Security Evaluation Labeled Encryption Protocol Generation System, Security Evaluation Labeled Encryption Protocol Generation Device, Method, and Program

Abstract

A system for generating an encryption protocol with a security evaluation label according to one aspect of the present disclosure comprises a protocol generation unit configured to generate a random encryption protocol, a verification unit configured to verify and evaluate the security requirements for the encryption protocol by formal verification to create a security evaluation label indicating a result of the verification and evaluation, and a labeling unit configured to output the encryption protocol and the security evaluation label to a predetermined output destination.

Description

Technical Field

[0001] The present disclosure relates to a security evaluation label - attached cryptographic protocol generation system, a security evaluation label - attached cryptographic protocol generation apparatus, a method, and a program.

Background Art

[0002] In recent years, with the complication of cryptographic protocols, automatic verification tools have been used for their security verification. Among the main automatic verification tools, an automatic verification technique called formal verification is used. However, formal verification has problems that termination is not guaranteed, and even when the verification stops, it requires an enormous verification time. On the other hand, research on the security verification of cryptographic protocols using machine learning has also been conducted (for example, Non - Patent Documents 1 and 2). The method using machine learning has a shorter verification time compared to formal verification and guarantees termination. However, it has a problem that the accuracy is not always 100%.

[0003] Generally, it is said that tens of thousands or more learning data are required to properly perform learning in machine learning. Therefore, in order to obtain sufficient accuracy in the security verification of cryptographic protocols using machine learning, it is necessary to prepare tens of thousands or more learning data with labels (hereinafter, security evaluation labels) representing the results of verifying and evaluating the security requirements for the cryptographic protocols.

Prior Art Documents

Non - Patent Documents

[0004]

Non - Patent Document 1

Non-Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in previous studies (e.g., Non-Patent Documents 1 and 2), since cryptographic protocols and their security evaluation labels were manually collected from existing academic papers and the like to create training data, only about 500 to 1000 cases could be prepared. For this reason, sufficient accuracy could not be obtained when verifying the security requirements of cryptographic protocols using machine learning.

[0006] This disclosure has been made in view of the above points, and provides a technique for generating a cryptographic protocol with a security label.

Means for Solving the Problems

[0007] A security evaluation labeled cryptographic protocol generation system according to an aspect of the present disclosure includes a protocol generation unit configured to generate a random cryptographic protocol, a verification unit configured to verify and evaluate security requirements of the cryptographic protocol by formal verification and create a security evaluation label representing the result of the verification and evaluation, and a labeling unit configured to output the cryptographic protocol and the security evaluation label to a predetermined output destination.

Advantages of the Invention

[0008] A technique for generating a cryptographic protocol with a security label is provided.

Brief Description of the Drawings

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Modes for Carrying Out the Invention

[0010] Hereinafter, an embodiment of the present invention will be described. Hereinafter, a security evaluation labeled cryptographic protocol generation apparatus 10 that can generate a security evaluation labeled cryptographic protocol to which a security evaluation label representing the result of verifying and evaluating the security requirements for the cryptographic protocol is attached will be described. Note that the security evaluation labeled cryptographic protocol is represented by, for example, a pair of a cryptographic protocol and a security evaluation label.

[0011] Here, hereinafter, key exchange protocols and authentication protocols are assumed as cryptographic protocols. In the case of a key exchange protocol, confidentiality is assumed as its security requirement, and in the case of an authentication protocol, authenticity is assumed as its security requirement. However, the cryptographic protocol and its security requirements are not limited to these, and this embodiment is similarly applicable to other cryptographic protocols and their security requirements.

[0012] <Preparation> Hereinafter, terms, concepts, definitions, etc. necessary for the description of this embodiment are prepared.

[0013] ≪Cryptographic Protocol of Interest≫ In this embodiment, a cryptographic protocol that satisfies the following (1) to (3) is targeted. Note that the executor of the cryptographic protocol is called a party. Also, one execution of the cryptographic protocol by a party (that is, from the start of message exchange until authentication or session key exchange, etc. is performed) is called a session.

[0014] (1) It is executed among n parties (where n is an integer of 2 or more) P1, ···, P n (However, n is an integer of 2 or more).

[0015] (2) Each party is assigned one ID, a long-term secret key (long-term secret key), a public key for the long-term secret key, and a secret key (temporary secret key) that is used only temporarily within the session.

[0016] (3) Messages are exchanged between parties to provide functions such as authentication and key exchange.

