Upload
others
View
1
Download
0
Embed Size (px)
Citation preview
HAL Id: hal-00955869https://hal.inria.fr/hal-00955869v1
Submitted on 5 Mar 2014 (v1), last revised 12 May 2014 (v2)
HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.
Lāarchive ouverte pluridisciplinaire HAL, estdestinĆ©e au dĆ©pĆ“t et Ć la diffusion de documentsscientifiques de niveau recherche, publiĆ©s ou non,Ć©manant des Ć©tablissements dāenseignement et derecherche franƧais ou Ć©trangers, des laboratoirespublics ou privĆ©s.
Automated analysis of security protocols with globalstate
Steve Kremer, KĆ¼nnemann Robert
To cite this version:Steve Kremer, KĆ¼nnemann Robert. Automated analysis of security protocols with global state. [Re-search Report] 2014, pp.56. ļæ½hal-00955869v1ļæ½
Automated analysis of security protocols with global state
(Full version)
Steve Kremer
INRIA Nancy - GrandāEst & Loria, France
Robert KĆ¼nnemannā
Department of Computer Science, TU Darmstadt, Germany
Abstract
Security APIs, key servers and protocols that need to keep the status of transactions, requireto maintain a global, non-monotonic state, e.g., in the form of a database or register. However,existing automated verification tools do not support the analysis of such stateful security protocolsā sometimes because of fundamental reasons, such as the encoding of the protocol as Horn clauses,which are inherently monotonic. An exception is the recent tamarin prover which allows specifyingprotocols as multiset rewrite (msr) rules, a formalism expressive enough to encode state. As multisetrewriting is a ālow-levelā specification language with no direct support for concurrent messagepassing, encoding protocols correctly is a difficult and error-prone process.
We propose a process calculus which is a variant of the applied pi calculus with constructsfor manipulation of a global state by processes running in parallel. We show that this languagecan be translated to msr rules whilst preserving all security properties expressible in a dedicatedfirst-order logic for security properties. The translation has been implemented in a prototype toolwhich uses the tamarin prover as a backend. We apply the tool to several case studies among whicha simplified fragment of PKCS#11, the Yubikey security token, and an optimistic contract signingprotocol.
1 Introduction
Automated analysis of security protocols has been extremely successful. Using automated tools, flawshave been for instance discovered in the Google Single Sign On Protocol [5], in commercial securitytokens implementing the PKCS#11 standard [10], and one may also recall Loweās attack [21] on theNeedham-Schroeder public key protocol 17 years after its publication. While efficient tools such asProVerif [7], AVISPA [4] or Maude-NPA [14] exist, these tools fail to analyze protocols that requirenon-monotonic global state, i.e., some database, register or memory location that can be read andaltered by different parallel threads. In particular ProVerif, one of the most efficient and widely usedprotocol analysis tools, relies on an abstraction that encodes protocols in first-order Horn clauses. Thisabstraction is well suited for the monotonic knowledge of an attacker (who never forgets), makes thetool extremely efficient for verifying an unbounded number of protocol sessions and allows to build onexisting techniques for Horn clause resolution. However, Horn clauses are inherently monotonic: oncea fact is true it cannot be set to false anymore. As a result, even though ProVerifās input language,a variant of the applied pi calculus [2], allows a priori encodings of a global memory, the abstractionsperformed by ProVerif introduce false attacks. In the ProVerif user manual [8, Section 6.3.3] such anencoding of memory cells and its limitations are indeed explicitly discussed: āDue to the abstractionsperformed by ProVerif, such a cell is treated in an approximate way: all values written in the cell are
āMost of this work was carried out when the author was affiliated to INRIA Paris - Rocquencourt, France
1
considered as a set, and when one reads the cell, ProVerif just guarantees that the obtained value is oneof the written values (not necessarily the last one, and not necessarily one written before the read).ā
A prominent example where non-monotonic global state appears are security APIs, such as theRSA PKCS#11 standard [23], IBMās CCA [11] or the trusted platform module (TPM) [27]. They havebeen known to be vulnerable to logical attacks for some time [20, 9] and formal analysis has shownto be a valuable tool to identify attacks and find secure configurations. One promising paradigm foranalyzing security APIs is to regard them as a participant in a protocol and use existing analysis tools.However, Herzog [18] already identified not accounting for mutable global state as a major barrier to theapplication of security protocol analysis tools to verify security APIs. Apart from security APIs manyother protocols need to maintain databases: key servers need to store the status of keys, in optimisticcontract signing protocols a trusted party maintains the status of a contract, RFID protocols maintainthe status of tags and more generally websites may need to store the current status of transactions.
Our contributions We propose a tool for analyzing protocols that may involve non-monotonicglobal state, relying on Schmidt et al.ās tamarin tool [25, 26] as a backend. We designed a newprocess calculus that extends the applied pi calculus by defining, in addition to the usual constructsfor specifying concurrent processes, constructs for explicitly manipulating global state. This calculusserves as the toolās input language. The heart of our tool is a translation from this extended appliedpi calculus to a set of multiset rewrite rules that can then be analyzed by tamarin which we useas a backend. We prove the correctness of this translation and show that it preserves all propertiesexpressible in a dedicated first order logic for expressing security properties. As a result, relying on thetamarin prover, we can analyze protocols without bounding the number of sessions, nor making anyabstractions. Moreover it allows to model a wide range of cryptographic primitives by the means ofequational theories. As the underlying verification problem is undecidable, tamarin may not terminate.However, it offers an interactive mode with a GUI which allows to manually guide the tool in its proof.Our specification language includes support for private channels, global state and locking mechanisms(which are crucial to write meaningful programs in which concurrent threads manipulate a commonmemory). The translation has been carefully engineered in order to favor termination by tamarin. Weillustrate the tool on several case studies: a simple security API in the style of PKCS#11, a complexcase study of the Yubikey security device, as well as several examples analyzed by other tools that aimat analyzing stateful protocols. In all of these case studies we were able to avoid restrictions that werenecessary in previous works.
Related work The most closely related work is the StatVerif tool by Arapinis et al. [3]. Theypropose an extension of the applied pi calculus, similar to ours, which is translated to Horn clausesand analyzed by the ProVerif tool. Their translation is sound but allows for false attacks, limitingthe scope of protocols that can be analyzed. Moreover, StatVerif can only handle a finite number ofmemory cells: when analyzing an optimistic contract signing protocol this appeared to be a limitationand only the status of a single contract was modeled, providing a manual proof to justify the correctnessof this abstraction. Finally, StatVerif is limited to the verification of secrecy properties. As illustratedby the Yubikey case study, our work is more general and we are able to analyze complex injectivecorrespondance properties.
Mƶdersheim [22] proposed a language with support for sets together with an abstraction where allobjects that belong to the same sets are identified. His language, which is an extension of the lowlevel AVISPA intermediate format, is compiled into Horn clauses that are then analyzed, e. g., usingProVerif. His approach is tightly linked to this particular abstraction limiting the scope of applicability.Mƶdersheim also discusses the need for a more high-level specification level which we provide in thiswork.
There has also been work tailored to particular applications. In [13], Delaune et al. show by adedicated hand proof that for analyzing PKCS#11 one may bound the message size. Their analysisstill requires to artificially bound the number of keys. Similarly in spirit, Delaune et al. [12] give adedicated result for analyzing protocols based on the TPM and its registers. However, the number ofreboots (which reinitialize registers) needs to be limited.
2
Guttman [17] also extended the strand space model by adding support for state. While the protocolexecution is modeled using the classical strand spaces model, state is modeled by a multiset of facts,and manipulated by multiset rewrite rules. The extended model has been used for analyzing by handan optimistic contract signing protocol. As of now, protocol analysis in the strand space model withstate has not been mechanized yet.
In the goal of relating different approaches for protocol analysis Bistarelli et al. [6] also proposeda translation from a process algebra to multiset rewriting: they do however not consider privatechannels, have no support for global state and assume that processes have a particular structure.These limitations significantly simplify the translation and its correctness proof. Moreover their workdoes not include any tool support for automated verification.
Obviously any protocol that we are able to analyze can be directly analyzed by the tamarinprover [25, 26] as the rules produced by our translation could have been given directly as an inputto tamarin. Indeed, tamarin has already been used for analyzing a model of the Yubikey device [19],the case studies presented with Mƶdersheimās abstraction, as well as those presented with StatVerif.It is furthermore able to reproduce the aforementioned results on PKCS#11 [13] and the TPM [12] āmoreover, it does so without bounding the number of keys, security devices, reboots, etc. Contraryto ProVerif, tamarin sometimes requires additional typing lemmas which are used to guide the proof.These lemmas need to be written by hand (but are proved automatically). In our case studies we alsoneeded to provide a few such lemmas manually. In our opinion, an important disadvantage of tamarinis that protocols are modeled as a set of multiset rewrite rules. This representations is very low leveland far away from actual protocol implementations, making it very difficult to model a protocol ad-equately. Encoding private channels, nested replications and locking mechanisms directly as multisetrewrite rules is a tricky and error prone task. As a result we observed that, in practice, the protocolmodels tend to be simplified. For instance, locking mechanisms are often omitted, modeling protocolsteps as a single rule and making them effectively atomic. Such more abstract models may obscureissues in concurrent protocol steps and increase the risk of implicitly excluding attacks in the modelthat are well possible in a real implementation, e. g., race conditions. Using a more high-level spec-ification language, such as our process calculus, arguably eases protocol specification and overcomessome of these risks.
2 Preliminaries
Terms and equational theories As usual in symbolic protocol analysis we model messages byabstract terms. Therefore we define an order-sorted term algebra with the sort msg and two incompa-rable subsorts pub and fresh . For each of these subsorts we assume a countably infinite set of names,FN for fresh names and PN for public names. Fresh names will be used to model cryptographic keysand nonces while public names model publicly known values. We furthermore assume a countablyinfinite set of variables for each sort s, Vs and let V be the union of the set of variables for all sorts.We write u : s when the name or variable u is of sort s. Let Ī£ be a signature, i.e., a set of functionsymbols, each with an arity. We write f/n when function symbol f is of arity n. We denote by TĪ£ theset of well-sorted terms built over Ī£, PN , FN and V. For a term t we denote by names(t), respectivelyvars(t) the set of names, respectively variables, appearing in t. The set of ground terms, i.e., termswithout variables, is denoted by MĪ£. When Ī£ is fixed or clear from the context we often omit it andsimply write T for TĪ£ and M for MĪ£.
We equip the term algebra with an equational theory E, that is a finite set of equations of the formM = N where M,N ā T . From the equational theory we define the binary relation =E on terms,which is the smallest equivalence relation containing equations in E that is closed under application offunction symbols, bijective renaming of names and substitution of variables by terms of the same sort.Furthermore, we require E to distinguish different fresh names, i. e., āa, b ā FN : a 6= bā a 6=E b.
Example. Symmetric encryption can be modelled using a signature
Ī£ = { senc/2, sdec/2, encCor/2, true/0 }
3
and an equational theory defined by
sdec(senc(m,k), k) = m encCor (senc(x, y), y) = true
The last equation allows to check whether a term can be correctly decrypted with a certain key.
For the rest of the paper we assume that E refers to some fixed equational theory and that thesignature and equational theory always contain symbols and equations for pairing and projection, i.e.,{ć., .ć, fst, snd} ā Ī£ and equations fst(ćx, yć) = x and snd(ćx, yć) = y are in E. We will sometimes usećx1, x2, . . . , xnć as a shortcut for ćx1, ćx2, ć. . . , ćxnā1, xnć . . .ć.
We also use the usual notion of positions for terms. A position p is a sequence of positive integersand t|p denotes the subterm of t at position p.
Facts We also assume an unsorted signature Ī£fact , disjoint from Ī£. The set of facts is defined as
F := {F (t1, . . . , tk) | ti ā TĪ£, F ā Ī£fact of arity k}.
Facts will be used both to annotate protocols, by the means of events, and for defining multiset rewriterules. We partition the signature Ī£fact into linear and persistent fact symbols. We suppose that Ī£fact
always contains a unary, persistent symbol !K and a linear, unary symbol Fr. Given a sequence orset of facts S we denote by lfacts(S) the multiset of all linear facts in S and pfacts(S) the set of allpersistent facts in S. By notational convention facts whose identifier starts with ā !ā will be persistent.G denotes the set of ground facts, i.e., the set of facts that does not contain variables. For a fact f wedenote by ginsts(f) the set of ground instances of f . This notation is also lifted to sequences and setsof facts as expected.
Substitutions A substitution Ļ is a partial function from variables to terms. We suppose thatsubstitutions are well-typed, i.e., they only map variables of sort s to terms of sort s, or of a subsortof s. We denote by Ļ = {t1/x1 , . . . ,
tn /xn} the substitution whose domain is D(Ļ) = {x1, . . . , xn} andwhich maps xi to ti. As usual we homomorphically extend Ļ to apply to terms and facts and usea postfix notation to denote its application, e.g., we write tĻ for the application of Ļ to the term t.A substitution Ļ is grounding for a term t if tĻ is ground. Given function g we let g(x) = ā„ whenx 6ā D(x). When g(x) = ā„ we say that g is undefined for x. We define the function f := g[a 7ā b]with D(f) = D(g) āŖ { a } as f(a) := b and f(x) := g(x) for x 6= a.
Sets, sequences and multisets We write Nn for the set {1, . . . , n}. Given a set S we denote by Sā
the set of finite sequences of elements from S and by S# the set of finite multisets of elements from S.We use the superscript # to annotate usual multiset operation, e.g. S1āŖ
#S2 denotes the multiset unionof multisets S1, S2. Given a multiset S we denote by set(S) the set of elements in S. The sequenceconsisting of elements e1, . . . , en will be denoted by [e1, . . . , en] and the empty sequence is denoted by [].We denote by |S| the length, i.e., the number of elements of the sequence. We use Ā· for the operationof adding an element either to the start or to the end, e.g., e1 Ā· [e2, e3] = [e1, e2, e3] = [e1, e2] Ā· e3.Given a sequence S, we denote by idx (S) the set of positions in S, i.e., Nn when S has n elements,and for i ā idx (S) Si denotes the ith element of the sequence. Set membership modulo E is denotedby āE and defined as e āE S if āeā² ā S. eā² =E e. āE and =E are defined for sets in a similarway. Application of substitutions are lifted to sets, sequences and multisets as expected. By abuse ofnotation we sometimes interpret sequences as sets or multisets; the applied operators should make theimplicit cast clear.
3 A cryptographic pi calculus with explicit state
3.1 Syntax and informal semantics
Our calculus is a variant of the applied pi calculus [2]. In addition to the usual operators for concurrency,replication, communication and name creation, it offers several constructs for reading and updating anexplicit global state. The grammar for processes is described in Figure 1.
4
ćM,N ć ::= x, y, z ā V| p ā PN
| n ā FN
| f(M1,. . . ,Mn) (f ā Ī£ of arity n)
ćP ,Qć ::= 0| P | Q| ! P| Ī½n; P| out(M,N); P| in(M,N); P| if M=N then P [else Q]| event F ; P (F ā F)| insert M ,N ; P| delete M ; P| lookup M as x in P [else Q]| lock M ; P| unlock M ; P| [L] ā[A]ā [R];P (L,R,A ā Fā)
Figure 1: Syntax
0 denotes the terminal process. P | Q is the parallel execution of processes P and Q and !Pthe replication of P , allowing an unbounded number of sessions in protocol executions. The constructĪ½n;P binds the name n in P and models the generation of a fresh, random value. Processes out(M,N);P and in(M,N); P represent the output, respectively input, of message N on channel M . Readersfamiliar with the applied pi calculus [2] may note that we opted for the possibility of pattern matchingin the input construct, rather than merely binding the input to a variable x. The process if M=Nthen P else Q will execute P if M =E N and Q otherwise. The event construct is merely used forannotating processes and will be useful for stating security properties. For readability we sometimesomit to write else Q when Q is 0, as well as trailing 0 processes.
The remaining constructs are used for manipulating state and are new compared to the applied picalculus. We offer two different mechanisms for state. The first construct is functional and allows toassociate a value to a key. The construct insert M ,N binds the value N to a key M . Successive insertsallow to change this binding. The delete M operation simply āundefinesā the mapping for the key M .The lookup M as x in P else Q allows to retrieve the value associated to M , binding it to the variablex in P . If the mapping is undefined for M the process behaves as Q. The lock and unlock constructsallow to gain exclusive access to a resource M . This is essential for writing protocols where parallelprocesses may read and update a common memory. We additionally offer another kind of global statein form of a multiset of ground facts, as opposed to the previously introduced functional store. Thismultiset can be altered using the construct [L] ā[A]ā [R];P , which tries to match each fact in thesequence L to facts in the current multiset and, if successful, adds the corresponding instance of factsR to the store. The facts A are used as annotations in a similar way to events. The purpose of thisconstruct is to provide access to the underlying notion of state in tamarin, but we stress that it isdistinct from the previously introduced functional state, and its use is only advised to expert users.We allow this ālow-levelā form of state manipulation in addition to the functional state, as it offers agreat flexibility and has shown useful in one of our case studies. This style of state manipulation issimilar to the state extension in the strand space model [17] and the underlying specification languageof the tamarin tool [25, 26]. Note that, even though those stores are distinct (which is a restrictionimposed by our translation), data can be moved from one to another, for example as follows: lookupāstore1ā as x in [] ā[ ]ā [store2(x)].
In the following example, which will serve as our running example, we model a security API that,even though much simplified, illustrates the most salient issues that occur in the analysis of security
5
APIs such as PKCS#11 [13, 10, 15] .
Example. We consider a security device that allows the creation of keys in its secure memory. Theuser can access the device via an API. If he creates a key, he obtains a handle, which he can use tolet the device perform operations on his behalf. For each handle the device also stores an attributewhich defines what operations are permitted for this handle. The goal is that the user can never gainknowledge of the key, as the userās machine might be compromised. We model the device by thefollowing process (we use out(m) as a shortcut for out(c,m) for a public channel c):
!Pnew | !Pset | !Pdec | !Pwrap , where
Pnew := Ī½h; Ī½k; event NewKey(h,k);insert ć ākeyā ,hć,k;insert ć ā att ā ,hć, ādecā ; out(h)
In the first line, the device creates a new handle h and a key k and, by the means of the eventNewKey(h, k), logs the creation of this key. It then stores the key that belongs to the handle byassociating the pair ćākeyā, hć to the value of the key k. In the next line, ćāattā, hć is associated toa public constant ādecā. Intuitively, we use the public constants ākeyā and āattā to distinguish twodatabases. The process
Pset := in(h); insert ćāattā,hć, āwrapā
allows the attacker to change the attribute of a key from the initial value ādecā to another value āwrapā.If a handle has the ādecā attribute set, it can be used for decryption:
Pdec := in(ćh,cć); lookup ćāattā,hć as a inif a=ādecā then
lookup ć ākeyā ,hć as k inif encCor(c,k)=true then
event DecUsing(k,sdec(c,k));out(sdec(c,k))
The first lookup stores the value associated to ćāattā, hć in a. The value is compared against ādecā. If thecomparison and another lookup for the associated key value k succeeds, we check whether decryptionsucceeds and, if so, output the plaintext.
If a key has the āwrapā attribute set, it might be used to encrypt the value of a second key:
Pwrap := in(ćh1,h2ć); lookup ćāattā,h1ć as a1 inif a1=āwrapā then
lookup ć ākeyā ,h1ć as k1 inlookup ć ākeyā , h2ć as k2 in
event Wrap(k1,k2);out(senc(k2,k1))
The bound names of a process are those that are bound by Ī½n. We suppose that all names of sortfresh appearing in the process are under the scope of such a binder. Free names must be of sort pub.A variable x can be bound in three ways: (i) by the construct lookup M as x, or (ii) x ā vars(N)in the construct in(M,N) and x is not under the scope of a previous binder, (iii) x ā vars(L) in theconstruct [L] ā[A]ā [R] and x is not under the scope of a previous binder. While the construct lookupM as x always acts as a binder, the input and [L] ā[A]ā [R] constructs do not rebind an alreadybound variable but perform pattern matching. For instance in the process
P = in(c,f(x)); in(c,g(x))
x is bound by the first input and pattern matched in the second. It might seem odd that lookup actsas a binder, while input does not. We justify this decision as follows: as Pdec and Pwrap in the previous
6
a ā FN āŖ PN a /ā nĪ½n.Ļ ā¢ a
DnameĪ½n.Ļ ā¢ t t =E tā²
Ī½n.Ļ ā¢ tā²DEq
x ā D(Ļ)
Ī½n.Ļ ā¢ xĻDFrame
Ī½n.Ļ ā¢ t1 Ā· Ā· Ā· Ī½n.Ļ ā¢ tn f ā Ī£k
Ī½n.Ļ ā¢ f(t1, . . . , tn)DAppl
Figure 2: Deduction rules.
x1 ā D(Ļ)
Ī½n.Ļ ā¢ senc(k2, k1)
x2 ā D(Ļ)
Ī½n.Ļ ā¢ k1Ī½n.Ļ ā¢ sdec(senc(k2, k1), k1) sdec(senc(k2, k1), k1) =E k2
Ī½n.Ļ ā¢ k2
Figure 3: Proof tree witnessing that Ī½n.Ļ ā¢ k2
example show, lookups appear often after input was received. If lookup were to use pattern matching,the following process
P = in(c, x); lookup āstoreā as x in P ā²
might unexpectedly perform a check if āstoreā contains the message given by the adversary, instead ofbinding the content of āstoreā to x, due to an undetected clash in the naming of variables.
A process is ground if it does not contain any free variables. We denote by PĻ the application ofthe homomorphic extension of the substitution Ļ to P . As usual we suppose that the substitution onlyapplies to free variables. We sometimes interpret the syntax tree of a process as a term and write P |pto refer to the subprocess of P at position p (where |, if and lookup are interpreted as binary symbols,all other constructs as unary).
3.2 Semantics
Frames and deduction Before giving the formal semantics of our calculus we introduce the notionsof frame and deduction. A frame consists of a set of fresh names n and a substitution Ļ and is writtenĪ½n.Ļ. Intuitively a frame represents the sequence of messages that have been observed by an adversaryduring a protocol execution and secrets n generated by the protocol, a priori unknown to the adversary.Deduction models the capacity of the adversary to compute new messages from the observed ones.
Definition 1 (Deduction). We define the deduction relation Ī½n.Ļ ā¢ t as the smallest relation betweenframes and terms defined by the deduction rules in Figure 2.
Example. If one key is used to wrap a second key, then, if the intruder learns the first key, he candeduce the second. For n = k1, k2 and Ļ = { senc(k2,k1)/x1 ,
k1 /x2 }, Ī½n.Ļ ā¢ k2, as witnessed by the prooftree given in Figure 3.
Operational semantics We can now define the operational semantics of our calculus. The semanticsis defined by a labelled transition relation between process configurations. A process configuration is a6-tuple (E ,S,SMS,P, Ļ,L) where
ā¢ E ā FN is the set of fresh names generated by the processes;
ā¢ S : MĪ£ ā MĪ£ is a partial function modeling the functional store;
ā¢ SMS ā G# is a multiset of ground facts and models the multiset of stored facts;
ā¢ P is a multiset of ground processes representing the processes executed in parallel;
ā¢ Ļ is a ground substitution modeling the messages output to the environment;
7
Standard operations:
(E ,S,SMS,P āŖ# {0}, Ļ,L) āā (E ,S,SMS,P , Ļ,L)
(E ,S,SMS,P āŖ# {P |Q}, Ļ,L) āā (E ,S,SMS,P āŖ# {P,Q}, Ļ,L)
(E ,S,SMS,P āŖ# {!P}, Ļ,L) āā (E ,S,SMS,P āŖ# {!P, P}, Ļ,L)
(E ,S,SMS,P āŖ# {Ī½a;P}, Ļ,L) āā (E āŖ {aā²},S,SMS,P āŖ# {P{aā²/a}}, Ļ,L)if aā² is fresh
(E ,S,SMS,P , Ļ,L)K(M)āāāāā (E ,S,SMS,P , Ļ,L) if Ī½E .Ļ ā¢M
(E ,S,SMS,P āŖ# {out(M,N);P}, Ļ,L)K(M)āāāāā (E ,S,SMS,P āŖ# {P}, Ļ āŖ {N/x},L)
if x is fresh and Ī½E .Ļ ā¢M
(E ,S,SMS,P āŖ# {in(M,N);P}, Ļ,L)K(ćM,NĻć)āāāāāāāā (E ,S,SMS,P āŖ# {PĻ}, Ļ,L)
if āĻ. Ļ is grounding for N, Ī½E .Ļ ā¢M, Ī½E .Ļ ā¢ NĻ
(E ,S,SMS,P āŖ# {out(M,N);P, in(M ā², N ā²);Q}, Ļ,L) āā (E ,S,SMS,P āŖ {P,QĻ}, Ļ,L)if M =E M ā² and āĻ. N =E N ā²Ļ and Ļ grounding for N ā²
(E ,S,SMS,P āŖ {if M = N then P else Q}, Ļ,L) āā (E ,S,SMS,P āŖ {P}, Ļ,L) if M =E N
(E ,S,SMS,P āŖ {if M = N then P else Q}, Ļ,L) āā (E ,S,SMS,P āŖ {Q}, Ļ,L) if M 6=E N
(E ,S,SMS,P āŖ {event(F ); P}, Ļ,L)F
āā (E ,S,SMS,P āŖ {P}, Ļ,L)
Operations on global state:
(E ,S,SMS,P āŖ# {insert M,N ; P}, Ļ,L) āā (E ,S[M 7ā N ],SMS,P āŖ# {P}, Ļ,L)
(E ,S,SMS,P āŖ# {delete M ; P}, Ļ,L) āā (E ,S[M 7ā ā„],SMS,P āŖ# {P}, Ļ,L)
(E ,S,SMS,P āŖ# {lookup M as x in P else Q }, Ļ,L) āā (E ,S,SMS,P āŖ# {P{V/x}}, Ļ,L)if S(N) =E V is defined and N =E M
(E ,S,SMS,P āŖ# {lookup M as x in P else Q }, Ļ,L) āā (E ,S,SMS,P āŖ# {Q}, Ļ,L)if S(N) is undefined for all N =E M
(E ,S,SMS,P āŖ# {lock M ; P}, Ļ,L) āā (E ,S,SMS,P āŖ# {P}, Ļ,L āŖ {M })if M 6āEL
(E ,S,SMS,P āŖ# {unlock M ; P}, Ļ,L) āā (E ,S,SMS,P āŖ# {P}, Ļ,L \ {M ā² |M ā² =E M })
(E ,S,SMS,P āŖ# {[l ā[a]ā r]; P}, Ļ,L)aā²
āā (E ,S,SMS \ lfacts(lā²) āŖ# rā²,P āŖ# {PĻ }, Ļ,L)if āĻ, lā², aā², rā². Ļ grounding for l ā[a]ā r, lā² ā[aā²]ā rā² =E (l ā[a]ā r)Ļ,
lfacts(lā²) ā# SMS, pfacts(lā²) ā SMS
Figure 4: Operational semantics
ā¢ L ā MĪ£ is the set of currently acquired locks.
