Deciding Hyperproperties

Transcription

1 ne.jpeg Deciding Hyperproperties Bernd Finkeiner nd Christopher Hhn Rective Systems Group Srlnd University, Germny Highlights of Logic, Gmes nd Automt Brussels, Septemer

2 Informti Lekge Hertleed - 4.5m ptient informti leked Goto Fil - encrypti of >300m devices roken Shellshock - we servers ttckle for 22 yers 1

3 HyperLTL - A Logic for Informti-flow Ctrol [Clrks, Finkeiner, Koleini, Micinski, Re, Sánchez, 14] Oservtil Determinism: Progrm ppers deterministic to low security users. π. π. (I π = I π ) (O π = O π ) Generlized Ninterference:... dditilly low-security outputs my not e ltered y injecti of high-security inputs. π. π. π. (HighI π = HighI π ) (O π = O π ) 2

4 HyperLTL - An Extensi of LTL LTL logicl cnectives:, temporl cnectives: - glolly - next is stisfied y {} ω s well s {, } ω is unstisfile. HyperLTL LTL + explicit trce quntifiers: Oservtil Determinism: π. π. (I π = I π ) (O π = O π ) π. π. π π is stisfile y {{} ω, {} ω }. defines set of computti trces (trce property) defines set of sets of computti trces (hyperproperty) 3

5 Stisfiility of HyperLTL Definiti (HyperLTL-SAT) Let φ e n HyperLTL formul. HyperLTL-SAT is the prolem to decide whether there exists n-empty trce set T stisfying φ. Exmple (Applicti) Two versis of Oservtil Determinism: π. π. (I π = I π ) (O π = O π ) π. π.(i π = I π ) (O π = O π ) Which vriti is strger? 4

6 Chllenge LTL Stisfiility Solving Trnslte LTL formul into Büchi utomt Check the utomt for emptiness PSPACE-complete HyperLTL Stisfiility Solving A Hyperproperty is not necessrily ω-regulr Stndrd utomt pproch cnnot e pplied 5

7 Key Results [Finkeiner, H., 16] HyperLTL-SAT is PSPACE-complete for lternti-free formuls HyperLTL-SAT is EXPSPACE-complete for formuls HyperLTL-SAT is undecidle for formuls 6

8 Outline - Solving HyperLTL-SAT & 1. Alternti-free frgments ( & ) 2. Alternti strting with existentil quntifier ( ) 3. Alternti strting with universl quntifier ( ) 7

9 Existentil Frgment Theorem HyperLTL-SAT is PSPACE-complete. Exmple π 0 π 1. π0 π0 c π0 π1 c π1 Ide: Replce indexed tomic propositis with fresh tomic propositis. 0 0 c 0 1 c 1 8

10 Existentil Frgment Theorem HyperLTL-SAT is PSPACE-complete. Exmple π 0 π 1. π0 π0 c π0 π1 c π1 Ide: Replce indexed tomic propositis with fresh tomic propositis. 0 0 c 0 1 c 1 t : { 0, 0, c 0, 1 } ω 8

11 Existentil Frgment Theorem HyperLTL-SAT is PSPACE-complete. Exmple π 0 π 1. π0 π0 c π0 π1 c π1 Ide: Replce indexed tomic propositis with fresh tomic propositis. 0 0 c 0 1 c 1 t : { 0, 0, c 0, 1 } ω T = {{,, c} ω, {} ω } 8

12 Universl Frgment Theorem HyperLTL-SAT is PSPACE-complete. Exmple π π. π π t t unstisfile Ide: Discrd indexes from indexed propositis 9

13 Outline - Solving HyperLTL-SAT & 1. Alternti-free frgments ( & ) 2. Alternti strting with existentil quntifier ( ) 3. Alternti strting with universl quntifier ( ) 10

14 HyperLTL-SAT Lemm For every π 1... π n π 1... π.φ HyperLTL formul, there exists m n equistisfile HyperLTL formul. Exmple π 0 π 1 π 0 π 1. ( π 0 π 1 ) ( c π 0 d π1 ) Ide: Unroll universl quntifiers π 0 π 1. ( π0 π0 ) ( c π0 d π1 ) ( π1 π0 ) ( c π0 d π1 ) ( π0 π1 ) ( c π0 d π1 ) ( π1 π1 ) ( c π0 d π1 ) 11

15 Complexity of HyperLTL-SAT Theorem Let n e the numer of existentil quntifier nd m e the numer of universl quntifier. HyperLTL-SAT is EXPSPACE-complete. Unrolling results in formul of size O(n m ). Hrdness follows from n encoding of n EXPSPACE-ounded Turing mchine in this frgment. 12

16 HyperLTL-SAT Theorem Bounded HyperLTL-SAT is PSPACE-complete. Oservti: In prctice, mny properties of interest quntify universlly over pirs of trces π. π. (I π = I π ) (O π = O π ) π. π.(i π = I π ) (O π = O π ) π. π. π. (HighI π = HighI π ) (O π = O π ) 13

17 Outline - Solving HyperLTL-SAT & 1. Alternti-free frgments ( & ) 2. Alternti strting with existentil quntifier ( ) 3. Alternti strting with universl quntifier ( ) 14