[0017] ≪Description Method of Cryptographic Protocol≫ The messages and the behavior of the parties are defined as follows, and the cryptographic protocol is defined as a sequence of the behavior of the parties. Note that messages are sometimes called protocol messages.

[0018] · Components of Messages An example of the elements constituting a message and its notation method is shown in FIG. 1. In FIG. 1, P represents any party. That is, P ∈ {P1, ···, P n}. In the following, the set of elements constituting the message is represented as AN = {a1, ···, a N} (where N is the total number of elements constituting the message). Note that the elements constituting AN (the elements constituting the message) are defined according to the target cryptographic protocol. For example, when the target cryptographic protocol is an authentication protocol, AN that does not include the session key SK P shared by the party P may be defined.

[0019] · Message composition method An example of the operations of the party and its notation method when constructing a message is shown in FIG. 2. In FIG. 2,

[0020]

Number

[0021] · Party behavior An example of the behavior of the party within the protocol and its notation method is shown in FIG. 3. In FIG. 3, → m represents a sequence of arbitrary messages.

[0022] <Hardware Configuration Example of Encryption Protocol Generation Device 10 with Security Evaluation Label> An example of the hardware configuration of the encryption protocol generation device 10 with a security evaluation label according to this embodiment is shown in FIG. 4. As shown in FIG. 4, the encryption protocol generation device 10 with a security evaluation label according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. These pieces of hardware are communicably connected via a bus 109, respectively.

[0023] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, or the like. The display device 102 is, for example, a display, a display panel, or the like. Note that the encryption protocol generation device 10 with a security evaluation label may not have at least one of the input device 101 and the display device 102, for example.

[0024] The external I / F 103 is an interface with an external device such as a recording medium 103a. The encryption protocol generation device 10 with a security evaluation label can read and write to the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), a USB (Universal Serial Bus) memory card, and the like.

[0025] The communication I / F 104 is an interface for connecting the security evaluation label - attached encryption protocol generation device 10 to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) for temporarily holding programs and data. The ROM 106 is a non - volatile semiconductor memory (storage device) that can hold programs and data even when the power is turned off. The auxiliary storage device 107 is a storage device (storage device) such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory. The processor 108 is an arithmetic device such as a CPU (Central Processing Unit).

[0026] The security evaluation label - attached encryption protocol generation device 10 according to this embodiment can realize the security evaluation label - attached encryption protocol generation process described later by having the hardware configuration shown in FIG. 4. Note that the hardware configuration shown in FIG. 4 is an example, and the hardware configuration of the security evaluation label - attached encryption protocol generation device 10 is not limited to this. For example, the security evaluation label - attached encryption protocol generation device 10 may have a plurality of auxiliary storage devices 107 and a plurality of processors 108, may not have a part of the illustrated hardware, or may have various hardware other than the illustrated hardware.

[0027] <Example of the functional configuration of the security evaluation label - attached encryption protocol generation device 10> An example of the functional configuration of the security evaluation label - attached encryption protocol generation device 10 according to this embodiment is shown in FIG. 5. As shown in FIG. 5, the security evaluation label - attached encryption protocol generation device 10 according to this embodiment includes a protocol automatic generation unit 201, a conversion unit 202, a verification unit 203, and a labeling unit 204. Each of these units is realized, for example, by a process in which one or more programs installed in the security evaluation label - attached encryption protocol generation device 10 are executed by the processor 108.

[0028] The protocol automatic generation unit 201 generates a random cryptographic protocol. The details of the method for generating the cryptographic protocol will be described later.

[0029] The conversion unit 202 converts the cryptographic protocol generated by the protocol automatic generation unit 201 into a format that can be input to the verification unit 203 (automatic verification tool). Hereinafter, the cryptographic protocol converted into a format that can be input to the verification unit 203 will be referred to as the "converted cryptographic protocol".

[0030] The verification unit 203 verifies and evaluates the security requirements of the converted cryptographic protocol by formal verification and outputs a security evaluation label. The security evaluation label is represented by, for example, a vector (or scalar) composed of elements corresponding to the security requirements and taking 1 when the security requirements are satisfied and 0 otherwise. Note that the verification unit 203 is realized by an existing automatic verification tool. Examples of existing automatic verification tools include ProVerif (for example, References 1 and 2), Tamarin prover (for example, References 3 and 4), and the like.

[0031] The labeling unit 204 assigns the security evaluation label output by the verification unit 203 to the cryptographic protocol generated by the protocol automatic generation unit 201 and creates a cryptographic protocol with a security evaluation label. Thereby, a cryptographic protocol with a security evaluation label is obtained. Note that the cryptographic protocol with a security evaluation label is represented by, for example, a pair of the cryptographic protocol and its security evaluation label.

