Hyperproperties are correctness conditions for labelled transition systems that are more expressive than traditional trace properties, with particular relevance to security. Recently, Attiya and Enea studied a notion of strong observational refinement that preserves all hyperproperties. They analyse the correspondence between forward simulation and strong observational refinement in a setting with finite traces only. We study this correspondence in a setting with both finite and infinite traces. In particular, we show that forward simulation does not preserve hyperliveness properties in this setting. We extend the forward simulation proof obligation with a progress condition, and prove that this progressive forward simulation does imply strong observational refinement

Derrick, J.

Doherty, S.

Dongol, B.

Schellhorn, G.

Wehrheim, H.

White Rose Research Online

This is a repository copy of Brief announcement: On strong observational refinement and forward simulation.White Rose Research Online URL for this paper:https://eprints.whiterose.ac.uk/180756/Version: Published VersionProceedings Paper:Derrick, J., Doherty, S., Dongol, B. et al. (2 more authors) (2021) Brief announcement: On strong observational refinement and forward simulation. In: 35th International Symposium on Distributed Computing (DISC 2021). 35th International Symposium on Distributed Computing (DISC 2021), 04-08 Oct 2021, Freiburg, Germany. Leibniz International Proceedings in Informatics (LIPIcs), 209 . Schloss Dagstuhl , 55:1-55:4. ISBN 9783959772105 https://doi.org/10.4230/LIPIcs.DISC.2021.55eprints@whiterose.ac.ukhttps://eprints.whiterose.ac.uk/Reuse This article is distributed under the terms of the Creative Commons Attribution (CC BY) licence. This licence allows you to distribute, remix, tweak, and build upon the work, even commercially, as long as you credit the authors for the original work. More information and the full terms of the licence here: https://creativecommons.org/licenses/ Takedown If you consider content in White Rose Research Online to be in breach of UK law, please notify us by emailing eprints@whiterose.ac.uk including the URL of the record and the reason for the withdrawal request. Brief Announcement: On Strong ObservationalRefinement and Forward SimulationJohn Derrick #University of Sheffield, UKSimon Doherty #University of Sheffield, UKBrijesh Dongol #University of Surrey, UKGerhard Schellhorn #Universität Augsburg, GermanyHeike Wehrheim #Universität Oldenburg, GermanyAbstractHyperproperties are correctness conditions for labelled transition systems that are more expressivethan traditional trace properties, with particular relevance to security. Recently, Attiya and Eneastudied a notion of strong observational refinement that preserves all hyperproperties. They analysethe correspondence between forward simulation and strong observational refinement in a settingwith finite traces only. We study this correspondence in a setting with both finite and infinite traces.In particular, we show that forward simulation does not preserve hyperliveness properties in thissetting. We extend the forward simulation proof obligation with a progress condition, and provethat this progressive forward simulation does imply strong observational refinement.2012 ACM Subject Classification Security and privacy → Formal methods and theory of security;Computing methodologies → Concurrent computing methodologiesKeywords and phrases Strong Observational Refinement, Hyperproperties, Forward SimulationDigital Object Identifier 10.4230/LIPIcs.DISC.2021.55Related Version Full Version: https://arxiv.org/abs/2107.14509Funding John Derrick: EPSRC Grant EP/R032351/1.Brijesh Dongol: EPSRC grants EP/V038915/1, EP/R032556/1, EP/R025134/2 and VeTSS.Heike Wehrheim: DFG Grant SFB 901.1 IntroductionHyperproperties [2] form a large class of properties over sets of sets of traces, characterising,in particular, security properties such as generalised non-interference that are not expressibleover a single trace. Like with trace properties, every hyperproperty can be characterised asthe conjunction of a hypersafety and hyperliveness property.Recently, Attiya and Enea proposed strong observational refinement, a correctness condi-tion that preserves all hyperproperties, even in the presence of an adversarial scheduler. Anobject O1 strongly observationally refines