Relational Decomposition

Beringer, Lennart

doi:10.1007/978-3-642-22863-6_6

Cited by 25 publications

(24 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For over-approximate relational logic, Beringer [2011] showed how one can decompose relational reasoning into over-approximate Hoare logic reasoning. We show that the same is true for under-approximate relational logic, in which relational reasoning can be decomposed into under-approximate Hoare logic reasoning.…”

Section: Under-approximate Relational Decompositionmentioning

confidence: 99%

See 1 more Smart Citation

Compositional Vulnerability Detection with Insecurity Separation Logic

Murray¹,

Yan²,

Ernst³

2021

Preprint

View full text Add to dashboard Cite

We present the first compositional, incremental static analysis for detecting memory-safety and information leakage vulnerabilities in C-like programs. To do so, we develop the first under-approximate relational program logics, including Insecurity Separation Logic (InsecSL). We show how InsecSL can be automated via backpropagating symbolic execution (BPSE) to build a bottom-up, inter-procedural and incremental analysis for detecting vulnerabilities. We prove our approach sound in Isabelle/HOL and implement it in a proof-of-concept tool, Underflow, for analysing C programs, which we apply to various case studies.

show abstract

Section: Under-approximate Relational Decompositionmentioning

confidence: 99%

“…information leakage). We also present the first sound and and complete under-approximate relational logic, for the language IMP [Nipkow and Klein 2014;Winskel 1993] and generalise Beringer's relational decomposition [Beringer 2011] to the under-approximate setting.…”

Section: Introductionmentioning

confidence: 99%

Compositional Vulnerability Detection with Insecurity Separation Logic

Murray¹,

Yan²,

Ernst³

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Verifying relational properties can also be reduced to synthesizing a suitable product program [5,7]. Some approaches synthesize product programs in the class of sequential compositions automatically, but such product compositions either cannot easily be constructed manually [9] or can only prove relational properties in a heavily restricted class [5,8,13,17,22]. Other approaches construct product programs depending partly on matching control structures between the pairs of programs and establishing the logical equivalence of program conditions included in matched structures.…”

Section: Related Workmentioning

confidence: 99%

Relational Verification via Invariant-Guided Synchronization

Zhou

Heath

Harris

2019

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

Relational properties describe relationships that hold over multiple executions of one or more programs, such as functional equivalence. Conventional approaches for automatically verifying such properties typically rely on syntax-based, heuristic strategies for finding synchronization points among the input programs. These synchronization points are then annotated with appropriate relational invariants to complete the proof. However, when suboptimal synchronization points are chosen the required invariants can be complicated or even inexpressible in the target theory.In this work, we propose a novel approach to verifying relational properties. This approach searches for synchronization points and synthesizes relational invariants simultaneously. Specifically, the approach uses synthesized invariants as a guide for finding proper synchronization points that lead to a complete proof. We implemented our approach as a tool named PEQUOD, which targets Java Virtual Machine (JVM) bytecode. We evaluated PEQUOD by using it to solve verification challenges drawn from the from the research literature and by verifying properties of student-submitted solutions to online challenge problems. The results show that PEQUOD solve verification problems that cannot be addressed by current techniques.

show abstract

“…Many techniques have been applied, several variations of product programs [48], constructing bisimulations between control flow graphs [28], iteratively applying equality axioms [38], or normalising [43] graph representations of the programs. Relational Hoare Logic [10,11,46,12,5] (RHL) was proposed by Benton, in 2004 [10], in the course of proving the correctness of various compiler optimisations. The Hoare triple {P }S{Q} is extended to a Hoare quadruple by inclusion of two statements, rather than one, {P }C 1 ∼ C 2 {Q}.…”

Section: Related Work and Conclusionmentioning

confidence: 99%

Modular Verification of Procedure Equivalence in the Presence of Memory Allocation

Wood

Drossopolou

Lahiri

et al. 2017

Programming Languages and Systems

View full text Add to dashboard Cite

For most high level languages, two procedures are equivalent if they transform a pair of isomorphic stores to isomorphic stores. However, tools for modular checking of such equivalence impose a stronger check where isomorphism is strengthened to equality of stores. This results in the inability to prove many interesting program pairs with recursion and dynamic memory allocation. In this work, we present RIE, a methodology to modularly establish equivalence of procedures in the presence of memory allocation, cyclic data structures and recursion. Our technique addresses the need for finding witnesses to isomorphism with angelic allocation, supports reasoning about equivalent procedures calls when the stores are only locally isomorphic, and reasoning about changes in the order of procedure calls. We have implemented RIE by encoding it in the Boogie program verifier. We describe the encoding and prove its soundness.

show abstract

Relational Decomposition

Cited by 25 publications

References 38 publications

Compositional Vulnerability Detection with Insecurity Separation Logic

Compositional Vulnerability Detection with Insecurity Separation Logic

Relational Verification via Invariant-Guided Synchronization

Modular Verification of Procedure Equivalence in the Presence of Memory Allocation

Contact Info

Product

Resources

About