Towards Validating Security Protocol Deployment in the Wild

As computing technology becomes increasingly pervasive and interconnected, mobility leads to shorter-lasting relationships between end-points with many different security requirements. Also the rapid development of new service landscapes calls for standardized, yet highly flexible security protocols. It has been demonstrated that the increasing number of application contexts of these highly flexible security protocols opens vulnerabilities emerging from the difficulty of assessing the impact of the selected protocol options on the actual security of the relationship established using the protocol. This contribution clearly identifies the underlying problem more generally and establishes the need for run-time on-the-fly verification of security protocol instances considering the actual choice of options and environment assumptions. Extending security protocol verification from the design-time realm into deployment and even run-time generates various challenges. This paper identifies these new challenges and proposes directions for research on solutions.