Istituto di Scienza e Tecnologie dell'Informazione     
Corin R., Di Caprio G., Etalle S., Gnesi S., Lenzini G., Moiso C. A Formal Security Analysis of an OSA/Parlay Authentication Interface. In: IFIP Conference on Formal Methods for Open Object-based Distributed (Athens, Greece, June 15-17, 2005). Proceedings, vol. LNCS 3535 pp. 131 - 146. M. Steffen and G. Zavattaro (Eds.) (eds.). (Lecture Notes in Computer Science). Springer Verlag, 2005.
We report on an experience in analyzing the security of the Trust and Security Management (TSM) protocol, an authentication procedure within the OSA/Parlay Application Program Interfaces (APIs) of the Open Service Access and Parlay Group. The experience has been conducted jointly by research institutes experienced in security and industry experts in telecommunication networking. OSA/Parlay APIs are designed to enable the creation of telecommunication applications outside the traditional network space and business model. Network operators consider the OSA/Parlay a promising architecture to stimulate the development of web service applications by third party providers, which may not necessarily be experts in telecommunication and security. The TSM protocol is executed by the gateways to OSA/Parlay networks; its role is to authenticate client applications trying to access the interfaces of some object representing an offered network capability. For this reason, potential security flaws in the TSM authentication strategy can cause the unauthorized use of the network, with evident damages to the operator and the quality of services. We report a rigorous formal analysis of the TSM specification, which is originally given in UML. Furthermore, we illustrate our design choices to obtain the formal model, describe the tool-aided verification and finally expose the security flaws discovered.
Subject Formal Verification of Security
OSA/Parlay API
Industrial Test case
D.2.4 Software/Program Verification

Icona documento 1) Download Document PDF

Icona documento Open access Icona documento Restricted Icona documento Private


Per ulteriori informazioni, contattare: Librarian http://puma.isti.cnr.it

Valid HTML 4.0 Transitional