an object O2 if the executions of any program Pusing O1 as scheduled by some admissible deterministic scheduler cannot be observationallydistinguished from those of P using O2 under another deterministic scheduler. They showedthat strong observational refinement preserves all hyperproperties. Furthermore, they provethat forward simulation implies strong observational refinement. Forward simulation alone issound but not complete for ordinary refinement, and in general both backward and forward© John Derrick, Simon Doherty, Brijesh Dongol, Gerhard Schellhorn, and Heike Wehrheim;licensed under Creative Commons License CC-BY 4.035th International Symposium on Distributed Computing (DISC 2021).Editor: Seth Gilbert; Article No. 55; pp. 55:1–55:4Leibniz International Proceedings in InformaticsSchloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany55:2 Brief Announcement: On Strong Observational Refinement and Forward Simulationsimulation are required. Forward simulation is furthermore known to not preserve livenessproperties, which motivates our study of forward simulation and observational refinement inthe context of infinite traces and hyperliveness.As a result we show – by example – that forward simulation does not preserve hyperliveness.Furthermore, forward simulation alone cannot guarantee strong observational refinementwhen requiring admissiblity of schedulers, i.e., when schedulers are required to continuallyschedule enabled actions. To address these limitations, we employ a version of forwardsimulation extended with a progress condition, thereby guaranteeing strong observationalrefinement and preservation of hyperliveness.2 Motivating Exampleint* current_val initially 0int fetch_and_add (int k):F1. do n = LL(& current_val )F2. while (!SC(& current_val , n + k))F3. return nFigure 1 A fetch-and-add with a nonterminating schedule when LL and SC are implemented usingthe algorithm of [4].We give an example of an abstract atomic object O2 and a non-atomic implementationO1 such that there is a forward simulation from O1 to O2, but hyperliveness properties arenot preserved for all schedules. As the atomic abstract object O2 we choose a fetch-and-addobject with just one operation, fetch_and_add(int k), which adds the value integer k to ashared integer variable and returns the value of that variable before the addition. Let P bea program with two threads t1 and t2, each of which executes one fetch_and_add operationand assigns the return value to a local variable of the thread. For any scheduler S, thevariable assignment of both threads will eventually occur. This “eventually” property can beexpressed as a hyperproperty.Now, consider the fetch-and-add implementation presented in Figure 1. This implement-ation uses the load-linked/store-conditional (LL/SC) instruction pair. The LL(ptr)operation loads the value at the location pointed to by the pointer ptr. The SC(ptr,v)conditionally stores the value v at the location pointed to by ptr if the location has notbeen modified by another SC since the executing thread’s most recent LL(ptr) operation. Ifthe update actually occurs, SC returns true, otherwise the location is not modified and SCreturns false. In the first case, we say that the SC succeeds. Otherwise, we say that it fails.Critically, we stipulate that the LL and SC operations are implemented using the algorithmof [4]. This algorithm has the following property. If thread t1 executes an LL operation, andthen thread t2 executes an LL operation before t1 has executed its subsequent SC operation,then that SC is guaranteed to fail. This happens even though there is no interveningmodification of the location.Now, let O1 be a labelled transition system (LTS) representing a multithreaded versionof this fetch_and_add implementation, using the specified LL/SC algorithm. Considerfurthermore the program P (above) running against the object O1. A scheduler can continuallyalternate the LL at line F2 of t1 and that of t2, such that neither fetch_and_add operationever completes. Therefore, unlike when using the O2 object, the variable assignments of Pwill never occur, so the O1 system does not satisfy the hyperproperty for all schedulers.J. Derrick, S. Doherty, B. Dongol, G. Schellhorn, and H. Wehrheim 55:3There is, however, a forward simulation from O1 to O2. The underlying LL/SC imple-mentation can be proven correct