[0032] <Cryptographic protocol generation process with security evaluation label> The cryptographic protocol generation process with a security evaluation label according to the present embodiment will be described with reference to FIG. 6.

[0033] The protocol automatic generation unit 201 generates a random cryptographic protocol (step S101). Here, the protocol automatic generation unit 201 generates a cryptographic protocol, for example, according to the following procedures 1 to 4. Note that R and S are each a predetermined natural number.

[0034] Step 1: Randomly select the number of exchanges of protocol messages (the number of protocol dialogues) from {1, ···, R}. Hereinafter, this number will be denoted as r.

[0035] Step 2: Set "send m from I to R" and "send m from R to I" alternately as the behavior of the parties in the cryptographic protocol. That is, set the cryptographic protocol Prt = {sentItoR( → m1), sentRtoI( → m2), ···, sentPtoP'( → m r )}. Note that when r is odd, P = I and P' = R, and when r is even, P = R and P' = I.

[0036] Step 3: For each → m i (1 ≤ i ≤ r), randomly select the number of elements of the message from {1, ···, S}. Hereinafter, as an example, an explanation will be given for a certain → m i . This → m i will be → denoted as m, and the number of elements of this message will be denoted as s. That is, → m = m1, ···, m s is represented as such.

[0037] Step 4: For each m j (1 ≤ j ≤ s), randomly select elements from AN ∪ FN until there are no selectable elements left. That is, when an element a of the message (that is, an element of AN) is selected as m j , then m j = a ∈ AN. On the other hand, when an operation f (that is, an element of FN) is selected as m j , execute the following Step 4-1 or Step 4-2.

[0038] Step 4-1: When f is an operation that takes the message sequence → m as input (for example, senc( →When it is m;K), etc., in the same way as in Procedure 3, after randomly selecting the number of elements s of the message from {1, ···, S}, → m = m1, ···, m s Procedure 4 is recursively executed for.

[0039] Procedure 4-2: When f is an operation that takes two elements as inputs (e.g., conc(m0, m1), etc.), Procedure 4 is recursively executed with s = 2.

[0040] As shown in FIG. 2, the common key K is used for generating the common key ciphertext, the public key pk of the communication partner is used for generating the public key ciphertext, and the own long-term secret key lsk is used for generating the electronic signature.

[0041] Here, when the target cryptographic protocol is a key exchange protocol, in the above Procedure 2, at the end of the cryptographic protocol Prt, acceptI( → m r+1 ) and acceptR( → m r+2 ) may be added.

[0042] A random cryptographic protocol is generated by the above Procedures 1 to 4.

[0043] Following Step S101, the conversion unit 202 converts the cryptographic protocol generated in Step S101 above into a converted cryptographic protocol in a format that can be input to the verification unit 203 (automatic verification tool) (Step S102). The conversion unit 202 converts the cryptographic protocol into a format that can be input to the automatic verification tool according to the automatic verification tool that realizes the verification unit 203. Note that the format for conversion depends on the automatic verification tool, and for example, for ProVerif, refer to References 1 and 2, etc., and for Tamarin prover, refer to References 3 and 4, etc.

[0044] Next, the verification unit 203 verifies and evaluates the security requirements of the converted cryptographic protocol obtained in Step S102 above by formal verification, and obtains a security evaluation label (Step S103).

[0045] Then, the labeling unit 204 outputs the pair of the encryption protocol generated in the above step S101 and the security evaluation label obtained in the above step S103 as an encryption protocol with a security evaluation label (step S104). Note that the labeling unit 204 may output the encryption protocol with a security evaluation label to a predetermined output destination (for example, the auxiliary storage device 107, another device connected via a communication network, etc.).

[0046] As described above, an encryption protocol with a security evaluation label is obtained. Therefore, by repeating the above steps S101 to S104, a desired number of encryption protocols with security evaluation labels can be obtained.

[0047] <Summary> As described above, the encryption protocol generation device 10 with a security evaluation label according to the present embodiment can automatically generate an encryption protocol with a security evaluation label. Therefore, a large number of encryption protocols with security evaluation labels can be obtained. Accordingly, these encryption protocols with security evaluation labels can be used as learning data to construct a machine learning model capable of verifying the security of the encryption protocol with high accuracy.

[0048] Note that the verification unit 203 (automatic verification tool) does not necessarily have to be possessed by the encryption protocol generation device 10 with a security evaluation label. For example, a device connected to the encryption protocol generation device 10 with a security evaluation label via a communication network may possess the verification unit 203 (automatic verification tool). In this case, an encryption protocol generation system with a security evaluation label is configured by the encryption protocol generation device 10 with a security evaluation label and the device having the verification unit 203 (automatic verification tool).

