Verification, Model Checking, and Abstract Interpretation: Third International Workshop, VMCAI 2002 Venice, Italy, January 21–22, 2002 Revised Papers

340 Pages·2002·4.097 MB·English

by  Cinzia Bernardeschi, Nicoletta De Francesco (auth.), Agostino Cortesi (eds.)

Lecture Notes in Computer Science 2294
EditedbyG.Goos,J.Hartmanis,andJ.vanLeeuwen
3
Berlin
Heidelberg
NewYork
Barcelona
HongKong
London
Milan
Paris
Tokyo
Agostino Cortesi (Ed.)
Verification,
Model Checking, and
Abstract Interpretation
Third InternationalWorkshop,VMCAI 2002
Venice, Italy, January 21-22, 2002
Revised Papers
1 3
SeriesEditors
GerhardGoos,KarlsruheUniversity,Germany
JurisHartmanis,CornellUniversity,NY,USA
JanvanLeeuwen,UtrechtUniversity,TheNetherlands
VolumeEditor
AgostinoCortesi
UniversitàCa’FoscaridiVenezia
DipartimentodiInformatica
ViaTorino155,30170Mestre-Venezia,Italy
E-mail:[email protected]
Cataloging-in-PublicationDataappliedfor
DieDeutscheBibliothek-CIP-Einheitsaufnahme
Verification,modelchecking,andabstractinterpretation:third
internationalworkshop;revisedpapers/VMCAI2002,Venice,Italy,January
21-22,2002.AgostinoCortesi(ed.).-Berlin;Heidelberg;NewYork;
Barcelona;HongKong;London;Milan;Paris;Tokyo:Springer,2002
(Lecturenotesincomputerscience;Vol.2294)
ISBN3-540-43631-6
CRSubjectClassification(1998):F.3.1-2,D.3.1,D.2.4
ISSN0302-9743
ISBN3-540-43631-6Springer-VerlagBerlinHeidelbergNewYork
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting,
reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965,
initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer-Verlag.Violationsare
liableforprosecutionundertheGermanCopyrightLaw.
Springer-VerlagBerlinHeidelbergNewYork
amemberofBertelsmannSpringerScience+BusinessMediaGmbH
http://www.springer.de
©Springer-VerlagBerlinHeidelberg2002
PrintedinGermany
Typesetting:Camera-readybyauthor,dataconversionbyBollerMediendesign
Printedonacid-freepaper SPIN10722206 06/3142 543210
Preface
This volume contains the revised version of papers presented at VMCAI 2002,
theThirdInternationalWorkshoponVerification,ModelChecking,andAbstract
Interpretation, Venice (Italy), January 21-22, 2002.
Themaingoaloftheworkshopwastogiveanoverviewofthemaindirections
decisive for the growth and cross-fertilization of major research activities in
program analysis and verification.
TheVMCAI serieswasstartedin1997withthe aimofgatheringresearchers
interestedininvestigatingsimilaritiesanddifferencesamongthesethreeresearch
methodologies, that may be summarized as follows:
- programverificationaimsatprovingthatprogramsmeettheirspecifications,
i.e., that the actual programbehavior corresponds to the desired one.
- model checking is a specific approach to the verification of temporal prop-
erties of reactive and concurrent systems, which has been very successful in
the area of finite-state programs.
- abstract interpretation is a method for designing and comparing semantics
of program,expressing various types of programproperties; in particular,it
has been successfully used to infer run-time programproperties that can be
valuable in optimizing programs.
Theprogramcommitteeselected22papersoutof41submissionsonthebasis
of at least 3 reviews. The principal selection criteria were relevance, quality,
and clarity. The resulting volume offers the reader an interesting perspective
of the current research trends in the area. In particular, the papers contribute
to the following topics: Security and Protocols, Timed Systems and Games,
