Formal Verification Techniques Research Articles

Security analysis of GTRBAC and its variants using model checking

Security analysis is a formal verification technique to ascertain certain desirable guarantees on the access control policy specification. Given a set of access control policies, a general safety requirement in such a system is to determine whether a desirable property is satisfied in all the reachable states. Such an analysis calls for the use of formal verification techniques. While formal analysis on traditional Role Based Access Control (RBAC) has been done to some extent, recent extensions to RBAC lack such an analysis. In this paper, we consider the temporal RBAC extensions and propose a formal technique using timed automata to perform security analysis by analyzing both safety and liveness properties. Using safety properties one ensures that something bad never happens while liveness properties show that some good state is also achieved. GTRBAC is a well accepted generalized temporal RBAC model which can handle a wide range of temporal constraints while specifying different access control policies. Analysis of such a model involves a process of mapping a GTRBAC based system into a state transition system. Different reduction rules are proposed to simplify the modeling process depending upon the constraints supported by the system. The effect of different constraints on the modeling process is also studied.

5.4.1 Simulation and Verification of [Dys]functional Behavior Models: Model Checking for SE

AbstractVerification is a key process in the dependability engineering of complex systems. As we have shown in earlier works, formal verification techniques such as model checking can be efficiently used in a Systems Engineering (SE) context, despite their inherent complexity. Considering the widely used Enhanced Function Flow Block Diagrams (EFFBDs), we have indeed developed a formal simulation and verification tool for these functional behavior models. Moreover, great care has been taken to conceal the processing complexity from the tool end‐user.In this paper, we present our latest developments as well as an extension of both method and tool to the case of dysfunctional models, to take into account failures affecting the model elements. By addressing both fault removal and fault forecasting problems with formal methods, we thus hope to improve the dependability analysis practice in SE.

Probabilistic verification and evaluation of Backoff procedure of the WSN ECo-MAC protocol

Communication protocols and techniques are often evaluated using simulation techniques. However, the use of formal modeling and analysis techniques for verification and evaluation in particular for Wireless Sensor Networks (WSN) becomes a necessity. In this paper we present a formal analysis of the backoff procedure integrated in the medium access control protocol named ECo-MAC designed for WSN. We describe this backoff procedure in terms of discrete time Markov chains (DTMCs) and evaluated using the well known probabilistic model checker PRISM. After checking the different invariants of the proposed model, we study the effect of contention window length (in number of time contention unit) on the acceptable number of simultaneous senders in a neighborhood of a given receiver. The obtained quantitative results confirm those provided by the simulation using OPNET tool and justify the validity of the adopted value for the time contention unit TCU.

Using Model Checking for Analyzing Distributed Power Control Problems

Model checking (MC) is a formal verification technique which has been known and still knows a resounding success in the computer science community. Realizing that the distributed power control (PC) problem can be modeled by a timed game between a given transmitter and its environment, the authors wanted to know whether this approach can be applied to distributed PC. It turns out that it can be applied successfully and allows one to analyze realistic scenarios including the case of discrete transmit powers and games with incomplete information. The proposed methodology is as follows. We state some objectives a transmitter-receiver pair would like to reach. The network is modeled by a game where transmitters are considered as timed automata interacting with each other. The objectives are then translated into timed alternating-time temporal logic formulae and MC is exploited to know whether the desired properties are verified and determine a winning strategy.

A Secure Key Establishment Protocol for ZigBee Wireless Sensor Networks

ZigBee is a wireless sensor network standard that defines network and application layers on top of IEEE 802.15.4's physical and medium access control layers. In the latest version of ZigBee, enhancements are prescribed for the security sublayer but we show in this paper that problems persist. In particular, we show that the end-to-end application key establishment protocol is flawed and we propose a secure protocol instead. We do so by using formal verification techniques based on static program analysis and process algebras. We present a way of using formal methods in wireless network security, and propose a secure key establishment protocol for ZigBee networks.