[0049] The present invention is not limited to the specifically disclosed above embodiments, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims.

[0050] [References] Reference 1: Bruno Blanchet. Automatic verification of security protocols in the symbolic model: The verifier proverif. In Foundations of security analysis and design VII, pp. 54-87. Springer, 2013. Reference 2: Bruno Blanchet. Proverif: Cryptographic protocol verifier in the formal model, 2021. Internet <URL:https: / / prosecco.gforge.inria.fr / personal / bblanche / proverif / > Reference 3: David Basin, Cas Cremers, Jannik Dreier, Simon Meier, Ralf Sasse, and Benedikt Schmidt. Tamarin prover, 2020. Internet <URL:https: / / tamarin-prover.github.io / > Reference 4: Simon Meier, Benedikt Schmidt, Cas Cremers, and David Basin. The tamarin prover for the symbolic analysis of security protocols. In International Conference on Computer Aided Verification, pp. 696-701. Springer, 2013.

Explanation of Symbols

[0051] 10 Security evaluation label - attached cryptographic protocol generation device 101 Input device 102 Display device 103 External I / F 103a Recording medium 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage device 108 Processor 109 Bus 201 Protocol automatic generation unit 202 Conversion unit 203 Verification unit 204 Labeling unit

Claims

1. A protocol generation unit configured to generate a random encryption protocol; A verification unit configured to verify and evaluate the security requirements of the encryption protocol by formal verification and create a security evaluation label representing the result of the verification and evaluation; A labeling unit configured to output the encryption protocol and the security evaluation label to a predetermined output destination; A security evaluation label - attached encryption protocol generation system having the above.

2. The protocol generation unit: After randomly selecting the number of exchanges r ∈ R (where R is a predetermined natural number) of protocol messages between the initiator and the responder, alternately sets the transmission of a random protocol message from the initiator to the responder and the transmission of a random protocol message from the responder to the initiator r times to generate the encryption protocol. The security evaluation label - attached encryption protocol generation system according to Claim 1.

3. The protocol generation unit: Generates a random protocol message from the initiator to the responder by randomly selecting a predetermined protocol message element and an operation on the protocol message element; Generates a random protocol message from the responder to the initiator by randomly selecting a predetermined protocol message element and an operation on the protocol message element. The security evaluation label - attached encryption protocol generation system according to Claim 2.

4. The protocol message element includes at least one of the ID of the initiator or the responder, the temporary secret key of the initiator or the responder, the long - term secret key of the initiator or the responder, the public key of the initiator or the responder, the timestamp of the initiator or the responder, the secret key pre - shared by the initiator and the responder, and the session key shared by the initiator and the responder. The security evaluation label - attached encryption protocol generation system according to Claim 3.

5. The operations on the protocol message elements include at least one of the following: an operation of creating a common key ciphertext using the secret key for at least one column of the protocol message elements, an operation of creating a public key ciphertext using the public key for at least one column of the protocol message elements, an operation of creating an electronic signature using the long-term secret key for at least one column of the protocol message elements, an operation of calculating a hash value for at least one column of the protocol message elements, an operation of concatenating two of the protocol message elements, an operation of raising one of the two protocol message elements to the power of the other, an operation of adding two of the protocol message elements, and an operation of multiplying two of the protocol message elements. The security evaluation label-added cipher protocol generation system according to claim 4.

6. A protocol generation unit configured to generate a random cipher protocol; A verification unit configured to verify and evaluate the security requirements of the cipher protocol by formal verification and create a security evaluation label representing the results of the verification and evaluation; A labeling unit configured to output the cipher protocol and the security evaluation label to a predetermined output destination; A security evaluation label-added cipher protocol generation device having the above.

7. A protocol generation procedure for generating a random cipher protocol; A verification procedure for verifying and evaluating the security requirements of the cipher protocol by formal verification and creating a security evaluation label representing the results of the verification and evaluation; A labeling procedure for outputting the cipher protocol and the security evaluation label to a predetermined output destination; A method for a computer to execute.

8. A protocol generation procedure for generating a random cipher protocol; A verification procedure for verifying and evaluating the security requirements of the cipher protocol by formal verification and creating a security evaluation label representing the results of the verification and evaluation; A labeling procedure for outputting the cipher protocol and the security evaluation label to a predetermined output destination; A program for causing a computer to execute.

Images