Faulty Logic: Reasoning about Fault Tolerant Programs

Abstract

Abstract. Transient faults are single-shot hardware errors caused by high energy particles from space, manufacturing defects, overheating, and other sources. Such faults can be devastating for security-and safetycritical systems. In order to mitigate these problems, software developers can add redundancy in various ways to their software systems. However, such redundancy is hard to reason about and corner cases are easy to miss, leaving these systems vulnerable. To solve this problem, we have developed a logic, based on Separation Logic, for reasoning about faults as resources. We show how to use this logic as a language of assertions and incorporate it into a Hoare Logic for verifying imperative programs. This Hoare Logic is parameterized by a formal fault model and it can be used to prove imperative programs correct with respect to that model. In addition to developing this basic verification platform, we have designed a modal operator that abstracts away the effects of individual faults, enabling modularization of proofs and greatly simplifying the reasoning involved. The logic is proved sound and studied through a number of examples, including a simplified version of the RSA Sign/Verify algorithm.

FISSC: A Fault Injection and Simulation Secure Collection

“…In order to assist both the development and certification processes, several tools have been developed, either to analyze the robustness of applications against fault injection [10,5,4,14,8,7,11,13], or to harden applications by adding software countermeasures [15,9,12]. All these tools are dedicated to particular fault models and code levels.…”

Fault-Tolerant Resource Reasoning

“…However, as is typical with Hoare logics, their specifications avoid host failures, assuming that if a precondition holds then associated operations will not fail. Faulty Logic [7] by Meola and Walker is an exception. Faulty logic is designed to reason about transient faults, such as random bit flips due to background radiation, which are different in nature from host failure.…”

Using linear codes as a fault countermeasure for nonlinear operations: application to AES and formal verification

“…More precisely, fault attacks may corrupt the logic, the analogue parts or the memory functionality of a circuit. Fault injection methods are numerous, from simple radiation exposures to more complex physical modifications with a Focused Ion Beam (FIB) [30]. Faults effects may differ depending on the hardware technology.…”