraint system, that is, when the constraint antecedent and When there are no common variables, the constraint system Can be simplified to an empty constraint system .
[0050] The rule indicates that when the constraint consequence yes function, the constraint system can be simplified to the combination of two simple constraints, that is, when When the constraint system It can be simplified into two simple constraints: The combination of.
[0051] Defining policies , including early use 、 、 Rules, will Applied to the remaining constraints, the above simplification rules satisfy correctness, completeness, and halting. Based on the above simplification rules, the recursive protocol can be simplified into a simple constraint system.
[0052] The security properties in the protocol (such as confidentiality, authentication, etc.) can be expressed by first-order logic formulas. By checking whether the simplified constraint system has a common solution with the first-order logic formula, it can be verified whether the adversary can destroy these security properties. If there is a common solution, it means that the adversary may destroy the security of the protocol; otherwise, the protocol is secure. The core challenge of recursive protocols is complex message flows and recursive operations. By converting the recursive process into a mathematical formula and a constraint system, and verifying the security of the protocol by solving the system, it can be directly determined whether the adversary can obtain confidential information or destroy the protocol through recursive operations. Such a formal analysis method can systematically handle the infinite number of possible execution paths of the recursive protocol, thereby solving the verification problem raised in the background technology.
[0053] The above-mentioned recursive protocol security verification method based on constraint solving, this application abstracts the protocol execution trace into a recursive language constraint system when performing formal analysis on the recursive protocol containing recursive operations, constructs simplified rules to simplify the constraint system, solves the simple constraint system, and uses a combination strategy to generate sufficient solutions to the constraint system to achieve security verification of the recursive protocol. This application also has a complete representation of the adversary's knowledge and can verify the general security of protocols with recursive primitives such as confidentiality. It is also effective when dealing with other security attributes such as checking routing feasibility and authentication.
[0054] In one of the embodiments, establishing adversary deduction rules includes a first rule, a second rule, a third rule, a fourth rule, a fifth rule and a sixth rule; the adversary deduction rules represent the adversary's ability to derive new messages from known messages, the first rule is an axiom, the second rule, the third rule and the fifth rule are synthesis rules, and the fourth rule and the sixth rule are decomposition rules; the synthesis rules describe that the adversary can synthesize messages in various ways; the various ways include pairing, encryption, and signing the message after obtaining the key; the decomposition rules describe that the adversary can deduce or decompose the message if there is a decryption key.
[0055] In one embodiment, the first rule is , the second rule is , the third rule is , the fourth rule is , the fifth rule is , the sixth rule is ,in, Representing Item Sets Derivable Items , express pair, Indicates and Symmetric key pair encryption, Indicates The private key pair Asymmetric encryption, express The first rule is an axiom, the second rule, the third rule and the fifth rule are synthesis rules, and the fourth rule and the sixth rule are decomposition rules.
[0056] In one embodiment, a new message constructed by the adversary at a certain stage of the recursive protocol execution is symbolized as a variable, and infinite possible execution traces of the security protocol are abstracted into a set of derivation constraints. The adversary constructs a constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol, including:
[0057] The new message constructed by the adversary at a certain stage of the recursive protocol execution is symbolized as a variable, and the infinite possible execution traces of the security protocol are abstracted into a set of derivation constraints. The adversary constructs the constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol: , is the empty set ⊥ or the union of a finite number of derivation constraints , , represents the set of natural numbers, where To constrain the antecedent, To constrain the subsequent condition, is a non-empty name set; the constraint antecedent and the constraint consequent satisfy two conditions; the two conditions include , and , then there exists Make , , , Representation and Different natural numbers, the second condition indicates that the new variable is introduced as a constraint consequence, where express The variables of the constraint are: the antecedent of the constraint represents the message sent in the network, and the consequent of the constraint represents the message that the participants want to obtain; The language constraint system is represented as , ,in express of Recursive language extensions.
[0058] In one embodiment, the preset simplification rules include a first simplification rule, a second simplification rule, a third simplification rule and a fourth simplification rule; the first simplification rule indicates that the logical result of the smaller constraint can be removed as a redundant constraint, that is, when u Available from When derived, the constraint system can be Simplified to ; The second simplification rule means that the permutation can be substituted into the constraint system, that is, the permutation Substitute the constraint system The constraint antecedent Constrained Consequence ， Restraint system Simplified to ; The third simplification rule indicates that when the constraint antecedent and the constraint consequent have no common variables, the constraint system can be simplified to an empty constraint system, that is, when the constraint antecedent and When there are no common variables, the constraint system Can be simplified to an empty constraint system ; The fourth simplification rule indicates that when the constraint consequence yes function, the constraint system can be simplified to the combination of two simple constraints, that is, when When the constraint system It can be simplified into two simple constraints: The combination of.
