Lecture Notes in Computer Science 1895 Edited by G. Goos, J. Hartmanis, and J. van Leeuwen

Lecture Notes in Computer Science 1895 Edited by G. Goos, J. Hartmanis, and J. van Leeuwen

3 Berlin Heidelberg New York Barcelona Hong Kong London Milan Paris Singapore Tokyo

Frédéric Cuppens Yves Deswarte Dieter Gollmann Michael Waidner (Eds.) Computer Security ESORICS 2000 6th European Symposium on Research in Computer Security Toulouse, France, October 4-6, 2000 Proceedings 1 3

Series Editors Gerhard Goos, Karlsruhe University, Germany Juris Hartmanis, Cornell University, NY, USA Jan van Leeuwen, Utrecht University, The Netherlands Volume Editors Frédéric Cuppens ONERA Centre de Toulouse 2 avenue Edouard Belin, 31055 Toulouse Cedex, France E-mail: cuppens@cert.fr Yves Deswarte LAAS-CNRS 7 avenue du Colonel Roche, 31077 Toulouse Cedex 4, France E-mail: Yves.Deswarte@laas.fr Dieter Gollmann Microsoft Research 1 Guildhall Street, Cambridge CB2 3NH, UK E-mail: diego@microsoft.com Michael Waidner IBM Zurich Research Laboratory, Computer Science Department Manager Network Security and Cryptography Saeumerstr. 4, 8803 Rueschlikon, Switzerland E-mail: wmi@zurich.ibm.com Cataloging-in-Publication Data applied for Die Deutsche Bibliothek - CIP-Einheitsaufnahme Computer security : proceedings / ESORICS 2000, 6th European Symposium on Research in Computer Security, Toulouse, France, October 4-6, 2000. Frédéric Cuppens... (ed.). - Berlin ; Heidelberg ; New York ; Barcelona ; Hong Kong ; London ; Milan ; Paris ; Singapore ; Tokyo : Springer, 2000 (Lecture notes in computer science ; Vol. 1895) ISBN 3-540-41031-7 CR Subject Classification (1998): D.4.6, E.3, C.2.0, H.2.0, K.6.5 ISSN 0302-9743 ISBN 3-540-41031-7 Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. Springer-Verlag Berlin Heidelberg New York a member of BertelsmannSpringer Science+Business Media GmbH c Springer-Verlag Berlin Heidelberg 2000 Printed in Germany Typesetting: Camera-ready by author, data conversion by PTP-Berlin, Stefan Sossna Printed on acid-free paper SPIN: 10722599 06/3142 5 43210

Preface Ten years ago, the first European Symposium on Research in Computer Security was created in Toulouse. It had been initiated by the French AFCET Technical Committee on Information System Security, and mostly by its President, Gilles Martin, who deceased a few months before. Toulouse was a natural choice for its venue, since two of the most important French research teams in security were and still are in Toulouse: ONERA and LAAS-CNRS. At this first symposium, one third of the presented papers were from French authors, while half of the papers came from other European countries. The second time ESORICS was held, also in Toulouse in November 1992, the number of accepted papers that came from France had decreased by half, equalling the number of US papers, while about two thirds of the papers came from other European countries. It was then recognised that ESORICS was really a European Symposium, and an international steering committee was established to promote the venue of ESORICS in other European countries. This led to the organisation of ESORICS 94 in Brighton, UK; ESORICS 96 in Rome, Italy; and ESORICS 98 in Louvain, Belgium. During these ten years, ESORICS has established its reputation as the main event in research on computer security in Europe. With this series of biannual events, ESORICS gathers researchers and practitioners of computer security and gives them the opportunity to present the most recent advances in security theory or more practical concerns such as social engineering or the risks related to simplistic implementations of strong security mechanisms. For its tenth anniversary, ESORICS is coming back to Toulouse, and its success will be reinforced by the conjunction with RAID 2000, the Symposium on Recent Advances in Intrusion Detection. Born as a workshop joined to ESO- RICS 98, RAID is now an annual event and the most important international symposium in its area. Let us hope that for the next ten years, ESORICS will again visit other European countries and give rise to other successful security spin-offs. Yves Deswarte

VI Preface Since the First European Symposium on Research in Computer Security in 1990, ESORICS has become an established international conference on the theory and practice of computer security and the main research-oriented security conference in Europe. ESORICS 2000 received 75 submissions, all of which were reviewed by at least three programme committee members or other experts. At a two-day meeting of the programme committee all submissions were discussed, and 19 papers were selected for presentation at the conference. Two trends in computer security became prominent since ESORICS 1998 and thus received special room in the programme: Cybercrime and the lack of dependability of the Internet, and the renaissance of formal methods in security analysis. The former is not reflected by research papers yet, but in order to facilitate discussion we included a panel discussion on Cybercrime and Cybercops. The latter trend convinced us to allocate two sessions to this topic, namely, on protocol verification and security property analysis. We gratefully acknowledge all authors who submitted papers for their efforts in maintaining the standards of this conference. It is also our pleasure to thank the members of the programme committee and the additional reviewers for their work and support. Frédéric Cuppens Michael Waidner

