Communicating Sequential Processes Research Articles

CSP2Turtle: Verified Turtle Robot Plans

Software verification is an important approach to establishing the reliability of critical systems. One important area of application is in the field of robotics, as robots take on more tasks in both day-to-day areas and highly specialised domains. Our particular interest is in checking the plans that robots are expected to follow to detect errors that would lead to unreliable behaviour. Python is a popular programming language in the robotics domain through the use of the Robot Operating System (ROS) and various other libraries. Python’s Turtle package provides a mobile agent, which we formally model here using Communicating Sequential Processes (CSP). Our interactive toolchain CSP2Turtle with CSP models and Python components enables plans for the turtle agent to be verified using the FDR model-checker before being executed in Python. This means that certain classes of errors can be avoided, providing a starting point for more detailed verification of Turtle programs and more complex robotic systems. We illustrate our approach with examples of robot navigation and obstacle avoidance in a 2D grid-world. We evaluate our approach and discuss future work, including how our approach could be scaled to larger systems.

Analysis of benchmark program results of worst case execution time for multithreaded programs

<span lang="EN-US">Worst case execution time (WCET) estimation by static analyzers is being investigated with keen interest in view of their importance in designing applications for embedded systems that have real- time requirements. Recent work reported on improving precision of estimates of WCET of multithreaded programs, by improving precision of shared instruction cache analysis, shows significant improvement in WCET estimates. An abstraction of a multithreaded program as Hoare’s communicating sequential processes (CSP) specification program is realized to enable higher precision in micro-architectural modelling unit of WCET analyzer of multithreaded programs. A thread is viewed as a composition of CSP. The WCET of a thread may be viewed as dependent on WCET of processes in a thread and in turn WCET of each process is the WCET of the sub-graph of basic block nodes in the process. Corresponding CSP in interacting threads, based on calls to synchronization primitives wait and notify, generate shared cache interferences to the process in a thread whose WCET is being estimated by the analyzer. A detailed study of how partitioning of a thread into processes yields higher reduction in WCET is performed on benchmark programs. Furthermore, which processes in a thread yield higher reduction in WCET is performed.</span>

Formalization and verification of Kafka messaging mechanism using CSP

Apache Kafka is an open source distributed messaging system based on the publish-subscribe model, which achieves low latency, high throughput and good load balancing. As a popular messaging system, the transmission of messages between applications is one of the core functions of Kafka. Therefore, the reliability and security of data in the process of message transmission in Kafka have become the focus of attention. The formal methods can analyze whether a model is highly credible. Therefore, it is significant to analyze Kafka messaging mechanism which describes the communication process and rules between each module entity in Kafka from the perspective of formal methods. In this paper, we apply the process algebra CSP (Communicating Sequential Processes) and the model checking tool PAT (Process Analysis Toolkit) to analyze Kafka messaging mechanism. The results of verification show that the model caters for its specification and guarantees the reliability of messages in the normal communication process. Moreover, in order to further analyze the security of Kafka messaging mechanism, we add the intruder model and the authentication protocol Kerberos model and compare the verification results of Kafka messaging mechanism with or without the secure protocol Kerberos. The results show that the Kerberos protocol has improved the security of Kafka messaging mechanism in some aspects, but there are still some security loopholes.

A formal framework for security testing of automotive over-the-air update systems

Modern vehicles are comparable to desktop computers due to the increase in connectivity. This fact also extends to potential cyber-attacks. A solution for preventing and mitigating cyber attacks is Over-The-Air (OTA) updates. This solution has also been used for both desktops and mobile phones. The current de facto OTA security system for vehicles is Uptane, which is developed to solve the unique issues vehicles face. The Uptane system needs to have a secure method of updating; otherwise, attackers will exploit it. To this end, we have developed a comprehensive and model-based security testing approach by translating Uptane and our attack model into formal models in Communicating Sequential Processes (CSP). These are combined and verified to generate an exhaustive list of test cases to see to which attacks Uptane may be susceptible. Security testing is then conducted based on these generated test cases, on a test-bed running an implementation of Uptane. The security testing result enables us to validate the security design of Uptane and some vulnerabilities to which it is subject.

