DERIVING BISIMULATIONS BY SIMPLIFYING PARTITIONS. Isabella Mastroeni VMCAI Deriving Bisimulations by Simplifying Partitions p.

What was the main purpose of the Bisimulation?
What type of relation did S have?
What did the Bisimulations by Simplifying Partitions do?

Transcription

1 DERIVING BISIMULATIONS BY SIMPLIFYING PARTITIONS Isabella Mastroeni VMCAI 2008 Deriving Bisimulations by Simplifying Partitions p.1/15

2 INTRODUCTION INGREDIENTS: BISIMULATION:... compares systems also on their capability of simulating each others. Deriving Bisimulations by Simplifying Partitions p.2/15

3 INTRODUCTION INGREDIENTS: BISIMULATION:... compares systems also on their capability of simulating each others. STABILITY:... requires a bisimulation between a system and one of its abstractions (partitions of states). Deriving Bisimulations by Simplifying Partitions p.2/15

4 INTRODUCTION INGREDIENTS: BISIMULATION:... compares systems also on their capability of simulating each others. STABILITY:... requires a bisimulation between a system and one of its abstractions (partitions of states). COMPLETENESS:... models the precision of an abstract domain wrt an operator. Deriving Bisimulations by Simplifying Partitions p.2/15

5 C bt = [PT = RT GQ[ INTRODUCTION ilar to is im Ano '87] ble Ano ts ta '05] '01, le tcomp te Ano Deriving Bisimulations by Simplifying Partitions p.2/15 INGREDIENTS:

6 C ba = [PT = RT GQ[ INGREDIENTS: INTRODUCTION ilar to is im '87] ble As ta '05] '01, le Acomp te Deriving Bisimulations by Simplifying Partitions p.2/15

7 C ba = [PT = RT GQ[ INGREDIENTS: INTRODUCTION ilar to is im '87] ble As ta '05] '01, le Acomp te Deriving Bisimulations by Simplifying Partitions p.2/15

8 ABSTRACT INTERPRETATION Consider the complete lattice < C,,,,, >, A i uco(c) Lattice of Abstract Domains Lattice uco A ρ(c) < uco(c),,,, λx., λx. x > Deriving Bisimulations by Simplifying Partitions p.3/15

9 ABSTRACT INTERPRETATION Consider the complete lattice < C,,,,, >, A i uco(c) Lattice of Abstract Domains Lattice uco A ρ(c) < uco(c),,,, λx., λx. x > A 1 A 2 A 2 A 1 Deriving Bisimulations by Simplifying Partitions p.3/15

10 ABSTRACT INTERPRETATION Consider the complete lattice < C,,,,, >, A i uco(c) Lattice of Abstract Domains Lattice uco A ρ(c) < uco(c),,,, λx., λx. x > A 1 A 2 A 2 A 1 i A i = M( i A i ) Deriving Bisimulations by Simplifying Partitions p.3/15

11 ABSTRACT INTERPRETATION Consider the complete lattice < C,,,,, >, A i uco(c) Lattice of Abstract Domains Lattice uco A ρ(c) < uco(c),,,, λx., λx. x > A 1 A 2 A 2 A 1 i A i = M( i A i ) i A i = i A i Deriving Bisimulations by Simplifying Partitions p.3/15

12 ABSTRACT INTERPRETATION Consider the complete lattice < C,,,,, >, A i uco(c) Lattice of Abstract Domains Lattice uco A ρ(c) < uco(c),,,, λx., λx. x > A 1 A 2 A 2 A 1 i A i = M( i A i ) i A i = i A i Top: C A x Deriving Bisimulations by Simplifying Partitions p.3/15

13 ABSTRACT INTERPRETATION Consider the complete lattice < C,,,,, >, A i uco(c) Lattice of Abstract Domains Lattice uco A ρ(c) < uco(c),,,, λx., λx. x > A 1 A 2 A 2 A 1 i A i = M( i A i ) i A i = i A i Top: C Bottom: C A A x x x Deriving Bisimulations by Simplifying Partitions p.3/15

