  Web services security specifications are typically expressed as a mixture of
XML schemas, example messages, and narrative explanations. We propose a new
specification language for writing complementary machine-checkable descriptions
of SOAP-based security protocols and their properties. Our TulaFale language is
based on the pi calculus (for writing collections of SOAP processors running in
parallel), plus XML syntax (to express SOAP messaging), logical predicates (to
construct and filter SOAP messages), and correspondence assertions (to specify
authentication goals of protocols). Our implementation compiles TulaFale into
the applied pi calculus, and then runs Blanchet's resolution-based protocol
verifier. Hence, we can automatically verify authentication properties of SOAP
protocols.
