Security Analysis Using Flow Logics

Security. Originated in the 70’s, security of computer systems became soon an essential requirement for many applications, especially in the last decade, due to the widespread diffusion of distributed systems and networks. Mobility is really shaping these systems, leading to new scenarios in which security problems become more and more urgent. The software executed on a computer needs not to be produced for it anymore, as it can also be downloaded from a server, somewhere on the net. Consequently, each computational environment offers a general and distributed platform to programs that can be concurrently executed by users either locally or remotely. This makes it mandatory to fix precise policies for access rights to obtain non-interference and the protection of private information. Moreover, it is necessary to face up to the heterogeneity of administration domains and untrustability of connections, due to geographic distribution: communications between nodes have to be guaranteed, both by making it possible to identify partners during the sessions and by preserving the secrecy and integrity of the data exchanged. To this end specifications for message exchange, called security protocols, are defined on the basis of cryptographic algorithms. Even though carefully designed, protocols may have flaws, allowing malicious agents or intruders to violate security. An intruder, gaining some control over the communication network, is able to intercept or forge or invent messages to convince agents to reveal sensitive information or to believe it is one of the legitimate agents in the session. Cryptography can minimize possible malicious effects.