14 PARTITIONS VS ABSTRACT DOMAINS Partitions uniquely correspond to particular abstract domains: PARTITIONING [RT 04,HM 05] Deriving Bisimulations by Simplifying Partitions p.4/15

15 PARTITIONS VS ABSTRACT DOMAINS Partitions uniquely correspond to particular abstract domains: PARTITIONING [RT 04,HM 05] η uco( (C)) x,y. x Rel η y iff η(x) = η(y) O Deriving Bisimulations by Simplifying Partitions p.4/15

16 PARTITIONS VS ABSTRACT DOMAINS Partitions uniquely correspond to particular abstract domains: PARTITIONING [RT 04,HM 05] η uco( (C)) x,y. x Rel η y iff η(x) = η(y) O Deriving Bisimulations by Simplifying Partitions p.4/15

17 PARTITIONS VS ABSTRACT DOMAINS Partitions uniquely correspond to particular abstract domains: PARTITIONING [RT 04,HM 05] η uco( (C)) x,y. x Rel η y iff η(x) = η(y) R Eq(C) Clo R (X) def = S x X [x] R O Deriving Bisimulations by Simplifying Partitions p.4/15

18 PARTITIONS VS ABSTRACT DOMAINS Partitions uniquely correspond to particular abstract domains: PARTITIONING [RT 04,HM 05] η uco( (C)) x,y. x Rel η y iff η(x) = η(y) R Eq(C) Clo R (X) def = S x X [x] R Π(η) def = Clo Relη η Deriving Bisimulations by Simplifying Partitions p.4/15

19 COMPLETENESS ρ η BACKWARD COMPLETENESS: η f ρ = η f Deriving Bisimulations by Simplifying Partitions p.5/15

20 COMPLETENESS ρ η BACKWARD IN-COMPLETENESS: η f ρ η f Deriving Bisimulations by Simplifying Partitions p.5/15

21 COMPLETENESS ρ η Making BACKWARD COMPLETE: Refining input domains [GRS 00] Deriving Bisimulations by Simplifying Partitions p.5/15

22 COMPLETENESS ρ η Making BACKWARD COMPLETE: Simplifying output domains [GRS 00] Deriving Bisimulations by Simplifying Partitions p.5/15

23 COMPLETENESS η ρ FORWARD COMPLETENESS: η f ρ = f ρ Deriving Bisimulations by Simplifying Partitions p.5/15

24 COMPLETENESS η ρ FORWARD IN-COMPLETENESS: η f ρ f ρ Deriving Bisimulations by Simplifying Partitions p.5/15

25 COMPLETENESS η ρ Making FORWARD COMPLETE: Refining output domains [GQ 01] Deriving Bisimulations by Simplifying Partitions p.5/15

26 COMPLETENESS η ρ Making FORWARD COMPLETE: Simplifying input domains [GQ 01] Deriving Bisimulations by Simplifying Partitions p.5/15

27 STABILITY Let S and R, resp., an output and an input partition, let p be a binary relation: STABILITY: S is stable wrt R if X S,Y R we have X p(y ) X p(y ) Deriving Bisimulations by Simplifying Partitions p.6/15

28 Y X p STABILITY Let S and R, resp., an output and an input partition, let p be a binary relation: STABILITY: S is stable wrt R if X S,Y R we have X p(y ) X p(y ) Deriving Bisimulations by Simplifying Partitions p.6/15

29 Y p STABILITY Let S and R, resp., an output and an input partition, let p be a binary relation: STABILITY: S is stable wrt R if X S,Y R we have X p(y ) X p(y ) Deriving Bisimulations by Simplifying Partitions p.6/15

30 MAIN CONTRIBUTION WHAT ALREADY EXISTS: A correspondence between stability and forward completeness [RANZATO & TAPPARO 05]; A refinement algorithm for partition stability [PAIGE & TARJAN 87]; A refinement transformer for abstract domain completeness [GIACOBAZZI ET AL. 00, GIACOBAZZI & QUINTARELLI 01]; A simplification transformer for abstract domain completeness [GIACOBAZZI ET AL. 00, GIACOBAZZI & QUINTARELLI 01];; Deriving Bisimulations by Simplifying Partitions p.7/15