The transition relation is defined by the rules described in Figure 4. Transitions are labelled bysets of ground facts. For readability we omit empty sets and brackets around singletons, i.e., we write
ā forā
āā andf
āā for{ f }āā. We write āā for the reflexive, transitive closure of ā (the transitions
that are labelled by the empty sets) and writefā for āā f
āāā. We can now define the set of traces,i.e., possible executions, that a process admits.
Definition 2 (Traces of P ). Given a ground process P we define the set of traces of P as
tracespi (P ) ={
[F1, . . . , Fn] | (ā , ā , ā , {P}, ā , ā )F1=ā (E1,S1,S
MS1 ,P1, Ļ1,L1)
F2=ā . . .Fn=ā (En,Sn,S
MSn ,Pn, Ļn,Ln)
}
Example. In Figure 5 we display the transitions that illustrate how the first key is created on thesecurity device in our running example and witness that [NewKey(hā², kā²)] ā tracespi (P ).
8
(ā , ā , ā , { !Pnew , !Pset |!Pdec |!Pwrapļøø ļø·ļø· ļøø
=:P ā²
}#, ā , ā ) ā (ā , ā , ā , {Pnew }# āŖ# P ā², ā , ā )
ā (ā , ā , ā , { Ī½h; Ī½k; event NewKey(h, k); . . . }# āŖ# P ā², ā , ā )
āā({hā², kā² }, ā , ā , { event NewKey(hā², kā²); . . . }# āŖ# P ā², ā , ā )
NewKey(hā²,kā²)āāāāāāāāāā ({hā², kā² }, ā , ā , { insert ćākeyā, hā²ć, kā²; . . . }# āŖ# P ā², ā , ā )
āā({hā², kā² },S, ā , { out(hā²); 0 }# āŖ# P ā², ā , ā ) āā ({hā², kā² },S, ā ,P ā², { hā²
/x1 }, ā )
where S(ćākeyā,hā²ć) = kā² and S(ćāattā,hā²ć) = ādecā.
Figure 5: Example of transitions modelling the creation of a key on a PKCS#11-like device
4 Labelled multiset rewriting
We now recall the syntax and semantics of labelled multiset rewriting rules, which constitute the inputlanguage of the tamarin tool [25].
Definition 3 (Multiset rewrite rule). A labelled multiset rewrite rule ri is a triple (l, a, r), l, a, r āFā, written l ā[a]ā r. We call l = prems(ri) the premises, a = actions(ri) the actions, and r =conclusions(ri) the conclusions of the rule.
Definition 4 (Labelled multiset rewriting system). A labelled multiset rewriting system is a set oflabelled multiset rewrite rules R, such that each rule l ā[a]ā r ā R satisfies the following conditions:
ā¢ l, a, r do not contain fresh names
ā¢ r does not contain Fr-facts
A labelled multiset rewriting system is called well-formed, if additionally
ā¢ for each lā² ā[aā²]ā rā² āE ginsts(l ā[a]ā r) we have that ā©rā²ā²=Erā²names(rā²ā²)ā©FN ā ā©lā²ā²=E lā²names(lā²ā²)ā©FN .
We define one distinguished rule Fresh which is the only rule allowed to have Fr-facts on theright-hand side
Fresh : [] ā[]ā [Fr(x : fresh)]
The semantics of the rules is defined by a labelled transition relation.
Definition 5 (Labelled transition relation). Given a multiset rewriting system R we define the labeledtransition relation āRā G# Ć P(G) Ć G# as
Sa
āāR ((S \# lfacts(l)) āŖ# r)
if and only if l ā[a]ā r āE ginsts(R āŖ Fresh), lfacts(l) ā# S and pfacts(l) ā S.
Definition 6 (Executions). Given a multiset rewriting system R we define its set of executions as
execmsr (R) ={
ā A1āāR . . .
AnāāR Sn |
āa, i, j : 0 ā¤ i 6= j < n.(Si+1 \
# Si) = {Fr(a)} ā (Sj+1 \# Sj) 6= {Fr(a)}
}
The set of executions consists of transition sequences that respect freshness, i. e., for a given namea the fact Fr(a) is only added once, or in other words the rule Fresh is at most fired once for eachname. We define the set of traces in a similar way as for processes.
9
Definition 7 (Traces). The set of traces is defined as
tracesmsr (R) ={
[A1, . . . , An] | ā 0 ā¤ i ā¤ n. Ai 6= ā
and ā A1=āR . . .
An=āR Sn ā execmsr (R)}
whereA
=āR is defined asā
āāāR
AāāR
ā āāā
R.
Note that both for processes and multiset rewrite rules the set of traces is a sequence of sets offacts.
5 Security Properties
In the tamarin tool [25] security properties are described in an expressive two-sorted first-order logic.The sort temp is used for time points, Vtemp are the temporal variables.
Definition 8 (Trace formulas). A trace atom is either false ā„, a term equality t1 ā t2, a timepointordering i ā j, a timepoint equality i
.= j, or an action F@i for a fact F ā F and a timepoint i. A
trace formula is a first-order formula over trace atoms.
As we will see in our case studies this logic is expressive enough to analyze a variety of securityproperties, including complex injective correspondence properties.
To define the semantics, let each sort s have a domain D(s). D(temp) = Q, D(msg) = M,D(fresh) = FN , and D(pub) = PN . A function Īø : V ā MāŖQ is a valuation if it respects sorts, thatis, Īø(Vs) ā D(s) for all sorts s. If t is a term, tĪø is the application of the homomorphic extension of Īøto t.
Definition 9 (Satisfaction relation). The satisfaction relation (tr , Īø) ļæ½ Ļ between trace tr , valuationĪø and trace formula Ļ is defined as follows:
(tr , Īø) ļæ½ ā„ never(tr , Īø) ļæ½ F@i iff Īø(i) ā idx (tr) and FĪø āE tr Īø(i)(tr , Īø) ļæ½ iā j iff Īø(i) < Īø(j)(tr , Īø) ļæ½ i
.= j iff Īø(i) = Īø(j)
(tr , Īø) ļæ½ t1 ā t2 iff t1Īø =E t2Īø(tr , Īø) ļæ½ Ā¬Ļ iff not (tr , Īø) ļæ½ Ļ(tr , Īø) ļæ½ Ļ1 ā§ Ļ2 iff (tr , Īø) ļæ½ Ļ1 and (tr , Īø) ļæ½ Ļ2
(tr , Īø) ļæ½ āx : s.Ļ iff there is u ā D(s) such that(tr , Īø[x 7ā u]) ļæ½ Ļ
When Ļ is a ground formula we sometimes simply write tr ļæ½ Ļ as the satisfaction of Ļ is independentof the valuation.
Definition 10 (Validity, satisfiability). Let Tr ā (P(G))ā be a set of traces. A trace formula Ļ issaid to be valid for Tr , written Tr ļæ½
ā Ļ, if for any trace tr ā Tr and any valuation Īø we have that(tr , Īø) ļæ½ Ļ.
A trace formula Ļ is said to be satisfiable for Tr , written Tr ļæ½ā Ļ, if there exist a trace tr ā Tr
and a valuation Īø such that (tr , Īø) ļæ½ Ļ.
Note that Tr ļæ½ā Ļ iff Tr 6ļæ½ā Ā¬Ļ. Given a multiset rewriting system R we say that Ļ is valid, written
R ļæ½ā Ļ, if tracesmsr (R) ļæ½ā Ļ. We say that Ļ is satisfied in R, written R ļæ½
ā Ļ, if tracesmsr (R) ļæ½ā Ļ.Similarly, given a ground process P we say that Ļ is valid, written P ļæ½
ā Ļ, if tracespi (P ) ļæ½ā Ļ, andthat Ļ is satisfied in P , written P ļæ½
ā Ļ, if tracespi(P ) ļæ½ā Ļ.
Example. The following trace formula expresses secrecy of keys generated on the security API, whichwe introduced in Section 3.
Ā¬(āh, k : msg , i, j : temp. NewKey(h, k)@i ā§K(k)@j)
10
Out(x) ā[ ]ā !K(x) (MDOut)!K(x) ā[K(x)]ā In(x) (MDIn)
ā[ ]ā !K(x : pub) (MDPub)Fr(x : fresh) ā[ ]ā !K(x : fresh) (MDFresh)
!K(x1), . . . , !K(xk) ā[ ]ā !K(f(x1, . . . , xk)) for f ā Ī£k (MDAppl)
Figure 6: The set of rules MD.
6 A translation from processes into multiset rewrite rules
In this section we define a translation from a process P into a set of multiset rewrite rules JP K and atranslation on trace formulas such that P |=ā Ļ if and only if JP K |=ā JĻK. Note that the result alsoholds for satisfiability, as an immediate consequence. For a rather expressive subset of trace formulas(see [25] for the exact definition of the fragment), checking whether JP K |=ā JĻK can then be dischargedto the tamarin prover that we use as a backend.
6.1 Definition of the translation of processes
To model the adversaryās message deduction capabilities, we introduce the set of rules MD defined inFigure 6.
In order for our translation to be correct, we need to make some assumptions on the set of processeswe allow. These assumptions are however, as we will see, rather mild and most of them without lossof generality. First we define a set of reserved variables that will be used in our translation and whoseuse we therefore forbid in the processes.
Definition 11 (Reserved variables and facts). The set of reserved variables is defined as the setcontaining the elements na for any a ā FN and lock l for any l ā N.
The set of reserved facts Fres is defined as the set containing facts f(t1, . . . , tn) where t1, . . . , tn ā Tand f ā { Init, Insert, Delete, IsIn, IsNotSet, state, Lock, Unlock, Out, Fr, In, Msg, ProtoNonce, Eq,NotEq, Event, InEvent }.
Similar to [3], for our translation to be sound, we require that for each process, there exists aninjective mapping assigning to every unlock t in a process a lock t that precedes it in the processāsyntax tree. Moreover, given a process lock t; P the corresponding unlock in P may not be under aparallel or replication. These conditions allow us to annotate each corresponding pair lock t, unlock twith a unique label l. The annotated version of a process P is denoted P . The formal definition of Pis given in Appendix A. In case the annotation fails, i.e., P violates one of the above conditions, theprocess P contains ā„.
Definition 12 (well-formed). A ground process P is well-formed if
ā¢ no reserved variable nor reserved fact appear in P ,
ā¢ any name and variable in P is bound at most once and
ā¢ P does not contain ā„.
ā¢ For each action l ā[a]ā r that appears in the process, the following holds: for each lā² ā[aā²]ā rā² āE
ginsts(l ā[a]ā r) we have that ā©rā²ā²=Erā²names(rā²ā²) ā© FN ā ā©lā²ā²=Elā²names(lā²ā²) ā© FN .
A trace formula Ļ is well-formed if no reserved variable nor reserved fact appear in Ļ.
The two first restrictions of well-formed processes are not a loss of generality as processes andformulas can be consistently renamed to avoid reserved variables and Ī±-converted to avoid bindingnames or variables several times. Also note that the second condition is not necessarily preservedduring an execution, e.g. when unfolding a replication, !P and P may bind the same names. We onlyrequire this condition to hold on the initial process for our translation to be correct.
11
The annotation of locks restricts the set of protocols we can translate, but allows us to obtain betterverification results, since we can predict which unlock is āsupposedā to close a given lock. This additionalinformation is helpful for tamarinās backward reasoning. We think that our locking mechanism capturesall practical use cases. Using our calculusā ālow-levelā multiset manipulation construct, the user is alsofree to implement locks himself, e.g., as
[NotLocked()] ā []; code ; [] ā [NotLocked()]
(In this case the user does not benefit from the optimisation we put into the translation of locks.)Obviously, locks can be modelled both in tamarinās multiset rewriting calculus (this is actually whatthe translation does) and Mƶdersheimās set rewriting calculus [22]. However, protocol steps typicallyconsist of a single input, followed by several database lookups, and finally an output. In practice, theytend to be modelled as a single rule, and are therefore atomic. Real implementations are howeverdifferent, as several entities might be involved, database lookups could be slow, etc. In this case, suchsimplified models could, e. g., miss race conditions. To the best of our knowledge, StatVerif is the onlycomparable tool that models locks explicitly and it has stronger restrictions.
Definition 13. Given a well-formed ground process P we define the labelled multiset rewriting systemJP K as
MD āŖ {Init} āŖ JP, [], []K
ā¢ where the rule Init is defined as
Init : [] ā[Init()]ā [state[]()]
ā¢ JP, p, xK is defined inductively for process P , position p ā Nā and sequence of variables x in
Figure 7.
ā¢ For a position p of P we define statep to be persistent if P |p = !Q for some process Q; otherwisestatep is linear.
In the definition of JP, p, xK we intuitively use the family of facts statep to indicate that the processis currently at position p in its syntax tree. A fact statep will indeed be true in an execution of theserules whenever some instance of Pp (i.e. the process defined by the subtree at position p of the syntaxtree of P ) is in the multiset P of the process configuration. The translation of the zero-process, paralleland replication operators merely use statep-facts. For instance JP | Q, p, xK defines the rule
[statep(x)] ā [statepĀ·1(x), statepĀ·2(x)]
which intuitively states that when a process is at position p (modelled by the fact statep(x) being true)then the process is allowed to move both to P (putting statepĀ·1(x) to true) and Q (putting statepĀ·2(x) totrue). The translation of JP | Q, p, xK also contains the set of rules JP, p Ā· 1, xKāŖ JQ, p Ā· 2, xK expressingthat after this transition the process may behave as P and Q, i.e., the processes at positions p Ā· 1,respectively p Ā· 2, in the process tree. Also note that the translation of !P results in a persistent factas !P always remains in P. The translation of the construct Ī½ a translates the name a into a variablena, as msr rules must not contain fresh names. Any instantiation of this rule will substitute na bya fresh name, which the Fr-fact in the premise guarantees to be new. This step is annotated with a(reserved) action ProtoNonce , used in the proof of correctness to distinguish adversary and protocolnonces. Note that the fact statepĀ·1 in the conclusion carries na, so that the following protocol stepsare bound to the fresh name used to instantiate na. The first rules of the translation of out and inmodel the communication between the protocol and the adversary, and vice versa. In the case ofout, the adversary must know the channel M , modelled by the fact In(M) in the ruleās premisse, andlearns the output message, modelled by the fact Out(N) in the conclusion. In the case of in, theknowledge of the message N is additionally required and the variables of the input message are addedto the parameters of the state fact to reflect that these variables are bound. The second and thirdrules of the translations of out and in model an internal communication, which is synchronous. For
12
J0, p, xK = {[statep(x)] ā []}
JP | Q, p, xK = {[statep(x)] ā [statepĀ·1(x), statepĀ·2(x)]} āŖ JP, p Ā· 1, xK āŖ JQ, p Ā· 2, xK
J!P, p, xK = {[!statep(x)] ā [statepĀ·1(x)]} āŖ JP, p Ā· 1, xK
JĪ½a;P, p, xK = {[statep(x),Fr(na : fresh)] ā[ProtoNonce(na : fresh)]ā [statepĀ·1(x, na : fresh)]}
āŖ JP, p Ā· 1, (x, na : fresh)K
JOut(M,N);P, p, xK = {[statep(x), In(M)] ā[InEvent(M)]ā [Out(N), statepĀ·1(x)],
[statep(x)] ā [Msg(M,N), statesemi
p (x)],
[statesemi
p (x),Ack(M,N)] ā [statepĀ·1(x)] } āŖ JP, p Ā· 1, xK
JIn(M,N);P, p, xK = {[statep(x), In(ćM,Nć)] ā[InEvent(ćM,Nć)]ā [statepĀ·1(x āŖ vars(N))],
[statep(x),Msg(M,N)] ā [statepĀ·1(x āŖ vars(N)),Ack(M,N)]}
āŖ JP, p Ā· 1, x āŖ vars(N)K
Jif M = N then P
else Q, p, xK
= {[statep(x)] ā[ Eq(M,N) ]ā [statepĀ·1(x)],
[statep(x)] ā[NotEq(M,N)]ā [statepĀ·2(x)]}
āŖ JP, p Ā· 1, xK āŖ JQ, p Ā· 2, xK
Jevent F ;P, p, xK = {[statep(x)] ā[Event(), F ]ā [statepĀ·1(x)]} āŖ JP, p Ā· 1, xK
Jinsert s, t;P, p, xK = {[statep(x)] ā[Insert(s, t)]ā [statepĀ·1(x)]} āŖ JP, p Ā· 1, xK
Jdelete s;P, p, xK = {[statep(x)] ā[Delete(s)]ā [statepĀ·1(x)]} āŖ JP, p Ā· 1, xK
Jlookup M as v
in P else Q, p, xK
= {[statep(x)] ā[IsIn(M,v)]ā [statepĀ·1(M, v)],
[statep(x)] ā[IsNotSet(M)]ā [statepĀ·2(x)]}
āŖ JP, p Ā· 1, (x, v)K āŖ JQ, p Ā· 2, xK
Jlockl s;P, p, xK = {[Fr(lockl), statep(x)] ā[Lock(lock l, s)]ā [statepĀ·1(x, lock l)]}
āŖ JP, p Ā· 1, xK
Junlockl s;P, p, xK = {[statep(x)] ā[Unlock(lock l, s)]ā [statepĀ·1(x)]} āŖ JP, p Ā· 1, xK
J[l ā[a]ā r]; P, p, xK = {[statep(x), l] ā[Event(), a]ā [r, statepĀ·1(x āŖ vars(l))]}
āŖ JP, p Ā· 1, x āŖ vars(l)K
Figure 7: Translation of processes: definition of JP, p, xK
13
[] ā[Init()]ā [state[]()]
[state[]()] ā[ ]ā [!state[1]()]
[!state[1](),Fr(h)] ā[ ]ā [state[11](h)]
[state[11](h),Fr(k)] ā[ ]ā [state[111](k, h)]
[state[111](k, h)] ā[Event(),NewKey(h, k)]ā [state[1111](k, h)]
[state[1111](k, h)] ā[Insert(ćākeyā, hć, k)]ā [state[11111](k, h)]
[state[11111](k, h)] ā[Insert(ćāattā, hć, ādecā)]ā [state[111111](k, h)]
[state[111111](k, h)] ā[ ]ā [Out(h), state[1111111](k, h)]
Figure 8: The set of multiset rewrite rules J!Pnew K (omitting the rules in MD)
this reason, when the second rule of the translation of out is fired, the state-fact is substituted by anintermediate, semi-state fact, statesemi, reflecting that the sending process can only execute the nextstep if the message was successfully received. The fact Msg(M,N) models that a message is present onthe synchronous channel. Only with the acknowledgement fact Ack(M,N), resulting from the secondrule of the translation of in, is it possible to advance the execution of the sending process, using thethird rule in the translation of out, which transforms the semi-state and the acknowledgement of receiptinto statepĀ·1(. . .). Only now the next step in the execution of the sending process can be executed. Theremaining rules essentially update the position in the state facts and add labels. Some of these labelsare used to restrict the set of executions. For instance the label Eq(M ,N) will be used to indicate thatwe only consider executions in which M =E N . As we will see in the next section these restrictionswill be encoded in the trace formula.
Example. Figure 8 illustrates the above translation by presenting the set of msr rules J!Pnew K (omittingthe rules in MD already shown in Figure 6).
A graph representation of an example trace, generated by the tamarin tool, is depicted in Figure 9.Every box in this picture stands for the application of a multiset rewrite rule, where the premises are atthe top, the conclusions at the bottom, and the actions (if any) in the middle. Every premise needs tohave a matching conclusion, visualized by the arrows, to ensure the graph depicts a valid msr execution.(This is a simplification of the dependency graph representation tamarin uses to perform backward-induction [25, 26].) Note that the machine notation for statep() predicates omits brackets [ ] in theposition p and denotes the empty sequence by ā0ā. We also note that in the current example !state[1]()is persistent and can therefore be used multiple times as a premise. As Fr( ) facts are generated bythe Fresh rule which has an empty premise and action, we omit instances of Fresh and leave thosepremises, but only those, disconnected.
Remark 1. One may note that, while for all other operators, the translation produces well-formed mul-tiset rewriting rules (as long as the process is well-formed itself), this is not the case for the translationof the lookup operator, i. e., it violates the well-formedness condition from Definition 4. Tamarinās con-straint solving algorithm requires all rules, with the exception of Fresh, to be well-formed. We showhowever that, under these specific conditions, the solution procedure is still correct. See Appendix Bfor the proof.
6.2 Definition of the translation of trace formulas
We can now define the translation for formulas.
Definition 14. Given a well-formed trace formula Ļ we define
JĻKā := Ī±ā Ļ and JĻKā := Ī± ā§ Ļ
where Ī± is defined in Figure 10.
The formula Ī± uses the actions of the generated rules to filter out executions that we wish todiscard:
14
state_0111111( k, h )
Out( h ) state_01111111( k, h )
state_011111( k, h )
Insert( <āattā, h>, ādecā )
state_0111111( k, h )
state_01111( k, h )
Insert( <ākeyā, h>, k )
state_011111( k, h )
state_0111( k, h )
Event( ),NewKey( h, k )
state_01111( k, h )
state_011( h ) Fr( k )
state_0111( k, h )
!state_01( ) Fr( h )
state_011( h )
state_0( )
!state_01( )
!state_01( ) Fr( hā )
state_011( hā )
0[Init( )]
state_0( )
state_0111111( kā, hā )
Out( hā ) state_01111111( kā, hā )
state_011111( kā, hā )
Insert( <āattā, hā>, ādecā )
state_0111111( kā, hā )
state_01111( kā, hā )
Insert( <ākeyā, hā>, kā )
state_011111( kā, hā )
state_0111( kā, hā )
Event( ),NewKey( hā, kā )
state_01111( kā, hā )
state_011( hā ) Fr( kā )
state_0111( kā, hā )
Figure 9: Example trace for the translation of !Pnew .
ā¢ Ī±init ensures that the init rule is only fired once.
ā¢ Ī±eq and Ī±noteq ensure that we only consider traces where all (dis)equalities hold.
ā¢ Ī±in and Ī±notin ensure that a successful lookup was preceded by an insert that was neither revokednor overwritten while an unsuccessful lookup was either never inserted, or deleted and never re-inserted.
ā¢ Ī±lock checks that between each two matching locks there must be an unlock. Furthermore,between the first of these locks and the corresponding unlock, there is neither a lock nor anunlock.
ā¢ Ī±inev ensures that whenever an instance of MDIn is required to generate an In-fact, it is generatedas late as possible, i. e., there is no visible event between the action K(t) produced by MDIn,and a rule that requires In(t).
We also note that Tr ļæ½ā JĻKā iff Tr 6ļæ½ā JĀ¬ĻKā.
The axioms in the translation of the formula are designed to work hand in hand with the translationof the process into rules. They express the correctness of traces with respect to our calculusā semantics,but are also meant to guide tamarinās constraint solving algorithm. Ī±in and Ī±notin illustrate what kindof axioms work well: when a node with the action IsIn is created, by definition of the translation, thiscorresponds to a lookup command. The existential translates into a graph constraint that postulatesan insert node for the value fetched by the lookup, and three formulas assuring that a) this insert nodeappears before the lookup, b) is uniquely defined, i. e., it is the last insert to the corresponding key,and c) there is no delete in between. Due to these conditions, Ī±notin only adds one Insert node per IsInnode ā the case where an axiom postulates a node, which itself allows for postulating yet another nodeneeds to be avoided, as tamarin runs into loops otherwise. Similarly, a naĆÆve way of implementinglocks using an axiom would postulate that every lock is preceeded by an unlock and no lock or unlock
15
Ī± := Ī±init ā§ Ī±eq ā§ Ī±noteq ā§ Ī±in ā§ Ī±notin ā§ Ī±lock ā§ Ī±inev and
Ī±init :=āi, j. Init()@i ā§ Init()@j =ā i = j
Ī±eq :=āx, y, i. Eq(x, y)@i =ā x ā y
Ī±noteq :=āx, y, i. NotEq(x, y)@i =ā Ā¬(x ā y)
Ī±in :=āx, y, t3. IsIn(x, y)@t3 =ā āt2. Insert(x, y)@t2 ā§ t2 ā t3
ā§ āt1, y. Insert(x, y)@t1 =ā (t1 ā t2 āØ t1.= t2 āØ t3 ā t1)
ā§ āt1. Delete(x)@t1 =ā (t1 ā t2 āØ t3 ā t1)
Ī±notin :=āx, y, t3. IsNotSet(x)@t3 =ā (āt1, y. Insert(x, y)@t1 =ā t3 ā t1)āØ
(āt1. Delete(x)@t1 ā§ t1 ā t3
ā§ āt2, y. (Insert(x, y)@t2 ā§ t2 ā t3) =ā t2 ā t1)
Ī±lock :=āx, l, lā², i, j. Lock(l, x)@i ā§ Lock(lā², x)@j ā§ iā j
=ā āk. Unlock(l, x)@k ā§ iā k ā§ k ā j
ā§ (ālā²,m. Lock(lā², x)@m =ā Ā¬(iām ā§mā k))
ā§ (ālā²,m. Unlock(lā², x)@m =ā Ā¬(iām ā§mā k))
Ī±inev :=āt, i. InEvent(t)@i =ā āj. K(t)@j ā§ (āk. Event()@k =ā (k ā j āØ iā k))
ā§ (āk, tā². K(tā²)@k =ā (k ā j āØ iā k āØ k ā j))
Figure 10: Definition of Ī±.
in between, unless it is the first lock. This again would cause tamarin to loop, because an unlock istypically preceeded by yet another lock. The axiom Ī±lock avoids this caveat because it only applies topairs of locks carrying the same annotations.
