Automata and fixpoints for asynchronous hyperproperties

Abstract

Hyperproperties have received increasing attention in the last decade due to their importance e.g. for security analyses. Past approaches have focussed on synchronous analyses, i.e. techniques in which different paths are compared lockstepwise. In this paper, we systematically study asynchronous analyses for hyperproperties by introducing both a novel automata model (Alternating Asynchronous Parity Automata) and the temporal fixpoint calculus H µ , the first fixpoint calculus that can systematically express hyperproperties in an asynchronous manner and at the same time subsumes the existing logic HyperLTL. We show that the expressive power of both models coincides over fixed path assignments. The high expressive power of both models is evidenced by the fact that decision problems of interest are highly undecidable, i.e. not even arithmetical. As a remedy, we propose approximative analyses for both models that also induce natural decidable fragments.

A Temporal Logic for Asynchronous Hyperproperties

“…The temporal logics LTL, CTL * have been extended with quantification over traces and paths, resulting in the temporal logics Hyper-LTL and HyperCTL * [7]. There are also extensions of the μ-calculus, most recently, the temporal fixpoint calculus H μ [15], which extends the linear time μ-calculus [3] with path quantifiers and indexed next operators. [10,11,17].…”

“…However, only a finite number of such predicates is available in each formula. S1S[E] is known to be strictly more expressive than FOL[E] [9], and conjectured to subsume H μ [15]. For S1S [E] and H μ , the model checking problem is in general undecidable; for H μ , two fragments, the ksynchronous, k-context bounded fragments, have been identified for which model checking remains decidable [15].…”

“…S1S[E] is known to be strictly more expressive than FOL[E] [9], and conjectured to subsume H μ [15]. For S1S [E] and H μ , the model checking problem is in general undecidable; for H μ , two fragments, the ksynchronous, k-context bounded fragments, have been identified for which model checking remains decidable [15]. Even though some asynchronous properties can be expressed in these decidable fragments of H μ , there is no systematic study to characterize practical properties that can be encoded.…”

“…For example, consider program P 2 in Fig. 2, where line 4 in P 1 is refined to its intermediate code using a register that stores the value l + 1 and then stores this value in memory location l in lines 4 and Besides HyperLTL, other logics have been proposed that allow trace quantification, for example, H μ [15], which extends the linear time μ-calculus [3] with path quantifiers and indexed next operators. For H μ , the model-checking problem is in general undecidable, but two fragments, the k-synchronous, k-context bounded fragments, have been identified for which model checking remains decidable [15].…”

Asynchronous Extensions of HyperLTL

“…In all these logics, the mechanism for comparing distinct traces is synchronous and consists in evaluating the temporal modalities by a lockstepwise traversal of all the traces assigned to the quantified trace variables. This represents a limitation in various scenarios [19], [20] where properties of interest are instead asynchronous, since these properties require to relate traces at distinct time points which can be arbitrarily far from each other. Recently, two powerful and expressively equivalent formalisms have been introduced [20] for specifying asynchronous linear-time hyperproperties.…”