Modelling the Turtle Python library in CSP

Software verification is an important tool in establishing the reliability of critical systems. One potential area of application is in the field of robotics, as robots take on more tasks in both day-to-day areas and highly specialised domains. Robots are usually given a plan to follow, if there are errors in this plan the robot will not perform reliably. The capability to check plans for errors in advance could prevent this. Python is a popular programming language in the robotics domain, through the use of the Robot Operating System (ROS) and various other libraries. Python's Turtle package provides a mobile agent, which we formally model here using Communicating Sequential Processes (CSP). Our interactive toolchain CSP2Turtle with CSP model and Python components, enables Turtle plans to be verified in CSP before being executed in Python. This means that certain classes of errors can be avoided, and provides a starting point for more detailed verification of Turtle programs and more complex robotic systems. We illustrate our approach with examples of robot navigation and obstacle avoidance in a 2D grid-world.

DroidFDR: Automatic Classification of Android Malware Using Model Checking

Android faces an increasing threat of malware attacks. The few existing formal detection methods have drawbacks such as complex code modeling, incomplete and inaccurate expression of family properties, and excessive manual participation. To this end, this paper proposes a formal detection method, called DroidFDR, for Android malware classification based on communicating sequential processes (CSP). In this method, the APK file of an application is converted to an easy-to-analyze representation, namely Jimple, in order to model the code behavior with CSP. The process describing the behavior of a sample is inputted to an FDR model checker to be simplified and verified against a process that is automatically abstracted from the malware to express the property of a family. The sample is classified by detecting whether it has the typical behavior of any family property. DroidFDR can capture the behavioral characteristics of malicious code such as control flow, data flow, procedure calls, and API calls. The experimental results show that the automated method can characterize the behavior patterns of applications from the structure level, with a high family classification accuracy of 99.06% in comparison with another formal detection method.

A Graph Transformation Approach for Modeling and Verification of UML 2.0 Sequence Diagrams

Unified Modeling Language (UML) 2.0 Sequence Diagrams (UML 2.0 SD) are used to describe interactions in software systems. These diagrams must be verified in the early stages of software development process to guarantee the production of a reliable system. However, UML 2.0 SD lack formal semantics as all UML specifications, which makes their verification difficult, especially if we are modeling a critical system where the automation of verification is necessary. Communicating Sequential Processes (CSP) is a formal specification language that is suited for analysis and has many automatic verification tools. Thus, UML and CSP have complementary aspects, which are modeling and analysis. Recently, a formalization of UML 2.0 SD using CSP has been proposed in the literature; however, no automation of that formalization exists. In this paper, we propose an approach on the basis of the above formalization and a visual modeling tool to model and automatically transform UML 2.0 SD to CSP ones; thus, the existing CSP model checker can verify them. This approach aims to use UML 2.0 SD for modeling and CSP and its tools for verification. This approach is based on graph transformation, which uses AToM3 tool and proposes a metamodel of UML 2.0 SD and a graph grammar to perform the mapping of the latter into CSP. Failures-Divergence Refinement (FDR) is the model checking tool used to verify the behavioral properties of the source model transformation such as deadlock, livelock and determinism. The proposed approach and tool are illustrated through a case study.

Formalization and Analysis of Ceph Using Process Algebra

Ceph is an object-based parallel distributed file system that provides excellent performance, reliability, and scalability. Additionally, Ceph provides its Cephx authentication system to authenticate users, so that it can identify users and realize authentication. In this paper, we first model the basic architecture of Ceph using process algebra CSP (Communicating Sequential Processes). With the help of the model checker PAT (Process Analysis Toolkit), we feed the constructed model to PAT and then verify several related properties, including Deadlock Freedom, Data Reachability, Data Write Integrity, Data Consistency and Authentication. The verification results show that the original model cannot cater to the Authentication property. Therefore, we formalize a new model of Ceph where Cephx is adopted. In the light of the new verification results, it can be found that Cephx satisfies all these properties.

