Upload
jessie-snow
View
219
Download
0
Tags:
Embed Size (px)
Citation preview
Towards Automatic Verification
of Safety Architectures
Carsten SchürmannCarnegie Mellon University
April 2000
2
Subtitle
TwelfA Tool to Reason About Formal
Systems
3
Motivation
CERT-advisories [www.cert.org] Computer Emergency Response Team January 1999 – February 2000 29 Advisories total 11 Advisories: Buffer overflow (e.g. ftpd) Others: Viruses, Denial of Service …
> 38% of vulnerabilities due to
bugs
4
Motivation
We need tools to Increase confidence in software Engineer trusted bases for computing Catch programming language design
flaws
There is such a tool:
Twelf
5
Contributions
Design of Twelf Meta-logic [Schürmann 00]
Algorithms for automated deduction
Implementation of Twelf Core [Pfenning, Schürmann 99] Meta theorem prover [Schürmann 00]
Application of Twelf Experiments
6
Outline of This Talk
Problem Safety Architectures
Twelf Design
Implementation Experiments
Conclusion Research Agenda
7
Trusting the Source?
Example: WU-ftpd 2.6.0: 17865 lines of code GCC-core 2.95.2: 433128 lines of code
Related work: Piton/Micro Gipsy [Moore, Young, Bevier 89]
Compiler BinarySource
Trusted Computing Base
8
Trusting Binaries?
Example: WU-ftpd 2.5.0 binary: 150 KB [RedHat 6.1]
Related work: Software fault isolation [Wahbe, … 93]
Compiler
Trusted Computing Base
VerifierBinarySource
9
Feasibility study Packet filter [Necula, Lee
96]
Trusting Safety Proofs?
CompilerSource Proof CheckerSafety Proof
Binary
Safety Proof Language
Small Trusted Computing Base
10
Safety Architectures
Proof Carrying Code Logic: 129 rules [Necula, Lee 97] Logic: several 100 rules [Appel, Felty
99] Proof checker: 206 lines [Schürmann
98] Uses a logical framework
Typed Assembly Language Type Theory: 31 rules [Morrisett, Crary … 98] Proof Checker: approx 4000 lines
Java Bytecode Type system: 20 pages prose Bytecode verifier
11
Uniform representation language Storing Shipping Checking
Logic-independent safety proof checker
Logical Frameworks
Safety ProofProof Checker
Safety Proof Language
Binary
Logical Framework
Safety ProofProof Checker
Safety Proof Language
12
Safety Proof Languages
First-order/higher-order logics[Gentzen 35]
Temporal logics (CTL, CTL*, LTL)[Pnueli, Manna, … 84]
Modal and linear logics[Girard 86]
Type theories
Language and system-specific knowledge
13
Good Safety Proof Languages
Consistency Falsehood should not be derivable
Expressiveness Small safety proofs require expressive logics
Extensibility Possibility to add new admissible rules
Is The Safety Proof Language Good?
14
Meta-Logical Framework
Meta-Logical Frameworks
Logical Framework
Safety ProofProof Checker
Safety Proof Language
Is The Safety Proof Language Good?
15
Rest of this Talk
Twelf A meta-logical framework that supports
the representation of logics and type systems
and automates reasoning about them
Used at CMU, Princeton, Stanford…
16
Overview
Safety Proof Language
• Logic• Judgments• Inference rules
Logical Framework
• Uniform language• Types• Direct encoding as objects
Reasoning
• Consistency arguments• Theorems about logics• Inductive proofs
Meta-logical Framework
• Automated proof search• Formulas• Direct encoding as proofs
17
Let’s Start
Safety Proof Language
• Logic• Judgments• Inference rules
18
A Simple Logic
Intuitionistic logic:
Sequent calculus: [Gentzen 35]
Judgment: Rules:
axiomAA,
imprBA
BA
,
implCBA
CBA
,
,
|| 21 AA
AAA n ,,1
cutC
CAA
,
19
Next: Logical Framework LF
Safety Proof Language
• Logic• Judgments• Inference rules
Logical Framework
• Uniform language• Types• Direct encoding as objects
20
Logical framework LF [Honsell, Harper, Plotkin 93]
Simply typed λ-calculus Dependent types
Paradigm Judgments as types Derivations as objects
Representation
Logical Framework
ADAuAu nn conchyphyp :|:,,: 11
DAAA n ,,1
21
Representation (cont’d)
Inference rules as constants
axiom : (hyp A -> conc A).
