Relational abstract interpretation for the verification of 2-hypersafety properties

Abstract

Information flow properties of programs can be formalized as hyperproperties specifying the relation of multiple executions. In this paper, we therefore introduce a framework for proving 2-hypersafety properties by means of abstract interpretation. The main idea is to apply abstract interpretation on the self-compositions of the control flow graphs of programs. As a result, our method is inherently capable of analyzing relational properties of even dissimilar programs.Constructing self-compositions of control flow graphs is nontrivial. Therefore, we present an algorithm for constructing quality self-compositions driven by a tree distance measure between the abstract syntax trees of subprograms. Finally, we demonstrate the applicability of the approach by proving intricate information flow properties of programs written in a simple language for tree manipulation motivated by the Web Services Business Process Execution Language.

Automating Information Flow Analysis of Low Level Code

“…As our case studies show, machine code verification requires flow and path sensitive techniques due to register reuse and complex data/control flow. Hence, compared to [30,38], our techniques is more precise. Third, our approach addresses additional complications due to the lack of support for data structures.…”

“…Relational program verification has been used to prove non-functional properties such as compiler optimization correctness [10], program equivalence [39,38] and information flow security [11,8,30]. Neither addresses verification at the machine level.…”

“…A related paper [10] presents product programs as a mean for reducing relational verification to classical functional verification. Several authors have studied algorithms for constructing and verifying over/under approximations of product programs automatically using typing [47], abstract interpretation [30,38] and symbolic execution [8,39,44]. This work differs in several aspects.…”

Product programs and relational program logics

“…In a nutshell, the type-directed transformation of programs does not self-compose branching statements depending on public variables, but rather uses synchronous programs, and performs copy propagation on self-composed assignments with low expressions to variables. Kovacs, Seidl and Finkbeiner [28] further refine this approach, again by providing a product program that is easier to verify.…”

Hypercollecting semantics and its application to static analysis of information flow

“…Several works have used abstract interpretation in some way. One approach to 2-safety is by forming a product program that encodes execution pairs (Barthe et al 2004;Terauchi and Aiken 2005;Darvas et al 2005), thereby reducing the problem to ordinary safety which can be checked by abstract interpretation (Kovács et al 2013) or other means. Alternatively, a 2-safety property can be checked by dedicated analyses which may rely in part on ordinary abstract interpretations for trace properties (Amtoft et al 2006).…”