31 MAIN CONTRIBUTION WHAT DOES NOT EXIST: A characterization of completeness for partitions; A notion of partition stability/completeness for the backward direction; A simplification algorithm for partition stability Deriving Bisimulations by Simplifying Partitions p.7/15

32 STABILITY VS FORWARD COMPLETENESS F-STABILITY: X f (Y ) X f (Y ) [PT 87,RT 05] Deriving Bisimulations by Simplifying Partitions p.8/15

33 Y R f S f(x ) X STABILITY VS FORWARD COMPLETENESS F-STABILITY: X f (Y ) X f (Y ) [PT 87,RT 05] Deriving Bisimulations by Simplifying Partitions p.8/15

34 Y R f S f(x ) X STABILITY VS FORWARD COMPLETENESS F-STABILITY: X f (Y ) X f (Y ) [PT 87,RT 05] Deriving Bisimulations by Simplifying Partitions p.8/15

35 Y R f S f(x ) X STABILITY VS FORWARD COMPLETENESS F-STABILITY: X f (Y ) X f (Y ) [PT 87,RT 05] F-COMPLETENESS: [f ([x] R )] S = f ([x] R ) Deriving Bisimulations by Simplifying Partitions p.8/15

36 Y R f S f(x ) X CD XD CX BY AB AY f D C X B Y A STABILITY VS FORWARD COMPLETENESS F-STABILITY: X f (Y ) X f (Y ) [PT 87,RT 05] F-COMPLETENESS: [f ([x] R )] S = f ([x] R ) ( X Clo R f (X) Clo S ) Deriving Bisimulations by Simplifying Partitions p.8/15

37 STABILITY VS BACKWARD COMPLETENESS B-STABILITY: X f (Y ) f (Y ) X Deriving Bisimulations by Simplifying Partitions p.9/15

38 R f S f(y ) STABILITY VS BACKWARD COMPLETENESS B-STABILITY: X f (Y ) f (Y ) X Y X Deriving Bisimulations by Simplifying Partitions p.9/15

39 R )X } {Y f S STABILITY VS BACKWARD COMPLETENESS B-STABILITY: X f (Y ) f (Y ) X Y X f(y Deriving Bisimulations by Simplifying Partitions p.9/15

40 R )X } {Y f S STABILITY VS BACKWARD COMPLETENESS B-STABILITY: X f (Y ) f (Y ) X Y X f(y B-COMPLETENESS: [f ([x] R )] S = [f (x)] S Deriving Bisimulations by Simplifying Partitions p.9/15

41 R )X } {Y f S CD XD CX BY AB AY f D C X B Y A STABILITY VS BACKWARD COMPLETENESS B-STABILITY: X f (Y ) f (Y ) X Y X f(y B-COMPLETENESS: { [f ([x] R )] S = [f (x)] S ( X Clo S max Y f (Y ) X } Clo R ) Deriving Bisimulations by Simplifying Partitions p.9/15

42 BACKWARD VS FORWARD A domain is backward complete wrt f iff it is forward complete wrt f + = λx. S { } Y f (Y ) X ; A (not trivial) partition is backward stable wrt f iff it is forward stable wrt { } f 1 = λx. y f (y) X ; If f is injective, a (not trivial) partition is forward stable wrt f iff it is backward stable wrt f 1 ; Deriving Bisimulations by Simplifying Partitions p.10/15

43 BACKWARD VS FORWARD A domain is backward complete wrt f iff it is forward complete wrt f + = λx. S { } Y f (Y ) X ; A (not trivial) partition is backward stable wrt f iff it is forward stable wrt { } f 1 = λx. y f (y) X ; If f is injective, a (not trivial) partition is forward stable wrt f iff it is backward stable wrt f 1 ; A backward problem can always be transformed in a forward one, but the viceversa is not always possible! Deriving Bisimulations by Simplifying Partitions p.10/15

44 REFINING FOR STABILITY: PT GENERALIZED The best refinement towards forward stability always exists! [PT 87] Deriving Bisimulations by Simplifying Partitions p.11/15