We will outline how Ī±lock is applied during the constraint solving procedure:
1. If there are two locks for the same term and with possibly different annotations, an unlock forthe first of those locks is postulated, more precisely, an unlock with the same term, the sameannotation and no lock or unlock for the same term in-between. The axiom itself contains onlyone case, so the only case distinction that takes place is over which rule produces the matchingUnlock-action. However, due to the annotation, all but one are refuted immediately in the nextstep. Note further that Ī±lock postulates only a single node, namely the node with the actionUnlock.
2. Due to the annotation, the fact statep(. . .) contains the fresh name that instantiates the annota-tion variable. Let a : fresh be this fresh name. Every fact statepā²(. . .) for some position pā² thatis a prefix of p and a suffix of the position of the corresponding lock contains this fresh name.Furthermore, every rule instantiation that is an ancestor of a node in the dependency graphcorresponds to the execution of a command that is an ancestor in the process tree. Therefore,the backward search eventually reaches the matching lock, including the annotation, which isdetermined to be a, and hence appears in the Fr-premise.
3. Because of the Fr-premise, any existing subgraph that already contains the first of the two originallocks would be merged with the subgraph resulting from the backwards search that we describedin the previous step, as otherwise Fr(a) would be added at two different points in the execution.
4. The result is a sequence of nodes from the first lock to the corresponding unlock, and graphconstraints restricting the second lock to not take place between the first lock and the unlock.We note that the axiom Ī±lock is only instantiated once per pair of locks, since it requires thatiā j, thereby fixing their order.
In summary, the annotation helps distinguishing which unlock is expected between to locks, vastlyimproving the speed of the backward search. This optimisation, however, required us to put restrictionson the locks.
16
6.3 Correctness of the translation
The correctness of our translation is stated by the following theorem.
Theorem 1. Given a well-formed ground process P and a well-formed trace formula Ļ we have that
tracespi (P ) ļæ½ā Ļ iff tracesmsr (JP K) ļæ½ā JĻKā
where ā is either ā or ā.
We here give an overview of the main propositions and lemmas needed to prove Theorem 1. Toshow the result we need two additional definitions. We first define an operation that allows to restricta set of traces to those that satisfy the trace formula Ī± as defined in Definition 14.
Definition 15. Let Ī± be the trace formula as defined in Definition 14 and Tr a set of traces. Wedefine
filter (Tr) := {tr ā Tr | āĪø.(tr , Īø) ļæ½ Ī±}
The following proposition states that if a set of traces satisfies the translated formula then thefiltered traces satisfy the original formula.
Proposition 1. Let Tr be a set of traces and Ļ a trace formula. We have that
Tr ļæ½ā JĻKā iff filter(Tr ) ļæ½ā Ļ
where ā is either ā or ā.
The proof (detailed in Appendix) follows directly from the definitions. Next we define the hidingoperation which removes all reserved facts from a trace.
Definition 16 (hide). Given a trace tr and a set of facts F we inductively define hide([]) = [] and
hide(F Ā· tr ) :=
{
hide(tr ) if F ā Fres
(F \ Fres) Ā· hide(tr) otherwise
Given a set of traces Tr we define hide(Tr ) = {hide(t) | t ā Tr}.
As expected well-formed formulas that do not contain reserved facts evaluate the same whetherreserved facts are hidden or not.
Proposition 2. Let Tr be a set of traces and Ļ a well-formed trace formula. We have that
Tr ļæ½ā Ļ iff hide(Tr ) ļæ½ā Ļ
where ā is either ā or ā.
We can now state our main lemma which is relating the set of traces of a process P and the set oftraces of its translation into multiset rewrite rules (proven in the full version).
Lemma 1. Let P be a well-formed ground process. We have that
tracespi (P ) = hide(filter (tracesmsr (JP K))).
Our main theorem can now be proven by applying Lemma 1, Proposition 3 and Proposition 1.
Proof of Theorem 1.
tracespi (P ) ļæ½ā Ļā hide(filter (tracesmsr (JP K))) ļæ½ā Ļ by Lemma 1ā filter(tracesmsr (JP K)) ļæ½ā Ļ by Proposition 3ā tracesmsr (JP K) ļæ½ā JĻKā by Proposition 1
17
7 Case studies
In this section we briefly overview some case studies we performed. These case studies include a simplesecurity API similar to PKCS#11 [23], the Yubikey security token, the optimistic contract signingprotocol by Garay, Jakobsson and MacKenzie (GJM) [16] and a few other examples discussed inArapinis et al. [3] and Mƶdersheim [22]. The results are summarized in Figure 11. For each case studywe provide the number of typing lemmas that were needed by the tamarin prover and whether manualguidance of the tool was required. In case no manual guidance is required we also give execution times.We do not detail all the formal models of the protocols and properties that we studied, and sometimespresent slightly simplified versions. All files of our prototype implementation and our case studies areavailable at http://sapic.gforge.inria.fr/.
Example Typing Lemmas Automated Runā
Security API Ć la PKCS#11 1 yes (51s)Yubikey Protocol [19, 28] 3 no
GJM protocol [3, 16] 0 yes (36s)Mƶdersheimās example (locks/inserts) [22] 0 noāā
Mƶdersheimās example (embedded msr rules) [22] 0 yes (1s)Security Device [3] 1 yes (21s)
Needham-Schroeder-Lowe [21] 1 yes (5s)
ā (Running times on Intel Core2 Duo 2.66Ghz with 4GB RAM)āā (little interaction: 7 manual rule selections)
Figure 11: Case studies.
7.1 Security API Ć la PKCS#11
This example illustrates how our modelling might be useful for the analysis of Security APIs in thestyle of the PKCS#11 standard [23]. We expect studying a complete model of PKCS#11, such asin [13], to be a straightforward extension of this example. In addition to the processes presented in therunning example in Section 3 the actual case study models the following two operations: (i) encryption:given a handle and a plain-text, the user can request an encryption under the key the handle pointsto. (ii) unwrap given a ciphertext senc(k2, k1), and a handle h1, the user can request the ciphertextto be unwrapped, i.e. decrypted, under the key pointed to by h1. If decryption is successful the resultis stored on the device, and a handle pointing to k2 is returned. Moreover, contrary to the runningexample, at creation time keys are assigned the attribute āinitā, from which they can move to eitherāwrapā, or āunwrapā, see the following snippet:
1 in(ć āset_decā,hć) ; lock ć ā att ā ,hć;2 lookup ć ā att ā ,hć as a in3 if a=āinit ā then4 insert ć ā att ā ,hć, ādecā ; unlock ć ā att ā ,hć
Note that, in contrast to the running example, it is necessary to encapsulate the state changes betweenlock and unlock. Otherwise an adversary can stop the execution after line 3, set the attribute to āwrapāin a concurrent process and produce a wrapping. After resuming operation at line 4, he can set thekeyās attribute to ādecā, even though the attribute is set to āwrapā. Hence, the attacker is allowed todecrypt the wrapping he has produced and can obtain the key. Such subtleties can produce attacksthat our modeling allows to detect. If locking is handled correctly, we show secrecy of keys producedon the device, proving the property introduced in Example 5. If locks are removed the attack describedbefore is found.
18
7.2 Yubikey
The Yubikey [28] is a small hardware device designed to authenticate a user against network-basedservices. Manufactured by Yubico, a Swedish company, the Yubikey itself is a low cost ($25), thumb-sized USB device. In its typical configuration, it generates one-time passwords based on encryptionsof a secret value, a running counter and some random values using a unique AES-128 key contained inthe device. The Yubikey authentication server accepts a one-time password only if it decrypts underthe correct AES key to a valid secret value containing a counter larger than the last counter accepted.The counter is thus used as a means to prevent replay attacks. To date, over a million Yubikeys havebeen shipped to more than 30,000 customers including governments, universities and enterprises, e.g.Google, Microsoft, Agfa and Symantec [29].
Besides the counter values used in the one-time password, the Yubikey stores three additionalpieces of information: the public id pid that is used to identify the Yubikey, a secret id secretid thatis transmitted as part of the one-time password and only known to the server and the Yubikey, as wellas the AES key k, which is also shared with the server. The following process PYubikey models a singleYubikey, as well as its initial configuration, where an entry in the serverās database for the public idpid is created. This entry contains a tuple consisting of the Yubikeyās secret id, AES key, and an initialcounter value.
PYubikey =Ī½ k; Ī½ pid; Ī½ secretid ;insert ć āServer ā ,pidć , ć secretid , k, ā zero ā ć ;insert ć āYubikeyā, pidć , ā zero ā+āoneā;out(pid) ;!PPlugin | !PButtonPress
Here, the processes !PPlugin and !PButtonPress model the Yubikey being unplugged and plugged in again(possibly on a different computer), and the emission of the one-time password. We will only discussPButtonPress here. When the user presses the button on the Yubikey, the device outputs a one-timepassword consisting of a counter tc, the secret id secretid and additional randomness npr encryptedusing the AES key k.
PButtonPress =lock pid;
lookup ć āYubikeyā,pidć as tc ininsert ć āYubikeyā,pidć , tc + āoneā;Ī½ nonce; Ī½ npr;event YubiPress(pid, secretid ,k, tc) ;out(ćpid,nonce,senc(ć secretid , tc ,nprć,k)ć) ;
unlock pid
The one-time password senc(ćsecretid, tc, nprć, k) can be used to authenticate against a server thatshares the same secret key, which we model in the process PServer . The process receives the encryptedone-time password along with the public id pid of a Yubikey and a nonce that is part of the protocol,but is irrelevant for the authentication of the Yubikey on the server.
The server looks up the secret id and the AES key associated to the public id, i. e., to the Yubikeysending the request, as well as the last recorded counter value otc. If the key and secret id used in therequest match the values retrieved from the database, then the event Smaller(otc, tc) is logged alongwith the event Login(pid , k, tc), which marks a successful login of the Yubikey pid with key k for thecounter value tc. Afterwards, the old tuple ćsecretid , k, otcć is replaced by ćsecretid , k, tcć, to updatethe latest counter value received.
PServer =! in(ćpid,nonce,senc(ć secretid , tc ,nprć,k)ć) ;lock pid;lookup ć āServer ā ,pidć as tuple in
if fst ( tuple )=secretid then
19
if fst (snd(tuple ))=k thenevent Smaller(snd(snd(tuple)) , tc)event Login(pid,k, tc) ;insert ć āServer ā ,pidć , ć secretid ,k, tcć ;
unlock pid
Note that, in our modelling, the server keeps one lock per public id, which means that it is possibleto have several active instances of the server thread in parallel as long as all requests concern differentYubikeys.
An important part of the modelling of the protocol is to determine whether one counter value issmaller than another. To this end, our modelling employs a feature added to the development versionof tamarin as of October 2012, a union operator āŖ# for multisets of message terms. The operator isdenoted with a plus sign (ā+ā). We model the counter as a multiset only consisting of the symbolsāoneā and āzeroā. The multiplicity of āoneā in the multiset is the value of the counter. A counter valueis considered smaller than another one, if the first multiset is included in the second. A test a < b isincluded by adding the event Smaller(a, b) and an axiom that requires that a is a subset of b:
Ī±Smaller :=āi : temp, a, b : msg . Smaller(a, b)@i
ā āz : msg . a+ z = b
We incorporate this axiom into the security properties just like in Definition 14. Intuitively, we areonly interested in traces where a is indeed smaller than b.
The process we analyse models a single authentication server (that may run arbitrary many threads)and an arbitrary number of Yubikeys, i. e., PServer | !PYubikey . Among other properties, we show bythe means of an injective correspondence property that an attacker that controls the network cannotperform replay attacks, and that each successful login was preceded by a user āpressing the buttonā,formally:
ā pid , k, x, t2.Login(pid , k , x )@t2 ā
āsid , t1.YubiPress(pid , sid , k , x )@t1 ā§ t1 ā t2
ā§ āt3 .Login(pid , k , x )@t3 ā t3 = t2
Besides injective correspondence, we show the absence of replay attacks and the property that asuccessful login invalidates previously emitted one-time passwords. All three properties follow more orless directly from a stronger invariant, which itself can be proven in 295 steps. To find theses steps,tamarin needs some additional human guidance, which can be provided using the interactive mode.This mode still allows the user to complement his manual efforts with automated backward search.The example files contain the modelling in our calculus, the complete proof, and the manual part ofthe proof which can be verified by tamarin without interaction.
Our analysis makes three simplifications: First, in PServer , we use pattern matching instead ofdecryption as demonstrated in the process Pdec we introduced in Section 3. Second, we omit the CRCchecksum and the time-stamp that are part of the one-time password in the actual protocol, since theydo not add to the security of the protocol in the symbolic setting. Third, the Yubikey has actually twocounters instead of one, a session counter, and a token counter. We treat the session and token counteron the Yubikey as a single value, which we justify by the fact that the Yubikey either increases thesession counter and resets the token counter, or increases only the token counter, thereby implementinga complete lexicographical order on the pair (session counter , token counter).
A similar analysis has already been performed by KĆ¼nnemann and Steel, using tamarinās multisetrewriting calculus [19]. However, the model in our new calculus is more fine-grained and we believemore readable. Security-relevant operations like locking and tests on state are written out in detail,resulting in a model that is closer to the real-life operation of such a device. The modeling of theYubikey takes approximately 38 lines in our calculus, which translates to 49 multiset rewrite rules.The model of [19] contains only four rules, but they are are quite complicated, resulting in 23 lines ofcode. More importantly, the gap between their model and the actual Yubikey protocol is larger ā inour calculus, it becomes clear that the server can treat multiple authentication requests in parallel, as
20
long as they do not claim to stem from the same Yubikey. An implementation on the basis of the modelfrom KĆ¼nnemann and Steel would need to implement a global lock accessible to the authenticationserver and all Yubikeys. This is however unrealistic, since the Yubikeys may be used at different placesaround the world, making it unlikely that there exist means of direct communication between them.While a server-side global lock might be conceivable (albeit impractical for performance reasons), areal global lock could not be implemented for the Yubikey as deployed.
7.3 Further Case Studies
We also investigated the case study presented by Mƶdersheim [22], a key-server example. We encodedtwo models of this example, one using the insert construct, the other manipulating state using theembedded multiset rewrite rules. For this example the second model turned out to be more naturaland more convenient allowing for a direct automated proof without any additional typing lemma.
We furthermore modeled the contract signing protocol by Garay et al. [16] and a simple securitydevice which both served as examples in [3]. In the contract signing protocol a trusted party needsto maintain a database with the current status of all contracts (aborted, resolved, or no decision hasbeen taken). In our calculus the status information is naturally modelled using our insert and lookupconstructs. The use of locks is indispensable to avoid the status to be changed between a lookupand an insert. Arapinis et al. [3] showed the crucial property that the same contract can never beboth aborted and resolved. However, due to the fact that StatVerif only allows for a finite number ofmemory cells, they have shown this property for a single contract and provide a manual proof to liftthe result to an unbounded number of contracts. We directly prove this property for an unboundednumber of contracts. Finally we also illustrate the toolās ability to analyze classical security protocols,by analyzing the Needham Schroeder Lowe protocol [21].
8 Conclusion
We present a process calculus which extends the applied pi calculus with constructs for accessing aglobal, shared memory together with an encoding of this calculus in labelled msr rules which enablesautomated verification using the tamarin prover as a backend. Our prototype verification tool, au-tomating this translation, has been successfully used to analyze several case studies. As future work weplan to increase the degree of automation of the tool by automatically generating helping lemmas. Toachieve this goal we can exploit the fact that we generate the msr rules, and hence control their form.We also plan to use the tool for more complex case studies including a complete model of PKCS#11and a study of the TPM 2.0 standard, currently in public review. Finally, we wish to investigate howour constructs for manipulating state can be used to encode loops, needed to model stream protocolssuch as TESLA.
Acknowledgements The research leading to these results has received funding from the EuropeanResearch Council under the European Unionās Seventh Framework Programme (FP7/2007-2013) /ERC grant agreement no 258865, project ProSecure and was supported by CASED (http://www.cased.de).
References
[1] M. Abadi and V. Cortier. Deciding knowledge in security protocols under equational theories.Theoretical Computer Science, 387(1-2):2ā32, 2006.
[2] M. Abadi and C. Fournet. Mobile values, new names, and secure communication. In Proc. 28thACM Symp. on Principles of Programming Languages (POPLā01), pages 104ā115. ACM Press,2001.
[3] M. Arapinis, E. Ritter, and M. Ryan. Statverif: Verification of stateful processes. In Proc. 24thIEEE Computer Security Foundations Symposium (CSFā11), pages 33ā47. IEEE Press, 2011.
21
[4] A. Armando, D. A. Basin, Y. Boichut, Y. Chevalier, L. Compagna, J. CuĆ©llar, P. H. Drielsma,P.-C. HĆ©am, O. Kouchnarenko, J. Mantovani, S. Mƶdersheim, D. von Oheimb, M. Rusinowitch,J. Santiago, M. Turuani, L. ViganĆ², and L. Vigneron. The AVISPA tool for the automatedvalidation of internet security protocols and applications. In Proc. 17th International Conferenceon Computer Aided Verification (CAVā05), LNCS, pages 281ā285. Springer, 2005.
[5] A. Armando, R. Carbone, L. Compagna, J. Cuellar, and L. T. Abad. Formal analysis of saml 2.0web browser single sign-on: Breaking the saml-based single sign-on for google apps. In Proc. 6thACM Workshop on Formal Methods in Security Engineering (FMSEā08), pages 1ā10, 2008.
[6] S. Bistarelli, I. Cervesato, G. Lenzini, and F. Martinelli. Relating multiset rewriting and processalgebras for security protocol analysis. Journal of Computer Security, 13(1):3ā47, 2005.
[7] B. Blanchet. An Efficient Cryptographic Protocol Verifier Based on Prolog Rules. In Proc. 14thComputer Security Foundations Workshop (CSFWā01), pages 82ā96. IEEE Press, 2001.
[8] B. Blanchet, B. Smyth, and V. Cheval. ProVerif 1.88: Automatic Cryptographic Protocol Verifier,User Manual and Tutorial, 2013.
[9] M. Bond and R. Anderson. API level attacks on embedded systems. IEEE Computer Magazine,pages 67ā75, October 2001.
[10] M. Bortolozzo, M. Centenaro, R. Focardi, and G. Steel. Attacking and fixing PKCS#11 securitytokens. In Proc. 17th ACM Conference on Computer and Communications Security (CCSā10),pages 260ā269. ACM Press, 2010.
[11] CCA Basic Services Reference and Guide, Oct. 2006. Available online.
[12] S. Delaune, S. Kremer, M. D. Ryan, and G. Steel. Formal analysis of protocols based on TPMstate registers. In Proc. 24th IEEE Computer Security Foundations Symposium (CSFā11), pages66ā82. IEEE Press, 2011.
[13] S. Delaune, S. Kremer, and G. Steel. Formal analysis of PKCS#11 and proprietary extensions.Journal of Computer Security, 18(6):1211ā1245, Nov. 2010.
[14] S. Escobar, C. Meadows, and J. Meseguer. Maude-npa: Cryptographic protocol analysis moduloequational properties. In Foundations of Security Analysis and Design V, volume 5705 of LNCS,pages 1ā50. Springer, 2009.
[15] S. B. Frƶschle and N. Sommer. Reasoning with past to prove PKCS#11 keys secure. In Proc.7th International Workshop on Formal Aspects in Security and Trust (FASTā10), volume 6561 ofLNCS, pages 96ā110, 2010.
[16] J. A. Garay, M. Jakobsson, and P. D. MacKenzie. Abuse-free optimistic contract signing. InAdvances in CryptologyāCryptoā99, volume 1666 of LNCS, pages 449ā466. Springer, 1999.
[17] J. D. Guttman. State and progress in strand spaces: Proving fair exchange. J. Autom. Reasoning,48(2):159ā195, 2012.
[18] J. Herzog. Applying protocol analysis to security device interfaces. IEEE Security & PrivacyMagazine, 4(4):84ā87, July-Aug 2006.
[19] R. KĆ¼nnemann and G. Steel. YubiSecure? Formal security analysis results for the Yubikey andYubiHSM. In Proc. 8th Workshop on Security and Trust Management (STMā12), volume 7783 ofLNCS, pages 257ā272, 2012.
[20] D. Longley and S. Rigby. An automatic search for security flaws in key management schemes.Computers and Security, 11(1):75ā89, March 1992.
22
[21] G. Lowe. Breaking and fixing the Needham-Schroeder public-key protocol using FDR. In Proc.2nd International Workshop on Tools and Algorithms for Construction and Analysis of Systems(TACASā96), volume 1055 of LNCS, pages 147ā166. Springer, 1996.
[22] S. Mƶdersheim. Abstraction by set-membership: verifying security protocols and web services withdatabases. In Proc. 17th ACM Conference on Computer and Communications Security (CCSā10),pages 351ā360. ACM, 2010.
[23] RSA Security Inc., v2.20. PKCS #11: Cryptographic Token Interface Standard., June 2004.
[24] B. Schmidt. Formal Analysis of Key-Exchange Protocols and Physical Protocols. PhD thesis, ETHZĆ¼rich, November 2012.
[25] B. Schmidt, S. Meier, C. Cremers, and D. Basin. Automated analysis of Diffie-Hellman protocolsand advanced security properties. In Proc. 25th IEEE Computer Security Foundations Symposium(CSFā12), pages 78ā94. IEEE Press, 2012.
[26] B. Schmidt, S. Meier, C. Cremers, and D. Basin. The tamarin prover for the symbolic analysisof security protocols. In Proc. 25th International Conference on Computer Aided Verification(CAVā13), volume 8044 of LNCS, pages 696ā701. Springer, 2013.
[27] Trusted Computing Group. TPM Specification version 1.2. Parts 1ā3, revision 103.http://www.trustedcomputinggroup.org/resources/tpm_main_specification, 2007.
[28] Yubico AB, Kungsgatan 37, 111 56 Stockholm Sweden. The YubiKey Manual -Usage, configuration and introduction of basic concepts (Version 2.2), available at:http: // www. yubico. com/ documentation , June 2010.
[29] Yubico AB. Yubico customer list, 2013. Accessed: Wed 17 Jul 2013 11:40:50 CEST.
A Definition of the process annotation
Definition 17 (Process annotation). Given a ground process P we define the annotated ground processP as follows:
0 := 0
P |Q := P |Q
!P := !P
if t1 = t2 then P
else Q:= if t1 = t2 then P else Q
lookup M as x
in P else Q:=
lookup M as x
in P else Q
Ī±;P := Ī±;Pwhere Ī± /ā { lock t,unlock t : t ā T }
lock t;P := lockl t; au(P, t, l)where l ā N is a fresh label
unlockl t;P := unlockl t;P
unlock t;P := ā„
23
where au(P, t, l) annotates the first unlock that has parameter t with the label l, i. e.:
au(P |Q, t, l) := ā„
au(!P , t, l) := ā„
au(if t1 = t2 thenP else Q, t, l)
:=if t1 = t2 then au(P, t, l)else au(Q, t, l)
au(lookup M as xin P else Q, t, l)
:=lookup M as x inau(P, t, l) else au(Q, t, l)
au(Ī±;P , t, l) := Ī±; au(P, t, l)where Ī± 6= unlock t
au(unlock t;P , t, l) := unlockl t;P
au(0, t, l) := 0
B Correctness of tamarinās solution procedure for translated rules
The multiset rewrite system produced by our translation for a well-formed process P could actuallycontain rewrite rules that are not valid with respect to Definition 4, because they violate the thirdcondition, which is: for each lā² ā[aā²]ā rā² ā R āE ginsts(l ā[a]ā r) we have that ā©rā²ā²=Erā²names(rā²ā²) ā©FN ā ā©lā²ā²=Elā²names(lā²ā²) ā© FN .
This does not hold for rules in JP K=p where p is the position of the lookup-operator. The righthand-side of this rule can be instantiated such that, assuming the variable bound by the lookup isnamed v, this variable v is substituted by a names that does not appear on the left-hand side. In thefollowing, we will show that the results from [25] still hold. In practice, this means that the tamarin-prover can be used for verification, despite the fact that it outputs well-formedness errors for each rulethat is a translation of a lock.
We will introduce some notation first. We re-define JP K to contain the Init rule and JP, [], []K, butnot MD (which is different to Definition 13). We furthermore define a translation with dummy-facts,
denoted JP KD, that contains Init and JP, [], []KD
, which is defined as follows:
Definition 18. We define JP KD := InitāŖ JP, [], []KD, where JP, [], []K
Dis defined just as JP, [], []K, with
the exception of two cases, P = lookup M as v in P else Q and P = insert s, t;P , where it is definedas follows:
Jlookup M as v in P else Q, p, xKD = {[statep(x), !Dum(v)] ā[IsIn(M,v)]ā [statepĀ·1(M, v)],
[statep(x)] ā[IsNotSet(M)]ā [statepĀ·2(x)]}
āŖ JP, p Ā· 1, (x, v)KD āŖ JQ, p Ā· 2, xKD
Jinsert s, t;P, p, xKD = { [statep(x)] ā[Insert(s, t)]ā [statepĀ·1(x), !Dum(t)] }
āŖ JP, p Ā· 1, xKD
The only difference between JP K and JP KD is therefore, that JP KD produces a permanent fact !Dumfor every value v that appears in an action insert(k, v), which is a premise to every rule instance withan action IsIn(kā², v). We see that JP KD contains now only valid multiset rewrite rules.