Program Committee Chair: Frédéric Cuppens ONERA Centre de Toulouse, France Vice-Chair: Michael Waidner IBM Research, Switzerland N. Asokan Nokia Research Center, Finland Elisa Bertino University of Milan, Italy Joachim Biskup University of Dortmund, Germany Bernd Blobel University of Magdeburg, Germany Ulf Carlsen Protective Technology, Norway Marc Dacier IBM Research, Switzerland Yves Deswarte LAAS-CNRS, France Gérard Eizenberg ONERA Centre de Toulouse, France Jean-Charles Fabre LAAS-CNRS, France Simon Foley University College Cork, Ireland Pierre Girard GEMPLUS, France Dieter Gollmann Microsoft Research, UK Roberto Gorrieri University of Bologna, Italy Joshua Guttman MITRE, USA Jeremy Jacob University of York, UK Sushil Jajodia George Mason University, USA Dirk Jonscher Crédit Suisse, Switzerland Sokratis Katsikas University of the Aegean, Greece Helmut Kurth ATSEC GmbH, Germany Carl Landwehr Mitretek, USA Ludovic Mé Supélec, France Catherine Meadows Naval Research Laboratory, USA John Mitchell Stanford University, USA Emilio Montolivo Fondazione Ugo Bordoni, Italy Jean-Jacques Quisquater Université Catholique de Louvain, Belgium Peter Ryan SRI, UK Pierangela Samarati University of Milan, Italy Jacques Stern École Supérieure Normale, France Additional Reviewers Cy Ardoin (Mitretek Systems, USA), Vittorio Bagini (Fondazione Ugo Bordoni, Italy), Michele Boreale (University of Firenze, Italy), Paul Bourret (ONERA Centre de Toulouse, France), Marco Bucci (Fondazione Ugo Bordoni, Italy), Cecilia Catalano (Fondazione Ugo Bordoni, Italy), Bruno Crispo (SRI, UK), Antonio Durante (University of Bologna, Italy), Elena Ferrari (University of Milano, Italy), Riccardo Focardi (University of Venezia, Italy), Pierre-Alain Fouque (ENS, France), Philip Ginzboorg (Nokia Research Center, Finland), Louis Granboulan (ENS, France), Helena Handschuh (GEMPLUS, France), Jonathan Herzog (MITRE, USA), Klaus Julisch (IBM Research, Switzerland), Marc-Olivier

VIII Program Committee Killijian (LAAS-CNRS, France), Helger Lipmaa (Nokia Research Center, Finland), Eric Marsden (LAAS-CNRS, France), Fabio Martinelli IAT-CNR, Italy), Renato Menicocci (Fondazione Ugo Bordoni, Italy), Richard Murphy (Mitretek Systems, USA), Valtteri Niemi (Nokia Research Center, Finland), Peng Ning (George Mason University, USA), Kaisa Nyberg (Nokia Research Center, Finland), David Pointcheval (ENS, France), Guillaume Poupard (ENS, France), Roberto Segala (University of Bologna, Italy), Francisco Javier Thayer (MITRE, USA), Andreas Wespi (IBM Research, Switzerland), Ningning Wu (George Mason University, USA), Charles Youman (George Mason University, USA), Lenore Zuck (MITRE, USA). Organisation Committee Claire Saurel Gilles Trouessin Jérôme Carrère Francine Decavèle Brigitte Giacomi Marie-Thérèse Ippolito Rudolphe Ortalo Roger Payrau ONERA Centre de Toulouse, Co-Chair CNAMTS CESSI, Co-Chair ONERA Centre de Toulouse ONERA Centre de Toulouse ONERA Centre de Toulouse LAAS-CNRS NEUROCOM ONERA Centre de Toulouse

Table of Contents Personal Devices and Smart Cards Checking Secure Interactions of Smart Card Applets... 1 P. Bieber, J. Cazin, P. Girard, J.-L. Lanet, V. Wiels, and G. Zanon Verification of a Formal Security Model for Multiapplicative Smart Cards 17 Gerhard Schellhorn, Wolfgang Reif, Axel Schairer, Paul Karger, Vernon Austel, and David Toll How Much Negotiation and Detail Can Users Handle? Experiences with Security Negotiation and the Granularity of Access Control in Communications... 37 Kai Rannenberg Electronic Commerce Protocols Secure Anonymous Signature-Based Transactions... 55 Els van Herreweghen Metering Schemes for General Access Structures... 72 Barbara Masucci and Douglas R. Stinson Access Control A Typed Access Control Model for CORBA... 88 Gerald Brose Safety Analysis of the Dynamic-Typed Access Matrix Model...106 Masakazu Soshi A Formal Model for Role-Based Access Control Using Graph Transformation...122 Manuel Koch, Luigi V. Mancini, and Francesco Parisi-Presicce Protocol Verification A Formal Semantics for SPKI...140 Jon Howell and David Kotz Formal Verification of Cardholder Registration in SET...159 Gimpalo Bella, Fabio Massacci, Lawrence C. Paulson, and Piero Tramontano

X Table of Contents Automating Data Independence...175 P. J. Broadfoot, G. Lowe, and A. W. Roscoe Internet Security Finding a Connection Chain for Tracing Intruders...191 Kunikazu Yoda and Hiroaki Etoh A Full Bandwidth ATM Firewall...206 Olivier Paul, Maryline Laurent, and Sylvian Gombault Security Property Analysis Analysing Time Dependent Security Properties in CSP Using PVS...222 Neil Evans and Steve Schneider Unwinding Possibilistic Security Properties...238 Heiko Mantel Authentication and Confidentiality via IPsec...255 Joshua D. Guttman, Amy L. Herzog, and F. Javier Thayer Mobile Agents A Security Framework for a Mobile Agent System...273 Ciarán Bryce A Distributed Access Control Model for Java...291 Refik Molva and Yves Roudier Using Reflection as a Mechanism for Enforcing Security Policies in Mobile Code...309 Ian Welch and Robert J. Stroud Author Index... 325