An executable framework for modeling and validating cooperative capability requirements in emergency response system

As the scale of current systems become larger and larger and their complexity is increasing gradually, research on executable models in the design phase becomes significantly important as it is helpful to simulate the execution process and capture defects of a system in advance. Meanwhile, the capability of a system becomes so important that stakeholders tend to emphasize their capability requirements when developing a system. To deal with the lack of official specifications and the fundamental theory basis for capability requirement, we propose a cooperative capability requirements (CCR) meta-model as a theory basis for researchers to refer to in this research domain, in which we provide detailed definition of the CCR concepts, associations and rules. Moreover, we also propose an executable framework, which may enable modelers to simulate the execution process of a system in advance and do well in filling the inconsistency and semantic gaps between stakeholders' requirements and their models. The primary working mechanism of the framework is to transform the Alf activity meta-model into the communicating sequential process (CSP) process meta-model based on some mapping rules, after which the internal communication mechanism between process nodes is designed to smooth the execution of behaviors in a CSP system. Moreover, a validation method is utilized to check the correctness and consistency of the models, and a self-fixing mechanism is used to fix the errors and warnings captured during the validation process automatically. Finally, a validation report is generated and fed back to the modelers for system optimization.

Modeling and verifying NDN‐based IoV using CSP

AbstractAs a crucial component of intelligent transportation system, Internet of Vehicles (IoV) plays an important role in the smart and intelligent cities. However, current Internet architectures cannot guarantee efficient data delivery and adequate data security for IoV. Therefore, Named Data Networking (NDN), a leading architecture of Information‐Centric Networking (ICN), is introduced into IoV. Although problems about data distribution can be resolved effectively, the combination of NDN and IoV causes some new security issues. In this paper, we apply Communicating Sequential Processes (CSP) to formalize NDN‐based IoV. We mainly focus on its data access mechanism and model this mechanism in detail. By feeding the formalized model into the model checker Process Analysis Toolkit (PAT), we verify four vital properties, namely, deadlock freedom, data reliability, PIT deletion faking, and CS caching pollution. According to verification results, the model cannot ensure the security of data with the appearance of intruders. To solve these problems, we construct a blockchain‐based mechanism by creating a blockchain‐based distribution trusted platform on top of NDN‐based IoV. Through the analysis of the improved model, the blockchain‐based mechanism can truly guarantee the security of NDN‐based IoV.

Denotational semantics of channel mobility in UTP-CSP

In this paper, we present the denotational semantics for channelmobility in the Unifying Theories of Programming (UTP) semanticsframework. The basis for the model is the UTP theory of reactiveprocesses, precisely, the UTP semantics for Communicating SequentialProcesses (CSP), which is extended to allow the mobility ofchannels—the set of channels that a process can use forcommunication (its interface), originally static or constant (setduring the process's definition), is now made dynamic or variable:it can change during the process's execution. A channel is thusmoved around by communicating it via other channels and thenallowing the receiving process to extend its interface with thereceived channel. We introduce a new concept, the capability of a process, which allows separating the ownership of channels fromthe knowledge of their existence. Mobile processes are then definedas having a static capability and a dynamic interface. Operations ofa mobile telecommunications network, e.g., handover, load balancing,are used to illustrate the semantics. We redefine CSP operators andin particular provide the first semantics for the renaming andhiding operators in the context of channel mobility.

A UML 2.0 Activity Diagrams/CSP Integrated Approach for Modeling and Verification of Software Systems

This paper proposes an approach integrating UML 2.0 Activity Diagrams (UML2-AD) and Communicating Sequential Process (CSP) for modeling and verication of software systems. A UML2-AD is used for modeling a software system while CSP is used for verication purposes. The proposed approach consists of another way of transforming UML2-AD models to Communicating Sequential Process (CSP) models. It focuses also on checking the correctness of some properties of the transformation itself. These properties are specified using Linear Temporal Logic (LTL) and verified using the GROOVE model checker. This approach is based on Model Driven Engineering (MDE). The meta-modelling is realized using AToMPM tool while the model transformation and the correctness of its properties are realized using GROOVE tool. Finally, we illustrated this approach through a case study.