18 The Power of - Encoding of PCP Cn give HyperLTL formul, which is ly stisfied y n infinite trce set: π π. π (1) ( π π ) (2) ( π π ) (3) Encoding of Posts Correspdence Prolem (PCP) in this frgment. Theorem HyperLTL-SAT is undecidle. 15

19 Summry & Cclusi -Bounded PSpcecomplete PSpcecomplete EXPSpcecomplete PSpcecomplete undecidle Stisfiility of lternti-free formuls is decidle Implicti nd equivlence of lternti-free formuls re decidle Full logic is undecidle: HyperLTL is much more powerful thn LTL Christopher Hhn: 16

20 Appendix 17

21 Biliogrphy [Clrks, Schneider, 10] Clrks, M. R., nd F. B. Schneider. "Hyperproperties." Journl of Computer Security 18.6 (2010): [Clrks, Finkeiner, Koleini, Micinski, Re, Sánchez, 14] Clrks, M. R., Finkeiner, B., Koleini, M., Micinski, K. K., Re, M. N., & Sánchez, C. (2014, April). Temporl logics for hyperproperties. In Interntil Cference Principles of Security nd Trust (pp ). [Finkeiner, H., 16] Bernd Finkeiner nd Christopher Hhn. Deciding hyperproperties. In Interntil Cference Ccurrency Theory (2016). Picture: 18

22 HyperLTL Syntx Syntx ψ ::= π. ψ π. ψ φ φ ::= π φ φ φ φ φ φ Quntifier Prefix with ritrry lternti Then quntifier-free LTL formul with trce vriles,,,, derived in the usul wy X π = X π syntctic sugr for x X(x π x π ) Exmple All executis hve the light t the sme time. π. π. ( π π ) 19

23 HyperLTL Semntics Semntics w.r.t. Trce Envirment : Vr TR = T π.φ iff for ll t T, s.t. [π t] = T φ = T π iff (π)[0] = T φ iff i 0 : [i, ] = T φ All executis hve the light t the sme time. π. π. ( π π ) 20

24 HyperLTL Semntics Semntics w.r.t. Trce Envirment : Vr TR = T π.φ iff for ll t T, s.t. [π t] = T φ = T π iff (π)[0] = T φ iff i 0 : [i, ] = T φ All executis hve the light t the sme time. π. π. ( π π ) 1. {π t} = M π. (...) 20

25 HyperLTL Semntics Semntics w.r.t. Trce Envirment : Vr TR = T π.φ iff for ll t T, s.t. [π t] = T φ = T π iff (π)[0] = T φ iff i 0 : [i, ] = T φ All executis hve the light t the sme time. π. π. ( π π ) 1. {π t} = M π. (...) 2. {π t, π t } = T (...) 20

26 HyperLTL Semntics Semntics w.r.t. Trce Envirment : Vr TR = T π.φ iff for ll t T, s.t. [π t] = T φ = T π iff (π)[0] = T φ iff i 0 : [i, ] = T φ All executis hve the light t the sme time. π. π. ( π π ) 1. {π t} = M π. (...) 2. {π t, π t } = T (...) 3. i 0 : {π t[i, ], π t [i, ]} = T π π 20

27 Encoding of Posts Correspdence Prolem Exmple PCP instnce: I II III 21

28 Encoding of Posts Correspdence Prolem Exmple PCP soluti: III II III I HyperLTL encoding: 1. exists soluti -trce π s, where top mtches ottom 22

29 Encoding of Posts Correspdence Prolem Exmple PCP soluti: III II III I π s HyperLTL encoding: 1. exists soluti -trce π s, where top mtches ottom 22

30 Encoding of Posts Correspdence Prolem Exmple PCP soluti: III II III I π s III HyperLTL encoding: 1. exists soluti -trce π s, where top mtches ottom 2. every trce strts with vlid ste 22

31 Encoding of Posts Correspdence Prolem Exmple PCP soluti: III II III I π s III HyperLTL encoding: 1. exists soluti -trce π s, where top mtches ottom 2. every trce strts with vlid ste 3. for every trce, there exists nother without the first ste 22

32 Encoding of Posts Correspdence Prolem Exmple PCP soluti: III II III I HyperLTL encoding: 1. exists soluti -trce π s, where top mtches ottom 2. every trce strts with vlid ste 3. for every trce, there exists nother without the first ste π s π s III

33 Encoding of Posts Correspdence Prolem Exmple PCP soluti: III II III I HyperLTL encoding: 1. exists soluti -trce π s, where top mtches ottom 2. every trce strts with vlid ste 3. for every trce, there exists nother without the first ste π s π s III II II

34 Encoding of Posts Correspdence Prolem Exmple PCP soluti: III II III I HyperLTL encoding: 1. exists soluti -trce π s, where top mtches ottom 2. every trce strts with vlid ste π s π s π s III II III II III III for every trce, there exists nother without the first ste 22

35 Encoding of Posts Correspdence Prolem Exmple PCP soluti: III II III I HyperLTL encoding: 1. exists soluti -trce π s, where top mtches ottom 2. every trce strts with vlid ste 3. for every trce, there exists nother without the first ste π s π s π s π s III II III I II III I III I I