ASIC verification: Integrating formal verification with HDL‐based courses

AbstractThe rapid progress of chip fabrication technology has paved the way to the design of complex ASICs containing several million transistors. According to published work, verification of these ASICs has emerged as a major bottleneck consuming up to three‐quarters of total pre‐silicon resources. This fact has tempted the scientific community to propose alternatives to the classical simulation approach. Recently, formal verification techniques have gained large attention and are becoming a key component in reducing the verification effort required to meet compressed design cycle times. In addition to the reliability factor, these techniques are proven to be cost effective since they help in reducing time allocated for test bench creation which is typically a time consuming and error prone activity. In this paper the formal or static approach is presented in a context that encourages its integration into HDL‐based courses at the senior or first year graduate level. Advantages of the static approach will be discussed by presenting property formulation for selected RTL designs. Moreover, the property language Property Specification Language (PSL), IEEE standard 1850, will be used in presenting property formulations. System Verilog Assertions (SVA) is another viable option for property specification and can be readily substituted for PSL. © 2010 Wiley Periodicals, Inc. Comput Appl Eng Educ 18: 269–276, 2010; Published online in Wiley InterScience (www.interscience.wiley.com); DOI 10.1002/cae.20252

Replication and Abstraction: Symmetry in Automated Formal Verification

This article surveys fundamental and applied aspects of symmetry in system models, and of symmetry reduction methods used to counter state explosion in model checking, an automated formal verification technique. While covering the research field broadly, we particularly emphasize recent progress in applying the technique to realistic systems, including tools that promise to elevate the scope of symmetry reduction to large-scale program verification. The article targets researchers and engineers interested in formal verification of concurrent systems.

A Pre-Injection Analysis for Identifying Fault-Injection Tests for Protocol Validation

Fault-injection (FI) based techniques for dependability assessment of distributed protocols face certain limitations in providing state-space coverage and also incur high operational cost. This is mainly due to lack of complete knowledge of fault-distribution at the protocol level which in turn limits the use of statistical approaches in deriving and estimating the number of test cases to inject. In practice, formal techniques have effectively being used in proving the correctness of dependable distributed protocols, and these techniques traditionally have not been directly associated with experimental validation techniques such as FI-based testing. There exists a gap between these two well-established approaches, viz. formal verification and FI-based validation techniques. If there exists an approach which utilizing a rich set of information pertaining to the protocol operation generated through formal verification process can provide guided-support to perform FI-based validation, then the overall effectiveness of such validation techniques can be greatly improved. With this viewpoint, in this paper, we propose a methodology which utilizes the theorem-proving technique as an underlying formal-engine, and is composed of two novel structured and graphical representation schemes (interactive user-interfaces) for (a) capturing/visualizing information generated over the formal verification process, (b) facilitating interactive analysis through the chosen formal-engine (any theorem-proving tool) and database, and (c) user-guided identification of influential parameters, those eventually used for generating test cases for FI-based testing. A case study of an on-line diagnosis protocol is used to illustrate and establish the viability of the proposed methodology.

Research on Formal Verification Technique for Aircraft Safety-Critical Software

As an important part of airborne avionics system, aircraft safety critical software (ASCS) plays an essential role to the safety of the aircraft, and to ensure its quality and reliability is one of the key problems we are facing. Formal methods have become important means for modeling and verifying safety critical software. In this paper, formal method is introduced into the ASCS verification field and the real-time extended finite state machine model (RT-EFSM) is studied, which includes the detailed real-time extension schemes and its validation methods. The verification process of ASCS based on RT-EFSM is also proposed. Furthermore, combined with the verification of an aircraft inertial/satellite navigation systems, a timed unique input/output sequence (t_UIO) is presented and the automatic generation algorithm of sub-transfer sequences based on t_UIO is given. Finally, the test adequacy criteria are discussed and a time condition coverage criterion is proposed. The actual engineering project application shows that the method proposed in this paper is of great value for the ASCS, which can be generally and effectively used in engineering.

Analysis and Modeling of a Priority Inversion Scheme for Starvation Free Controller Area Networks

Control Area Network (CAN) development began in 1983 and continues today. The forecast for annual world production in 2008 is approximately 65-67 million vehicles with 10-15 CAN nodes per vehicle on average [1]. Although the CAN network is successful in automobile and industry control because the network provides low cost, high reliability, and priority messages, a starvation problem exists in the network because the network is designed to use a fixed priority mechanism. This paper presents a priority inversion scheme, belonging to a dynamic priority mechanism to prevent the starvation problem. The proposed scheme uses one bit to separate all messages into two categories with/without inverted priority. An analysis model is also constructed in this paper. From the model, a message with inverted priority has a higher priority to be processed than messages without inverted priority so its mean waiting time is shorter than the others. Two cases with and without inversion are implemented in our experiments using a probabilistic model checking tool based on an automatic formal verification technique. Numerical results demonstrate that low-priority messages with priority inversion have better expression in the probability in a full queue state than others without inversion. However, our scheme is very simple and efficient and can be easily implemented at the chip level.

