An Automatically Verified Prototype of the Tokeneer ID Station Specification

Abstract

The Tokeneer project was an initiative set forth by the National Security Agency (NSA, USA) to be used as a demonstration that developing highly secure systems can be made by applying rigorous methods in a cost effective manner. Altran Praxis (UK) was selected by NSA to carry out the development of the Tokeneer ID Station. The company wrote a Z specification later implemented in the SPARK Ada programming language, which was verified using the SPARK Examiner toolset. In this paper, we show that the Z specification can be easily and naturally encoded in the {log} set constraint language, thus generating a functional prototype. Furthermore, we show that {log}'s automated proving capabilities can discharge all the proof obligations concerning state invariants as well as important security properties. As a consequence, the prototype can be regarded as correct with respect to the verified properties. This provides empirical evidence that Z users can use {log} to generate correct prototypes from their Z specifications. In turn, these prototypes enable or simplify some verification activities discussed in the paper.

A Decision Procedure for a Theory of Finite Sets with Finite Integer Intervals

“…Several in-depth empirical evaluations provide evidence that {log} is able to solve non-trivial problems [11,23,13,24]; in particular as an automated verifier of security properties [16,17].…”

“…3. Rules ( 16) and (17) trivially terminate. This is important because other rules in Figures 2-5 produce constraints of the form…”

“…Then, {log} users can write programs and prove their properties using the same and only code and tool, all within set theory. As a satisfiability solver, {log} has proved to solve non-trivial problems [16,17]. After presenting the implementation of L [ ] in {log} we provide empirical evidence that it is useful in practice through a preliminary empirical evaluation and a case study based on the elevator algorithm.…”