[0059] In one embodiment, the security property to be verified is modeled as a first-order formula, and security verification is achieved by determining whether an adversary can destroy the security property by solving a simple constraint system and the first-order formula to determine whether they have a common solution, including:
[0060] The solution of a simple constraint system is the solution of the constraint system ,if And each constraint is of the form ,in is a variable, a constraint system The solution is a domain of Base substitution , it is for each , , both ,say yes The non-aliased solution of , if and only if When, meet ;
[0061] set up is a solvable constraint system, is a non-aliased solution to the constraint system, for A constraint antecedent in In order to make Items established for Each item in , add a The sub-item collection obtained in: ,
[0062] Then, using the synthesis rule, we get , which shows that when solving the constraint system, All derivable items can be generated by using only synthesis rules. For any non-obfuscated solution, any derivable items of attacker knowledge can be generated only by combination. For the associated constraint system of Language Constraint System ,at this time Solution satisfy Constraint System The solution, and for any , ;
[0063] Model the security property to be verified as a first-order formula , by solving the constraint system and Whether there is a common solution to determine whether the adversary can destroy the security property, and thus determine whether the security of the protocol is satisfied.
[0064] It should be understood that although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.
[0065] In one embodiment, Figure 2 As shown, a recursive protocol security verification device based on constraint solving is provided, comprising: an adversary derivation module 202, a constraint system construction module 204 and a security verification module 206, wherein:
[0066] The adversary derivation module 202 is used to obtain known information of the recursive protocol; establish adversary derivation rules, and derive the known messages according to the adversary derivation rules to obtain new messages;
[0067] The constraint system construction module 204 is used to symbolize the new message constructed by the adversary at a certain stage of the recursive protocol execution into a variable, abstract the infinite number of possible execution traces of the security protocol into a set of derivation constraints, and the adversary constructs the constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol;
[0068] The security verification module 206 is used to simplify the constraint system according to pre-set simplification rules to obtain a simple constraint system; the security attribute to be verified is modeled as a first-order formula, and security verification is achieved by determining whether the adversary can destroy the security attribute by solving whether the simple constraint system and the first-order formula have a common solution.
[0069] For the specific limitations of the recursive protocol security verification device based on constraint solving, please refer to the limitations of the recursive protocol security verification method based on constraint solving above, which will not be repeated here. Each module in the above-mentioned recursive protocol security verification device based on constraint solving can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.
[0070] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a recursive protocol security verification method based on constraint solving is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.
[0071] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0072] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0073] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0074] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.
Claims
1. A recursive protocol security verification method based on constraint solving, characterized in that: The method comprises: Acquire known information of the recursive protocol; establish an adversary derivation rule, and derive the known message of the recursive protocol according to the adversary derivation rule to obtain a new message; The new message constructed by the adversary at a certain stage of the recursive protocol execution is symbolized as a variable, and the infinite possible execution traces of the security protocol are abstracted into a set of derivation constraints. The adversary constructs a constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol. The constraint system is simplified according to a preset simplification rule to obtain a simple constraint system; the security attribute to be verified is modeled as a first-order formula, and whether the simple constraint system and the first-order formula have a common solution is determined to determine whether the adversary can destroy the security attribute to achieve security verification; The adversary derivation rules include the first rule, the second rule, the third rule, the fourth rule, the fifth rule and the sixth rule; the adversary derivation rules represent the adversary's ability to derive new messages from known messages, the first rule is an axiom, the second rule, the third rule and the fifth rule are synthesis rules, and the fourth rule and the sixth rule are decomposition rules; the synthesis rules describe that the adversary can synthesize messages in multiple ways; the multiple ways include pairing, encryption and signing messages after obtaining a key; the decomposition rules describe that the adversary can deduce or decompose messages when having a decryption key.
2. The method according to claim 1, characterized in that The first rule is , the second rule is , the third rule is , the fourth rule is , the fifth rule is , the sixth rule is ,in, Representing Item Sets Derivable Items , express pair, Indicates and Symmetric key pair encryption, Indicates The private key pair Asymmetric encryption, express The first rule is an axiom, the second rule, the third rule and the fifth rule are synthesis rules, and the fourth rule and the sixth rule are decomposition rules.