Modeling dynamic reconfigurations in Reo using high-level replacement systems

Reo is a channel-based coordination language, wherein circuit-like connectors model and implement interaction protocols in heterogeneous environments that coordinate components or services. Connectors are constructed from primitive channels and can be reconfigured dynamically. Reconfigurations can even execute within a pending I/O transaction. In this article, we formally model and analyze dynamic reconfigurations and show how running coordinators can be reconfigured without the cooperation of their engaged components. We utilize the theory of high-level replacement systems to model rule-based reconfigurations of connectors. This allows us to perform a complex reconfiguration as an atomic step and analyze it using formal verification techniques. Specifically, we formalize the structure of connectors as typed hypergraphs and use critical pair and state space analyses for verification of dynamic reconfigurations. We provide a full implementation of our approach in a framework that includes tools for the definition, analysis, and execution of reconfigurations, and is integrated with two execution engines for Reo. Our framework, moreover, integrates with the graph transformation tools AGG and GROOVE for formal analysis, as well as the Eclipse platform and standard web service technologies.

Parallel and Distributed Invariant Checking of Microcontroller Software

Formal verification techniques are recognized as promising tools for the development of embedded systems. One such technique is invariant checking, which can be applied intuitively by developers as it does not require knowledge of temporal logics. State spaces for invariant checking are built using the same methods as used for model checking. They can become large due to the state-explosion problem. In [mc]square, which is a model checker for microcontroller programs, most of the time is spent building state spaces when checking programs. To improve the performance of [mc]square, we have implemented four parallel and one distributed algorithm for invariant checking. Parallel algorithms are especially helpful as they allow to fully utilize multi-core CPUs. This paper describes several parallel and distributed algorithms and presents a case study that compares these algorithms and shows the performance improvements achieved.

SYSTEM ENGINEERING AND RISK ASSESSMENT IN COMPLEX ORGANIZATION: APPLICATION TO HEALTH CARE ORGANIZATIONS

This paper presents an approach merging System Engineering, Enterprise Modeling and Risk assessment concepts, techniques and methods and formal verification techniques. This approach aims to model and analyze complex socio-technical organization when facing risks which may impact the performance, stability and integrity of the organization. It is applied here to Health Care Organizations' modeling and analysis.

Dynamic symmetry-breaking for Boolean satisfiability

With impressive progress in Boolean Satisfiability (SAT) solving and several extensions to pseudo-Boolean (PB) constraints, many applications that use SAT, such as high-performance formal verification techniques are still restricted to checking satisfiability of certain conditions. However, there is also frequently a need to express a preference for certain solutions. Extending SAT-solving to Boolean optimization allows the use of objective functions to describe a desirable solution. Although recent work in 0---1 Integer Linear Programming (ILP) offers extensions that can optimize a linear objective function, this is often achieved by solving a series of SAT or ILP decision problems. Our work articulates some pitfalls of this approach. An objective function may complicate the use of any symmetry that might be present in the given constraints, even when the constraints are unsatisfiable and the objective function is irrelevant. We propose several new techniques that treat objective functions differently from CNF/PB constraints and accelerate Boolean optimization in many practical cases. We also develop an adaptive flow that analyzes a given Boolean optimization problem and picks the symmetry-breaking technique that is best suited to the problem characteristics. Empirically, we show that for non-trivial objective functions that destroy constraint symmetries, the benefit of static symmetry-breaking is lost but dynamic symmetry-breaking accelerates problem-solving in many cases. We also introduce a new objective function, Localized Bit Selection (LBS), that can be used to specify a preference for bit values in formal verification applications.

Model checking of healthcare domain models

This paper shows the application of a type of formal software verification technique known as lightweight model checking to a domain model in healthcare informatics in general and public health surveillance systems in particular. One of the most complex use cases of such a system is checked using assertions to verify one important system property. This use case is one of the major justifications for the complexity of the domain model. Alloy Analyzer verification tool is utilized for this purpose. Such verification work is very effective in either uncovering design flaws or in providing guarantees on certain desirable system properties in the earlier phases of the development lifecycle of any critical project.