by means of forward simulation, as can the fetch_and_addimplementation. Therefore, standard forward simulation is insufficient to show that allhyperproperties are preserved, contradicting Lemma 5.2 of [1].3 Progressive Forward Simulation implies Strong Observ. RefinementWe will use the notation of Attiya and Enea [1], in particular that of an LTS A = (Q, Σ, s0, δ)and of a (deterministic, admissible) scheduler S : Σ∗ → 2Σ (full definitions can also befound in [3]). The main change we make is that the traces in trace sets T (A) and T (A, S)(S-scheduled traces) now include finite and infinite sequences1. A scheduler is admitted by anLTS A if for all finite traces σ of A consistent with S, the scheduler satisfies (i) S(σ) is non-empty and (ii) all actions in S(σ) are enabled in state(σ). Besides being admissible, schedulersfor programs P and objects O (LTSs of the form P × O) also have to be deterministic:they must resolve the nondeterminism on the actions of the object. An object O1 stronglyobservationally refines the object O2, written O1 ≤S O2, iff for every deterministic schedulerS1 admitted by P × O1 there exists a deterministic scheduler S2 admitted by P × O2 suchthat T (P × O1, S1)♣ΣP = T (P × O2, S2)♣ΣP for all programs P .Contrary to the claim in [1], standard forward simulation does not imply strong ob-servational refinement (details in [3]). In the example given in Section 2, a deterministicadmissible scheduler S1 for P and O1 could drive P × O1’s execution along the infinite traceof LL and SC operations, so that calls to fetch_and_add never return. On the other hand,any scheduler for the O2 system must eventually execute call and return actions for bothfetch_and_add operations, and subsequently execute the writes to the program variables.Thus, T (P × O1, S1)♣ΣP ≠ T (P × O2, S2)♣ΣP . To guarantee strong observational refinement,forward simulation additionally has to guarantee some sort of progress, so that the schedulerS2 is always able to schedule some action without producing a trace not present in P × O1under S1. This guarantee can be made if we disallow infinite stuttering.▶ Definition 1 (Progressive Forward Simulation). Let Ai = (Qi, Σi, si0, δi), i = 1, 2, be twoLTSs and Γ an alphabet. A relation F ⊆ Q1 × Q2 together with a well-founded order≪ ⊆ Q1 × Q1 is called a progressive Γ-forward simulation from A1 to A2 iff(s10, s20) ∈ F , andfor all (s1, s2) ∈ F , if (s1, a, s′1) ∈ δ1 and a ∈ Σ1, then there exist α ∈ Σ∗2 and s′2 ∈ Q2such that a ♣ Γ = α ♣ Γ, (s2, α, s′2) ∈ δ2 and (s′1, s′2) ∈ F . Whenever α = ε then s′1 ≪ s1.The definition requires that the concrete state decreases in the well-founded order whenthe abstract sequence α in the forward simulation is empty and s2 = s′2 (stuttering).Progressiveness prohibits an infinite sequence of concrete internal steps that map to theempty abstract sequence. For object O1 above with the fetch_and_add implementation nosuch well-founded ordering can be given. We have (full proof in [3]):▶ Theorem 2. If there exists a progressive (C ∪ R)-forward simulation from O1 to O2, thenO1 ≤S O2.1 The work of [1] just considers finite traces. However, they still assume schedulers to always be able toschedule a next action which seems to contradict the fact that all traces are finite.DISC 202155:4 Brief Announcement: On Strong Observational Refinement and Forward Simulation4 ConclusionIn this paper, we have reported on our findings that forward simulation does not implystrong observational refinement in a setting with infinite traces. We have proposed a notionof progressive forward simulation implying strong observational refinement. In future work,we will investigate whether the reverse direction also holds.References1 H. Attiya and C. Enea. Putting strong linearizability in context: Preserving hyperpropertiesin programs that use concurrent objects. In J. Suomela, editor, DISC, volume 146 of LIPIcs,pages 2:1–2:17. Schloss Dagstuhl, 2019. doi:10.4230/LIPIcs.DISC.2019.2.2 M. R. Clarkson and F. B. Schneider. Hyperproperties. J. Comput. Secur., 18(6):1157–1210,2010. doi:10.3233/JCS-2009-0393.3 J. Derrick, S. Doherty, B. Dongol, G. Schellhorn, and H. Wehrheim. On strong observationalrefinement and forward simulation, 2021. arXiv:2107.14509.4 V. Luchangco, M. Moir, and N. Shavit. Nonblocking k-compare-single-swap. In SPAA, pages314–323. ACM, 2003. doi:10.1145/777412.777468.