In the following, we would like to show that the tamarin-proverās solution algorithm is correct forJP K. To this end, we make use of the proof of correctness of tamarin as presented in Benedikt SchmidtāsPh.D. thesis [24]. We will refer to Lemmas, Theorems and Corollaries in this work by their numbers.We will use the notation of this work, to make it easier to the reader to compare our statements againstthe statements there. In particular, trace(execs(R)) is tracesmsr (R) in our notation. We have to showthat:
Lemma 2. For all well-formed process P and guarded trace properties Ļ,
trace(execs(JP K āŖ MD) ļæ½DHeĀ¬Ī±in āØ Ļ
24
if and only iftrace(ndgraphs (JP K)) ļæ½ACC Ā¬Ī±in āØ Ļ.
Proof. The proof proceeds similar to the proof to Theorem 3.27. We refer to results in [24], whenevertheir proofs apply despite the fact that the rules in JP K do not satisfy the third condition of multisetrewrite rules.
trace(execs(JP K āŖ MD) ļæ½DHeĀ¬Ī±in āØ Ļ
ā trace(execs(JP K āŖ MD) ļæ½DHe Ā¬Ī±in āØ Ļ (Lemma 3.7 (unaltered))
ā trace(execs(JP K āŖ MD)) āRDHeļæ½DHe
Ā¬Ī±in āØ Ļ (Definition of ļæ½DHe)
ā trace(dgraphsDHe(JP K āŖ MD)) āRDHeļæ½DHe Ā¬Ī±in āØ Ļ (Lemma 3.10 (unaltered))
ā trace({dg | dg ā dgraphsACC(āJP K āŖMDāRDHe
insts )
ā§dg āRDHe-normal}) ļæ½DHe
Ā¬Ī±in āØ Ļ (Lemma 3.11 (unaltered))
ā trace(ndgraphs(JP K)) ļæ½DHe Ā¬Ī±in āØ Ļ (Lemma A.12 (*))
ā trace(ndgraphs(JP K)) ļæ½ACC Ā¬Ī±in āØ Ļ (Lemma 3.7 and A.20(both unaltered))
It is only in Lemma A.12 where the third condition is used: The proof to this lemma appliesLemma A.14, which says that all factors (or their inverses) are known to the adversary. We will quoteLemma A.14 here:
Lemma 3 (Lemma A.14 in [24]). For all ndg ā ndgraphs(P ), conclusions (i, u) in ndg with conclusionfact f and terms t ā afactors(f), there is a conclusion (j, v) in ndg with j < i and conclusion factKd(m) such that m āACC { t, (tā1) āRBPe }.
If there is ndg ā ndgraphs (JP K), such that trace(ndg) ļæ½ACC Ī±in , then
trace(ndgraphs(JP K)) ļæ½ACC Ā¬Ī±in āØ Ļ
āāndg ā ndgraphs(JP K) s. t. trace(ndg) ļæ½ACC Ī±in
trace(ndg) ļæ½ACCļæ½ Ļ
Since for the empty trace, [] ļæ½ACC Ī±in , we only have to show that Lemma A.14 holds for ndg āndgraphs (JP K), such that trace(ndg) ļæ½ACC Ī±in .
For every ndg ā ndgraphs(JP K), such that trace(ndg) ļæ½ACC Ī±in , there is a trace equivalent ndg ā² āndgraphs (JP KD), since the only difference between JP K and JP KD lies in the dummy conclusion andpremises, and Ī±in requires that any v in an action IsIn(u, v) appeared previously in an action Insert(u, v)(equivalence modulo ACC ). Therefore, ndg ā² has the same Kd-conclusions ndg has, and every conclusionin ndg is a conclusion in ndg ā².
We have that Lemma A.14 holds for JP KD, since all rules generated in this translation are valid mul-tiset rewrite rules. Therefore, Lemma A.14 holds for all ndg ā ndgraphs(JP K), such that trace(ndg) ļæ½ACC
Ī±in , too, concluding the proof by showing the marked (*) step.
C Proofs of Section 6
Proposition 1. Let Tr be a set of traces and Ļ a trace formula. We have that
Tr ļæ½ā JĻKā iff filter(Tr ) ļæ½ā Ļ
where ā is either ā or ā.
25
Proof. We first show the two directions for the case ā = ā. We start by showing that Tr ļæ½ā JĻK implies
filter (Tr) ļæ½ Ļ.
Tr ļæ½ā JĻKā ā filter (Tr) ļæ½ā JĻKā (since filter (Tr) ā Tr)
ā filter (Tr) ļæ½ā Ī±ā Ļ (by definition of JĻKā)
ā filter (Tr) ļæ½ā Ļ (since filter(Tr ) ļæ½ā Ī±)
We next show that filter (Tr) ļæ½ā Ļ implies Tr ļæ½ā JĻKā.
filter (Tr ) ļæ½ā Ļā filter (Tr) ļæ½ā Ī± ā§ Ļ (since filter(Tr ) ļæ½ā Ī±)
ā Tr ļæ½ā Ā¬Ī± āØ (Ī± ā§ Ļ) (since filter (Tr) ā Tr and (Tr \ filter (Tr)) 6ļæ½ā Ī±)
ā Tr ļæ½ā Ī±ā Ļ
ā Tr ļæ½ā JĻKā (by definition of JĻKā)
The case of ā = ā now easily follows:
Tr ļæ½ā JĻKā iff Tr 6ļæ½ā JĀ¬ĻKā
iff filter(Tr ) 6ļæ½ā Ā¬Ļiff filter(Tr ) ļæ½ā Ļ.
Proposition 3. Let Tr be a set of traces and Ļ a well-formed trace formula. We have that
Tr ļæ½ā Ļ iff hide(Tr ) ļæ½ā Ļ
where ā is either ā or ā.
Proof. We start with the case ā = ā and show the stronger statement that for a trace tr
āĪø.āĪøā². if (tr , Īø) ļæ½ Ļ then (hide(tr), Īøā²) ļæ½ Ļ
andāĪø.āĪøā². if (hide(tr ), Īø) ļæ½ Ļ then (tr , Īøā²) ļæ½ Ļ
We will show both statements by a nested induction on |tr | and the structure of the formula. (Theunderlying well-founded order is the lexicographic ordering of the pairs consisting of the length of thetrace and the size of the formula)
If |tr | = 0 then tr = [] and tr = hide(tr ) which allows us to directly conclude letting Īøā² := Īø.
If |tr | = n, we define tr and F such that tr = tr Ā· F . By induction hypothesis we have that
āĪø.āĪøā². if (tr , Īø) ļæ½ Ļ then (hide(tr), Īø
ā²) ļæ½ Ļ
andāĪø.āĪø
ā². if (hide(tr ), Īø) ļæ½ Ļ then (tr , Īø
ā²) ļæ½ Ļ
We proceed by structural induction on Ļ.
ā¢ Ļ = ā„, Ļ = iā j, Ļ = i.= j or t1 ā t2. In these cases we trivially conclude as the truth value of
these formulas does not depend on the trace and for both statements we simply let Īøā² := Īø.
ā¢ Ļ = f@i. We start with the first statement. Suppose that (tr , Īø) ļæ½ f@i. If Īø(i) < n then we have
also that tr , Īø ļæ½ f@i. By induction hypothesis, there exists Īøā²such that (tr , Īø
ā²) ļæ½ f@i. Hence we
also have that (tr , Īøā²) ļæ½ f@i and letting Īøā² := Īø
ā²allows us to conclude. If Īø(i) = n we know that
f ā trn. As Ļ is well-formed f 6ā Fres and hence f ā hide(tr )nā² where nā² = |hide(tr )|. The proofof the other statement is similar.
26
ā¢ Ļ = Ā¬Ļā², Ļ = Ļ1 ā§ Ļ2, or Ļ = āx : s.Ļā². We directly conclude by induction hypotheses (on thestructure of Ļ).
From the above statements we easily have that Tr ļæ½ā Ļ iff hide(Tr ) ļæ½ā Ļ.
The case of ā = ā now easily follows:
Tr ļæ½ā Ļ iff Tr 6ļæ½ā Ā¬Ļ iff hide(Tr) 6ļæ½ā Ā¬Ļ iff hide(Tr) ļæ½ā Ļ
In order to prove Lemma 1, we need a few additional lemmas.We say that a set of traces Tr is prefix closed if for all tr ā Tr and for all tr ā² which is a prefix of
tr we have that tr ā² ā Tr .
Lemma 4 (filter is prefix-closed). Let Tr be a set of traces. If Tr is prefix closed then filter (Tr) isprefix closed as well.
Proof. It is sufficient to show that for any trace tr = tr ā² Ā· a we have that if āĪø. (tr , Īø) ļæ½ Ī± thenāĪø. (tr ā², Īø) ļæ½ Ī±. This can be shown by inspecting each of the conjuncts of Ī±.
We next show that the translation with dummy facts defined in Definition 18 produces the sametraces as JP K, excluding traces not consistent with the axioms. For this we define the function d whichremoves any dummy fact from an execution, i.e.,
d(ā F1āā S1
F2āā . . .Fnāā Sn) = ā
F1āā Sā²1
F2āā . . .Fnāā Sā²
n
where Sā²i = Si \
# āŖtāT !Dum(t).
Lemma 5. Given a ground process P , we have that
filter(execmsr (JP K)) = filter(d(execmsr (JP KD āŖ MD)))
Proof. The only rules in JP KD that differ from JP K are translations of insert and lookup. The first oneonly adds a permanent fact, which by the definition of d, is removed when applying d. The second onerequires a fact !Dum(t), whenever the rule is instantiated such the actions equals IsIn(s, t) for some s.Since the translation is otherwise the same, we have that
filter(d(execmsr (JP KD āŖ MD))) ā filter (execmsr (JP K))
For any trace in filter (d(execmsr (JpK āŖMD))) and any action IsIn(s, t) in this trace, there is an earlieraction Insert(sā², tā²) such that s = sā² and t = tā², as otherwise Ī±in would not hold. Therefore the sametrace is part of filter(d(execmsr (JpKD āŖMD))), as this means that whenever !Dum(t) is in the premise,!Dum(tā²) for t = tā² has previously appeared in the conclusion. Since it is a permanent fact, it has notdisappeared and therefore
filter(d(execmsr (JP KD āŖ MD))) ā filter (execmsr (JP K))
We slightly abuse notation by defining filter on executions to filter out all traces contradicting theaxioms, see Definition 15.
Lemma 6. Let P be a ground process and ā F1āā S1
F2āā . . .Fnāā Sn ā filter (execmsr (JP K)). For all
1 ā¤ i ā¤ n, if Fr(a) ā Si and F (t1, . . . , tk) ā Si for any F ā Ī£fact \ {Fr }, then a 6ā ā©t=Etā²names(tā²), forany t ā {t1, . . . , tk}.
27
Proof. The translation with the dummy fact introduced in Appendix B will make this proof easier asfor JP KD āŖ MD, we have that the third condition of Definition 4 holds, namely,
ālā² ā[aā²]ā rā² āE ginsts(l ā[a]ā r) : ā©rā²ā²=Erā²names(rā²ā²) ā© FN ā ā©lā²ā²=E lā²names(lā²ā²) ā© FN (1)
We will show that the statement holds for all ā F1āā S1
F2āā . . .Fnāā Sn ā filter (execmsr (JP KD āŖ MD)),
which implies the claim by Lemma 5. We proceed by induction on n, the length of the execution.
ā¢ Base case, n = 0. We have that S0 = ā and therefore the statement holds trivially.
ā¢ Inductive case, n ā„ 1. We distinguish two cases.
1. A rule that is not Fresh was applied and there is a fact F (t1, . . . , tk) ā Sn, such thatF (t1, . . . , tk) /ā Snā1, and Fr(a) ā Sn such that a ā ā©ti=Etā²names(tā²) for some ti. (If thereare no such F (t1, . . . , tk) and Fr(a) we immediately conclude by induction hypothesis.) ByEquation 1, a ā tā²j for some F ā²(tā²1, . . . , t
ā²l) ā Snā1. Since Fresh is the only rule that adds a
Fr-fact and Fr(a) ā Sn, it must be that Fr(a) ā Snā1, contradicting the induction hypothesis.Therefore this case is not possible.
2. The rule Fresh was applied, i. e., Fr(a) ā Sn and Fr(a) /ā Snā1. If there is no a āā©ti=Etā²names(tā²) for some ti, and F (t1, . . . , tk) ā Sn, then we conclude by induction hy-pothesis. Otherwise, if there is such a F (t1, . . . , tk) ā Sn, then, by Equation 1, a ā tā²j forsome F ā²(tā²1, . . . , t
ā²l) ā Si for i < n. We construct a contradiction to the induction hypothesis
by taking the prefix of the execution up to i and appending the instantiation of the Fresh
rule to its end. Since d(execmsr (JP KD āŖ MD)) is prefix closed by Lemma 4 we have that
ā F1āā Sā²
1F2āā . . .
Fiāā Si ā filter (d(execmsr (JP KD āŖ MD))). Moreover as rule Fresh wasapplied adding Fr(a) ā Sn it is also possible to apply the same instance of Fresh to theprefix (by Definition 6) and therefore
ā F1āā Sā²
1F2āā . . .
Fiāā Si āā Si āŖ {Fr(a) } ā filter (d(execmsr (JP KD āŖMD)))
contradicting the induction hypothesis.
Lemma 7. For any frame Ī½n.Ļ, t ā M and a ā FN , if a 6ā st(t), a 6ā st(Ļ) and Ī½n.Ļ ā¢ t, thenĪ½n, a.Ļ ā¢ t.
Proof. In [1, Proposition 1] it is shown that Ī½n.Ļ ā¢ t if and only if āM.fn(M) ā© n = ā and MĻ =E t.Define M ā² as M renaming a to some fresh name, i.e., not appearing in n, Ļ, t. As a 6ā st(Ļ, t) and thefact that equational theories are closed under bijective renaming of names we have that M ā²Ļ =E t andfn(M ā²) ā© (n, a) = ā . Hence Ī½n, a.Ļ ā¢ t.
Lemma 8. Let P be a ground process and ā F1āā S1
F2āā . . .Fnāā Sn ā filter (execmsr (JP K)). Let
n = {a : fresh | ProtoNonce(a) āā
1ā¤jā¤n
Fj},
{t1, . . . , tm} = {t | Out(t) ā1ā¤jā¤n Sj}.
Let Ļ = {t1/x1 , . . . ,tm /xm}. We have that
1. if !K(t) ā Sn then Ī½n.Ļ ā¢ t;
2. if Ī½n.Ļ ā¢ t then there exists S such that
ā¢ ā F1āā S1
F2āā . . .Fnāā Snāā
āS ā filter (execmsrE (JP K)),
ā¢ !K(t) āE S and
ā¢ Sn āāR S for R = {MDOut,MDPub,MDFresh,MDAppl,Fresh }.
Proof. We prove both items separately.
1. The proof proceeds by induction on n, the number of steps of the execution.
28
Base case: n=0. This case trivially holds as Sn = ā .
Inductive case: n>0. By induction we suppose that if !K(t) ā Snā1 then Ī½nā².Ļā² ā¢ t wherenā², Ļā² are defined in a similar way as n, Ļ but for the execution of size nā 1. We proceed by caseanalysis on the rule used to extend the execution.
ā¢ MDOut. Suppose that Out(u) ā[ ]ā!K(u) ā ginsts(MDOut) is the rule used to extendthe execution. Hence Out(u) ā Snā1 and by definition of Ļ there exists x such that xĻ = u.We can apply deduction rule DFrame and conclude that Ī½n.Ļ ā¢ u. If !K(t) ā Sn and t 6= uwe conclude by induction hypothesis as n = nā², Ļ = Ļā².
ā¢ MDPub. Suppose that ā[ ]ā K(a : pub) ā ginsts(MDPub) is the rule used to extend theexecution. As names of sort pub are never added to n we can apply deduction rule DName
and conclude that Ī½n.Ļ ā¢ a. If K(t) ā Sn and t 6= a we conclude by induction hypothesisas n = nā², Ļ = Ļā².
ā¢ MDFresh. Suppose that Fr(a : fresh) ā[ ]ā K(a : fresh) ā ginsts(MDFresh) is the ruleused to extend the execution. By definition of an execution we have that Fr(a : fresh) 6=(Sj+1 \ Sj) for any j 6= n ā 1. Hence n 6ā n. We can apply deduction rule DName andconclude that Ī½n.Ļ ā¢ a. If !K(t) ā Sn and t 6= a we conclude by induction hypothesis asn = nā², Ļ = Ļā².
ā¢ MDAppl. Suppose that !K(t1), . . . , !K(tk) ā[ ]ā!K(u) ā ginsts(MDAppl) is the rule usedto extend the execution. We have that K(t1), . . . ,K(tk) ā Snā1 and u =E f(t1, . . . , tk). Byinduction hypothesis, Ī½nā².Ļā² ā¢ ti for 1 ā¤ i ā¤ k. As n = nā², Ļ = Ļā² we have that Ī½n.Ļ ā¢ tifor 1 ā¤ i ā¤ k. We can apply deduction rule DAppl and conclude that Ī½n.Ļ ā¢ f(t1, . . . , tk).Hence, Ī½n.Ļ ā¢ u by rule DEq. If K(t) ā Sn and t 6= f(t1, . . . , tk) we conclude by inductionhypothesis as n = nā², Ļ = Ļā².
ā¢ If Snā1ProtoNonce(a)āāāāāāāāāāSn we have that Fr(a) ā Snā1. By Lemma 6, we obtain that if !K(t) ā
Snā1 then there exist tā² and Ļā²ā² such that tā² =E t, Ļā²ā² =E Ļā² and a 6ā st(tā²) and a 6ā st(Ļā²ā²).For each !K(u) ā Sn there is !K(u) ā Snā1, and by induction hypothesis, Ī½nā².Ļā² ā¢ u. ByLemma 7 and the fact that Ļā²ā² =E Ļā² we have that Ī½nā², a.Ļā² ā¢ u. As nā², a = n and Ļā² = Ļwe conclude.
ā¢ All other rules do neither add !K( )-facts nor do they change n and may only extend Ļ.Therefore we conclude by the induction hypothesis.
2. Suppose that Ī½n.Ļ ā¢ t. We proceed by induction on the proof tree witnessing Ī½n.Ļ ā¢ t.
Base case. The proof tree consists of a single node. In this case one of the deduction rulesDName or DFrame has been applied.
ā¢ DName. We have that t 6ā n. If t ā PN we use rule MDPub and we have that Sn ā S =Sn āŖ {!K(t)}. In case t ā FN we need to consider 3 different cases: (i) !K(t) ā Sn and weimmediately conclude (by letting S = Sn), (ii) Fr(t) ā Sn and applying rule MDFresh wehave that Sn ā S = Sn āŖ {!K(t)}, (iii) Fr(t) 6ā Sn. By inspection of the rules we see thatFr(t) 6ā Si for any 1 ā¤ i ā¤ n: the only rules that could remove Fr(t) are MDFresh whichwould have created the persistent fact !K(t), or the ProtoNonce rules which would howeverhave added t to n. Hence, applying successively rules Fresh and MDFresh yields a validextension of the execution Sn ā Sn āŖ {Fr(t)} ā S = Sn āŖ {!K(t)}.
ā¢ DFrame. We have that xĻ = t for some x ā D(Ļ), that is, t ā {t1, . . . , tm}. By definitionof {t1, . . . , tm}, Out(t) ā Si for some i ā¤ n. If Out(t) ā Sn we have that Sn ā S =(Sn \{Out(t)})āŖ{!K(t)} applying rule MDOut. If Out(u) 6ā Sn, the fact that the only rulein JP K that allows to remove an Out-fact is MDOut, suggests that it was applied before,and thus !K(u) ā S.
29
Inductive case. We proceed by case distinction on the last deduction rule which was applied.
ā¢ DAppl. In this case t = f(t1, . . . , tk), such that f ā Ī£k and Ī½nr.Ļ ā¢ ti for everyi ā {1, . . . , k}. Applying the induction hypothesis we obtain that there are k transitionsequences Sn āā
R Si for 1 ā¤ i ā¤ k which extend the execution such that ti ā Si. All ofthem only add !K facts which are persistent facts. If any two of these extensions remove thesame Out(t)-fact or the same Fr(a)-fact it also adds the persistent fact !K(t), respectively!K(a), and we simply remove the second occurrence of the transition. Therefore, applyingthe same rules as for the transitions Sn āā Si (and removing duplicate rules) we have thatSn āā Sā² and !K(t1), . . . , !K(tk) ā Sā². Applying rule MDAppl we conclude.
ā¢ DEq. By induction hypothesis there exists S as required with !K(tā²) āE S and t =E tā²
which allows us to immediately conclude that !K(t) āE S.
Lemma 9. If Ī½n.Ļ ā¢ t, n =E nā², Ļ =E Ļā² and t =E tā², then Ī½nā².Ļā² ā¢ tā².
Proof. Assume Ī½n.Ļ ā¢ t. Since an application of DEq can be appended to the leafs of its proof tree,we have Ī½n.Ļā² ā¢ t. Since DEq can be applied to its root, we have Ī½n.Ļā² ā¢ tā². Since n, nā² consist onlyof names, n = nā² and thus Ī½nā².Ļā² ā¢ tā².
To state our next lemma we need two additional definitions.
Definition 19. Let P be a well-formed ground process and pt a position in P . We define the set ofmultiset rewrite rules generated for position pt of P , denoted JP K=pt
as follows:
JP K=pt:= JP, [], []K=pt
where JĀ·, Ā·, Ā·K=ptis defined in Figure 12.
The next definition will be useful to state that for a process P every fact of the form statep(t) in amultiset rewrite execution of JP K corresponds to an active process in the execution of P which is aninstance of the subprocess P |p.
Definition 20. Let P be a ground process, P be a multiset of processes and S a multiset of multisetrewrite rules. We write P āP S if there exists a bijection between P and the multiset {statep(t) |āp, t. statep(t) ā
# S}# such that whenever Q ā# P is mapped to statep(t) ā# S we have that
1. P |pĻ = QĻ, for some substitution Ļ and some bijective renaming Ļ of fresh, but not bound namesin Q, and
2. āri āE ginsts(JP K=p). statep(t) ā prems(ri).
When P āP S, Q ā# P and statep(t) ā# S we also write QāP statep(t) if this bijection maps Q
to statep(t).
Remark 2. Note that āP has the following properties (by the fact that it defines a bijection betweenmultisets).
ā¢ If P1 āP S1 and P2 āP S2 then P1 āŖ# P2 āP S1 āŖ
# S2.
ā¢ If P1 āP S1 and QāP statep(t) for Q ā P1 and statep(t) ā S1 (i.e. Q and statep(t) are relatedby the bijection defined by P1 āP S1) then P1 \
# {Q} āP S1 \# {statep(t)}.
Proposition 4. Let A be a finite set, < a strict total order on A and p a predicate on elements of A.We have that
āi ā A.p(i) ā āi ā A. p(i) āØ āj ā A. i < j ā§ Ā¬p(j)(ā āi ā A. Ā¬p(i) ā āj ā A. i < j ā§ Ā¬p(j))
andāi ā A.p(i) ā āi ā A.p(i) ā§ āj ā A. i < j ā Ā¬p(j)
30
J0, p, xK=pt= { [statep(x)] ā [] }
p?=pt
JP | Q, p, xK=pt= { [statep(x)] ā [statepĀ·1(x), statepĀ·2(x)] }
p?=pt
āŖ JP, p Ā· 1, xK=ptāŖ JQ, p Ā· 2, xK=pt
J!P, p, xK=pt= { [!statep(x)] ā [statepĀ·1(x)] }
p?=pt
āŖ JP, p Ā· 1, xK=pt
JĪ½a;P, p, xK=pt= { [statep(x),Fr(na : fresh)] ā[ProtoNonce(na : fresh)]ā [statepĀ·1(x, na : fresh)] }
p?=pt
āŖ JP, p Ā· 1, (x, na : fresh)K=pt
JOut(M,N);P, p, xK=pt= { [statep(x), In(M)] ā[InEvent(M)]ā [Out(N), statepĀ·1(x)],
[statep(x)] ā [Msg(M,N), statesemi
p (x)],
[statesemi
p (x),Ack(M,N)] ā [statepĀ·1(x)] }p?=pt
āŖ JP, p Ā· 1, xK=pt
JIn(M,N);P, p, xK=pt= { [statep(x), In(ćM,Nć)] ā[InEvent(ćM,Nć)]ā [statepĀ·1(x āŖ vars(N))],
[statep(x),Msg(M,N)] ā [statepĀ·1(x āŖ vars(N)),Ack(M,N)] }p
?=pt
āŖ JP, p Ā· 1, x āŖ vars(N)K=pt
Jif M = N then P
else Q, p, xK=pt
= { [statep(x)] ā[ Eq(M,N) ]ā [statepĀ·1(x)],
[statep(x)] ā[NotEq(M,N)]ā [statepĀ·2(x)] }p?=pt
āŖ JP, p Ā· 1, xK=ptāŖ JQ, p Ā· 2, xK=pt
Jevent F ;P, p, xK=pt= { [statep(x)] ā[Event(), F ]ā [statepĀ·1(x)] }
p?=pt
āŖ JP, p Ā· 1, xK=pt
Jinsert s, t;P, p, xK=pt= { [statep(x)] ā[Insert(s, t)]ā [statepĀ·1(x)] }
p?=pt
āŖ JP, p Ā· 1, xK=pt
Jdelete s;P, p, xK=pt= { [statep(x)] ā[Delete(s)]ā [statepĀ·1(x)] }
p?=pt
āŖ JP, p Ā· 1, xK=pt
Jlookup M as v
in P else Q, p, xK=pt
= { [statep(x)] ā[IsIn(M,v)]ā [statepĀ·1(M , v)],
[statep(x)] ā[IsNotSet(M)]ā [statepĀ·2(x)] }p
?=pt
āŖ JP, p Ā· 1, (x, v)K=ptāŖ JQ, p Ā· 2, xK=pt
Jlockl s;P, p, xK=pt= { [Fr(lockl), statep(x)] ā[Lock(lock l, s)]ā [statepĀ·1(x, lock l)] }
p?=pt
āŖ JP, p Ā· 1, xK=pt
Junlockl s;P, p, xK=pt= { [statep(x)] ā[Unlock(lock l, s)]ā [statepĀ·1(x)] }
p?=pt
āŖ JP, p Ā· 1, xK=pt
J[l ā[a]ā r]; P, p, xK=pt= { [statep(x), l] ā[Event(), a]ā [r, statepĀ·1(x āŖ vars(l))] }
p?=pt
āŖ JP, p Ā· 1, x āŖ vars(l)K
Figure 12: Definition of JP, p, xK=ptwhere {Ā·}
a?=b
= { Ā· } if a = b and ā otherwise.