Reversible CSP Computations

Reversibility enables a program to be executed both forwards and backwards. This ability allows programmers to backtrack the execution to a previous state. This is essential if the computation is not deterministic because re-running the program forwards may not lead to that state of interest. Reversibility of sequential programs has been well studied and a strong theoretical basis exists. Contrarily, reversibility of concurrent programs is still very young, especially in the practical side. For instance, in the particular case of the Communicating Sequential Processes (CSP) language, reversibility is practically missing. In this article, we present a new technique, including its formal definition and its implementation, to reverse CSP computations. Most of the ideas presented can be directly applied to other concurrent specification languages such as Promela or CCS, but we center the discussion and the implementation on CSP. The technique proposes different forms of reversibility, including strict reversibility and causal-consistent reversibility. On the practical side, we provide an implementation of a system to reverse CSP computations that is able to highlight the source code that is being executed in each forwards/backwards computation step, and that has been optimized to be scalable to real systems.

Hybrid Modeling and Model Transformation of AADL for Verifying the Properties of CPS Space-Time Compositions

The wide application of Cyber Physical System (CPS) makes the security of CPS more and more concerned. As the key factors affecting the safety of CPS, space and time have also become the current research hotspot. The space and time safety of CPS requires that CPS arrives at the specified place at the specified time, time and space should meet the safety requirements of the CPS in the current CPS environment. We call the behavior space-time compositions. In order to solve the problem that CPS lacks the method of modeling and verification of space-time compositions, a hybrid Architecture Analysis & Design Language (AADL) modeling and model transformation method for CPS space-time compositions verification is proposed. Firstly, space-time description capability is extended in the AADL behavior annex and Hybrid AADL (HAADL) is proposed. Secondly, differential equations and space-time compositions vector are introduced in Process Algebra to propose Hybrid Space-Time Communication Sequential Processes (HS-TCSP). Furthermore, the Hybrid AADL is transformed to HS-TCSP. Finally, an example of an aircraft collision avoidance system is used to verify the effectiveness of the method.

Availability analysis of a permissioned blockchain with a lightweight consensus protocol

This paper offers a novel approach to the evaluation of provenance blockchain security and reliability using analytical methods for assessing system availability against malicious miner DoS attacks. In particular, we present the reliability and availability analysis of the LightWeight Mining (LWM) protocol for securing data provenance. Our analysis shows the reliability of the protocol and its ability to protect against malicious miner DoS attacks. We use digital signatures to prove integrity and non-repudiation of messages passing the system. We describe system behaviors using communicating sequential processes (CSP) to check for synchronization within a number of concurrent processes. Queuing theory is used to determine the average waiting time for client blockchain transactions when malicious miners work to slow the system. CSP and queuing theory jointly test the blockchain’s ability to make progress despite the presence of malicious miners. Further, the methodology described can be extended to other blockchain applications. Additional threats, beyond the malicious miner DoS attack, are reserved for future work.

Translating between models of concurrency

Hoare’s Communicating Sequential Processes (CSP) (Hoare in Communicating Sequential Processes, Prentice-Hall Inc, Upper Saddle River, 1985) admits a rich universe of semantic models closely related to the van Glabbeek spectrum. In this paper we study finite observational models, of which at least six have been studied for CSP, namely traces, stable failures, revivals, acceptances, refusal testing and finite linear observations (Roscoe in Understanding concurrent systems. Texts in computer science, Springer, Berlin, 2010). (Others are known.) We show how to use the relatively recently-introduced priority operator (Roscoe in Understanding concurrent systems. Texts in Computer Science, Springer, Berlin, 2010) to transform refinement questions in these models into trace refinement (language inclusion) tests. Furthermore, we are able to generalise this to any (rational) finite observational model. As well as being of theoretical interest, this is of practical significance since the state-of-the-art refinement checking tool FDR4 (Gibson-Robinson et al. in Int J Softw Tools Technol Transf 18(2):149–167, 2016) currently only supports two such models. In particular we study how it is possible to check refinement in a discrete version of the Timed Failures model that supports Timed CSP.

