183 research outputs found
A Temporal Logic for Hyperproperties
Hyperproperties, as introduced by Clarkson and Schneider, characterize the
correctness of a computer program as a condition on its set of computation
paths. Standard temporal logics can only refer to a single path at a time, and
therefore cannot express many hyperproperties of interest, including
noninterference and other important properties in security and coding theory.
In this paper, we investigate an extension of temporal logic with explicit path
variables. We show that the quantification over paths naturally subsumes other
extensions of temporal logic with operators for information flow and knowledge.
The model checking problem for temporal logic with path quantification is
decidable. For alternation depth 1, the complexity is PSPACE in the length of
the formula and NLOGSPACE in the size of the system, as for linear-time
temporal logic
Deductive Controller Synthesis for Probabilistic Hyperproperties
Probabilistic hyperproperties specify quantitative relations between the
probabilities of reaching different target sets of states from different
initial sets of states. This class of behavioral properties is suitable for
capturing important security, privacy, and system-level requirements. We
propose a new approach to solve the controller synthesis problem for Markov
decision processes (MDPs) and probabilistic hyperproperties. Our specification
language builds on top of the logic HyperPCTL and enhances it with structural
constraints over the synthesized controllers. Our approach starts from a family
of controllers represented symbolically and defined over the same copy of an
MDP. We then introduce an abstraction refinement strategy that can relate
multiple computation trees and that we employ to prune the search space
deductively. The experimental evaluation demonstrates that the proposed
approach considerably outperforms HyperProb, a state-of-the-art SMT-based model
checking tool for HyperPCTL. Moreover, our approach is the first one that is
able to effectively combine probabilistic hyperproperties with additional
intra-controller constraints (e.g. partial observability) as well as
inter-controller constraints (e.g. agreements on a common action)
Smart Contract Synthesis Modulo Hyperproperties
Smart contracts are small but highly security-critical programs that
implement wallets, token systems, auctions, crowd funding systems, elections,
and other multi-party transactions on the blockchain. A broad range of methods
has been developed to ensure that a smart contract is functionally correct.
However, smart contracts often additionally need to satisfy certain
hyperproperties, such as symmetry, determinism, or an information flow policy.
In this paper, we show how a synthesis method for smart contracts can ensure
that the contract satisfies its desired hyperproperties. We build on top of a
recently developed synthesis approach from specifications in the temporal logic
TSL. We present HyperTSL, an extension of TSL for the specification of
hyperproperties of infinite-state software. As a preprocessing step, we show
how to detect if a hyperproperty has an equivalent formulation as a (simpler)
trace property. Finally, we describe how to refine a synthesized contract to
adhere to its HyperTSL specification.Comment: published at 36th IEEE Computer Security Foundations Symposium (CSF
2023
Automata-Based Software Model Checking of Hyperproperties
We develop model checking algorithms for Temporal Stream Logic (TSL) and
Hyper Temporal Stream Logic (HyperTSL) modulo theories. TSL extends Linear
Temporal Logic (LTL) with memory cells, functions and predicates, making it a
convenient and expressive logic to reason over software and other systems with
infinite data domains. HyperTSL further extends TSL to the specification of
hyperproperties - properties that relate multiple system executions. As such,
HyperTSL can express information flow policies like noninterference in software
systems. We augment HyperTSL with theories, resulting in HyperTSL(T),and build
on methods from LTL software verification to obtain model checking algorithms
for TSL and HyperTSL(T). This results in a sound but necessarily incomplete
algorithm for specifications contained in the forall*exists* fragment of
HyperTSL(T). Our approach constitutes the first software model checking
algorithm for temporal hyperproperties with quantifier alternations that does
not rely on a finite-state abstraction
Logical methods for the hierarchy of hyperlogics
