Automated Verification of Relational Properties
This work presents an automated verification approach for relational properties utilizing synthesis of relational invariants and fair & semantic schedulers. The main contributions include sound and complete reduction to constraint solving, introduction of a new class of predicate constraints, and implementation of a solver for relational verification. Relational verification is achieved by formalizing various security properties and generalizing non-deterministic programs. Examples such as Termination-Insensitive Non-Interference (TI-NI) are provided to illustrate the concepts discussed.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Constraint Constraint- -based Relational Verification Relational Verification based Hiroshi Unno (U. of Tsukuba / RIKEN AIP, Japan) Tachio Terauchi (Waseda University, Japan) Eric Koskinen (Stevens Institute of Technology, USA)
This Work: Automated Verification of Relational Properties 1. 1. ?-safety Hypersafety Termination-Insensitive Non-Interference (TI-NI) ?-safety A well-studied security property formalizing the absence of information leakage [Goguen+ 82] 2. Co-termination Hyperliveness Formalize that multiple programs agree on termination Termination-Sensitive NI (TS-NI) = TI-NI Co-termination 3. (TI-/TS-) Generalized NI (GNI) hyperproperties A generalization of NI for non-deterministic programs July 2021 CAV 2021 2
Main Contributions Sound and complete reduction to constraintsolving Key observation: relational verification amounts to synthesis of relational invariants and fair & semantic schedulers New expressive class of predicate constraints pfwCSP Extend the class of CHCs with non-Horn clauses and functional / well-founded predicate variables Stratified CEGIS for pfwCSP solving Combine CEGIS with stratified families of templates for achieving completeness and efficiency Implementation of a solver PCSat and Evaluation Available from: https://github.com/hiroshi-unno/coar July 2021 CAV 2021 3
Relational Verification via Synthesis of Relational Invariants and Fair & Semantic Schedulers 1. 1. ?-safety Hypersafety Termination-Insensitive Non-Interference (TI-NI) ?-safety A well-studied security property formalizing the absence of information leakage [Goguen+ 82] 2. Co-termination Hyperliveness Formalize that multiple programs agree on termination Termination-Sensitive NI (TS-NI) = TI-NI Co-termination 3. (TI-/TS-) Generalized NI (GNI) hyperproperties A generalization of NI for non-deterministic programs July 2021 CAV 2021 4
Example: Termination-Insensitive Non-Interference (TI-NI) 2-safety doubleSquare ,?[Shemer+ 19] computes 2 ?2 in two different ways depending on the high security input Can an attacker infer the value of by observing the low security input ? and the return value ?? doubleSquare(bool h,int x) { int z, y=0; if(h) { z=2*x } else { z=x } while(z>0) { z--; y=y+x } if(!h) { y=2*y } return y; } No! Formally, TI-NI holds: ??,??,??,??,??,??. doubleSquare ??,?? ?? doubleSquare ??,?? ?? ??= ?? ??= ?? July 2021 CAV 2021 5
Example: Co-Termination Hyperliveness prog1(int x, int y) { while(x>0) { x=x y; } } prog2(int x, int y) { while(x>0) { x=x 2*y; } } Do prog1 ?1,?1 and prog2 ?2,?2 agree on termination under the precondition ?1= ?2 ?1= ?2? Yes! Formally, the following holds: ??,??,??,??. ??= ?? ??= ?? ??.prog1 ??,?? ?? prog2 ??,?? ??.prog2 ??,?? ?? prog1 ??,?? July 2021 CAV 2021 6
Example: (TI-/TS-)GNI hyperproperties gniEx ,?non-deterministically returns a value ? ? in two different ways depending on the high security input gniEx(bool high, int low) { if(high) { int x = nondet_int(); if(x >= low) { return x } else { while(true) {} } } else { int x = low; while(nondet_bool()){x++} return x; } } Can an attacker infer the value of by observing the low security input ? and the return value ?? No! Formally, satisfies TI-GNI: ??,??,?,??.gniEx ??,? ?? gniEx ??,? ??.gniEx ??,? ?? ??= ?? gniEx also satisfies TS-GNI: ??,??,?,??.gniEx ??,? ?? ??.gniEx ??,? ?? ??= ?? July 2021 CAV 2021 7