31
Lemma 10. Le P be a well-formed ground process. If
(E0,S0,SMS0 ,P0, Ļ0,L0)
E1āā (E1,S1,SMS1 ,P1, Ļ1,L1)
E2āā . . .Enāā (En,Sn,S
MSn ,Pn, Ļn,Ln)
where (E0,S0,SMS0 ,P0, Ļ0,L0) = (ā , ā , ā , {P }, ā , ā ) then there are (F1, S1), . . . , (Fnā² , Snā²) such that
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā² ā execmsr (JP K)
and there exists a monotonic, strictly increasing function f : Nn ā Nnā² such that f(n) = nā² and for alli ā Nn
1. Ei = { a | ProtoNonce(a) āā
1ā¤jā¤f(i) Fj }
2. āt ā M. Si(t) =
u if āj ā¤ f(i).Insert(t, u) ā Fj
ā§ājā², uā².j < jā² ā¤ f(i) ā Insert(t, uā²) 6āE Fjā² ā§Delete(t) 6āE Fjā²
ā„ otherwise
3. SMSi = Sf(i) \
# Fres
4. Pi āP Sf(i)
5. {xĻi | x ā D(Ļi) }# = {Out(t) ā āŖkā¤f(i)Sk}
#
6. Li =E { t | āj ā¤ f(i), u. Lock(u, t) āE Fj ā§ āj < k ā¤ f(i).Unlock(u, t) 6āE Fk }
7. [F1, . . . , Fnā² ] ļæ½ Ī± where Ī± is defined as in Definition 14.
8. āk. f(iā 1) < k ā¤ f(i) and Ei = Fk and āŖf(iā1)<j 6=kā¤f(i) Fj ā Fres
Proof. We proceed by induction over the number of transitions n.
Base Case. For n = 0, we let f(n) = 1 and S1 be the multiset obtained by using the Rule Init:
ā Initāā { state[]() }
#
Condition 1, Condition 2, Condition 3, Condition 5, Condition 6, Condition 7 and Condition 8 holdtrivially. To show that Condition 4 holds, we have to show that P0 āP { state[]() }
#. Note that
P0 = {P }#. We choose the bijection such that P āP state[](). For Ļ = ā and Ļ = ā we have thatP |[]Ļ = PĻ = PĻ. By Definition 19, JP K=[] = JP, [], []K=[]. We see from Figure 12 that for everyP we have that state[]() ā prems(JP, [], []K=[]). Hence, we conclude that there is a ground instanceri āE ginsts(JP K=[]) with state[]() ā prems(ri).
Inductive step. Assume the invariant holds for n ā 1 ā„ 0. We have to show that the lemma holds forn transitions
(E0,S0,SMS0 ,P0, Ļ0,L0)
E1āā (E1,S1,SMS1 ,P1, Ļ1,L1)
E2āā . . .Enāā (En,Sn,S
MSn ,Pn, Ļn,Ln)
By induction hypothesis, we have that there exists a monotonically increasing function from Nnā1 āNnā² and an execution
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā² ā execmsr (JP K)
such that Conditions 1 to 8 hold. Let fp be this function and note that nā² = fp(nā 1). Fix a bijectionsuch that Pnā1 āP Sfp(nā1). We will abuse notation by writing P āP statep(t), if this bijection goes
from P to statep(t).We now proceed by case distinction over the type of transition from (Enā1,Snā1,S
MSnā1,Pnā1, Ļnā1,
Lnā1) to (En,Sn,SMSn ,Pn, Ļn,Ln). We will (unless stated otherwise) extend the previous execution by
a number of steps, say s, from Snā² to some Snā²+s, and prove that Conditions 1 to 8 hold for n (since byinduction hypothesis, they hold for all i < n) and a function f : Nn ā Nnā²+s that is defined as follows:
f(i) :=
{
fp(i) if i ā Nnā1
nā² + s if i = n
32
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ {0}, Ļnā1,Lnā1) ā (Enā1,Snā1,S
MSnā1,P
ā², Ļnā1,Lnā1). By in-duction hypothesis Pnā1 āP Snā² . Let p and t be such that 0 āP statep(t). By Definition 20, there isa ri ā ginsts(JP K=p) such that statep(t) is part of its premise. By definition of JP K=p, we can choose
ri = [statep(t)] ā[ ]ā []. We can extend the previous execution by one step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²āāJP KSnā²+1 ā execmsr (JP K)
with Snā²+1 = {Sf(nā1) \ {statep(t) }. It is left to show that Conditions 1 to 8 hold for n.Condition 1, Condition 2, Condition 3, Condition 5, Condition 6, Condition 7, and Condition 8
hold trivially.Condition 4 holds because P ā² = Pnā1 \
# {0}, Sf(n) = Sf(nā1) \# { statep(t) }
#, and 0 āP statep(t)(see Remark 2).
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ {Q|R}, Ļnā1,Lnā1) ā (Enā1,Snā1,S
MSnā1,P
ā² āŖ {Q,R},Ļnā1,Lnā1). By induction hypothesis Pnā1 āP Snā² . Let p and t be such that Q|R āP statep(t). ByDefinition 20, there is a ri ā ginsts(JP K=p) such that statep(t) is part of its premise. By definition
of JP K=p, we can choose ri = [statep(t)] ā[ ]ā [statepĀ·1(t), statepĀ·2(t)]. We can extend the previousexecution by one step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²āāJP KSnā²+1 ā execmsr (JP K)
with Snā²+1 = Sf(nā1) \ { statep(t) }# āŖ { statepĀ·1(t), statepĀ·2(t) }
#. It is left to show that Conditions 1to 8 hold for n.
Condition 1, Condition 2, Condition 3, Condition 5, Condition 6, Condition 7 and Condition 8hold trivially. We now show that Condition 4 holds.
Condition 4 holds because Pn = Pnā1 \# {Q|R} āŖ# {Q,R}, {Q} āP {statepĀ·1(x)} and {R} āP
{statepĀ·2(x)} (by definition of the translation) (see Remark 2).
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ {!Q}, Ļnā1,Lnā1) ā (Enā1,Snā1,S
MSnā1,P
ā² āŖ {!Q,Q},Ļnā1,Lnā1). Let p and t such that !iQ āP statep(t). By Definition 20, there is a ri ā ginsts(JP K=p)
such that statep(t) is part of its premise. By definition of JP K=p, we can choose ri = [statep(t)] ā[ ]ā
[statep(t), statepĀ·1(t)]. We can extend the previous execution by 1 step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
(ri)āJP K Snā²+1 ā execmsr (JP K)
with Snā²+1 = Sf(n) āŖ# { statepĀ·1(t) }
#. Condition 4 holds because Pn = Pnā1 āŖ# {Q} and {Q} āP
{statepĀ·1(t)} (by definition of JP K=p). Condition 1, Condition 2, Condition 3, Condition 5, Condition 6,Condition 7 and Condition 8 hold trivially.
Case: (Enā1,Sinā1,SMSinā1,Pnā1 = P ā² āŖ { Ī½a;Q }, Ļnā1,Lnā1) ā (Enā1 āŖ {aā²},Sinā1,S
MSinā1,
P ā² āŖ {Q{aā²
/a}}, Ļnā1,Lnā1) for a fresh aā². Let p and t be such that {Ī½a;Q} āP statep(t). Thereis a ri ā ginsts(JP K=p) such that statep(t) is part of its premise. By definition of JP K=p, there is a
ri ā ginsts(JP K=p), ri = [statep(t),Fr(aā² : fresh)] ā[ProtoNonce(aā² : fresh)]ā [statepĀ·1(t, a
ā² : fresh)].Assume there is an i < nā² such that Fr(aā²) ā Si. If Fr(aā²) ā Sn, then we can remove the application ofthe instance of Fresh that added Fr(aā²) while still preserving Conditions 1 to 8. If Fr(aā²) is consumnedat some point, by the definition of JP K, the transition where it is consumned is annotated eitherProtoNonce(aā²) or Lock(a ā², t) for some t. In the last case, we can apply a substitution to the executionthat substitutes a by a different fresh name that never appears in āŖi ā¤ nā²Si. The conditions we haveby induction hypothesis hold on this execution, too, since Lock ā Fres , and therefore Condition 8 isnot affected. The first case implies that aā² ā Enā1, contradicting the assumption that aā² is fresh withrespect to the process execution. Therefore, without loss of generality, the previous execution does notcontain an i < nā² such that Fr(aā²) ā Si, and we can extend the previous execution by two steps usingthe Fresh rule and ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
(Fresh)āJP K Snā²+1
(ri)āJP K Snā²+2 ā execmsr (JP K)
33
with Snā²+1 = Snā² āŖ# {Fr(aā² : fresh) }# and Snā²+2 = Sf(n) = Snā² āŖ# { statepĀ·1(t, aā² : fresh) }#. We
define f(i) := fp(i) for i < n and f(n) := f(n ā 1) + 2. We now show that Condition 4 holds.As by induction hypothesis Ī½a;Q āP statepĀ·1(t) we also have that P |pĻ = Ī½a;QĻ for some Ļ and Ļ.Extending Ļ with {aā² 7ā a} it is easy to see from definition of JP K=p that {Q{a
ā²
/a}} āP {statepĀ·1(t, aā²)}.
As Pn = Pnā1 \# {Ī½a;Q} āŖ# {Q{a
ā²
/a} }#, we also immediately obtain that Pn āP Sf(n). Since aā²
is fresh, and therefore { aā² } = En \ Enā1, and Fn = ProtoNonce(aā²), Condition 1 holds. Condition 2,Condition 3, Condition 5, Condition 6, Condition 7 and Condition 8 hold trivially.
Case: (Enā1,Snā1,SMSnā1,Pnā1, Ļnā1,Lnā1)
K(t)āā (Enā1,Snā1,S
MSnā1,Pnā1, Ļnā1,Lnā1). This step re-
quires that Ī½Enā1.Ļnā1 ā¢ t. From Lemma 8 follows that there is an execution ā F1āāS1
F2āā . . .Fnā²
āāāSnā² āā
S ā execmsrE (JP K) such that !K(t) āE S and Snā² āā
R S for R = {MDOut,MDPub,MDFresh,MDAppl }.
From S, we can go one further step using MDIn, since !K(t) ā S:
ā F1āāJP KS1
F2āāJP K . . .Fnā²
āāāJP KSnā²āāāRāJP KS = Snā²+sā1
K(t)āāāāJP KSnā²+s ā execmsr (JP K)
where Snā²+s = S āŖ {In(t)}.From the fact that Sf(nā1) āā
R Sf(n) = S, and the induction hypothesis, we can conclude thatCondition 8 holds. Condition 4 holds since Pn = Pnā1 and no state-facts where neither removednor added. Condition 1, Condition 2, Condition 3, Condition 5, Condition 6 and Condition 7 holdtrivially.
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ { out(t, tā²);Q }, Ļnā1,Lnā1)
K(t)āāāā(Enā1,Snā1,S
MSnā1,
P ā²āŖ#{Q }, Ļnā1āŖ{tā²/x},Lnā1). This step requires that x is fresh and Ī½Enā1.Ļ ā¢ t. Using Lemma 8, we
have that there is an execution ā F1āāS1
F2āā . . .Ff(n)āāāāSf(nā1) ā
ā S ā execmsrE (JP K) such that !K(t) āE S
and Sf(nā1) āāR S for R = {MDOut,MDPub,MDFresh,MDAppl }. Let p and t such that
{out(t, tā²);Q} āP statep(t). By Definition 20, there is a ri ā ginsts(JP K=p) such that statep(t) is part of
its premise. From the definition of JP K=p, we see that we can choose ri = [statep(t), In(t)] ā[InEvent(t)]ā
[Out(tā²), statepĀ·1(t)]. To apply this rule, we need the fact In(t). Since Ī½Enā1.Ļ ā¢ t, as mentioned
before, we can apply Lemma 8. It follows that there is an execution ā F1āāS1
F2āā . . .Fnā²
āāāSnā² āā S āexecmsr
E (JP K) such that !K(t) āE S and Snā² āāR S forR = {MDOut,MDPub,MDFresh,MDAppl }.
From S, we can now go two steps further, using MDIn and ri :
ā F1āāJP K S1 . . .
Fnā²
āāJP K Snā² āāRāJP K S = Snā²+sā2
K(t)āāāāJP KSnā²+sā1
InEvent(t)āāāāāāāJP KSnā²+s ā execmsr (JP K)
where Snā²+sā1 = S āŖ# { In(t) }# and Sf(n) = S \# { statep(t) } āŖ# {Out(tā²), statepĀ·1(t) }.
Taking k = nā² + s ā 1 we immediately obtain that Condition 8 holds. Note first that, sinceSnā² āR S, set(Snā²) \ {Fr(t),Out(t)|t ā M} ā set(S) and set(S) \ { !K(t)|t ā M} ā set(Snā²). SincePn = Pnā1 \ {out(t, tā²);Q} āŖ {Q} and {Q} āP {statepĀ·1(t)} (by definition of JP K=p), we have thatPn āP Sf(n), i. e., Condition 4 holds. Condition 5 holds since tā² was added to Ļnā1 and Out(t) addedto Sf(nā1). Condition 7 holds since K(t) appears right before InEvent(t). Condition 1, Condition 2,Condition 3 and Condition 6 hold trivially.
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ {in(t,N);Q}, Ļnā1,Lnā1) ā (Enā1,Snā1,S
MSnā1,
P ā² āŖ# {QĪø }, Ļnā1,Lnā1). This step requires that Īø is grounding for N and that Ī½Enā1.Ļnā1 ā¢
ćt,NĪøć. Using Lemma 8, we have that there is an execution ā F1āāS1
F2āā . . .Ff(nā1)āāāāāāSf(nā1) āā S ā
execmsrE (JP K) such that !K(t) āE S and Sf(nā1) āā
R S for R = {MDOut,MDPub,MDFresh,MDAppl }. The same holds for NĪø. We can combine those executions, by removing duplicateinstantiations of Fresh, MDFresh and MDOut. (This is possible since !K is persistent.) Let
ā F1āāS1
F2āā . . .Ff(nā1)āāāāāāSf(nā1) ā
āR S ā execmsr
E (JP K) this combined execution, and !K(t), !K(NĪø) āE S.Let p and t be such that, in(t,N);Q āP statep(t). By Definition 20 there is a ri ā ginsts(JP K=p)
such that statep(t) is part of its premise. From the definition of JP K=p and the fact that Īø is grounding
34
for NĪø, we have statep(t) in their premise, namely,
ri = [statep(t), In(ćt,NĪøć)] ā[InEvent(ćt,NĪøć)]ā [statepĀ·1(t āŖ (vars(N)Īø)].
From Snā² , we can first apply the above transition Snā² āāR S, and then, (since !K(t), !K(NĪø),
statep(x) ā S), MDAppl for the pair constructer, MDIn and ri :
ā F1āāJP K S1 . . .
Fnā²
āāJP K Snā² āāRāJP K S = Snā²+sā3
(MdAppl)āāāāāāāJP KSnā²+sā2
K(ćt,NĪøć)āāāāāāāJP KSnā²+sā1
InEvent(ćt,NĪøć)āāāāāāāāāāāJP KSnā²+s ā execmsr (JP K), where
ā¢ since Snā² āR S, S is such that set(Snā²) \ {Fr(t),Out(t)|t ā M} ā set(S), set(S) \ { !K(t)|t āM} ā set(Snā²), and !K(t), !K(NĪø) ā S
ā¢ Snā²+sā2 = S āŖ# { !K(ćt,NĪøć) }#,
ā¢ Snā²+sā1 = S āŖ# { In(ćt,NĪøć) }#,
ā¢ Snā²+s = S \# { statep(t) } āŖ# { statepĀ·1(t āŖ (vars(N)Īø)) }.
Letting k = nā² + sā 1 we immediately have that Condition 8 holds.We now show that Condition 4 holds. Since by induction hypothesis, in(t,N);Q āP statep(t),
we have that P |pĻ = in(t,N);QĻ for some Ļ and Ļ. Therefore we also have that P |pĀ·1Ļ āŖ (ĪøĻ) =QĻ(ĪøĻ) and it is easy to see from definition of JP K=p that {QĪø} āP {statepĀ·1(t, (vars(N)Īø))}. Since
Pn = Pnā1 \# {in(t,N);Q} āŖ# {Q}, we have that Pn āP Sf(n), i. e., Condition 4 holds. Condition 7
holds since Kćt,NĪøć) appears right before InEventćt,NĪøć). Condition 1, Condition 2, Condition 3,Condition 5 and Condition 7 hold trivially.
Case: (E ,S,SMS,PāŖ{out(c,m);Q}āŖ{in(cā², N);R}, Ļ,L) ā (E ,S,SMS,PāŖ{Q,RĪø }, Ļ,L). This steprequires that Īø grounding for N , t =E NĪø and c =E cā². Let p, pā² and t, N such that {out(c,m);P} āP
statep(t), {in(cā², N);Q} āP statepā²(t
ā²), and there are ri ā ginsts(JP K=p) and ri ā² ā ginsts(JP K=pā²) such
that statep(t) and statepā²(tā²) are part of their respective premise. From the definition of JP K=p and the
fact that Īø is grounding for N , we have:
ri1 = [statep(t)] ā [Msg(t,NĪø), statesemi
pĀ·1 (t)]
ri2 = [statepā²(tā²),Msg(t,NĪø)] ā [statepā²Ā·1(t
ā² āŖ (vars(N)Īø)),Ack(t,NĪø)]
ri3 = [statesemi
p (t),Ack(t,NĪø)] ā [statepĀ·1(t)].
This allows to extend the previous execution by 3 steps:
ā F1āāJP K S1 . . .
Fnā²
āāJP K Snā²
(ri1)āJP K Snā²+sā2
(ri2)āJP K Snā²+sā1
(ri2)āJP K Snā²+s ā execmsr (JP K)
where:
ā¢ Snā²+sā2 = Snā² \# { statep(t) } āŖ# {Msg(t,NĪø), statesemi
pĀ·1 (t) }#,
ā¢ Snā²+sā1 = Snā² \# { statep(t), statepā²(tā²) }āŖ# { statesemi
pĀ·1 (t), statepā²Ā·1(tā² āŖ (vars(N)Īø)),Ack(t,NĪø) }#,
ā¢ Snā²+s = Snā² \# { statep(t), statepā²(tā²) } āŖ# { statepĀ·1(t), statepā²Ā·1(t
ā² āŖ (vars(N)Īø)) }.
We have that Pn = Pnā1 \# { out(c,m);Q, in(cā², tā²);R }āŖ# {Q,RĪø }#. Exactly as in the two previous
cases we have that Q ā statepĀ·1(t), as well as RĪø ā statepā²Ā·1(tā²). Hence we have that, Condition 4
holds. Condition 1, Condition 2, Condition 3, Condition 5, Condition 6, Condition 8 and Condition 7hold trivially.
35
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ { if t = tā² then Q else Qā² }, Ļnā1,Lnā1) ā (Enā1,Snā1,
SMSnā1,P
ā² āŖ {Q }, Ļnā1,Lnā1). This step requires that t =E tā². By induction hypothesis Pnā1 āP
Snā² . Let p and t be such that if t = tā² then Q else Qā² āP statep(t). By Definition 20, there is ari ā ginsts(JP K=p) such that statep(t) is part of its premise. By definition of JP K=p, we can choose
ri = [statep(t)] ā[Eq(t, tā²)]ā [statepĀ·1(t)]. We can extend the previous execution by one step using ri ,therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
Eq(t,tā²)āāāāāJP KSnā²+1 ā execmsr (JP K)
with Snā²+1 = {Snā² \# { statep(t) }# āŖ# { statepĀ·1(t) }
# }. It is left to show that Conditions 1 to 8 holdfor n. The last step is labelled Ff(n) = {Eq(t, tā²) }#. As t =E tā², Condition 7 holds, in particular, Ī±eq
is not violated. Since Eq is reserved, Condition 8 holds as well.As before, since Pn = Pnā1 \
# { if t = tā² then Q else Qā² } āŖ# {Q} and {Q} ā {statepĀ·1(t, a)} (bydefinition of the translation), we have that Pn āP Sf(n), and therefore Condition 4 holds. Condition 1,Condition 2, Condition 3, Condition 5 and Condition 6 hold trivially.
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ { if t = tā² then Qā² else Q }, Ļnā1,Lnā1) ā (Enā1,Snā1,
SMSnā1,P
ā²āŖ{Qā² }, Ļnā1,Lnā1). This step requires that t 6=E tā². This proof step is similar to the previouscase, except ri is chosen to be
[statep(t)] ā[NotEq(t, tā²)]ā [statepĀ·2(t)].
The condition in Ī±noteq holds since t 6=E tā².
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ { event(F );Q }, Ļnā1,Lnā1)
Fāā(Enā1,Snā1,S
MSnā1,
P ā²āŖ{Q }, Ļnā1,Lnā1) . By induction hypothesis Pnā1 āP Snā² . Let p and t be such that event(F );Q āP
statep(t). By Definition 20, there is a ri ā ginsts(JP K=p) such that statep(t) is part of its premise. By
definition of JP K=p, we can choose ri = [statep(t)] ā[F,Event()]ā [statepĀ·1(t)]. We can extend theprevious execution by one step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
F,Event()āāāāāāāJP KSnā²+1 ā execmsr (JP K)
with Snā²+1 = Snā²) \# {statep(t)} āŖ
# {statepĀ·1(t)}. It is left to show that Conditions 1 to 8 hold for n.
Condition 4 holds because Pn = Pnā1\#{ event(F );Q }āŖ#{Q } and {Q} ā {statepĀ·1(t)} (by definition
of JP K=p). Taking k = f(n) Condition 8 holds. Condition 1, Condition 2, Condition 3, Condition 5,Condition 6 and Condition 7 hold trivially.
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ { insert t, tā²; Q }, Ļnā1,Lnā1) ā (Enā1,Sn = Snā1[t 7ā tā²],
SMSnā1,P
ā² āŖ {Q }, Ļnā1,Lnā1). By induction hypothesis Pnā1 āP Snā² . Let p and t be such thatinsert t, tā²; Q āP statep(t). By Definition 20, there is a ri ā ginsts(JP K=p) such that statep(t) is
part of its premise. By definition of JP K=p, we can choose ri = [statep(t)] ā[Insert(t, tā²)]ā [statepĀ·1(t)].
We can extend the previous execution by one step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
Insert(t,tā²)āāāāāāāJP KSnā²+1 ā execmsr (JP K)
with Snā²+1 = Sf(nā1) \# { statep(t) }
# āŖ# { statepĀ·1(t) }#. It is left to show that Conditions 1 to 8 hold
for n.This step is labelled Ff(n) = Insert(t, tā²), hence Condition 8 holds. To see that Condition 2 holds we
let j = f(n) for which both conjuncts trivially hold. Since, by induction hypothesis, Condition 7 holds,i.e., [F1, . . . Fnā² ] ļæ½ Ī±, it holds for this step too. In particular, if [F1, . . . Fnā² ] ļæ½ Ī±in and [F1, . . . Fnā² ] ļæ½Ī±notin , we also have that [F1, . . . Fnā² , Ff(n)] ļæ½ Ī±in and [F1, . . . Fnā² , Ff(n)] ļæ½ Ī±notin : as the Insert-actionwas added at the last position of the trace, it appears after any InIn or IsNotSet-action and by thesemantics of the logic the formula holds.
Since Pn = Pnā1 \# { insert t, tā²; Q }āŖ# {Q } and {Q} ā {statepĀ·1(t)} (by definition of JP K=p), we
have that Condition 4 holds. Condition 1, Condition 3, Condition 5 and Condition 6 hold trivially.
