loading
Papers

Research.Publish.Connect.

Paper

Authors: Diego Sempreboni 1 ; Giampaolo Bella 2 ; Rosario Giustolisi 3 and Luca Viganò 1

Affiliations: 1 Department of Informatics, King’s College London and U.K. ; 2 Dipartimento di Informatica, Università di Catania and Italy ; 3 Department of Computer Science, IT University of Copenhagen and Denmark

ISBN: 978-989-758-378-0

Keyword(s): Threat Model, Security Ceremonies, Formal Analysis, Systematic Method.

Related Ontology Subjects/Areas/Topics: Human Factors and Human Behaviour Recognition Techniques ; Information and Systems Security ; Information Assurance ; Network Security ; Security Protocols ; Security Verification and Validation ; Wireless Network Security

Abstract: We address the fundamental question of what are, and how to define, the threat models for a security protocol and its expected human users, the latter pair forming a heterogeneous system that is typically called a security ceremony. Our contribution is the systematic definition of an encompassing method to build the full threat model chart for security ceremonies, from which one can conveniently reify the specific threat models of interest for the ceremony under consideration. For concreteness, we demonstrate the application of the method on three ceremonies that have already been considered in the literature: MP-Auth, Opera Mini and the Danish Mobilpendlerkort ceremony. We discuss how the full threat model chart suggests some interesting threats that haven’t been investigated although they are well worth of scrutiny. In particular, one of the threat models in our chart leads to a novel vulnerability of the Danish Mobilpendlerkort ceremony. We discovered the vulnerability by analysing this threat model using the formal and automated tool Tamarin, which we employed to demonstrate the relevance of our method, but it is important to highlight that our method is generic and can be used with any tool for the analysis of security protocols and ceremonies. (More)

PDF ImageFull Text

Download
CC BY-NC-ND 4.0

Sign In Guest: Register as new SciTePress user now for free.

Sign In SciTePress user: please login.

PDF ImageMy Papers

You are not signed in, therefore limits apply to your IP address 34.237.51.35

In the current month:
Recent papers: 100 available of 100 total
2+ years older papers: 200 available of 200 total

Paper citation in several formats:
Sempreboni, D.; Bella, G.; Giustolisi, R. and Viganò, L. (2019). What Are the Threats? (Charting the Threat Models of Security Ceremonies).In Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT, ISBN 978-989-758-378-0, pages 161-172. DOI: 10.5220/0007924901610172

@conference{secrypt19,
author={Diego Sempreboni. and Giampaolo Bella. and Rosario Giustolisi. and Luca Viganò.},
title={What Are the Threats? (Charting the Threat Models of Security Ceremonies)},
booktitle={Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT,},
year={2019},
pages={161-172},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0007924901610172},
isbn={978-989-758-378-0},
}

TY - CONF

JO - Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT,
TI - What Are the Threats? (Charting the Threat Models of Security Ceremonies)
SN - 978-989-758-378-0
AU - Sempreboni, D.
AU - Bella, G.
AU - Giustolisi, R.
AU - Viganò, L.
PY - 2019
SP - 161
EP - 172
DO - 10.5220/0007924901610172

Login or register to post comments.

Comments on this Paper: Be the first to review this paper.