Faster and More Complete Extended Static Checking for the Java Modeling Language

Extended Static Checking (ESC) is a fully automated formal verification technique. Verification in ESC is achieved by translating programs and their specifications into verification conditions (VCs). Proof of a VC establishes the correctness of the program. The implementations of many seemingly simple algorithms are beyond the ability of traditional Extended Static Checking (ESC) tools to verify. Not being able to verify toy examples is often enough to turn users off of the idea of using formal methods. ESC4, the ESC component of the JML4 project, is able to verify many more kinds of methods in part because of its use of novel techniques which apply multiple theorem provers. In particular, we present Offline User-Assisted ESC (OUA-ESC), a new form of verification that lies between ESC and Full Static Program Verification (FSPV). ESC is generally quite efficient, as far as verification tools go, but it is still orders of magnitude slower than simple compilation. As can be imagined, proving VCs is computationally expensive: While small classes can be verified in seconds, verifying larger programs of 50 KLOC can take hours. To help address the added cost of using multiple provers and this lack of scalability, we present the multi-threaded version of ESC4 and its distributed prover back-end.

English

Improving software reliability of mission-critical systems is widely recognised as one of the major challenges. Early detection of errors in software requirements, designs and implementation, need rigorous verification and validation techniques. Several techniques comprising static and dynamic testing approaches are used to improve reliability of mission critical software; however it is hard to balance development time and budget with software reliability. Particularly using dynamic testing techniques, it is hard to ensure software reliability, as exhaustive testing is not possible. On the other hand, formal verification techniques utilise mathematical logic to prove correctness of the software based on given specifications, which in turn improves the reliability of the software. Theorem proving is a powerful formal verification technique that enhances the software reliability for missioncritical aerospace applications. This paper discusses the issues related to software reliability and theorem proving used to enhance software reliability through formal verification technique, based on the experiences with STeP tool, using the conventional and internationally accepted methodologies, models, theorem proving techniques available in the tool without proposing a new model. Defence Science Journal, 2009, 59(3), pp.314-317 , DOI:http://dx.doi.org/10.14429/dsj.59.1527

Integrating Abstraction Techniques for Formal Verification of Analog Designs

The verification of analog designs is a challenging and exhaustive task that requires deep understanding of physical behaviours. In this paper, we propose a qualitative based predicate abstraction method for the verification of a class of non-linear analog circuits. In the proposed method, system equations are automatically extracted from a circuit diagram by means of a bond graph. Verification is applied based on combining techniques from constraint solving and computer algebra along with symbolic model checking. Our methodology has the advantage of avoiding exhaustive simulation normally encountered in the verification of analog designs. To this end, we have used Dymola, Hsolver, SMV and Mathematica to implement the verification flow. We illustrate the methodology on several analog examples including Colpitts and tunnel diode oscillators.

A Faithful Semantics for Generalised Symbolic Trajectory Evaluation

Generalised Symbolic Trajectory Evaluation (GSTE) is a high-capacity formal verification technique for hardware. GSTE uses abstraction, meaning that details of the circuit behaviour are removed from the circuit model. A semantics for GSTE can be used to predict and understand why certain circuit properties can or cannot be proven by GSTE. Several semantics have been described for GSTE. These semantics, however, are not faithful to the proving power of GSTE-algorithms, that is, the GSTE-algorithms are incomplete with respect to the semantics. The abstraction used in GSTE makes it hard to understand why a specific property can, or cannot, be proven by GSTE. The semantics mentioned above cannot help the user in doing so. The contribution of this paper is a faithful semantics for GSTE. That is, we give a simple formal theory that deems a property to be true if-and-only-if the property can be proven by a GSTE-model checker. We prove that the GSTE algorithm is sound and complete with respect to this semantics.

PRISM

Probabilistic model checking is a formal verification technique for the modelling and analysis of stochastic systems. It has proved to be useful for studying a wide range of quantitative properties of models taken from many diffierent application domains. This includes, for example, performance and reliability properties of computer and communication systems. In this paper, we give an overview of the probabilistic model checking tool PRISM, focusing in particular on its support for continuous-time Markov chains and Markov reward models, and how these can be used to analyse performability properties.