Cartesian hoare logic for verifying k-safety properties

Abstract

Unlike safety properties which require the absence of a "bad" program trace, k-safety properties stipulate the absence of a "bad" interaction between k traces. Examples of k-safety properties include transitivity, associativity, anti-symmetry, and monotonicity. This paper presents a sound and relatively complete calculus, called Cartesian Hoare Logic (CHL), for verifying k-safety properties. Our program logic is designed with automation and scalability in mind, allowing us to formulate a verification algorithm that automates reasoning in CHL. We have implemented our verification algorithm in a fully automated tool called DESCARTES, which can be used to analyze any k-safety property of Java programs. We have used DESCARTES to analyze user-defined relational operators and demonstrate that DESCARTES is effective at verifying (or finding violations of) multiple k-safety properties.

A monadic framework for relational verification: applied to information security, program equivalence, and optimizations

“…Instead, we make use of the generality of our approach to prove application-specific relational properties (including 4-and 6-ary relations) of higher-order programs with local state. In contrast, most prior relational logics are specialized to proving binary relations, or, at best, properties of n runs of a single first-order program (Sousa and Dillig 2016).…”

“…While some systems have been designed for the efficient verification of specialized relational properties of programs (notably information-flow type systems, e.g., Sabelfeld and Myers (2003a)), others support larger classes of properties. These include tools based on product program constructions for automatically proving relations between first-order imperative programs (e.g., SymDiff (Lahiri et al 2012) and Descartes (Sousa and Dillig 2016)), as well as relational program logics (Benton 2004) that support interactive verification of relational properties within proof assistants (e.g., EasyCrypt (Barthe et al 2012) and RHTT (Nanevski et al 2013)). …”

Verifying Weak Probabilistic Noninterference

“…Hoare logic [27] is one of the most widely-used logics for proof-based verification of software. Variants of Hoare logic have been proposed for verifying relational, and in particular, k-safety properties [28][29][30]. An advantage of these techniques is that they avoid the state-space explosion problem, because they do not check the whole state space of the program.…”

Exploiting Synchrony and Symmetry in Relational Verification

“…Representative efforts include those that target general analysis using relational program logics and frameworks [4,5,8,27,31] or specific applications such as security verification [1,7,9], compiler validation [16,32], and differential program analysis [17,19,[21][22][23]. These efforts are supported by tools that range from automatic verifiers to interactive theorem-provers.…”

“…In contrast, a parallel composition would provide potential for aligning the loop bodies, where relational invariants may be easier to establish than a functional loop invariant. Examples of techniques that exploit opportunities for such alignment include use of type-based analysis with self-composition [29], allowing flexibility in composition to be a mix of sequential and parallel [6], exploiting structurally equivalent programs for compiler validation [32], lockstep execution of loops in reasoning using Cartesian Hoare Logic [27], and merging Horn clause rules for relational verification [13,24].…”