impr : (hyp A -> conc B) -> conc (A imp B).
impl : conc A -> (hyp B -> conc C) -> (hyp (A imp B) -> conc C).
cut : conc A -> (hyp A -> conc C) -> conc C.
axiomAA,
implCBA
CBA
,
,
imprBA
BA
,
cutC
CAA
,
22
Reasoning about the real worldis as good as the encoding is
Theorem prover for LF [Schürmann 98]
Representation (cont’d)
1-to-1
Logic Logical Framework
23
Notes on the Representation
Elegance Higher-order representation techniques Dependent types
Benefit Variables and substitutions come for free!
We can look at the current field of problem solving by computers as a series of ideas about how to present a problem. If a problem can be cast into one of these representations in a natural way, then it is possible to manipulate it and stand some chance of solving it.
[Allen Newell]
24
Next: Reasoning
Safety Proof Language
• Logic• Judgments• Inference rules
Logical Framework
• Uniform language• Types• Direct encoding as objects
Reasoning
• Consistency arguments• Theorems about logics• Inductive proofs
25
A (Not So) Simple ArgumentTheorem [Admissibility]: [Gentzen 35]
If and then
Proof: by induction on A,D,E.
Case: E=
by induction hyp. on D,E’
by application of impr
DA
ECA,
FC
imprCBACBA
,,,E'
imprCBCB
,
F'
26
History of This Result
Fundamental theorem in Logic [Gentzen 35]
Consistency of first-order logic Structural proof [Pfenning 95] Twelf can prove it automatically [Schürmann 99]
Neither a toy problem nor a trivial problem 182 = 324 cases for full-first order intuitionistic
logic One of the most basic theorems of logic and
automated deduction
27
Significance of This Result
It is not reasoning in a logic Derivation in a logic is only an object Admissibility lemma is not expressible
But reasoning about a logic Step outside the logic Analyze properties of the logic Admissibility lemma is expressible
It is not reasoning in a logic Derivation in a logic is only an object Admissibility lemma is not expressible
But reasoning about a logic Step outside the logic Analyze properties of the logic Admissibility lemma is expressible
28
Next: Meta-logical Framework
Safety Proof Language
• Logic• Judgments• Inference rules
Logical Framework
• Uniform language• Types• Direct encoding as objects
Reasoning
• Consistency arguments• Theorems about logics• Inductive proofs
Meta-logical Framework
• Automated proof search• Formulas• Direct encoding as proofs
29
Problem
Reasoning about derivations is inductiveIn general: LF signatures are not inductive
Standard induction techniques do not apply
axiom : (hyp A -> conc A).
impr : (hyp A -> conc B) -> conc (A imp B).
impl : conc A -> (hyp B -> conc C) -> (hyp (A imp B) -> conc C).
Negative occurrence
30
Closed World Assumption
Standard induction techniques assume Fixed set of constructors Existence of induction principles
Example: Natural number induction
zero:nat succ:nat -> nat
31
Open World Assumption
No induction principles Type definitions are open-ended New types, new inference rules may be
added
Example: Admissibility Theorem Not stable under extensions of the world
Forms of objects are not predictable
32
Solution
Regular world assumption
Closed world assumption
Open world assumption
33
Regular World Assumption
Extensions to the world are predictable!
Sound induction principle exist But it is not standard!
axiom : (hyp A -> conc A).
impr : (hyp A -> conc B) -> conc (A imp B).
impl : conc A -> (hyp B -> conc C) -> (hyp (A imp B) -> conc C).
h1 :hyp A1.
h2 :hyp A2.