47 REFINING FOR STABILITY: PT GENERALIZED The best refinement towards forward stability always exists! [PT 87] { P : Partition Partition obtained from P by replacing PTSplit f (S, P) : each block B P with B f (S) and B f (S) PTRefiners f (P) def { = S P PTSplit f (S, P) {B i } i P. S = S i B i while (P is not stable) do choose S PTRefiners PT-Algorithm f : f (P); [RT 05] P := PTSplit f (S, P); endwhile } Deriving Bisimulations by Simplifying Partitions p.11/15

48 REFINING FOR STABILITY: PT GENERALIZED The best refinement towards forward stability always exists! [PT 87] The best refinement towards backward stability always exists! Deriving Bisimulations by Simplifying Partitions p.11/15

51 REFINING FOR STABILITY: PT GENERALIZED The best refinement towards forward stability always exists! [PT 87] The best refinement towards backward stability always exists! We can use the PT algorithm since a backward problem wrt f corresponds always to a forward problem wrt f 1. Deriving Bisimulations by Simplifying Partitions p.11/15

52 SIMPLIFYING FOR STABILITY The best simplification towards backward stability always exists! Deriving Bisimulations by Simplifying Partitions p.12/15

55 SIMPLIFYING FOR STABILITY The best simplification towards backward stability always exists! PTSimplifiers f (S) def { = X PTMerge f (S, P) : X f (S) Partition obtained from P by replacing all the blocks X PTSimplifiers f (S) with S PTSimplifiersf (S) } DPT-Algorithm f : while (P is not stable) do choose S PTSimplifiers f (P); P := PTMerge f (S, P)); endwhile Deriving Bisimulations by Simplifying Partitions p.12/15

56 SIMPLIFYING FOR STABILITY The best simplification towards backward stability always exists! The best simplification towards forward stability DOES NOT always exist! Deriving Bisimulations by Simplifying Partitions p.12/15

60 SIMPLIFYING FOR STABILITY The best simplification towards backward stability always exists! The best simplification towards forward stability DOES NOT always exist! EXAMPLE: Consider f (x) = 2x. is not stable (f ( ) = even ). Consider R = {even, odd} (Parity partition), then even f (odd) since 6 f (3) and even f (odd) since 4 / f (odd) A forward stable simplification does not exist! Deriving Bisimulations by Simplifying Partitions p.12/15

61 STABILITY IN ABSTRACT NON INTERFERENCE ABSTRACT NON INTERFERENCE: [GM 04] Fixed an observation of public input, the variation of private input has not to interfere with the observation of the public output. l 1,l 2 V L,h 1,h 2 V H. η(l 1 ) = η(l 2 ) ρ( P (h 1,l 1 ) L ) = ρ( P (h 2,l 2 ) L ) Deriving Bisimulations by Simplifying Partitions p.13/15

62 STABILITY IN ABSTRACT NON INTERFERENCE ABSTRACT NON INTERFERENCE: [GM 04] Fixed an observation of public input, the variation of private input has not to interfere with the observation of the public output. l 1,l 2 V L,h 1,h 2 V H. η(l 1 ) = η(l 2 ) ρ( P (h 1,l 1 ) L ) = ρ( P (h 2,l 2 ) L ) Let Υ(η(l)) denote the sets of value that has to be indistinguishable by a malicious attacker observing η in input (Υ(η(l)) = P (V H, η(l)) L ). Deriving Bisimulations by Simplifying Partitions p.13/15

63 STABILITY IN ABSTRACT NON INTERFERENCE ABSTRACT NON INTERFERENCE: [GM 04] Fixed an observation of public input, the variation of private input has not to interfere with the observation of the public output. l 1,l 2 V L,h 1,h 2 V H. η(l 1 ) = η(l 2 ) ρ( P (h 1,l 1 ) L ) = ρ( P (h 2,l 2 ) L ) Let Υ(η(l)) denote the sets of value that has to be indistinguishable by a malicious attacker observing η in input (Υ(η(l)) = P (V H, η(l)) L ). Υ(L 1 ) Υ(L 2 ) Deriving Bisimulations by Simplifying Partitions p.13/15