3. The method according to any one of claims 1 to 2, characterized in that: The new message constructed by the adversary at a certain stage of the recursive protocol execution is symbolized as a variable, and the infinite possible execution traces of the security protocol are abstracted into a set of derivation constraints. The adversary constructs a constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol, including: The new message constructed by the adversary at a certain stage of the recursive protocol execution is symbolized as a variable, and the infinite possible execution traces of the security protocol are abstracted into a set of derivation constraints. The adversary constructs the constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol: is the empty set ⊥ or the union of a finite number of derivation constraints , , , represents the set of natural numbers where To constrain the antecedent, To constrain the subsequent condition, is a non-empty name set; the constraint antecedent and constraint consequent satisfy two conditions; the two conditions include , and , then there exists Make , , ， Representation and Different natural numbers, represents a variable, and the second condition indicates that the new variable is introduced as a constraint consequence, where express The constraint antecedent represents the message sent in the network, and the constraint consequent represents the message that the participant wants to obtain; The language constraint system is represented as , ,in express of Recursive language extensions.
4. The method according to claim 3, characterized in that The preset simplification rules include a first simplification rule, a second simplification rule, a third simplification rule and a fourth simplification rule; the first simplification rule indicates that the logical result of the smaller constraint can be removed as a redundant constraint, that is, when Available from When derived, the constraint system can be Simplified to The second simplification rule indicates that the permutation can be substituted into the constraint system, that is, the permutation Substitute the constraint system The constraint antecedent Constrained Consequence ， Restraint system Simplified to The third simplification rule indicates that when the constraint antecedent and the constraint consequent have no common variables, the constraint system can be simplified to an empty constraint system, that is, when the constraint antecedent and When there are no common variables, the constraint system Can be simplified to an empty constraint system ; The fourth simplified rule indicates that when the constraint consequence yes function, the constraint system can be simplified to the combination of two simple constraints, that is, when When the constraint system It can be simplified into two simple constraints: The combination of.
5. The method according to claim 3, characterized in that: The security attribute to be verified is modeled as a first-order formula. Security verification is achieved by determining whether the adversary can destroy the security attribute by solving a simple constraint system and the first-order formula to determine whether they have a common solution, including: The solution of a simple constraint system is the solution of the constraint system ,if And each constraint is of the form ,in x is a variable, a constraint system The solution is a domain of Base substitution θ , it is for each , , both have ,say θ yes The non-aliased solution of , , if and only if When, meet ; set up is a solvable constraint system, θ is a non-aliased solution to the constraint system, for A constraint antecedent in In order to make Items established for Each item in , add a The sub-item collection obtained in: , and then use the synthesis rule to get , which shows that when solving the constraint system, All derivable items can be generated by using only synthesis rules. For any non-obfuscated solution, any derivable items of attacker knowledge can be generated only by combination. For the associated constraint system of Language Constraint System ,at this time Solution satisfy Constraint System The solution, and for any , ; Model the security property to be verified as a first-order formula , by solving the constraint system and Whether there is a common solution to determine whether the adversary can destroy the security property, and thus determine whether the security of the protocol is satisfied.
6. A recursive protocol security verification device based on constraint solving, characterized in that: The device comprises: The adversary derivation module is used to obtain known information of the recursive protocol; establish adversary derivation rules, and derive the known messages of the recursive protocol according to the adversary derivation rules to obtain new messages; the adversary derivation rules include the first rule, the second rule, the third rule, the fourth rule, the fifth rule and the sixth rule; the adversary derivation rules represent the adversary's ability to derive new messages from known messages, the first rule is an axiom, the second rule, the third rule and the fifth rule are synthesis rules, and the fourth rule and the sixth rule are decomposition rules; the synthesis rules describe that the adversary can synthesize messages in multiple ways; the multiple ways include pairing, encryption and signing messages after obtaining a key; the decomposition rules describe that the adversary can deduce or decompose messages in the presence of a decryption key; The constraint system construction module is used to symbolize the new message constructed by the adversary at a certain stage of the recursive protocol execution into variables, abstract the infinite number of possible execution traces of the security protocol into a set of derivation constraints, and the adversary constructs the constraint system through the derivation constraints in the interaction between the initial knowledge and the protocol; The security verification module is used to simplify the constraint system according to preset simplification rules to obtain a simple constraint system; the security attribute to be verified is modeled as a first-order formula, and security verification is achieved by determining whether the adversary can destroy the security attribute by solving whether the simple constraint system and the first-order formula have a common solution.
7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.