36
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ {delete t; Q }, Ļnā1,Lnā1) ā (Enā1,Sn = Snā1[t 7ā ā„],
SMSnā1,P
ā² āŖ {Q }, Ļnā1,Lnā1). By induction hypothesis Pnā1 āP Snā² . Let p and t be such thatdelete t; Q āP statep(t). By Definition 20, there is a ri ā ginsts(JP K=p) such that statep(t) is part of
its premise. By definition of JP K=p, we can choose ri = [statep(t)] ā[Delete(t)]ā [statepĀ·1(t)]. We canextend the previous execution by one step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
Delete(t)āāāāāāJP KSnā²+1 ā execmsr (JP K)
with Snā²+1 = Sf(nā1) \# {statep(t)} āŖ
# {statepĀ·1(t)}. It is left to show that Conditions 1 to 8 hold forn.
This step is labelled Ff(n) = Delete(t), hence Condition 8 holds. Since, by induction hypothesis,Condition 7 holds, i.e., [F1, . . . Fnā² ] ļæ½ Ī±, it holds for this step too. In particular, if [F1, . . . Fnā² ] ļæ½ Ī±in and[F1, . . . Fnā² ] ļæ½ Ī±notin , we also have that [F1, . . . Fnā² , Ff(n)] ļæ½ Ī±in and [F1, . . . Fnā² , Ff(n)] ļæ½ Ī±notin : as theInsert-action was added at the last position of the trace, it appears after any InIn or IsNotSet-actionsand by the semantics of the logic the formula holds.
We now show that Condition 2 holds. We have that Sn = Snā1[t 7ā ā„] and therefore, for alltā² 6=E T t, Sn(x) = Snā1(x). Hence for all such tā² we have by induction hypothesis that for some u,
āj ā¤ nā².Insert(tā², u) ā Fj ā§ ājā², uā².j < jā² ā¤ nā² ā Insert(tā², uā²) 6āE Fjā² ā§Delete(tā²) 6āE Fjā²
As, Fnā²+1 6=E Delete(x, u) and, for all uā² ā M, Fnā²+1 6=E Insert(x, uā²) we also have that
āj ā¤ nā² + 1.Insert(tā², u) ā Fj ā§ ājā², uā².j < jā² ā¤ nā² + 1 ā Insert(tā², uā²) 6āE Fjā² ā§Delete(tā²) 6āE Fjā² .
For tā² =E t, the above condition can never be true, because Fnā²+1 = Delete(t) which allows us toconclude that Condition 2 holds.
Since Pn = Pnā1 \# {delete t; Q } āŖ# {Q } and {P} ā {statepĀ·1(t)} (by definition of JP K=p), we
have that Condition 4 holds. Condition 1, Condition 3, Condition 5 and Condition 6 hold trivially.
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ { lookup t as x in Q else Qā² }, Ļnā1,Lnā1) ā (Enā1,Snā1,
SMSnā1,P
ā² āŖ {Q{v/x} }, Ļnā1,Lnā1). This step requires that Snā1(tā²) =E v for some tā² =E t. By
induction hypothesis Pnā1 āP Snā² . Let p and t be such that lookup t as v in Q else Qā² āP statep(t).By Definition 20, there is a ri ā ginsts(JP K=p) such that statep(t) is part of its premise. By definition
of JP K=p, we can choose ri = [statep(t)] ā[IsIn(t, v)]ā [statepĀ·1(t, v)]. We can extend the previousexecution by one step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
IsIn(t,v)āāāāāāJP KSnā²+1 ā execmsr (JP K)
with Snā²+1 = Sf(nā1) \# {statep(t)} āŖ
# {statepĀ·1(t)}. It is left to show that Conditions 1 to 8 hold forn.
This step is labelled Ff(n) = IsIn(t, v), hence Condition 8 holds.From the induction hypothesis, Condition 2, we have that there is a j such that Insert(t, tā²) āE Fj ,
j ā¤ nā² andājā², uā². j < jā² ā¤ nā² ā Insert(t, uā²) 6āE Fjā² ā§Delete(t) 6āE Fjā²
This can be strengthened, since Ff(n) = { IsIn(t, v) }:
ājā², uā². j < jā² ā¤ f(n) ā Insert(t, uā²) 6āE Fjā² ā§Delete(t) 6āE Fjā²
This allows to conclude that Condition 2 holds. From Condition 2 it also follows that Condition 7, inparticular Ī±in , holds.
We now show that Condition 4 holds. By induction hypothesis we have that lookup t as x in Q else Qā² āP
statep(t), and hence P |pĻ = (lookup t as x in Q else Qā²)Ļ for some Ļ and Ļ. Therefore we also havethat P |pĀ·1Ļ āŖ ({vĻ/x}) = QĻ{vĻ/x}) and it is easy to see from definition of JP K=p that {Q{v/x}} āP
{statepĀ·1(t, v)}. Since Pn = Pnā1 \# { lookup t as x in Q else Qā² } āŖ# {Q{v/x} } we have that Pn āP
Sf(n), i. e., Condition 4 holds.Condition 1, Condition 3, Condition 5 and Condition 6 hold trivially.
37
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ { lookup t as x in Q else Qā² }, Ļnā1,Lnā1) ā (Enā1,
Snā1,SMSnā1,P
ā² āŖ {Qā² }, Ļnā1,Lnā1). This step requires that S(tā²) is undefined for all tā² =E t. Byinduction hypothesis Pnā1 āP Snā² . Let p and t be such that lookup t as x in Q else Qā² āP statep(t).By Definition 20, there is a ri ā ginsts(JP K=p) such that statep(t) is part of its premise. By definition
of JP K=p, we can choose ri = [statep(t)] ā[IsNotSet(t)]ā [statepĀ·1(t)]. We can extend the previousexecution by one step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
IsNotSet(t)āāāāāāāāJP KSnā²+1 ā execmsr (JP K)
with Snā²+1 = Sf(nā1) \# statep(t) āŖ
# statepĀ·1(t). It is left to show that Conditions 1 to 8 hold for n.This step is labelled Ff(n) = IsNotSet(t), hence Condition 8 holds. Condition 2 also holds trivially
and will be used to show Condition 7. Since this step requires that S(tā²) is undefined for all tā² =E t,we have by Condition 2 that
āj ā¤ f(n), u. Insert(t, u) āE Fj
ā ājā², uā².j < jā² ā¤ f(n) ā§ (Insert(t, uā²) āE Fjā² āØDelete(t) āE Fjā²)
Now suppose thatāi ā¤ f(n), y.Insert(t, y) āE Fi)
As there exists an insert, there is a last insert and hence we also have
āi ā¤ f(n), y.Insert(t, y) āE Fi ā§ āiā², yā².i < iā² ā¤ f(n) ā Insert(t, yā²) /āE Fiā²
Applying Condition 2 (cf above) we obtain that
āi ā¤ f(n), y.Insert(t, y) āE Fi ā§ āiā², yā². i < iā² ā¤ f(n) ā Insert(t, yā²) /āE Fiā²
ā§ ājā², uā². i < jā² ā¤ f(n) ā§ (Insert(t, uā²) āE Fjā² āØDelete(t) āE Fjā²)
which simplifies to
āi ā¤ f(n), y.Insert(t, y) āE Fi ā§ āiā², yā². i < iā² ā¤ f(n) ā Insert(tā², yā²) /ā Fiā²
ā§ ājā². i < jā² ā¤ f(n) ā§Delete(t) āE Fjā²
Now we weaken the statement by dropping the first conjunct and restricting the quantification āiā².i <iā² ā¤ f(n) to āiā².jā² < iā² ā¤ f(n), since i < jā².
āi ā¤ f(n). ājā². i < jā² ā¤ f(n) ā§ āiā². jā² < iā² ā¤ f(n) ā Insert(tā², yā²) /ā Fiā² ā§Delete(t) āE Fjā²
We further weaken the statement by weakening the scope of the existential quantification ājā². i < jā² ā¤f(n) to ājā². jā² ā¤ f(n). Afterwards, i is not needed anymore.
ājā². jā² ā¤ f(n) ā§ āiā². jā² < iā² ā¤ f(n) ā Insert(tā², yā²) /ā Fiā² ā§Delete(t) āE Fjā²
This statement was obtained under the hypothesis that āi ā¤ f(n), y.Insert(t, y) āE Fi). Hence wehave that
āi ā¤ f(n), y.Insert(t, y) 6āE Fi
āØājā² ā¤ f(n). Delete(t) āE Fjā² ā§ āiā². jā² < iā² ā¤ f(n) ā Insert(tā², yā²) /ā Fiā²
This shows that Condition 7, in particular Ī±notin , holds.Since Pn = Pnā1 \
# { lookup t as x in Q else Qā² } āŖ# {Qā² } and {Qā²} ā {statepĀ·1(t)} (by definitionof JP K=p), we have that Condition 4 holds. Condition 1, Condition 3, Condition 5 and Condition 6hold trivially.
38
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ { lock t; Q }, Ļnā1,Lnā1) ā (Enā1,Snā1,S
MSnā1,P
ā² āŖ# {Qā² },Ļnā1,Lnā1āŖ{ t }). This step requires that for all tā² =E t, tā² /ā Lnā1. Let p and t such that lock t; Q āP
statep(t). By Definition 20, there is a ri ā ginsts(JP K=p) such that statep(t) is part of its premise. By
definition of JP K=p, we can choose ri = [Fr(l), statep(t)] ā[Lock(l, t)]ā [statepĀ·1(t, l)] for a fresh name l,that never appeared in a Fr-fact in āŖjā¤f(nā1)Sj. We can extend the previous execution by s = 2 stepsusing an instance of Fresh for l and ri :
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²āā{ fresh }Snā²+sā1Lock(l,t)āāāāāāJP KSnā²+s ā execmsr (JP K)
with Snā²+sā1 = Sf(nā1)\#{ statep(t) }
#āŖ#{Fr(l) } and Snā²+s = Sf(nā1)\#{ statep(t) }
#āŖ#{ statepĀ·1(t) }#.
It is left to show that Conditions 1 to 8 hold for n.The step from Sf(n)ā1 to Sf(n) is labelled Ff(n) = Lock(l, t), hence Condition 8 and Condition 2
hold.Ff(n) also preserves Condition 6 for the new set of active locks Lf(n) = Lf(nā1) āŖ { t }.In the following we show by contradiction that Ī±lock , and therefore Condition 7 holds. Ī±lock held
in the previous step, and Ff(nā1)+1 is empty, so we assume (by contradiction), that Ff(n) = Lock(l, t)violates Ī±lock . If this was the case, then:
āi < f(n), l1. Lock(l1, t) āE Fiā§
ā§ āj. i < j < f(n) ā Unlock(l1, t) 6āE Fj
āØ āl2, k. i < k < j ā§ (Lock(l2, t) āE Fk āØUnlock(l2, t) āE Fk) (2)
Since the semantics of the calculus requires that for all tā² =E t, tā² /ā Lnā1, by induction hypothesis,Condition 6, we have that
āi < f(nā 1), l1. Lock(l1, t) āE Fi ā
āj. i < j < f(nā 1) ā§Unlock(l1, t) āE Fj
Since Ff(nā1)+1 = ā and f(n) = f(nā 1) + 2, we have:
āi < f(n), l1.Lock(l1, t) āE Fi ā
āj. i < j < f(n) ā§Unlock(l1, t) āE Fj
We apply Proposition 4 for the total order > on the integer interval i+ 1..f(n)ā 1:
āi < f(n), l1. Lock(l1, t) āE Fi ā
āj. i < j < f(n) ā§Unlock(l1, t) āE Fj
ā§ āk. i < k < j ā Unlock(l1, t) 6āE Fk
Combining this with (2) we obtain that
āi < f(n), l1. Lock(l1, t) āE Fiā§
āj. i < j < f(n) ā§Unlock(l1, t) āE Fj
ā§ āl2, k. i < k < j ā§ (Lock(l2, t) āE Fk āØ (Unlock(l2, t) āE Fk ā§ l2 6=E l1))
Fix i < f(n), j such that i < j < f(n), and l1 such that Lock(l1, t) āE Fi and Unlock(l1, t) āE Fj .Then, there are l2 and k such that i < k < j and either Lock(l2, t) āE Fk or Unlock(l2, t) āE Fk, butl2 6=E l1. We proceed by case distinction.Case 1: there is no unlock in between i and j, i. e., for all m, i < m < j, Unlock(lā², t) 6ā Fm. Then thereis a k and l2 such that Lock(l2, t) āE Fk. In this case, Ī±lock is already invalid at the trace producedby the k-prefix of the execution, contradicting the induction hypothesis.Case 2: there are lā² and m, i < m < j such that Unlock(lā², t) ā Fm (see Figure 17).
We first observe that for any l, u, i1, i2 , if Unlock(l,u) āE Fi1 and Unlock(l,u) āE Fi2 , then i1 = i2.We proceed by contradiction. By definition of JP K and well-formedness of P , the steps from i1ā1 to i1
39
i
Lock(l1, t)
m
Unlock(lā², t)
j
Unlock(l1, t)
Figure 13: Visualisation of Case 2.
and from i2 ā 1 to i2 must be ground instances of rules JP K=q and JP K=qā² such that P |q and P |qā² startwith unlock commands that are labelled the same and have the same parameter, since every variablelockl in JP K appears in a Fr-fact in the translation for the corresponding lock command. By definitionof P , this means q and qā² have a common prefix ql that starts with a lock with this label.
Let ql ā¤ q denote that ql is a prefix of q. Since P gives ā„ if there is a replication or a parallelbetween ql and q or qā², and since P is well-formed (does not contain ā„), we have that every state factstater for ql ā¤ r ā¤ q or ql ā¤ r ā¤ qā² appearing in JP K is a linear fact, since no replication is allowedbetween ql and q or qā². This implies that qā² 6= q. Furthermore, every rule in āŖqlā¤rā¤qāØqlā¤rā¤qā²JP K=r addsat most one fact stater and if it adds one fact, it either removes a fact staterā² where r = rā² Ā·1 or rā² Ā·2, orremoves a fact statesemi
rā² where r = rā² Ā·1, which in turn requires removing staterā² (see translation of out).Therefore, either q ā¤ qā² or qā² ā¤ q. But this implies that both have different labels, and since JP K=qlrequires Fr(l), and E distinguishes fresh names, we have a contradiction. (A similiar observation ispossible for locks: For any l, u, i1, i2 , if Lock(l,u) āE Fi1 and Lock(l,u) āE Fi2 , then i1 = i2, since bydefinition of the translation, the transition from i1 ā 1 to i1 or iā 2ā 1 to i2 removes fact Fr(l).)
From the first observation we learn that , lā² 6=E l1 for any lā² and m, i < m < j such thatUnlock(lā², t) ā Fm. We now choose the smallest such m. By definition of JP K, the step from Smā1 toSm must be ground instance of a rule from JP K=q for P |q starting with unlock. Since P is well-formed,there is a ql such that P |ql starts with lock, with the same label and parameter as the unlock. Asbefore, since P is well-formed, and therefore there are no replications and parallels between ql and q,there must be n such that Lock(lā², t) ā Fn and n < m. We proceed again by case distinction.Case 2a: n < i (see Figure 14). By the fact that m > i we have that there is no o such that n < o < iand Unlock(lā², t) āE Fo (see first observation). Therefore, the trace produced by the i-prefix of thisexecution does already not satisfy Ī±lock , i. e., [F1, . . . , Fi] 6ļæ½ Ī±lock .
n
Lock(lā², t)
i
Lock(l1, t)
m
Unlock(lā², t)
j
Unlock(l1, t)
Figure 14: Visualisation of Case 2a.
Case 2b: i < n (see Figure 15). Again, Ī±lock is not satisfied, i.e., [F1, . . . , Fn] 6ļæ½ Ī±lock , since there is noo such that i < o < n and Unlock(l1, t) āE Fo.
i
Lock(l1, t)
n
Lock(lā², t)
m
Unlock(lā², t)
j
Unlock(l1, t)
Figure 15: Visualisation of Case 2b.
Since we could, under the assumption that Condition 1 to Condition 8 hold for i ā¤ nā², reduce everycase in which [F1, . . . , Fnā²+1] 6ļæ½ Ī±lock to a contradiction, we can conclude that Condition 7 holds fornā² + 1.
Since Pn = Pnā1\# { lock t; Q }āŖ#{Q } and {Q} ā {statepĀ·1(t)} (by definition of the translation),
we have that Condition 4 holds. Condition 1, Condition 3 and Condition 5 hold trivially.
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ {unlock t; Q }, Ļnā1,Lnā1) ā (Enā1,Snā1,S
MSnā1,
P ā² āŖ# {Qā² }, Ļnā1,Lnā1 \ { tā² : tā² =E t }). By induction hypothesis Pnā1 āP Snā² . Let p and t be such
that unlock t; Q āP statep(t). By Definition 20, there is a ri ā ginsts(JP K=p) such that statep(t) is
40
part of its premise. By definition of JP K=p, we can choose ri = [statep(t)] ā[Unlock(l, t)]ā [statepĀ·1(t)].We can extend the previous execution by one step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
Unlock(l,t)āāāāāāāJP KSnā²+1 ā execmsr (JP K)
with Snā²+1 = Sf(nā1) \# {statep(t)} āŖ
# {statepĀ·1(t)}. It is left to show that Conditions 1 to 8 hold forn.
The step from Sf(nā1) to Sf(n) is labelled Ff(n) = Unlock(l, t), hence Condition 8 and Condition 2hold.
In order to show that Condition 6 holds, we perform a case distinction. Assume t 6āEā Lnā1. Then,Lf(nā1) = Lf(n). In this case, Condition 6 holds by induction hypothesis. In the following, we assumet āE Lnā1. Thus, there is j ā nā², lā² such that Lock(lā², t) āE Fj and for all k such that j < k ā¤ nā²,Unlock(lā², t) 6āE Fk.
Since P |p is an unlock node and P is well-formed, there is a prefix q of p, such that P |q is a lockwith the same parameter and annotation. By definition of P , there is no parallel and no replicationbetween q and p. Note that any rule in JP K that produces a state named statep for a non-empty p issuch that it requires a fact with name statepā² for p = pā² Ā· 1 or p = pā² Ā· 2 (in case of the translation ofout, it might require statesemi
pā² , which in turn requires statepā²). This means that, since statep(t) ā Snā² ,
there is an i such that stateq(tā²) ā Si and stateq(t
ā²) 6ā Siā1 for tā² a prefix to t. This rule is an instanceof JP K=q and thus labelled Fi = Lock(l, t). We proceed by case distinction.
j
Lock(lā², t)
i
Lock(l, t)
nā² + 1
Unlock(l, t)
Figure 16: Visualisation of Case 1.
Case 1: j < i (see Figure 16). By induction hypothesis, Condition 7 holds for the trace up to nā². But,[F1, . . . , Fi] 6ļæ½ Ī±lock , since we assumed that for all k such that j < k ā¤ nā², Unlock(lā², t) 6āE Fk.
i
Lock(l, t)
j
Lock(lā², t)
nā² + 1
Unlock(l, t)
Figure 17: Visualisation of Case 2.
Case 2: i < j (see Figure 17). As shown in the lock case, any k such that Unlock(l, t) āE Fk isk = nā² +1. This contradicts Condition 7 for the trace up to j, since [F1, . . . , Fj ] 6ļæ½ Ī±lock , because thereis not k such that i < k < j such that Unlock(l, t) āE Fk. This concludes the proof that Condition 6holds for n+ 1.
Condition 7 holds, since none of the axioms, in particular not Ī±lock , become unsatisfied if they weresatisfied for the trace up to f(nā 1) and an Unlock is added.
Since Pn = Pnā1 \# {unlock t; Q } āŖ# {Q } and {Q} ā {statepĀ·1(t)} (by definition of the transla-
tion), we have that Condition 4 holds. Condition 1, Condition 3 and Condition 5 hold trivially.
Case: (Enā1,Snā1,SMSnā1,Pnā1 = P ā² āŖ { l ā[a]ā r; Q }, Ļnā1,Lnā1)
aāā
(Enā1,Snā1,SMSnā1 \ lfacts(lā²) āŖ# mset(r),P ā² āŖ# {Q }, Ļnā1,Lnā1). This step requires that lā² ā[aā²]ā
rā² āE ginsts(l ā[a]ā r) and lfacts(lā²) ā# SMSnā1, pfacts(l
ā²) ā mset(SMSnā1). Let Īø be a substitution such
that (l ā[a]ā r)Īø = (lā² ā[aā²]ā rā²). Since, by induction hypothesis, SMSnā1 = Snā² \# Fres , we therefore
have lfacts(lā²) ā# Snā² , pfacts(lā²) ā mset(Snā²). By induction hypothesis Pnā1 āP Snā² . Let p andt be such that l ā[a]ā r; Q āP statep(t). By Definition 20, there is a ri ā ginsts(JP K=p) such that
statep(t) is part of its premise. By definition of JP K=p, we can choose ri = [statep(t), lā²] ā[aā²,Event()]ā
[rā², statepĀ·1(t āŖ (vars(l)Īø))]. We can extend the previous execution by one step using ri , therefore:
ā F1āāJP K S1
F2āāJP K . . .Fnā²
āāJP K Snā²
aā²,Event()āāāāāāāJP KSnā²+1 ā execmsr (JP K)
41
with Snā²+1 = Sf(nā1) \# { statep(t) }
# \# lfacts(lā²)āŖ# { statepĀ·1(tāŖ (vars(l)Īø)) }# āŖ#mset(rā²). It is leftto show that Conditions 1 to 8 hold for n.
Condition 3 holds since
SMSn = SMS
nā1 \# lfacts(lā²) āŖ# mset(r)
= (Snā² \# Fres ) \ lfacts(lā²) āŖ# mset(r) (induction hypothesis)
= (Snā² \# lfacts(lā²) āŖ# mset(r) \# { statep(t) }# āŖ# { statepĀ·1(t āŖ (vars(l)Īø)) }#) \# Fres
(since statep(t), statepĀ·1(t āŖ (vars(l)Īø)) ā Fres)
= Sf(n) \# Fres
The step from Sf(nā1) to Sf(n) is labelled Ff(n) = a, and does not contain actions in Fres , since Pis well-formed. Hence Condition 2, Condition 6, Condition 7 and Condition 8 hold.
Since Pn = Pnā1 \# { l ā[a]ā r; Q }āŖ# {Q } and {Q} ā {statepĀ·1(tāŖ (vars(l)Īø))} (by definition of
JP K=p), we have that Condition 4 holds. Condition 1, and Condition 5 hold trivially.
Definition 21 (normal msr execution). A msr execution ā E1āāJP K Ā· Ā· Ā·
EnāāāJP KSn ā execmsr (JP K) for themultiset rewrite system JP K defined by a ground process P is normal if:
1. The first transition is an instance of the Init rule, i. e., S1 = state[]() and there is at least thistransition.
2. Sn neither contains any fact with the symbol statesemip for any p, nor any fact with symbol Ack.
3. if for some i and t1, t2 ā M, Ack(t1, t2) ā (Siā1 \# Si), then there are p and q such that:
Siā3āāR1Siā2āāR2Siā1āāR3Si , where:
ā¢ R1 = [statep(x)] ā [Msg(t1, t2), statesemip (x)]
ā¢ R2 = [stateq(y),Msg(t1, t2)] ā [stateqĀ·1(y āŖ yā²),Ack(t1, t2)]
ā¢ R3 = [statesemip (x),Ack(t1, t2)] ā [statepĀ·1(x)].
4. Snā1EnāāāJP,[],[]K,MDIn,InitSn
5. if In(t) ā (Siā1 \# Si) for some i and t ā M, then Siā2
K(t)āāāāMDInSiā1
6. if n ā„ 2 and no Ack-fact in (Siā1 \# Si), then there exists m < n such that Sm āā
R Snā1 for R =
{MDOut,MDPub,MDFresh,MDAppl } āŖ Fresh and ā E1āāJP K Ā· Ā· Ā·
EmāāāJP KSm ā execmsr (JP K)is normal.
7. if for some t1, t2 ā M, Ack(t1, t2) ā (Snā1 \# Sn), then there exists m ā¤ nā 3 such that Sm āā
R
Snā3 for R = {MDOut,MDPub,MDFresh,MDAppl }āŖFresh and ā E1āāJP K Ā· Ā· Ā·
EmāāāJP KSm āexecmsr (JP K) is normal.
Lemma 11 (Normalisation). Le P be a well-formed ground process. If
S0 = ā E1āāJP K S1
E2āāJP K . . .EnāāJP K Sn ā execmsr (JP K)
and [E1, . . . , En] ļæ½ Ī±, then there exists a normal msr execution
T0 = ā F1āāJP K T1
F2āāJP K . . .Fnā²
āāJP K Tnā² ā execmsr (JP K)
such that hide([E1, . . . , En]) = hide(F1, . . . , Fnā²) and [F1, . . . , Fnā² ] ļæ½ Ī±.
Proof. We will modify S0E1āāJP K . . .
EnāāJP K Sn by applying one transformation after the other, eachresulting in an msr execution that still fulfills the conditions on its trace.
42
1. If an application of the Init rule appears in S0E1āāJP K . . .
EnāāJP K Sn, we move it to the front.Therefore, S1 = state[](). This is possible since the left-hand side of the Init rule is empty. Ifthe rule is never instantiated, we prepend it to the trace. Since Init() ā Fres , the resulting msrexecution
S(1)0
E(1)1āāJP K . . .
E(1)nāāJP K S
(1)
n(1)
is such that hide([E1, . . . , En]) = hide([E(1)1 , . . . , E
(1)
n(1) ]). Since Init() is only added if it was not
present before, [E(1)1 , . . . , E
(1)
n(1) ] ļæ½ Ī±, especially Ī±init .
2. For each fact Ack(t1, t2) contained in S(1)
n(1 , it also contains a fact statesemip (t) for some p and t
such that there exists a rule of type R3 that consumes both of them, since Ack(t1, t2) can only beproduced by a rule of type R2 which consumes Msg(t1, t2) which in turn can only be producedalong with a fact statesemi
p (t), and by definition of JP K, there exists a rule in JP K=p of form R3
that consumes Ack(t1, t2) and statesemip (t). We append as many applications of rules of type R3
as there are facts Ack(t1, t2) ā S(1)
n(1) , and repeat this for all t1, t2 such that Ack(t1, t2) ā S(1)
n(1) .
Then, S(1)
n(1)āāJP KS(1)nā² and S
(1)nā² does not contain Ack-facts anymore.
