Symbolic forward/backward traversals of large finite state machines

Cabodi, Gianpiero; Camurati, P.; Quer, Stefano

doi:10.1016/s1383-7621(00)00014-x

Cited by 5 publications

(3 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• BDD-based representations and traversals (BDD), including forward, backward, combined (approximate) forward/ (exact) backward reachability algorithms [14], [15] partitioned BDDs and/or image computation procedures [16], [17] • Interpolant-based verification (ITP), with ad-hoc abstraction and tightening techniques [18], [19], integrated SAT-based approaches [20], [21], Interpolant reduction techniques [22] and Guided Refinement [23] • Property Directed Reachability (PDR) verification strategies [24] Figures 4 and 5 show verification results considering three different unbounded model checking strategies: interpolation (ITP), binary decision diagram reachability (BDD) and Property Directed Reachability strategy (PDR). Results show that the most suitable strategy for the presented security properties verification is PDR.…”

Section: B Verification Strategiesmentioning

confidence: 99%

Secure embedded architectures: Taint properties verification

Cabodi

Camurati

Finocchiaro

et al. 2016

2016 International Conference on Development and Application Systems (DAS)

View full text Add to dashboard Cite

Nowadays embedded devices collect various kinds of information and provide it to communication networks for further processing. These devices often provide critical functionalities that could be exploited by malicious parties. Using formal techniques is a natural way to increase the confidence in the overall embedded system security. However, the major research focus is on verifying only the correctness of encryption algorithms and their implementation in software and hardware and not the whole security process. Following novel research studies, many security requirements of an embedded architecture can be specified as Taint Properties, expressing properties related to information flow and access control. In this paper we define Taint Properties as a way to find out whether there is a path from src to dest, where src is an RTL signal seeded with the Taint and dest is a signal not to be reached by the Taint in order to satisfy the security requirements. In our scenario a Taint is an untrusted code following an illegal path from src to dest. We present a systematic approach to formalize generic security requirements, referring to a model abstraction, and their related Taint Properties of an embedded architecture. First, we present our model abstraction of two selected embedded secure architectures, then we define a portfolio of Taint Properties to verify key secrecy, isolation, attestation, confidentiality and availability features. We finally perform verification of previously defined formal security properties, hence presenting results on two selected embedded architectures proving the effectiveness of our approach.

show abstract

Section: B Verification Strategiesmentioning

confidence: 99%

Secure embedded architectures: Taint properties verification

Cabodi

Camurati

Finocchiaro

et al. 2016

2016 International Conference on Development and Application Systems (DAS)

View full text Add to dashboard Cite

show abstract

“…-BDD-based representations and traversals, including forward, backward, combined (approximate)forward/(exact)backward algorithms [26,27], partitioned BDDs and/or image computation procedures [28,29]. -Interpolant-based verification, with ad-hoc abstraction and tightening techniques [18,19], integrated SAT-based approaches [20,21].…”

Section: The Pdtrav Packagementioning

confidence: 99%

Benchmarking a model checker for algorithmic improvements and tuning for performance

Cabodi

Nocco

Quer

2011

Form Methods Syst Des

Self Cite

View full text Add to dashboard Cite

This paper describes a portfolio-based approach for model checking, i.e., an approach in which several model checking engines are orchestrated to reach the best possible performance on a broad and real set of designs. Model checking algorithms are evaluated through experiments, and experimental data inspire package tuning, as well as new algorithmic features and methodologies. This approach, albeit similar to several industrial and academic experiences, and already applied in other domains, is somehow new to the model checking field. Its contributions lie in the description of how we: (1) characterize and classify benchmarks in a dynamic way, throughout experimental runs, (2) relate model checking problems to algorithms and engines, (3) introduce a dynamic tuning of sub-engines, exploiting an on-the-fly performance analysis, (4) record results of different approaches, and sort out heuristics to target different classes of problems. We provide a detailed description of the experiments performed in preparation of the Model Checking Competition 2010, where PdTRAV, our academic verification tool, won the UNSAT division, while ranking second in the OVERALL category.

show abstract

“…Some of the above contributions are full-length descriptions of results that are available in the conference literature. 19,20 …”

Section: Introductionmentioning

confidence: 99%

Memory optimization in function and set manipulation with BDDs

Cabodi¹,

Quer²,

Camurati³

1998

Softw: Pract. Exper.

View full text Add to dashboard Cite

SUMMARYBinary Decision Diagrams (BDDs) are the state-of-the-art technique for many synthesis, verification and testing problems in CAD for VLSI. Many researchers proposed optimized BDD-based representations, but in many complex applications the (working) memory required is still too much. Virtual memory is no alternative solution, because if the working set size for a program is large and memory accesses are random, an extremely large number of page faults significantly modifies the performance of the software. This paper proposes a solution to this problem for a specific application, namely BDD-based exploration of large state spaces, an issue often found in CAD for VLSI. Our 'divide-and-conquer' approach for reachability analysis is based on decomposition of state sets carried out at different levels and on an effective use of mass memory. As a result, we are able to explore the state space of large Finite State Machines. At the same time, the technique we develop is orthogonal to a variety of symbolic techniques and graph manipulation procedures and it allows reducing complexity of very common operations. Experimental results, on well known synchronous benchmarks usually used in the field of CAD for VLSI, show that this approach is particularly effective on larger problems as decomposition decreases the amount of working memory, avoids page faulting and makes the overall process more efficient.

show abstract

Symbolic forward/backward traversals of large finite state machines

Cited by 5 publications

References 23 publications

Secure embedded architectures: Taint properties verification

Secure embedded architectures: Taint properties verification

Benchmarking a model checker for algorithmic improvements and tuning for performance

Memory optimization in function and set manipulation with BDDs

Contact Info

Product

Resources

About