Formal Reasoning About the Security of Amazon Web Services

Abstract

We report on the development and use of formal verification tools within Amazon Web Services (AWS) to increase the security assurance of its cloud infrastructure and to help customers secure themselves. We also discuss some remaining challenges that could inspire future research in the community.

Code-level model checking in the software development workflow

“…Over the last 16 years, automated reasoning techniques (e.g., model checking) have evolved significantly [10,15]. As a consequence, several software verification frameworks have emerged in the literature [5]; with many applications in the industrial setting [7,12,14,27]. Some papers [8,20,23] describe how human factors impact the adoption and integration of formal verification techniques into well-established software engineering process.…”

Scaling static analyses at Facebook

“…Rather, we present our rationale for, and results from, using techniques similar to ones that might be encountered at the edge of the research literature, not only simple techniques that are much easier to make scale. Our goal is to complement other reports on industrial static analysis and formal methods, 1,6,13,17 and we hope that such perspectives can provide input both to future research and to further industrial use of static analysis.…”

Domain-independent interprocedural program analysis using block-abstraction memoization

“…Software verification has been successfully applied to improve the quality and reliability of computer programs [2,3,19,22,28,30,40]. In the last decades, several algorithms and approaches were developed to perform software model checking for various kinds of C programs.…”