. . .
hn :hyp An .
34
Meta Logic M2
Regular extensions of the world: Here
true.:.:.:
.:.:
CFCAEAD
CA
concconchypconc
oo
Ahyph :,|:: Theorem [Admissibility]:
If and thenDA
ECA,
FC
Au hyp:,|::
+
35
Meta Logic M2 (cont’d)
Formulas:Semantics:
true||.:|.::: 21 FFFAxFAxF
+
true|
|||
|||
|||
2121
:,]/[.:
:,]/[.:
FFFF
AMMxMFFAx
AMMxMFFAx
andiff
s.t.someforiff
s.t.allforiff
36
Meta Logic M2 (cont’d)
Proof calculus for M2 [Schürmann 00]
Judgment: Rules: see thesis
Theorem [Soundness of M2] [Schürmann 00]
If then
Proof: via realizability interpretation.
+
+
FP |
FP | F |
+
37
Twelf Implementation
Implements a theorem prover for M2
Success due to regular world assumption
Automated proof searchNo tactics
TwelfLemmas
Ind.-variablesBound
Proof in M2
Not found
+
+
38
Twelf Implementation (cont’d)Splitting
Case analysis over LF objectsRegular world assumption
RecursionInduction hypotheses
Regular world assumption
FillingApplies an underlying LF prover
Or theorem prover for underlying logic
39
Experiments
Problem Total time Reason
Cut-Elimination I L Admissibility of Cut 6min 35sec
Cut-elimination 0.28sec
ND - Sequent ND -> Sequent 0.11sec
Sequent -> ND 0.12sec
ND - Hilbert Deduction theorem 0.12sec
Translation theorem 0.37sec
falsetrue
Machine: Pentium II, 400Mhz, 192MB RAM, Linux 2.0
40
Experiments (cont’d)
Problem Total time Reason
Mini-ML Value-soundness 0.13sec
Type preservation 0.42sec
Reduction theorem 0.66sec
(app/ lam) Uniqueness of typing 0.25sec
Compiler (CPM) Soundness not yet. Compl. ind.
Completeness 0.31sec
(both directions) Proof equivalence 0.46sec
CCC Translation lambda 3.392sec
Distributivity not yet. LF Prover
Machine: Pentium II, 400Mhz, 192MB RAM, Linux 2.0
41
Experiments (cont’d)
Problem Total time Reason
Church-Rosser Append lemma 0.08sec
Substitution lemma 0.18sec
Diamond lemma 5.6sec
Strip lemma 3min 58sec
Confl uence lemma 28.52sec
Church-Rosser thm 2.05sec
Machine: Pentium II, 400Mhz, 192MB RAM, Linux 2.0
42
Experiments (cont’d)
Problem Total time Reason
LP (Harrop) Soundness (Uni) 0.31sec
Canonical forms 0.34sec
Completeness (Uni) 0.28sec
Soundness (Res) 1.05sec
Completeness (Res) 0.52sec
Kolmogorov CL->I L Soundness 9.55.sec
Completeness not yet LF Prover
Rippling Equivalence lemma 0.65sec
Skeleton preservation 0.94sec
Machine: Pentium II, 400Mhz, 192MB RAM, Linux 2.0
43
Contributions
Design of Twelf Design of a theorem prover for LF Regular world assumption Design of the sound meta-logic M2
Implementation of Twelf Core (together with Frank Pfenning) Meta theorem prover
Application of Twelf Experiments
+
44
Research Vision
I believe, that the demand for safe and secure software, networks, programming languages will continuously increase.
I foresee myself designing, implementing, and applying the necessary tools.
45
Research Agenda
Towards real-world applications Network protocol design Security protocol design Programming language design Software engineering
46
Research Agenda (cont’d)
Design and Implementation Meta logic + Constraints Lemma generalization Natural language explanation
47
Conclusion
A meta-logical framework
(Twelf)
that supports the representation of logics and type
systems and automates reasoning about them
http://www.twelf.org