If S(1)nā² contains a fact statesemi
p (t), we remove the last transition that produced this fact, i. e., for
i such that Si = Siā1 \# { statep(t) }
# āŖ# {Msg(t1, t2), statesemip (t) }#, we define
S(1)ā²
j :=
{
S(1)j if j ā¤ iā 1
S(1)j+1 \
# {Msg(t1, t2), statesemip (t) }# āŖ# { statep(t) }
# if iā 1 < j < nā²
The resulting execution is valid, since statesemip (t) ā S
(1)nā² and since Msg(t1, t2) ā S
(1)nā² . The latter
is the case because if Msg(t1, t2) would be consumned at a later point, say j, j+1 would contain
Ack(t1, t2), but since S(1)ā²
nā²ā1 does not contain Ack-facts, they can only be consumned by a rule of
type R3, which would have consumned statesemip (t). We repeat this procedure for every remaining
statesemip (t) ā S
(1)nā² , and call the resulting trace
S(2)0
E(2)1āāJP K . . .
E(2)nāāJP K S
(2)
n(2)
Since no rule added or removed or removed has an action, hide([E1, . . . , En]) = hide([E(2)1 ,
. . . , E(2)
n(2) ]) and [E(2)1 , . . . , E
(2)
n(2) ] ļæ½ Ī±.
3. We transform S(1)0
E(1)1āāJP K . . .
E(1)nāāJP K S
(1)
n(1) as follows (all equalities are modulo E): Let us callinstances of R1, R2 or R3 that appear outside a chain
Siā3āāR1Siā2āāR2Siā1āāR3Si
for some i t1, t2 ā M āunmarkedā. Do the following for the smallest i that is an unmarkedinstance of R3 ( we will call the instance of R3 ri3 and suppose it is applied from Siā1 to Si):Apply ri3 after j < i such that Sjā1 to Sj is the first unmarked instance of R2, for some q andy,i. e., this instance produces a fact stateqĀ·1(y, y
ā²) and a fact Ack(t1, t2). Since there is no rulebetween j and i that might consume Ack(t1, t2) (only rules of form R3 do, and ri3 is the firstunmarked instance of such a rule) and since ri3 does not consume stateqĀ·1(y, y
ā²), we can moveri3 between j and j + 1, adding the conclusions of ri3 and removing the premises of ri3 fromevery Sj+1, . . . , Si. Note that unmarked instances of R2 and R3 are guaranteed to be preceededby a marked R1, and therefore only remove facts of form Ack(. . .) or Msg(. . .) that have beenadded in that preceeding step. Since the transition at step j requires a fact Msg(t1, t2), there isan instance of R1 prior to j, say at k < j, since only rules of form R1 produces facts labelledMsg(t1, t2). Since ri3 is now applied from Sj to Sj+1, we have that an instance ri1 of a rule of
43
form R1 that produces statesemip (t) must appear before j, i. e., ri1 ā ginsts(JP K=p). Therefore,
it produces a fact Msg(t1, t2) indeed. We choose the largest k that has an unmarked R1 thatproduces Msg(t1, t2) and statesemi
p (t) and move it right before j, resulting in the following msrexecution:
S(1)ā²
t :=
S(1)t if t < k
S(1)t+1 āŖ
# {Msg(t1, t2), statesemip (t) }# \# { statep(t) }
# if k ā¤ t < j ā 1
S(1)(t) if j ā 1 ā¤ t < j + 1
S(1)(tā1) \
# { statesemip (t),Ack(t1, t2) }
# āŖ# { statepĀ·1(t) }# if j + 1 ā¤ t < i+ 1
S(1)t if i+ 1 ā¤ t
We apply this procedure until it reaches a fixpoint and call the resulting trace
S(3)0
E(3)1āāJP K . . .
E(3)nāāJP K S
(3)
n(3)
Since no rule moved during the procedure has an action, hide([E1, . . . , En]) = hide([E(3)1 , . . . , E
(3)
n(3) ])
and [E(3)1 , . . . , E
(3)
n(3) ] ļæ½ Ī±.
4. If the last transition is in {MDOut,MDPub,MDFresh,MDAppl,Fresh }, we remove it.Repeat until fixpoint is reached and call the resulting trace
S(4)0
E(4)1āāJP K . . .
E(4)nāāJP K S
(4)
n(4)
Since no rule removed during the procedure has an action, hide([E1, . . . , En]) = hide([E(4)1 ,
. . . , E(4)
n(4) ]) and [E(4)1 , . . . , E
(4)
n(4) ] ļæ½ Ī±.
5. If there is In(t) ā S(4)
n(4)ā1, then there is a transition where In(t) is produced and never consumned
until n(4)ā1. The only rule producing In(t) is MDIn. We can move this transition to just beforen(4) ā 1 and call the resulting trace
S(5)0
E(5)1āāJP K . . .
E(5)nāāJP K S
(5)
n(5)
Since [E(4)1 , . . . , E
(4)
n(4) ] ļæ½ Ī±, especially Ī±inev , there is no action that is not in Fres between the
abovementioned instance of MDIn, therefore, hide([E1, . . . , En]) = hide([E(5)1 , . . . , E
(5)
n(5) ]) holds.Since Ī±inev is the only part of Ī± that mentions K, and since the tranformation preserved Ī±inev ,
we have that [E(5)1 , . . . , E
(5)
n(5) ] ļæ½ Ī±.
6. We will show that 6 and 7 hold for
S(5)0
E(5)1āāJP K . . .
E(5)nāāJP K S
(5)
n(5)
in one step.
If n(5) ā„ 2 and there is no Ack-fact in S(5)
n(5)ā1 \ S(5)
n(5) , then we chose the largest m < n such
that S(5)mā1
E(5)māāāāJP,[],[]K,Init,MDInS
(5)m , or, if there is an Ack-fact in S
(5)
n(5)ā1 \ S(5)
n(5) , we will chose the
largest mā² < nā 2 such that S(5)mā²ā1
E(5)
mā²
āāāāJP,[],[]K,Init,MDInS(5)mā² .
This trivially fulfills 4. S(5)m āā
R S(5)
n(5) and S(5)mā² āā
R S(5)
n(5)ā3 , since otherwise there would be alarger m or mā². This also implies 2, as none of the rules in R = {MDOut,MDPub,MDFresh,MDAppl,Fresh } remove Ack- or statesemi-facts, and the chain of rules R1, R2, R3 consumes as
many as it produces. Thus, if they where in S(5)m , they would be in S
(5)
n(5) , too. Since n > 2,
44
m > 1, and therefore 1. 3 holds for all parts of the trace, and therefore also for the m prefix.Similar for 5.
Since we can literally apply the same argument for the largest m < m such that
S(5)mā1
E(5)māāāāJP,[],[]K,Init,MDInS
(5)m
or, in case that there is an Ack-fact in S(5)mā1 \ S
(5)m , for the largest m < mā 2, can show that 6
and 7 hold for the trace up to m or mā², concluding it is normal.
Definition 22. Let P be a ground process, P be a multiset of processes and S a multiset of multisetrewrite rules. We write P !P S if there exists a bijection between P and the multiset {statep(t) |āp, t. statep(t) ā
# S}# such that whenever Q ā# P is mapped to statep(t) ā# S, then:
1. statep(t) āE prems(R) for R ā ginsts(JP K=p).
2. Let Īø be a grounding substitution for state(x) ā prems(JP K=p) such that t = xĪø. Then
(P |pĻ)Ļ =E Q
for a substitution Ļ , and a bijective renaming Ļ of fresh, but not bound names in Q, defined asfollows:
Ļ(x) :=Īø(x) if x not a reserved variable
Ļ(a) :=aā² if Īø(na) = aā²
When P !P S, Q ā# P and statep(t) ā# S we also write Q !P statep(t) if this bijection maps
Q to statep(t).
Remark 3. Note that !P has the following properties (by the fact that it defines a bijection betweenmultisets).
ā¢ If P1 !P S1 and P2 !P S2 then P1 āŖ# P2 !P S1 āŖ
# S2.
ā¢ If P1 !P S1 and Q !P statep(t) for Q ā P1 and statep(t) ā S1 (i.e. Q and statep(t) arerelated by the bijection defined by P1 !P S1) then P1 \
# {Q} !P S1 \# {statep(t)}.
Lemma 12. Le P be a well-formed ground process. If
S0 = ā E1āāJP K S1
E2āāJP K . . .EnāāJP K Sn ā execmsr (JP K)
is normal (see Definition 21) and [E1, . . . , En] ļæ½ Ī± (see Definition 14), then there are (E0,S0,SMS0 ,P0,
Ļ0,L0), . . . , (Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²) and F1, . . . , Fnā² such that:
(E0,S0,SMS0 ,P0, Ļ0,L0)
F1āā (E1,S1,SMS1 ,P1, Ļ1,L1)
F2āā . . .Fnā²
āā (Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)
where (E0,S0,SMS0 ,P0, Ļ0,L0) = (ā , ā , ā , {P }, ā , ā ) and there exists a monotonically increasing, surjec-
tive function f : Nn \ { 0 } ā Nnā² such that f(n) = nā² and for all i ā Nn
1. Ef(i) = { a ā FN | ProtoNonce(a) āE
ā
1ā¤jā¤iEj }
2. ā t ā M. Sf(i)(t) =
u if āj ā¤ i.Insert(t, u) āE Ej
ā§ājā², uā².j < jā² ā¤ iā Insert(t, uā²) 6āE Ejā² ā§Delete(t) 6āE Ejā²
ā„ otherwise
3. SMSf(i) =E Si \
# Fres
45
4. Pf(i) !P Si
5. {xĻf(i) | x ā D(Ļf(i)) }# =E {Out(t) ā āŖkā¤iSk }
#
6. Lf(i) =E { t | āj ā¤ i, u. Lock(u, t) āE Ej ā§ āj < k ā¤ i.Unlock(u, t) 6āE Ek }.
Furthermore,
7. hide([E1, . . . , En]) =E [F1, . . . , Fā²n].
Proof. We proceed by induction over the number of transitions n.
Base Case. A normal msr execution contains at least an application of the init rule, thereby theshortest normal msr execution is
ā āāJP KS1 = { state[]() }#
We chose nā² = 0 and thus
(E0,S0,SMS0 ,P0, Ļ0,L0) = (ā , ā , ā , {P }#, ā , ā ).
We define f : { 1 } ā { 0 } such that f(1) = 0.To show that Condition 4 holds, we have to show that P0 !P { state[](s : fresh) }#. Note that
P0 = {P }#. We choose the bijection such that P !P state[](s : fresh).By Definition 19, JP K=[] = JP, [], []K=[]. We see from Figure 12 that for every P we have that
state[](s : fresh) ā prems(RĪø), for R ā JP, [], []K=[] and Īø = ā . This induces Ļ = ā and Ļ = ā . SinceP |[]ĻĻ = P , we have P !P state[](), and therefore P0 !P S1.
Condition 1, Condition 2, Condition 3, Condition 5, Condition 6, and Condition 7 hold trivially.
Inductive step. Assume the invariant holds for n ā 1 ā„ 1. We have to show that the lemma holds forn transitions, i. e., we assume that
ā E1āāJP K S1
E2āāJP K . . .EnāāJP K Sn ā execmsr (JP K)
is normal and [E1, . . . , En] ļæ½ Ī±. Then it is to show that there is
(E0,S0,SMS0 ,P0, Ļ0,L0)
F1āā (E1,S1,SMS1 ,P1, Ļ1,L1)
F2āā . . .F ā²
nāā (Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)
fulfilling Conditions 1 to 8.Assume now for the following argument, that there is not fact with the symbol Ack in Snā1 \
# Sn.This is the case for all cases except for the case where rule instance applied from Snā1 to Sn has theform ri = [statesemi
p (s),Ack(t1, t2)] ā[]ā [statepĀ·1(s)]. This case will require a similiar, but differentargument, which we will present when we come to this case.
Since ā E1āāJP K Ā· Ā· Ā·
EnāāāJP KSn ā execmsr (JP K) is normal and n ā„ 2, there exists m < n such that
Sm āāR Sn for R = {MDOut,MDPub,MDFresh,MDAppl,Fresh } and ā
E1āāJP K Ā· Ā· Ā·EmāāāJP KSm ā
execmsr (JP K) is normal, too. This allows us to apply the induction hypothesis on ā E1āāJP K Ā· Ā· Ā·
EmāāāJP KSm āexecmsr (JP K). Hence there is a monotonically increasing function from Nm ā Nnā² and an executionsuch that Conditions 1 to 8 hold. Let fp be this function and note that nā² = fp(m).
In the following case distinction, we will (unless stated otherwise) extend the previous execution byone step from (Enā² ,Snā² ,SMS
nā² ,Pnā² , Ļnā² ,Lnā²) to (Enā²+1,Snā²+1,SMSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1), and prove that
Conditions 1 to 7 hold for nā² + 1. By induction hypothesis, they hold for all i ā¤ nā². We define afunction f : Nn ā Nnā²+1 as follows:
f(i) :=
fp(i) if i ā Nm
nā² if m < i < n
nā² + 1 if i = n
46
Since, Sm āāR Sn for R = {MDOut,MDPub,MDFresh,MDAppl,Fresh }, only Sn \# Sm
contains only Fr-facts and !K-facts, and Sm \# Sn contains only Fr-facts and Out-facts. Therefore,Condition 3,4 and 5 hold for all i ā¤ nā 1. Since Em+1, . . . , Enā1 = ā , Condition 1, 2,6 and 7 hold forall i ā¤ nā 1.
Fix a bijection such that Pnā² !P Sm. We will abuse notation by writing P !P statep(t), if thisbijection maps P to statep(t).
We now proceed by case distinction over the last type of transition from Snā1 to Sn. Let llinear =E
Snā1 \ Sn and r =E Sn \ Snā1. llinear can only contain linear facts, while r can contain linear as wellas persistent facts. The rule instance ri used to go from Snā1 to Sn has the following form:
[llinear , lpersistent ] ā[En]ā r
for some lpersistent ā#E Snā1.
Note that llinear , En and r uniquely identify which rule in JP, [], []K ri is an instance of ā with exactlyone exception: J[] ā[a]ā []; P, p, xK = Jevent a; P , p, xK. Luckily, we can treat the last as a special caseof the first.
If R is uniquely determined, we fix some ri ā ginsts(R).
Case: R = Init or R ā MD \ {MDIn }. In this case, ā E1āā . . .
EnāāāSn is not a well-formed msrexecution.
Case: R = MDIn. Let t ā M such that ri = RĻ =!K(t) ā[K(t)]ā In(t).From the induction hypothesis, and since Em+1, . . . , En = ā , we have that
Enā² = { a ā FN | ProtoNonce(a) āE
ā
1ā¤jā¤n
Ej }.
From the induction hypothesis, and since no rule producing Out-facts is applied between step mand step n, we have that
{xĻnā² | x ā D(Ļnā²) }# =E {Out(t) ā āŖkā¤nSk }#.
Let r = { a ā FN | RepNonce(a) āE
ā
1ā¤jā¤n Fj }. Then, by Lemma 8 and Lemma 9, we have thatĪ½Enā² , r.Ļnā² ā¢ t. Therefore, Ī½Enā² .Ļnā² ā¢ t. This allows us to chose the following transition:
Ā· Ā· Ā·Fnā²
āāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)
K(t)āāāā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with (Enā²+1,Snā²+1,SMSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)=(Enā² ,Snā² ,SMS
nā² ,Pnā² , Ļnā² ,Lnā²).Conditions 1 to 8 hold trivially.
Case: ri = [statep(t)] ā[]ā [] (for some p and t). By induction hypothesis, we have Pnā² !P Sm,and thus, as previously established, Pnā² !P Snā1. Let Q ā# Pnā² such that Q !P statep(t). LetĪø be a grounding substitution for statep(x) ā prems(JP K=p) such that t = xĪø. Then Īø induces asubstitution Ļ and a bijective renaming Ļ for fresh, but not bound names (in Q) such that P |pĻĻ = Q(see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = 0.We therefore chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)
K(t)āāāā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# { 0 }#, Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.Condition 4 holds since Q ā statep(t), Pnā²+1 = Pnā² \# { 0 }# and Sn = Snā1 \
# { statep(t) }#.
Conditions 1, 2, 3, 5 and 7 hold trivially.
47
Case: ri = [statep(t)] ā[]ā [statepĀ·1(t), statepĀ·2(t)] (for some p and t). By induction hypothesis,we have Pnā² !P Sm, and thus, as previously established, Pnā² !P Snā1. Let Q ā# Pnā² such thatQ !P statep(t). Let Īø be a grounding substitution for statep(x) ā prems(JP K=p) such that t = xĪø.Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh, but not bound names (in Q) suchthat P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = Q1|Q2, for someprocesses Q1 = P |pĀ·1ĻĻ and Q2 = P |pĀ·2ĻĻ.
We therefore chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# {Q1 | Q2 }# āŖ# {Q1, Q2 }
#, Ļnā²+1 = Ļnā²
and Lnā²+1 = Lnā² .We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.By definition of JP K and JP K=p, we have that Q1 ā statepĀ·1(t) and Q2 ā statepĀ·2(t). Therefore,
and since Qā statep(t), Pnā²+1 = Pnā² \# {Q1 | Q2 }#āŖ# {Q1, Q2 }
#, and Sn = Snā1 \# { statept }
#āŖ#
{ statepĀ·1(t), statepĀ·2(t) }#, Condition 4 holds.
Conditions 1, 2, 3, 5 and 7 hold trivially.
Case: ri = [!statep(t)] ā[]ā [statepĀ·1(t)] (for some p, t). By induction hypothesis, we have Pnā² !P
Sm, and thus, as previously established, Pnā² !P Snā1. Let Q ā# Pnā² such that Q !P statep(t).Let Īø be a grounding substitution for statep(x) ā prems(JP K=p) such that t = xĪø. Then Īø induces asubstitution Ļ and a bijective renaming Ļ for fresh, but not bound names (in Q) such that P |pĻĻ = Q(see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = !Qā²for a processQā² = P |pĀ·1ĻĻ..
We therefore chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² āŖ# {Qā² }#, Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.By definition of JP K and JP K=p, we have that Qā²
!P statepĀ·1(t). Therefore, and since Pnā²+1 =
Pnā² āŖ# {Qā² }#, while Sn = Snā1 āŖ# { statepĀ·1(t) }
#, Condition 4 holds.Conditions 1, 2, 3, 5 and 7 hold trivially.
Case: ri = [statep(t),Fr(aā² : fresh)] ā[ProtoNonce(aā² : fresh)]ā [statepĀ·1(t, a
ā² : fresh)] (for some p, tand aā² ā FN). By induction hypothesis, we have Pnā² !P Sm, and thus, as previously established,Pnā² !P Snā1. Let Q ā# Pnā² such that Q !P statep(t). Let Īø be a grounding substitution forstatep(x) ā prems(JP K=p) such that t = xĪø. Then Īø induces a substitution Ļ and a bijective renamingĻ for fresh, but not bound names (in Q) such that P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = Ī½ a; Qā² for a namea ā FN and a process Qā² = P |pĀ·1ĻĻ.
By definition of execmsr , the fact Fr(aā²) can only be produced once. Since this fact is linear it canonly be consumed once. Every rule in JP K that produces a label ProtoNonce(x) for some x consumesa fact Fr(x). Therefore,
aā² /ā { a ā FN | ProtoNonce(a) āE
ā
1ā¤jā¤nā1
Ej }.
The induction hypothesis allows us to conclude that aā² /ā Enā² ,i. e., aā² is fresh. We therefore chose thefollowing transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
48
with Enā²+1 = Enā² āŖ aā², Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# { Ī½ a;Qā² }# āŖ# {Qā²{ a/aā² } }#,
Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.By definition of JP K, statepĀ·1(x, a) ā prems(Rā²) for an Rā² ā JP K=pĀ·1. We can choose Īøā² := Īø[na 7ā aā²]
and have statepĀ·1(t, aā²) = statepĀ·1(x, a)Īø
ā². Since Q = P |pĻĻ for Ļ and Ļ induced by Īø, Qā²{ aā²/a } = P |pĻā²Ļā²
for Ļ ā² and Ļā² induced by Īøā², i. e., Ļ ā² = Ļ and Ļā² = Ļ[a 7ā aā²]. Therefore, Qā²{ aā²/a } !P statepĀ·1(t, aā²).
Condition 4 holds, since furthermore Ī½ aā²; Qā ā statep(t), Pnā²+1 = Pnā²\#{ Ī½ aā²; Qā }#āŖ#{Qā²{ aā²/a } }#,
and Sn = Snā1 \# {Fr(a), statep(t) }
# āŖ# statepĀ·1(t, a : fresh).Condition 1, holds since Enā²+1 = Enā² āŖ aā², and En = ProtoNonce(aā²). Condition 7 holds since
ProtoNonce(a) ā Fres .Conditions 2, 3 and 5 hold trivially.
Case: ri = [statep(t), In(t1)] ā[InEvent(t1)]ā [statepĀ·1(t),Out(t2)] (for some p, t and t1, t2 ā M).
Since the msr execution is normal, we have that Snā2K(t1)āāāāMDInSnā1. Since S0
E1āāJP K . . .EnāāāJP KSn
is normal, so is S0E1āāJP K . . .
Enā1āāāāJP KSnā1, and therefore S0
E1āāJP K . . .Enā2āāāāJP KSnā2. Hence there is
an m < n ā 2 such S0E1āāJP K . . .
EmāāāJP KSm is a normal trace and Sm āāR Snā1 for R = {MDOut,
MDPub,MDFresh,MDAppl,Fresh }.By induction hypothesis, we have Pnā² !P Sm, and thus, since {MDOut,MDPub,MDFresh,
MDAppl }and Fresh do not add or remove state-facts, Pnā² !P Snā2. Let Q ā# Pnā² such thatQ !P statep(t). Let Īø be a grounding substitution for state(x) ā prems(JP K=p) such that t = xĪø.Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh, but not bound names (in Q) suchthat P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = out (t1, t2);Qā² for a
process Qā² = P |pĀ·1ĻĻ.From the induction hypothesis, and since Em+1, . . . , Enā2 = ā , we have that
Enā² = { a ā FN | ProtoNonce(a) āE
ā
1ā¤jā¤nā2
Ej }.
From the induction hypothesis, and since no rule producing Out-facts is applied between step mand step nā 2, we have that
{xĻnā² | x ā D(Ļnā²) }# =E {Out(t) ā āŖkā¤nā2Sk }#. (3)
Let r = { a : fresh | RepNonce(a) āā
1ā¤jā¤nā2 Fj }. Since !K(t1) ā prems(MDInĻ) for Ļ(x) = t1,we have !K(t) āE Snā2. By Lemma 8 and Lemma 9, we have Ī½Enā² , r.Ļnā² ā¢ t. Therefore, Ī½Enā² .Ļnā² ā¢ t.We chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)
K(t1)āāāā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# { out (t1, t2);Qā² }# āŖ# {Qā² }#, Ļnā²+1 =
Ļnā² āŖ { t2/x } and Lnā²+1 = Lnā² for a fresh x.We define f as follows:
f(i) :=
fp(i) if i ā Nm
nā² if m < i < nā 1
nā² + 1 if i = n
Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that Conditions 1 to 8 hold for n.Condition 7 holds since hide([E1, . . . , Em]) =E [F1, . . . , n
ā²], and [Em+1, . . . , Enā1] =E [Fnā²+1], sinceEnā1 = K(t1).
Condition 5 holds since Ļnā²+1 = Ļnā² āŖ { t2/x }, and therefore:
{xĻnā²+1 | x ā D(Ļnā²+1) }# ={xĻnā² | x ā D(Ļnā²) }# āŖ# { t2 }
#
=E{Out(t) ā āŖkā¤nā2Sk }# āŖ# { t2 }
# (by (4))
={Out(t) ā āŖkā¤nSk }#
49
By definition of JP K and JP K=p, we have thatQā²!P statepĀ·1(t). Therefore, and since out (t1, t2);Q
ā²!P
statep(t), Pnā²+1 = Pnā² \# { out (t1, t2);Qā² }# āŖ# {Qā² }#, and Sn =E Snā1 \
# { In(a), statep(t) }# āŖ#
{ statepĀ·1(t),Out(t2) }, Condition 4 holds.Conditions Condition 1, 2 and 3 hold trivially.
Case: ri = [statep(t), In(< t1, t2 >)] ā[InEvent(ćt1, t2ć)]ā [statepĀ·1(t, tā²)] (for some p, t, tā² and
t1, t2 ā M). Since the msr execution is normal, we have that Snā2K(t1)āāāāMDInSnā1. Since S0
E1āāJP K . . .EnāāāJP KSn
is normal, so is S0E1āāJP K . . .
Enā1āāāāJP KSnā1, and therefore S0
E1āāJP K . . .Enā2āāāāJP KSnā2. Hence there is an
m < nā2 such S0E1āāJP K . . .
EmāāāJP KSm is a normal trace and Sm āāR Snā1 for R = {MDOut,MDPub,
MDFresh,MDAppl,Fresh }.By induction hypothesis, we have Pnā² !P Sm. Since {MDOut,MDPub,MDFresh,MDAppl },
Fresh and MDIn do not add or remove state-facts, Pnā² !P Snā2. Let Q ā# Pnā² such that Q !P
statep(t). Let Īø be a grounding substitution for statep(x) ā prems(JP K=p) such that t =E xĪø. Then Īøinduces a substitution Ļ and a bijective renaming Ļ for fresh, but not bound names (in Q) such thatP |pĻĻ = Q (see Definition 22). From the form of the rule R, and since Q = P |pĻĻ, we can deduce thatQ = in (t1, N);Qā², for N a term that is not necessarily ground, and a process Qā² = P |pĀ·1ĻĻ. Sinceri āE ginsts(R), we have that there is a substitution Ļ ā² such that NĻ ā² =E t2.
