Detecting Intrusions in Security Protocols

Secure electronic communication relies on the application of cryptography. However, even with perfect encryption, communication may be compromised without effective security protocols for key exchange, authentication, privacy, etc. We are beginning to see environments characterized by high volume encrypted traffic between large numbers of communicating principals, facilitated by heterogeneous infrastructure-based trusted services, e.g. Public Key Infrastructures. These vital services are dependent on security protocols. Unfortunately, security protocols are known to be highly susceptible to subtle errors. To date, we have relied on formal methods to tell us if our security protocols are effective. These methods do not provide complete or measurable protocol security. Moreover, security protocols are subject to the same implementation and administrative vulnerabilities as communication protocols. As a result, we are and will operate security protocols that have known and unknown flaws. In this paper, we describe a method and architecture to detect intrusions in security protocol environments. Our method is based on classic intrusion detection techniques of knowledge-based and behavior-based techniques detection. Section