Security Analysis of Parlay/OSA Framework

R.J. Corin, G. Di Caprio, Sandro Etalle, S. Gnesi, Gabriele Lenzini, C. Moiso

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    18 Downloads (Pure)

    Abstract

    This paper analyzes the security of the Trust and Security Management (TSM) protocol, an authentication protocol which is part of the Parlay/OSA Application Program Interfaces (APIs). Architectures based on Parlay/OSA APIs allow third party service providers to develop new services that can access, in a controlled and secure way, to those network capabilities offered by the network operator. Role of the TSM protocol, run by network gateways, is to authenticate the client applications trying to access and use the network capabilities features offered. For this reason potential security flaws in its authentication strategy can bring to unauthorized use of network with evident damages to the operator and to the quality of the services. This paper shows how a rigorous formal analysis of TSM underlines serious weaknesses in the model describing its authentication procedure. This usually means that also the original system (i.e., the TSM protocol itself) hides the same flaws. The paper relates about the design activity of the formal model, the tool-aided verification performed and the security flaws discovered. This will allow us to discuss about how the security of the TSM protocol can be generally improved.
    Original languageUndefined
    Title of host publication9th Int. Conf. on Intelligence in service delivery Networks ICIN
    EditorsB. Villain
    Place of PublicationAmsterdam
    PublisherIOS Press
    Pages54-59
    Number of pages6
    Publication statusPublished - Oct 2004
    EventICIN: Proceedings 9th Int. Conference on Intelligence in service delivery Networks -
    Duration: 1 Jan 1900 → …

    Publication series

    Name
    PublisherIOS Press

    Conference

    ConferenceICIN
    Period1/01/00 → …

    Keywords

    • EWI-764
    • IR-48641
    • METIS-220301
    • SCS-Cybersecurity

    Cite this