Code-level model checking in the software development workflow

Abstract

This experience report describes a style of applying symbolic model checking developed over the course of four years at Amazon Web Services (AWS). Lessons learned are drawn from proving properties of numerous C-based systems, e.g., custom hypervisors, encryption code, boot loaders, and an IoT operating system. Using our methodology, we find that we can prove the correctness of industrial low-level C-based systems with reasonable effort and predictability. Furthermore, AWS developers are increasingly writing their own formal specifications. All proofs discussed in this paper are publicly available on GitHub. CCS CONCEPTS • Software and its engineering → Formal software verification; Model checking; Correctness; • Theory of computation → Program reasoning.

Bridging Arrays and ADTs in Recursive Proofs

“…Correct-by-construction correspondence between low-level code and high-level data types helps to some extent in, e.g., [13] and Cogent [3]. Recent work on "push-button" verification includes a verified TLS library [12], AWS C Common library [11], file system [50], a hyperkernel [42], network functions [56], where the high degree of proof automation is in part achieved by statically bounding the state space of the systems. The latter work [56] specifically notes how non-experts can formulate high-level correctness requirements (their specifications are written in Python), as evidence that refinement-based approaches may ultimately overcome the "specification bottleneck" [6,43].…”

“…Proofs found for one component can be reused while reasoning about another component, or even the system in a whole. Successful examples in large-scale verification projects include a step-wise refinement in seL4 [30] and the integration of model checking to software development workflow in AWS C Common [11].…”

Code‐level model checking in the software development workflow at Amazon Web Services

“…All specifications, proofs, and related artifacts (such as continuous integration reports) described in this article have been integrated into the main AWS C Common repository on GitHub, and are publicly available at https://github.com/awslabs/aws-c-common/. This article is a substantially revised and extended version of our work presented at ICSE 2020 6 . The major difference is the detailed description of our continuous integration architecture and its leverage to integrate proofs into the software development workflow.…”

“…The major difference is the detailed description of our continuous integration architecture and its leverage to integrate proofs into the software development workflow. All tools, scripts, benchmarks, and results of our evaluation are also available on a replication package 7 …”

“…The focus of our work is the foundational security of software running in AWS data centers, SDKs, and devices. The breadth of our work includes boot code, 29 network communication protocols, 30 real‐time operating system code, 31,32 an SDK implementing data structures, 6 and an SDK facilitating principled use of cryptographic primitives.…”