Communicating sequential processes in the go programming language

This 60-minute tutorial will cover the Communicating Sequential Processes (CSP) model of concurrency---a (re-)emerging concurrent programming model that is increasing in popularity, especially in t...

Formalization and Analysis of Haystack Architecture from Process Algebra Perspective

As a storage system architecture optimized for Facebook’s photo application, Haystack has four main advantages than before, including high throughput and low latency, fault-tolerance, cost-effectiveness and simplicity. With its widespread use, its validity and other major properties abstracted from the architecture need to be analyzed in a formal framework. However, to the best of our knowledge, there is nearly no research conducted to describe the communications and properties in Haystack. In this paper, we focus on the internal design of serving and uploading a photo of Haystack architecture and apply Communicating Sequential Processes (CSP) to formalize them in detail. By feeding the models into the model checker Process Analysis Toolkit (PAT), we have verified some crucial properties, including basic property and supplementary properties. Basic property contains Deadlock Freedom. Supplementary properties include synchronous concurrent access, asynchronous concurrent access, synchronous concurrent access with the same client, synchronous concurrent upload and synchronous concurrent upload with the same client. Finally, according to the verification results, we believe that from the CSP’s perspective, the properties of Haystack architecture is valid, which means that it meets the requirements of the documents of Facebook.

Modeling and verifying the topology discovery mechanism of OpenFlow controllers in software-defined networks using process algebra

• Formalizes a general framework for software-defined networks using CSP. • Instantiates and extends the framework to build a system model for TopoGuard. • Finds two loopholes of TopoGuard by verifying the system model in PAT. • Proposes a new topology discovery mechanism to solve the two loopholes. • Discusses the verification results for a larger set of networks. Software-Defined Networking (SDN) is an emerging paradigm, providing separation of concerns between controllers that manage the network and switches that forward data flow. SDN enables network programmability and reduces the complexity of network control and management. The OpenFlow protocol is a widely accepted interface between SDN controllers and switches. OpenFlow controllers are the core of Software-Defined Networks (SDNs). They collect topology information to build a global and shared view of the network, which is used to provide services for topology-dependent core modules and applications. Therefore, the accuracy of the centralized abstract view of the network is of outermost importance for many essential SDN operations. However, the topology discovery mechanism used in almost all the mainstream OpenFlow controllers suffers from two kinds of topology poisoning attacks: Link Fabrication Attack and Host Hijacking Attack. TopoGuard is a wide-spread secure OpenFlow controller, which improves the standard topology discovery mechanism, providing automatic and real-time detection of these two attacks. However, the mechanism of TopoGuard lacks formal verification, especially in the situation where some hosts are migrating to their new locations. In this paper, we propose a general parameterized framework, including the Communicating Sequential Processes (CSP) models of the network components and the interfaces among them. Two loopholes of TopoGuard are found by implementing and verifying the proposed system model, which is an instance of the framework, in the model checker Process Analysis Toolkit (PAT). Moreover, we propose a new topology discovery mechanism based on TopoGuard, which solves the two loopholes.

Formalization and Verification of TESAC Using CSP

Cloud computing is an emerging computing paradigm in IT industries. The wide adoption of cloud computing is raising concerns about management of data in the cloud. Access control and data security are two critical issues of cloud computing. Time-efficient secure access control (TESAC) model is a new data access control scheme which can minimize many significant problems. This scheme has better performance than other existing models in a cloud computing environment. TESAC is attracting more and more attentions from industries. Hence, the reliability of TESAC becomes extremely important. In this paper, we apply Communication Sequential Processes (CSP) to model TESAC, as well as their security properties. We mainly focus on its data access mechanism part and formalize it in detail. Moreover, using the model checker Process Analysis Toolkit (PAT), we have verified that the TESAC model cannot assure the security of data with malicious users. For the purpose of solving this problem, we introduce a new method similar to digital signature. Our study can improve the security and robustness of the TESAC model.