Program Verification Tools Research Articles

Static Verification of Code Access Security Policy Compliance of .NET Applications.

Stack inspection-based sandboxing originated as a security mechanism for safely executing partially trusted code. Today, it is widely used for the more general purpose of supporting the principle of least privilege in component-based software development. In this more general setting, the permissions required by a component to run properly, or the permissions needed by other components to successfully call methods in a given component are conceptually part of the interface specification of the component. Hence, correct documentation of this part of the interface is essential. In this paper, we propose formal component and method contracts for stack inspectionbased sandboxing, and we show that formal verification of these contracts is feasible with state-of-the-art program verification tools. Our contracts are significantly more expressive than existing type systems for stack inspection-based sandboxing. We describe our solution in the context of the sandboxing mechanism in the .NET Framework, called Code Access Security. Our system relies on the Spec# programming language and its accompanying static verification tool.

An Equivalent CTL Formulation for Condition Sequences

A condition system is a form of Petri net that interacts with other condition systems and the environment via state-based signals called conditions. The condition language framework has been used in previous papers to characterize the input/output behavior of such interacting systems, as well as to specify desired control behavior among other things. In this paper, we show that condition sequences (the specification) and condition systems (the model of the system) have an equivalent structure in the computation tree logic (CTL) framework. The primary goals of this work are to be able to utilize existing tools for program verification for our systems, and to make our work more accessible to the temporal logic community.

Transition predicate abstraction and fair termination

Predicate abstraction is the basis of many program verification tools. Until now, the only known way to overcome the inherent limitation of predicate abstraction to safety properties was to manually annotate the finite-state abstraction of a program. We extend predicate abstraction to transition predicate abstraction. Transition predicate abstraction goes beyond the idea of finite abstract-state programs (and checking the absence of loops). Instead, our abstraction algorithm transforms a program into a finite abstract-transition program. Then, a second algorithm checks fair termination. The two algorithms together yield an automated method for the verification of liveness properties under full fairness assumptions (justice and compassion). In summary, we exhibit principles that extend the applicability of predicate abstraction-based program verification to the full set of temporal properties.

Accurate Theorem Proving for Program Verification

Symbolic software verification engines such as Slam and ESC/Java often use automatic theorem provers to implement forms of symbolic simulation. The theorem provers that are used, such as Simplify, usually combine decision procedures for the theories of uninterpreted functions, linear arithmetic, and sometimes bit vectors using techniques proposed by Nelson-Oppen or Shostak. Programming language constructs such as pointers, structures and unions are not directly supported by the provers, and are often encoded imprecisely using axioms and uninterpreted functions. In this paper we describe a more direct and accurate approach towards providing symbolic infrastructure for program verification engines. We propose the use of a theorem prover called Cogent, which provides better accuracy for ANSI-C expressions with the possibility of nested logic quantifiers. The prover’s implementation is based on a machinelevel interpretation of expressions into propositional logic. Cogent’s translation allows the program verification tools to better reason about finite machine-level variables, bit operations, structures, unions, references, pointers and pointer arithmetic. This paper also provides experimental evidence that the proposed approach is practical when applied to industrial program verification.

Interface-Based Specification and Verification of Concurrency Controllers

We present a modular approach to specification and verification of concurrency controllers by decoupling their behavior and interface specifications. The behavior specification of a concurrency controller defines how its shared variables change their values whereas the interface specification defines the order in which a client thread should call its methods. We show that the concurrency controllers can be designed modularly by composing their interfaces. We separate the verification of the concurrency controllers from the verification of the threads that use them. For the verification of the concurrency controllers we use infinite state verification techniques which enable us to verify controllers with parameterized constants and arbitrary number of user threads. We automatically generate Java monitors from the concurrency controller specifications which preserve the verified properties. For the thread verification we use finite state program verification tools which enable us to verify Java threads without any restrictions. We show that the user threads can be verified using stubs generated from the concurrency controller interfaces which improves the efficiency of the thread verification significantly.

Debugging temporal specifications with concept analysis

Program verification tools (such as model checkers and static analyzers) can find many errors in programs. These tools need formal specifications of correct program behavior, but writing a correct specification is difficult, just as writing a correct program is difficult. Thus, just as we need methods for debugging programs, we need methods for debugging specifications.This paper describes a novel method for debugging formal, temporal specifications. Our method exploits the short program execution traces that program verification tools generate from specification violations and that specification miners extract from programs. Manually examining these traces is a straightforward way to debug a specification, but this method is tedious and error-prone because there may be hundreds or thousands of traces to inspect. Our method uses concept analysis to automatically group the traces into highly similar clusters. By examining clusters instead of individual traces, a person can debug a specification with less work.To test our method, we implemented a tool, Cable, for debugging specifications. We have used Cable to debug specifications produced by Strauss, our specification miner. We found that using Cable to debug these specifications requires, on average, less than one third as many user decisions as debugging by examining all traces requires. In one case, using Cable required only 28 decisions, while debugging by examining all traces required 224.

Formal verification of a programming logic for a distributed programming language

This paper presents a method for mechanically proving the soundness of a programming logic for a distributed programming language, in support of the development of verified program verification tools. We focus on: 1. (1) how to formalize the operational semantics of a distributed programming language; 2. (2) how to formalize the concept of program correctness for distributed programs; 3. (3) how to mechanically prove the soundness of a programming logic with respect to the formal semantics of the language; 4. (4) how to use the mechanized and sound logic to develop verification tools with soundness guaranteed; and 5. (5) how to accomplish all above in the same formalism. Our programming logic permits the verification of single processes executing in isolation and, also, the verification of the composition of concurrently executing processes. Our method demonstrates that structuring the specification of operational semantics can ease the creation of a sound and mechanized programming logic for distributed programming languages. We believe that our method can be scaled up to larger distributed programming languages and their programming logics. The Cambridge HOL theorem proving system is used in our research.

Automatic verification of functional programs

We propose an approach to verification of functional programs based on an example of methods and tools developed in functional programming. The program verification procedures and tools developed in the framework of this approach are described.

Evaluation methods in SARA—the graph model simulator

The supported methodology evolving in the SARA (System ARchitects' Apprentice) system creates a design frame-work on which increasingly powerful analytical tools are to be grafted. Control flow analyses and program verification tools have shown promise. However, in the realm of the complex systems which interest us there is a great deal of research and development to be done before we can count on the use of such powerful tools. We must always be prepared to resort to experiments for evaluation of proposed designs. This paper describes a fundamental SARA tool, the graph model simulator. During top-down refinement of a design, the simulator is used to test consistency between the levels of abstraction. During composition, known building blocks are linked together and the composite graph model is tested relative to the lowest top-down model. Design of test environments is integrated with the multilevel design process. The SARA methodology is exemplified through design of a higher level building block to do a simple FFT.

Evaluation methods in SARA—the graph model simulator

The supported methodology evolving in the SARA (System ARchitects' Apprentice) system creates a design frame-work on which increasingly powerful analytical tools are to be grafted. Control flow analyses and program verification tools have shown promise. However, in the realm of the complex systems which interest us there is a great deal of research and development to be done before we can count on the use of such powerful tools. We must always be prepared to resort to experiments for evaluation of proposed designs. This paper describes a fundamental SARA tool, the graph model simulator. During top-down refinement of a design, the simulator is used to test consistency between the levels of abstraction. During composition, known building blocks are linked together and the composite graph model is tested relative to the lowest top-down model. Design of test environments is integrated with the multilevel design process. The SARA methodology is exemplified through design of a higher level building block to do a simple FFT.