From the induction hypothesis, and since Em+1, . . . , Enā2 = ā , we have that
Enā² = { a | ProtoNonce(a) āā
1ā¤jā¤nā2
Ej }.
From the induction hypothesis, and since no rule producing Out-facts is applied between step mand step nā 2, we have that
{xĻnā² | x ā D(Ļnā²) }# = {Out(t) ā āŖkā¤nā2Sk }#. (4)
Let r = { a : fresh | RepNonce(a) āā
1ā¤jā¤nā2 Fj }. Since !K(< t1, t2 >) ā prems(MDInĻ) forĻ(x) =< t1, t2 >, we have !K(< t1, t2 >)E ā Snā2. By Lemma 8 and Lemma 9, we have Ī½Enā² , r.Ļnā² ā¢<t1, t2 >. Therefore, Ī½Enā² .Ļnā² ā¢< t1, t2 >. Using DEq and DAppl with the function symbols fst andsnd , we have Ī½Enā² .Ļnā² ā¢ t1 and Ī½Enā² .Ļnā² ā¢ t2. Therefore, we chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)
K(t1)āāāā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā²\#{ in (t1, N);Qā² }#āŖ#{Qā²Ļ ā² }#, Ļnā²+1 = Ļnā²
and Lnā²+1 = Lnā² .We define f as follows:
f(i) :=
fp(i) if i ā Nm
nā² if m < i < nā 1
nā² + 1 if i = n
Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that Conditions 1 to 8 hold for n.Condition 7 holds since hide([E1, . . . , Em]) = [F1, . . . , n
ā²], and [Em+1, . . . , Enā1] = [Fnā²+1], sinceEnā1 = K(t1).
Let Īøā² such that ri = Īøā²R. As established before, we have Ļ ā² such that NĻ ā² =E t2. By definition ofJP K=p, we have that statepĀ·1(t, t
ā²) āE ginsts(P=pĀ·1), and that Īøā² = Īø Ā· Ļ ā². Since Ļ and Ļ are induced byĪø, Īøā² induces Ļ Ā· Ļ ā² and the same Ļ. We have that Qā²Ļ ā² = (P |pĀ·1ĻĻ)Ļ
ā² = P |pĻĻā²Ļ and therefore Qā²Ļ !P
statepĀ·1(t, tā²). Thus, and since in (t1, N);Qā²
!P statep(t), Pnā²+1 = Pnā² \# { in (t1, N);Qā² }# āŖ#
{Qā²Ļ ā² }# and Sn = Snā1 \# { In(< t1, t2 >), statep(t) }
# āŖ# { statepĀ·1(t, tā²) }#, Condition 4 holds.
Conditions Condition 1, 2, 3 and 5 hold trivially.
Case: ri = [statesemip (s),Ack(t1, t2)] ā[]ā [statepĀ·1(s)] (for some p, t and t1, t2 ā M). Since the msr
execution is normal, we have that there p,q,x, y, yā² such that:
Snā3āāR1Snā2āāR2Snā1āāR3Sn , where:
50
ā¢ R1 = [statep(x)] ā [Msg(t1, t2), statesemip (x)]
ā¢ R2 = [stateq(y),Msg(t1, t2)] ā [stateqĀ·1(y āŖ yā²),Ack(t1, t2)]
ā¢ R3 = [statesemip (x),Ack(t1, t2)] ā [statepĀ·1(x)]
.Since in this case, there is a fact with symbol Ack removed from Snā1 to Sn, we have to apply a
different argument to apply the induction hypothesis.
Since ā E1āāJP K Ā· Ā· Ā·
EnāāāJP KSn ā execmsr (JP K) is normal, n ā„ 2, and t1, t2 ā M, Ack(t1, t2) ā
(Snā1 \# Sn), there exists m ā¤ nā 3 such that Sm āā
R Snā3 for R = {MDOut,MDPub,MDFresh,
MDAppl } āŖ Fresh and ā E1āāJP K Ā· Ā· Ā·
EmāāāJP KSm ā execmsr (JP K) is normal. This allows us to apply
the induction hypothesis on ā E1āāJP K Ā· Ā· Ā·
EmāāāJP KSm ā execmsr (JP K). Hence there is a monotonicallyincreasing function from Nm ā Nnā² and an execution such that Conditions 1 to 8 hold. Let fp be thisfunction and note that nā² = fp(m).
In the following case distinction, we extend the previous execution by one step from (Enā² ,Snā² ,SMSnā² ,
Pnā² , Ļnā² ,Lnā²) to (Enā²+1,Snā²+1,SMSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1), and prove that Conditions 1 to 7 hold for
nā² + 1. By induction hypothesis, they hold for all i ā¤ nā². We define a function f : Nn ā Nnā²+1 asfollows:
f(i) :=
fp(i) if i ā Nm
nā² if m < i ā¤ nā 3
nā² + 1 if i = n
Since, Sm āāR Sn for R = {MDOut,MDPub,MDFresh,MDAppl,Fresh }, only Sn \# Sm
contains only Fr-facts and !K-facts, and Sm \# Sn contains only Fr-facts and Out-facts. Therefore,Condition 3, 4 and 5 hold for all i ā¤ n ā 3. Since Em+1, . . . , Enā1 = ā , Condition 1, 2, 6 and 7 holdfor all i ā¤ nā 3.
Fix a bijection such that Pnā² !P Sm. We will abuse notation by writing P !P statep(t), if thisbijection maps P to statep(t). Since {MDOut,MDPub,MDFresh,MDAppl } and Fresh do notadd or remove state-facts, Pnā² !P Snā3. Let P ā# Pnā² such that P !P statep(s). Let Q ā# Pnā²
such that Q!P stateq(t).Let Īøā² be a grounding substitution for stateq(y) ā prems(JP K=q) such that t =E yĪøā². Then Īøā²
induces a substitution Ļ ā² and a bijective renaming Ļā² for fresh, but not bound names (in Q) such thatP |qĻ
ā²Ļā² = Q (see Definition 22).From the form of the rules R1 and R3, and since P =E P |pĻĻ, for Ļ and Ļ induced by the grounding
substitution for statep(x), we can deduce that P =E out t1, t2; Pā² for a process P ā² = P |pĀ·1ĻĻ. Similarly,
from the form of R2, we can deduce Q =E in (t1, N);Qā², for N a term that is not necessarily ground,and a process Qā² = P |qĀ·1Ļ
ā²Ļā². Since Snā2āāR2Snā1, we have that there is a substitution Ļā such thatNĻ ā²Ļā²Ļā =E t2 and ((y āŖ vars(N)) \ y)Ļā =E tā², where tā² such that stateqĀ·1(t, t
ā²) ā Snā1 \# Snā2.
Given that Q =E in (t1, N);Qā² and P =E out t1, t2; Pā², have that Pnā² = P ā² āŖ# { out t1, t2;P
ā²,in (tā²1, N);Qā² }# with t1 =E tā²1 and t2 =E NĻā. Therefore, we chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)
K(t1)āāāā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = P ā² āŖ# {P ā², Qā² }#, Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .Conditions 1 to 8 hold for i ā¤ nā 3. It is left to show that Conditions 1 to 8 hold for n.As established before, we have Ļā such that NĻ ā²Ļā²Ļā =E t2. Let stateq(t, t
ā²) be the state variableadded to Snā1. Then, ((y āŖ vars(N)) \ y)Ļā = tā². By definition of JP K=q, we have that stateqĀ·1(t, t
ā²) āprems(ginsts(P=pĀ·1)) for a grounding substitution ĪøqĀ·1 = Īøā² Ā· Ļā. Since Ļ ā² and Ļā² are induced by Īøā²,ĪøqĀ·1 induces Ļ Ā· Ļ ā² and the same Ļ. We have that Qā²Ļ ā² = (P |qĀ·1Ļ
ā²Ļā²)Ļā = P |qĀ·1ĻĻā²Ļ and therefore
Qā²Ļā !P stateqĀ·1(t, tā²). Similarly, we have P ā²
!P stateqĀ·1(s). We conclude that Condition 4 holds.Conditions Condition 1, 2, 3, 5, 6 and 7 hold trivially.
51
Case: ri = [statep(t)] ā[Eq(t1, t2)]ā [statepĀ·1(t)] (for some p, t and t1, t2 ā M). By inductionhypothesis, we have Pnā² !P Sm, and thus, as previously established, Pnā² !P Snā1. Let Q ā# Pnā²
such that Q!P statep(t). Let Īø be a grounding substitution for statep(x) ā prems(JP K=p) such that
t = xĪø. Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh, but not bound names(in Q) such that P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and sinceQ = P |pĻĻ, we can deduce thatQ = if t1 = t2 thenQ1 elseQ2
for a process Qā² = P |pĀ·1ĻĻ.Since, [E1, . . . , En ļæ½ Ī±, and thus [E1, . . . , Em ļæ½ Ī±eq , we have that t1 =E t2. We therefore chose the
following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā²\#{ if t1 = t2thenQ1 elseQ2 }#āŖ#{Q1 }
#,Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .
We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show thatConditions 1 to 8 hold for n.
By definition of JP K and JP K=p, we have that Q1 ā statepĀ·1(t). Therefore, and since if t1 =
t2 then Q1 else Q2 ā statep(t), Pnā²+1 = Pnā² \# { if t1 = t2 then Q1 else Q2 }# āŖ# {Q1 }
#, andSn = Snā1 \
# { statep(t) }# āŖ# { statepĀ·1(t) }
#, Condition 4 holds. Conditions 1, 2, 3, 5, 6 and 7 holdtrivially.
Case: ri = [statep(t)] ā[NotEq(t1, t2)]ā [statepĀ·1(t)] (for some p, t and t1, t2 ā M). In this case, theproof is almost the same as in the previous case, except that Ī±noteq is the relevant axiom, Q2 is choseninstead of Q1 and and Sn = Snā1 \
# { statep(t) }# āŖ# { statepĀ·2(t) }
#.
Case: ri = [statep(t)] ā[F,Event()]ā [statepĀ·1(t)] (for some p, t). This is a special case of the casewhere ri = [statep(t), l] ā[a]ā [statepĀ·1(t), r] for l = r = ā and a = F .
Case: ri = [statep(t)] ā[Insert(t1, t2)]ā [statepĀ·1(t)] (for some p, t and t1, t2 ā M). By inductionhypothesis, we have Pnā² !P Sm, and thus, as previously established, Pnā² !P Snā1. Let Q ā# Pnā²
such that Q!P statep(t). Let Īø be a grounding substitution for statep(x) ā prems(JP K=p) such that
t = xĪø. Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh, but not bound names(in Q) such that P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = insert t1, t2;Qā² for a
process Qā² = P |pĀ·1ĻĻ.We therefore chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² [t1 7ā t2], SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# { insert t1, t2;Qā² }# āŖ# {Qā² }#,
Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.By definition of JP K and JP K=p, we have thatQā² ā statepĀ·1(t). Therefore, and since insert t1, t2;Q
ā² ā
statep(t), Pnā²+1 = Pnā² \# { insert t1, t2;Qā² }# āŖ# {Qā² }#, and Sn = Snā1 \# { statep(t) }# āŖ#
{ statepĀ·1(t) }#, Condition 4 holds.
Condition 2 holds, since En = Insert(t1, t2) is the last element of the trace.Conditions 1, 3, 5, 6 and 7 hold trivially.
Case: ri = [statep(t)] ā[Delete(t1, t2)]ā [statepĀ·1(t)] (for some p, t and t1, t2 ā M). By inductionhypothesis, we have Pnā² !P Sm, and thus, as previously established, Pnā² !P Snā1. Let Q ā# Pnā²
such that Q!P statep(t). Let Īø be a grounding substitution for statep(x) ā prems(JP K=p) such that
t = xĪø. Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh, but not bound names(in Q) such that P |pĻĻ = Q (see Definition 22).
52
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = delete t1;Qā² for a
process Qā² = P |pĀ·1ĻĻ.We therefore chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² [t1 7ā t2], SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# { delete t1;Qā² }# āŖ# {Qā² }#,
Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.By definition of JP K and JP K=p, we have that Qā² ā statepĀ·1(t). Therefore, and since delete t1;Q
ā² ā
statep(t), Pnā²+1 = Pnā²\#{ delete t1;Qā² }#āŖ#{Qā² }#, and Sn = Snā1\
#{ statep(t) }#āŖ#{ statepĀ·1(t) }
#,Condition 4 holds.
Condition 2 holds, since En = Delete(t1, t2) is the last element of the trace.Conditions 1, 3, 5, 6 and 7 hold trivially.
Case: ri = [statep(t)] ā[IsIn(t1, t2)]ā [statepĀ·1(t, t2)] (for some p, t and t1, t2 ā M). By inductionhypothesis, we have Pnā² !P Sm, and thus, as previously established, Pnā² !P Snā1. Let Q ā# Pnā²
such that Q!P statep(t). Let Īø be a grounding substitution for statep(x) ā prems(JP K=p) such that
t = xĪø. Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh, but not bound names(in Q) such that P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = lookup t1 as vin Q1 else Q2 for some variable V , and two processes Q1 = P |pĀ·1ĻĻ and Q2 = P |pĀ·2ĻĻ.
Since [E1, . . . , En] ļæ½ Ī±in , there is an i < n such that Insert(t1, t2) āE Ei and there is no j suchthat i < j < n and Delete(t1) āE Ej or and Insert(t1, t2) āE TEj. Since Em, . . . , En = ā , we knowthat i < m. Hence, by induction hypothesis, Snā²(t1) = t2. We therefore chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# { lookup t1 as v in Q1 else Q2 }# āŖ#
{Q1{t2/v } }
#, Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.By definition of JP K and JP K=p, we have that Q1{
v/t2 } ā statepĀ·1(t, t2) (for Ļ ā² = Ļ [v 7ā t2] and
Ļā² = Ļ). Therefore, and since lookup t1 as v in Q1 else Q2 ā statep(t), Pnā²+1 = Pnā² \# { lookupt1 as v in Q1 else Q2 }
#āŖ#{Qā² }#, and Sn = Ā§nā1 \#{ statep(t) }
#āŖ#{ statepĀ·1(t, t2) }#, Condition 4
holds.Conditions 1, 2, 3, 5, 6 and 7 hold trivially.
Case: ri = [statep(t)] ā[IsNotSet(t1)]ā [statepĀ·2(t)] (for some p, t and t1 ā M). By inductionhypothesis, we have Pnā² !P Sm, and thus, as previously established, Pnā² !P Snā1. Let Q ā# Pnā²
such that Q!P statep(t). Let Īø be a grounding substitution for statep(x) ā prems(JP K=p) such that
t = xĪø. Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh, but not bound names(in Q) such that P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = lookup t1 as vin Q1 else Q2 for a variable v and two processes Q1 = P |pĀ·1ĻĻ and Q2 = P |pĀ·2ĻĻ.
Since [E1, . . . , En] ļæ½ Ī±notin , there is no i < n such that Insert(t1, t2) āE Ei and there is no jsuch that i < j < n and Delete(t1) āE Ej or and Insert(t1, t2) āE TEj . Since Em, . . . , En = ā , weknow that holds j < m. Hence, by induction hypothesis, Snā²(t1) is undefined. We therefore chose thefollowing transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# { lookup t1 as v in Q1 else Q2 }# āŖ#
{Q2 }#, Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .
53
We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show thatConditions 1 to 8 hold for n.
By definition of JP K and JP K=p, we have that Q2 ā statepĀ·2(t). Therefore, and since lookup
t1 as v in Q1 else Q2 ā statep(t), Pnā²+1 = Pnā² \# { lookup t1 as v in Q1 else Q2 }# āŖ# {Q2 }
#,and Sn = Ā§nā1 \
# { statep(t) }# āŖ# { statepĀ·2(t) }
#, Condition 4 holds.Conditions 1, 2, 3, 5, 6 and 7 hold trivially.
Case: ri = [statep(t),Fr(lock l)] ā[Lock (lock l, t)]ā [statepĀ·1(t, lock l)] (for some p, t, lock l ā FN andt ā M). By induction hypothesis, we have Pnā² !P Sm, and thus, as previously established, Pnā² !P
Snā1. Let Q ā# Pnā² such that Q !P statep(t). Let Īø be a grounding substitution for statep(x) āprems(JP K=p) such that t = xĪø. Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh,but not bound names (in Q) such that P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = lockl t; Qā² forQā² = P |pĀ·1ĻĻ.
Since [E1, . . . , En] ļæ½ Ī±lock , for every i < n such that Lock(lp, t) āE Ei, there a j such that i < j < nand Unlock (lp, t) āE Ej , and in between i and j, there is no lock or unlock, i. e., for all k such thati < k < j, and all li, Lock (li, t) /āE Ek and Unlock (li, t) /āE Ek.
Since Em, . . . , En = ā , we know that this holds for i < m and j < m as well. By inductionhypothesis, Condition 6, this implies that t 6āE Lnā² . We therefore chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# { lockl t; Qā² }# āŖ# {Qā² }#, Ļnā²+1 = Ļnā²
and Lnā²+1 = Lnā² āŖ { t }.We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.By definition of JP K and JP K=p, we have that Qā² ā statepĀ·1(t). Therefore, and since lockl t; Qā² ā
statep(t), Pnā²+1 = Pnā² \# { lockl t; Qā² }# āŖ# {Qā² }#, and Sn = Ā§nā1 \# { statep(t),Fr(lock l) }
# āŖ#
{ statepĀ·1(t, lock l) }#, Condition 4 holds.
Condition 6 holds since En = {Lock(lock l, t) }# is added to the end of the trace.
Conditions 1, 2, 3, 5 and 7 hold trivially.
Case: ri = [statep(t)] ā[Unlock(nl, t)]ā [statepĀ·1(t)] (for some p, t, nl ā FN and t ā M). Byinduction hypothesis, we have Pnā² !P Sm, and thus, as previously established, Pnā² !P Snā1. LetQ ā# Pnā² such that Q!P statep(t). Let Īø be a grounding substitution for statep(x) ā prems(JP K=p)
such that t = xĪø. Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh, but not boundnames (in Q) such that P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = unlockl t; Qā² forQā² = P |pĀ·1ĻĻ.
We therefore chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² , Pnā²+1 = Pnā² \# { unlockl t; Qā² }#āŖ# {Qā² }#, Ļnā²+1 = Ļnā²
and Lnā²+1 = Lnā² \ { t }.We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.By definition of JP K and JP K=p, we have that Qā² ā statepĀ·1(t). Therefore, and since unlockl t; Qā² ā
statep(t), Pnā²+1 = Pnā²\#{ unlockl t; Qā² }#āŖ#{Qā² }#, and Sn = Ā§nā1\#{ statep(t) }
#āŖ#{ statepĀ·1(t) }#,
Condition 4 holds.We show that Condition 6 holds for Lnā²+1 = Lnā² \ { t }: For all tā² 6=E t, tā² āE Lnā² ā tā² āE Lnā²+1
by induction hypothesis. If t 6āE Lnā² , then āj ā¤ m,u.Lock(u, t) āE Ej ā āj < k ā¤ n.Unlock(u, t) āE
Ek. Since we have Em, . . . , Enā1 = ā and En = {Unlock(nl, t) }#, we can strengthen this to āj ā¤
n, u.Lock(u, t) āE Ej ā āj < k ā¤ n.Unlock(u, t) āE Ek, which means that the condition holds in
54
this case. If t āE Lnā² , then āj ā¤ n, u.Lock(u, t) āE Ej ā§ āj < k ā¤ n.Unlock(u, t) 6āE Ek and sinceEm, . . . , Enā1 = ā and En = {Unlock(nl, t) }
#, a contradiction to Condition 6 would constitute of jand u 6=E nl such that Lock(u, t) āE Ej and āj < k ā¤ n.Unlock(u, t) 6āE Ek.
We will show that this leads to a contradiction with [E1, . . . , En] ļæ½ Ī±. Fix j and u. By definitionof JP K and well-formedness of P , there is a pl that is a prefix of p such that P |ql = locklt;Qā²ā² for thesame annotation l and parameter t. The form of the translation guarantees that if statep(t) ā Sn, thenfor some tā² there is i ā¤ n such that statepā²(t
ā²) ā Si, if pā² is a prefix of p. We therefore have that thereis i < n such that Ei =E {Lock(nl, t) }
#. We proceed by case distinction:Case 1: j < i (see Figure 18). Since āj < k ā¤ n.Unlock(u, t) 6āE Ek, [E1, . . . , En] 6ļæ½ Ī±lock .
j
Lock(u, t)
i
Lock(nl, t)
n
Unlock(nl, t)
Figure 18: Visualisation of Case 1.
Case 2: i < j (see Figure 19). By definition of P , there is no parallel and no replication between pland p. Note that any rule in JP K that produces a state named stateq for a non-empty q is such that itrequires a fact with name stateqā² for q = qā² Ā· 1 or q = qā² Ā· 2 (in case of the translation of out, it mightrequire statesemi
qā² , which in turn requires stateqā²). Therefore, there cannot be a second k 6= n such thatUnlock(nl, t) āE Ek (since nl was added in a Fr-fact in to Si). This means in particular that there isnot k such that i < k < n and Unlock(nl, t) āE Ek. Therefore, [E1, . . . , En] 6ļæ½ Ī±lock .
i
Lock(nl, t)
j
Lock(u, t)
n
Unlock(nl, t)
Figure 19: Visualisation of Case 2.
Conditions 1, 2, 3, 5 and 7 hold trivially.
Case: ri = [statep(t), lā²] ā[aā²,Event()]ā [statepĀ·1(t, t
ā²), rā²] (for some p, t, tā² and lā², rā², aā² ā Gā). Byinduction hypothesis, we have Pnā² !P Sm, and thus, as previously established, Pnā² !P Snā1. LetQ ā# Pnā² such that Q!P statep(t). Let Īø be a grounding substitution for statep(x) ā prems(JP K=p)
such that t = xĪø. Then Īø induces a substitution Ļ and a bijective renaming Ļ for fresh, but not boundnames (in Q) such that P |pĻĻ = Q (see Definition 22).
From the form of the rule R, and since Q = P |pĻĻ, we can deduce that Q = l ā[a]ā r;Qā² for aprocess Qā² = P |pĀ·1ĻĻ.
Since ri āE ginsts(R), we have that there is a substitution Ļā such that (l ā[a]ā r)Ļā = lā² ā[a]āā²
rā², lfacts(lā²) ā# Snā1, pfacts(lā²) āE Snā1 and, from the definition of JP K for embedded msr rules,vars(l)Ļā = tā². Since P is well-formed, no fact in Fres appears in neither l nor r, so from Condition 3in the induction hypothesis, we have that lfacts(lā²) ā# SMS
m = SMSnā² and pfacts(lā²) ā SMS
m = SMSnā² . We
therefore chose the following transition:
Ā· Ā· Ā·F ā²
nāāā(Enā² ,Snā² ,SMSnā² ,Pnā² , Ļnā² ,Lnā²)
aā²āā(Enā²+1,Snā²+1,S
MSnā²+1,Pnā²+1, Ļnā²+1,Lnā²+1)
with Enā²+1 = Enā² , Snā²+1 = Snā² , SMSnā²+1 = SMS
nā² \ lfacts(lā²) āŖ# rā², Pnā²+1 = Pnā² \# { l ā[a]ā r;Qā² }# āŖ#
{Qā²Ļā }#, Ļnā²+1 = Ļnā² and Lnā²+1 = Lnā² .We define f as on page 51. Therefore, Conditions 1 to 8 hold for i < nā 1. It is left to show that
Conditions 1 to 8 hold for n.Condition 7 holds since hide([E1, . . . , Em]) = [F1, . . . , n
ā²], and Em+1, . . . , Enā1 = ā , while En =F ā²n \ Event() = aā² (note that Event() ā Fres).
As established before, we have Ļā such that (l ā[a]ā r)Ļā =E l ā[a]ā r. By the definition of JP K=p,
we have that statepĀ·1(t, tā²) āE ginsts(P=pĀ·1), and a Īøā² = Īø Ā· Ļā that is grounding for statepĀ·1(t, t
ā²). SinceĻ and Ļ are induced by Īø, Īøā² induces Ļ Ā·Ļā and the same Ļ. We have that Qā²Ļā = (P |pĀ·1ĻĻ)Ļ
ā = P |pĻĻāĻ
55
and therefore Qā²Ļ !P statepĀ·1(t, tā²). Thus, and since l ā[a]ā r;Qā²
!P statep(t), Pnā²+1 = Pnā² \#
{ l ā[a]ā r;Qā² }# āŖ# {Qā²Ļā }# and Sn = Snā1 \# lfacts(lā²)āŖ# rā² \# { statep(t) }
# āŖ# { statepĀ·1(t, tā²) }#,
Condition 4 holds.Condition 3, holds since
Sn \# Fres =(Snā1 \# lfacts(lā²) āŖ# rā² \# { statep(t) }
# āŖ# { statepĀ·1(t, tā²) }#) \# Fres
=(Snā1 \# lfacts(lā²) āŖ# rā²) \# Fres
=Snā1 \# Fres \
# lfacts(lā²) āŖ# rā²
=SMSnā² \# lfacts(lā²) āŖ# rā²
=SMSnā²+1
Conditions 1, 2, 5, 6 and 7 hold trivially.
Lemma 1. Let P be a well-formed ground process. We have that
tracespi (P ) = hide(filter (tracesmsr (JP K))).
Proof. From Lemma 10, we can conclude that
tracespi (P ) ā { hide(t)|tr ā tracesmsr (JP K) and tr ļæ½ Ī± } = hide(filter (tracesmsr (JP K))).
From Lemma 11, we have that
hide(filter (tracesmsr (JP K))) = { tr ā hide(filter (tracesmsr (JP K))) | tr is normal }.
From Lemma 12, we can conclude that
{ tr ā hide(filter (tracesmsr (JP K))) | tr is normal } ā tracespi(P ).
Hencehide(filter (tracesmsr (JP K))) ā tracespi(P ).
56