64 STABILITY IN ABSTRACT NON INTERFERENCE ABSTRACT NON INTERFERENCE: [GM 04] Fixed an observation of public input, the variation of private input has not to interfere with the observation of the public output. l 1,l 2 V L,h 1,h 2 V H. η(l 1 ) = η(l 2 ) ρ( P (h 1,l 1 ) L ) = ρ( P (h 2,l 2 ) L ) Let Υ(η(l)) denote the sets of value that has to be indistinguishable by a malicious attacker observing η in input (Υ(η(l)) = P (V H, η(l)) L ). Y Υ(L 1 ) and Υ(L 1 ) Y Υ(L 1 ) Υ(L 2 ) Deriving Bisimulations by Simplifying Partitions p.13/15

65 STABILITY IN ABSTRACT NON INTERFERENCE ABSTRACT NON INTERFERENCE: [GM 04] Fixed an observation of public input, the variation of private input has not to interfere with the observation of the public output. l 1,l 2 V L,h 1,h 2 V H. η(l 1 ) = η(l 2 ) ρ( P (h 1,l 1 ) L ) = ρ( P (h 2,l 2 ) L ) Let Υ(η(l)) denote the sets of value that has to be indistinguishable by a malicious attacker observing η in input (Υ(η(l)) = P (V H, η(l)) L ). THEOREM: The domain { X X is backward stable wrt Υ harmless attacker for deterministic systems. } is the strongest Deriving Bisimulations by Simplifying Partitions p.13/15

66 STABILITY FOR OPACITY OPAQUE PREDICATE: A predicate φ over the semantics of a system, is opaque wrt the observation function obs if, for every execution t 1 satisfying φ there is an execution t 2 which does not satisfy φ, such that obs(t 1 ) =obs(t 2 ). [Bryans et al. 05] Deriving Bisimulations by Simplifying Partitions p.14/15

67 STABILITY FOR OPACITY OPAQUE PREDICATE: A predicate φ over the semantics of a system, is opaque wrt the observation function obs if, for every execution t 1 satisfying φ there is an execution t 2 which does not satisfy φ, such that obs(t 1 ) =obs(t 2 ). [Bryans et al. 05] t. obs(t) φ and obs(t) φ (φ NOT backward stable wrt obs) Deriving Bisimulations by Simplifying Partitions p.14/15

68 STABILITY FOR OPACITY OPAQUE PREDICATE: A predicate φ over the semantics of a system, is opaque wrt the observation function obs if, for every execution t 1 satisfying φ there is an execution t 2 which does not satisfy φ, such that obs(t 1 ) =obs(t 2 ). [Bryans et al. 05] t. obs(t) φ and obs(t) φ (φ NOT backward stable wrt obs) EXAMPLE: φ = 3 (x 3 x), attacker capability α = {Z, 3Z, Z 3Z, } If the attacker can observe the predicate as the bca of all the function composing φ then obs(2) φ = Z φ, while obs(2) φ. Deriving Bisimulations by Simplifying Partitions p.14/15

69 STABILITY FOR OPACITY OPAQUE PREDICATE: A predicate φ over the semantics of a system, is opaque wrt the observation function obs if, for every execution t 1 satisfying φ there is an execution t 2 which does not satisfy φ, such that obs(t 1 ) =obs(t 2 ). [Bryans et al. 05] t. obs(t) φ and obs(t) φ (φ NOT backward stable wrt obs) Completeness can be exploited for certifying the resilience of opaque predicates to reverse engineering; Opacity provides new expectations in seeking domain transformers increasing incompleteness, Deriving Bisimulations by Simplifying Partitions p.14/15

70 DISCUSSION We extend the existing notion of stability (corresponding to forward completeness for partitions) also to the backward direction; We dualize the existing refinement algorithm for stability in order to simplify partitions; The simplification algorithm can be considered for simplifying abstract models in abstract model checking; We show fields of computer science where the new stability notion models existing concepts: The strongest harmless attacker in abstract non-interference [Giacobazzi & Mastroeni 04, Hunt & Mastroeni 05] Opacity for abstract observations of programs Deriving Bisimulations by Simplifying Partitions p.15/15