Brief announcement: On strong observational refinement and forward simulation

Derrick, John

Doherty, Simon

Dongol, Brijesh

Schellhorn, Gerhard

Wehrheim, Heike

Dagstuhl Research Online Publication Server

Brief Announcement: On Strong ObservationalRefinement and Forward SimulationJohn Derrick #University of Sheffield, UKSimon Doherty #University of Sheffield, UKBrijesh Dongol #University of Surrey, UKGerhard Schellhorn #Universität Augsburg, GermanyHeike Wehrheim #Universität Oldenburg, GermanyAbstractHyperproperties are correctness conditions for labelled transition systems that are more expressivethan traditional trace properties, with particular relevance to security. Recently, Attiya and Eneastudied a notion of strong observational refinement that preserves all hyperproperties. They analysethe correspondence between forward simulation and strong observational refinement in a settingwith finite traces only. We study this correspondence in a setting with both finite and infinite traces.In particular, we show that forward simulation does not preserve hyperliveness properties in thissetting. We extend the forward simulation proof obligation with a progress condition, and provethat this progressive forward simulation does imply strong observational refinement.2012 ACM Subject Classification Security and privacy → Formal methods and theory of security;Computing methodologies → Concurrent computing methodologiesKeywords and phrases Strong Observational Refinement, Hyperproperties, Forward SimulationDigital Object Identifier 10.4230/LIPIcs.DISC.2021.55Related Version Full Version: https://arxiv.org/abs/2107.14509Funding John Derrick: EPSRC Grant EP/R032351/1.Brijesh Dongol: EPSRC grants EP/V038915/1, EP/R032556/1, EP/R025134/2 and VeTSS.Heike Wehrheim: DFG Grant SFB 901.1 IntroductionHyperproperties [2] form a large class of properties over sets of sets of traces, characterising,in particular, security properties such as generalised non-interference that are not expressibleover a single trace. Like with trace properties, every hyperproperty can be characterised asthe conjunction of a hypersafety and hyperliveness property.Recently, Attiya and Enea proposed strong observational refinement, a correctness condi-tion that preserves all hyperproperties, even in the presence of an adversarial scheduler. Anobject O1 strongly observationally refines an object O2 if the executions of any program Pusing O1 as scheduled by some admissible deterministic scheduler cannot be observationallydistinguished from those of P using O2 under another deterministic scheduler. They showedthat strong observational refinement preserves all hyperproperties. Furthermore, they provethat forward simulation implies strong observational refinement. Forward simulation alone issound but not complete for ordinary refinement, and in general both backward and forward© John Derrick, Simon Doherty, Brijesh Dongol, Gerhard Schellhorn, and Heike Wehrheim;licensed under Creative Commons License CC-BY 4.035th International Symposium on Distributed Computing (DISC 2021).Editor: Seth Gilbert; Article No. 55; pp. 55:1–55:4Leibniz International Proceedings in InformaticsSchloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany55:2 Brief Announcement: On Strong Observational Refinement and Forward Simulationsimulation are required. Forward simulation is furthermore known to not preserve livenessproperties, which motivates our study of forward simulation and observational refinement inthe context of infinite traces and hyperliveness.As a result we show – by example – that forward simulation does not preserve hyperliveness.Furthermore, forward simulation alone cannot guarantee strong observational refinementwhen requiring admissiblity of schedulers, i.e., when schedulers are required to continuallyschedule enabled actions. To address these limitations, we employ a version of forwardsimulation extended with a progress condition, thereby guaranteeing strong observationalrefinement and preservation of hyperliveness.2 Motivating Exampleint* current_val initially 0int fetch_and_add (int k):F1. do n = LL(& current_val )F2. while (!SC(& current_val , n + k))F3. return nFigure 1 A fetch-and-add with a nonterminating schedule when LL and SC are implemented usingthe algorithm of [4].We give an example of an abstract atomic object O2 and a non-atomic implementationO1 such that there is a forward simulation from O1 to O2, but hyperliveness properties arenot preserved for all schedules. As the atomic abstract object O2 we choose a fetch-and-addobject with just one operation, fetch_and_add(int k), which adds the value integer k to ashared integer variable and returns the value of that variable before the addition. Let P bea program with two threads t1 and t2, each of which executes one fetch_and_add operationand assigns the return value to a local variable of the thread. For any scheduler S, thevariable assignment of both threads will eventually occur. This “eventually” property can beexpressed as a hyperproperty.Now, consider the fetch-and-add implementation presented in Figure 1. This implement-ation uses the load-linked/store-conditional (LL/SC) instruction pair. The LL(ptr)operation loads the value at the location pointed to by the pointer ptr. The SC(ptr,v)conditionally stores the value v at the location pointed to by ptr if the location has notbeen modified by another SC since the executing thread’s most recent LL(ptr) operation. Ifthe update actually occurs, SC returns true, otherwise the location is not modified and SCreturns false. In the first case, we say that the SC succeeds. Otherwise, we say that it fails.Critically, we stipulate that the LL and SC operations are implemented using the algorithmof [4]. This algorithm has the following property. If thread t1 executes an LL operation, andthen thread t2 executes an LL operation before t1 has executed its subsequent SC operation,then that SC is guaranteed to fail. This happens even though there is no interveningmodification of the location.Now, let O1 be a labelled transition system (LTS) representing a multithreaded versionof this fetch_and_add implementation, using the specified LL/SC algorithm. Considerfurthermore the program P (above) running against the object O1. A scheduler can continuallyalternate the LL at line F2 of t1 and that of t2, such that neither fetch_and_add operationever completes. Therefore, unlike when using the O2 object, the variable assignments of Pwill never occur, so the O1 system does not satisfy the hyperproperty for all schedulers.J. Derrick, S. Doherty, B. Dongol, G. Schellhorn, and H. Wehrheim 55:3There is, however, a forward simulation from O1 to O2. The underlying LL/SC imple-mentation can be proven correct by means of forward simulation, as can the fetch_and_addimplementation. Therefore, standard forward simulation is insufficient to show that allhyperproperties are preserved, contradicting Lemma 5.2 of [1].3 Progressive Forward Simulation implies Strong Observ. RefinementWe will use the notation of Attiya and Enea [1], in particular that of an LTS A = (Q, Σ, s0, δ)and of a (deterministic, admissible) scheduler S : Σ∗ → 2Σ (full definitions can also befound in [3]). The main change we make is that the traces in trace sets T (A) and T (A, S)(S-scheduled traces) now include finite and infinite sequences1. A scheduler is admitted by anLTS A if for all finite traces σ of A consistent with S, the scheduler satisfies (i) S(σ) is non-empty and (ii) all actions in S(σ) are enabled in state(σ). Besides being admissible, schedulersfor programs P and objects O (LTSs of the form P × O) also have to be deterministic:they must resolve the nondeterminism on the actions of the object. An object O1 stronglyobservationally refines the object O2, written O1 ≤S O2, iff for every deterministic schedulerS1 admitted by P × O1 there exists a deterministic scheduler S2 admitted by P × O2 suchthat T (P × O1, S1)|ΣP = T (P × O2, S2)|ΣP for all programs P .Contrary to the claim in [1], standard forward simulation does not imply strong ob-servational refinement (details in [3]). In the example given in Section 2, a deterministicadmissible scheduler S1 for P and O1 could drive P × O1’s execution along the infinite traceof LL and SC operations, so that calls to fetch_and_add never return. On the other hand,any scheduler for the O2 system must eventually execute call and return actions for bothfetch_and_add operations, and subsequently execute the writes to the program variables.Thus, T (P × O1, S1)|ΣP ≠ T (P × O2, S2)|ΣP . To guarantee strong observational refinement,forward simulation additionally has to guarantee some sort of progress, so that the schedulerS2 is always able to schedule some action without producing a trace not present in P × O1under S1. This guarantee can be made if we disallow infinite stuttering.▶ Definition 1 (Progressive Forward Simulation). Let Ai = (Qi, Σi, si0, δi), i = 1, 2, be twoLTSs and Γ an alphabet. A relation F ⊆ Q1 × Q2 together with a well-founded order≪ ⊆ Q1 × Q1 is called a progressive Γ-forward simulation from A1 to A2 iff(s10, s20) ∈ F , andfor all (s1, s2) ∈ F , if (s1, a, s′1) ∈ δ1 and a ∈ Σ1, then there exist α ∈ Σ∗2 and s′2 ∈ Q2such that a | Γ = α | Γ, (s2, α, s′2) ∈ δ2 and (s′1, s′2) ∈ F . Whenever α = ε then s′1 ≪ s1.The definition requires that the concrete state decreases in the well-founded order whenthe abstract sequence α in the forward simulation is empty and s2 = s′2 (stuttering).Progressiveness prohibits an infinite sequence of concrete internal steps that map to theempty abstract sequence. For object O1 above with the fetch_and_add implementation nosuch well-founded ordering can be given. We have (full proof in [3]):▶ Theorem 2. If there exists a progressive (C ∪ R)-forward simulation from O1 to O2, thenO1 ≤S O2.1 The work of [1] just considers finite traces. However, they still assume schedulers to always be able toschedule a next action which seems to contradict the fact that all traces are finite.DISC 202155:4 Brief Announcement: On Strong Observational Refinement and Forward Simulation4 ConclusionIn this paper, we have reported on our findings that forward simulation does not implystrong observational refinement in a setting with infinite traces. We have proposed a notionof progressive forward simulation implying strong observational refinement. In future work,we will investigate whether the reverse direction also holds.References1 H. Attiya and C. Enea. Putting strong linearizability in context: Preserving hyperpropertiesin programs that use concurrent objects. In J. Suomela, editor, DISC, volume 146 of LIPIcs,pages 2:1–2:17. Schloss Dagstuhl, 2019. doi:10.4230/LIPIcs.DISC.2019.2.2 M. R. Clarkson and F. B. Schneider. Hyperproperties. J. Comput. Secur., 18(6):1157–1210,2010. doi:10.3233/JCS-2009-0393.3 J. Derrick, S. Doherty, B. Dongol, G. Schellhorn, and H. Wehrheim. On strong observationalrefinement and forward simulation, 2021. arXiv:2107.14509.4 V. Luchangco, M. Moir, and N. Shavit. Nonblocking k-compare-single-swap. In SPAA, pages314–323. ACM, 2003. doi:10.1145/777412.777468.

English

Brief Announcement: On Strong Observational Refinement and Forward Simulation

https://eprints.whiterose.ac.uk/180756/6/LIPIcs-DISC-2021-55.pdf

Brief announcement: On strong observational refinement and forward simulation

Abstract

Similar works

Full text

Available Versions

White Rose Research Online

Dagstuhl Research Online Publication Server