In this thesis, we develop logical methods for reasoning about hyperproperties. Hyperproperties describe relations between multiple executions of a system. Unlike trace properties, hyperproperties comprise relational properties like noninterference, symmetry, and robustness. While trace properties have been studied extensively, hyperproperties form a relatively new concept that is far from fully understood. We study the expressiveness of various hyperlogics and develop algorithms for their satisfiability and synthesis problems. In the first part, we explore the landscape of hyperlogics based on temporal logics, first-order and second-order logics, and logics with team semantics. We establish that first-order/second-order and temporal hyperlogics span a hierarchy of expressiveness, whereas team logics constitute a radically different way of specifying hyperproperties. Furthermore, we introduce the notion of temporal safety and liveness, from which we obtain fragments of HyperLTL (the most prominent hyperlogic) with a simpler satisfiability problem. In the second part, we develop logics and algorithms for the synthesis of smart contracts. We introduce two extensions of temporal stream logic to express (hyper)properties of infinite-state systems. We study the realizability problem of these logics and define approximations of the problem in LTL and HyperLTL. Based on these approximations, we develop algorithms to construct smart contracts directly from their specifications.In dieser Arbeit beschreiben wir logische Methoden, um über Hypereigenschaften zu argumentieren. Hypereigenschaften beschreiben Relationen zwischen mehreren Ausführungen eines Systems. Anders als pfadbasierte Eigenschaften können Hypereigenschaften relationale Eigenschaften wie Symmetrie, Robustheit und die Abwesenheit von Informationsfluss ausdrücken. Während pfadbasierte Eigenschaften in den letzten Jahrzehnten ausführlich erforscht wurden, sind Hypereigenschaften ein relativ neues Konzept, das wir noch nicht vollständig verstehen. Wir untersuchen die Ausdrucksmächtigkeit verschiedener Hyperlogiken und entwickeln ausführbare Algorithmen, um deren Erfüllbarkeits- und Syntheseproblem zu lösen. Im ersten Teil erforschen wir die Landschaft der Hyperlogiken basierend auf temporalen Logiken, Logiken erster und zweiter Ordnung und Logiken mit Teamsemantik. Wir stellen fest, dass temporale Logiken und Logiken erster und zweiter Ordnung eine Hierarchie an Ausdrucksmächtigkeit aufspannen. Teamlogiken hingegen spezifieren Hypereigenschaften auf eine radikal andere Art. Wir führen außerdem das Konzept von temporalen Sicherheits- und Lebendigkeitseigenschaften ein, durch die Fragmente der bedeutensten Logik HyperLTL entstehen, für die das Erfüllbarkeitsproblem einfacher ist. Im zweiten Teil entwickeln wir Logiken und Algorithmen für die Synthese digitaler Verträge. Wir führen zwei Erweiterungen temporaler Stromlogik ein, um (Hyper)eigenschaften in unendlichen Systemen auszudrücken. Wir untersuchen das Realisierungsproblem dieser Logiken und definieren Approximationen des Problems in LTL und HyperLTL. Basierend auf diesen Approximationen entwickeln wir Algorithmen, die digitale Verträge direkt aus einer Spezifikation erstellen
Realizing Omega-regular Hyperproperties
We studied the hyperlogic HyperQPTL, which combines the concepts of trace
relations and -regularity. We showed that HyperQPTL is very expressive,
it can express properties like promptness, bounded waiting for a grant,
epistemic properties, and, in particular, any -regular property. Those
properties are not expressible in previously studied hyperlogics like HyperLTL.
At the same time, we argued that the expressiveness of HyperQPTL is optimal in
a sense that a more expressive logic for -regular hyperproperties would
have an undecidable model checking problem. We furthermore studied the
realizability problem of HyperQPTL. We showed that realizability is decidable
for HyperQPTL fragments that contain properties like promptness. But still, in
contrast to the satisfiability problem, propositional quantification does make
the realizability problem of hyperlogics harder. More specifically, the
HyperQPTL fragment of formulas with a universal-existential propositional
quantifier alternation followed by a single trace quantifier is undecidable in
general, even though the projection of the fragment to HyperLTL has a decidable
realizability problem. Lastly, we implemented the bounded synthesis problem for
HyperQPTL in the prototype tool BoSy. Using BoSy with HyperQPTL specifications,
we have been able to synthesize several resource arbiters. The synthesis
problem of non-linear-time hyperlogics is still open. For example, it is not
yet known how to synthesize systems from specifications given in branching-time
hyperlogics like HyperCTL.Comment: International Conference on Computer Aided Verification (CAV 2020
- …