Static Analysis, Optimizations, Types and Verification, and Temporal Logics
and Systems.
The quality of the papers, the interesting discussions at the workshop, and
the friendly atmosphere enjoyed by all participants in Venice, encouraged us in
the projectof making VMCAI anannualprivilegedforumfor researchersin the
area.
Specialthanksareduetotheinstitutionsthatsponsoredtheevent:theCom-
puter Science Department of the University Ca’ Foscari, the European Associ-
ation for Programming Languages and Systems (EAPLS), the MIUR Project
“InterpretazioneAstratta,TypeSystemseAnalisiControl-Flow”andtheMIUR
Project“MetodiFormaliperlaSicurezza-MEFISTO”.Weareespeciallygrate-
ful to C. Braghin for her helpful support in organizing the workshop.
March 2002 Agostino Cortesi
Program Committee Chair
Agostino Cortesi Univ. Ca’ Foscari - Venezia (Italy)
Program Committee
Annalisa Bossi Univ. Ca’ Foscari
Dennis Dams Bell Labs and TU Eindhoven
Javier Esparza TU Munchen
Chris Hankin Imperial College
Joxan Jaffar NU Singapore
Thomas Jensen Irisa Rennes
Cosimo Laneve Univ. di Bologna
Baudouin Le Charlier UC Louvain La Neuve
Michael Leuschel Univ. of Southampton
Giorgio Levi Univ. di Pisa
Torben Mogensen DIKU, Copenhagen
Supratik Mukhopadhyay Univ. of Pennsylvania
Thomas Reps Univ. of Wisconsin
Hanne Riis Nielson TU of Denmark
David Schmidt Kansas State University
Pascal Van Hentenryck Brown University
Additional Referees
Busi Nadia Levi Francesca Scozzari Francesca
Charatonik Witold Levin Vladimir Sharygina Natasha
Thao Dang Lovengreen Hans Henrik Sokolsky Oleg
Di Pierro Alessandra Maggiolo Schettini An- Spoto Fausto
Elphick Daniel drea Steffen Martin
Faella Marco Maier Patrick Sun Hongyan
Ferrari Gianluigi Martinelli Fabio Taguchi Kenji
Giacobazzi Roberto Murano Aniello ThiagarajanP.S.
Godefroid Patrice Namjoshi Kedar Tronci Enrico
Gori Roberta Ngan Chin Wei Varea Mauricio
Hansen Michael R. Pinna Michele Voicu Razvan
Hansen Rene Rydhof Ravi Kavita Xiaoqun Du
Khoo Siau-Cheng Roychoudhury Abhik Zavattaro Gianluigi
La Torre Salvatore Sacerdoti Coen Claudio
Table of Contents
Security and Protocols
Combining Abstract Interpretation and Model Checking for Analysing
Security Properties of Java Bytecode ................................. 1
Cinzia Bernardeschi, Nicoletta De Francesco
Proofs Methods for Bisimulation Based Information Flow Security ....... 16
Riccardo Focardi, Carla Piazza, Sabina Rossi
A Formal Correspondence between Offensive and Defensive JavaCard
Virtual Machines .................................................. 32
Gilles Barthe, Guillaume Dufay, Line Jakubiec, Sima˜o Melo de Sousa
Analyzing Cryptographic Protocols in a Reactive Framework ............ 46
R.K. Shyamasundar
Timed Systems and Games
An Abstract Schema for Equivalence-Checking Games .................. 65
Li Tan
Synchronous Closing of Timed SDL Systems for Model Checking......... 79
Natalia Sidorova, Martin Steffen
Automata-Theoretic Decision of Timed Games ........................ 94
Marco Faella, Salvatore La Torre, Aniello Murano
Static Analysis
Compositional Termination Analysis of Symbolic ForwardAnalysis....... 109
Witold Charatonik, Supratik Mukhopadhyay, Andreas Podelski
Combining Norms to Prove Termination .............................. 126
Samir Genaim, Michael Codish, John Gallagher, Vitaly Lagoon
Static Monotonicity Analysis for λ-definable Functions over Lattices ..... 139
Andrzej S. Murawski, Kwangkeun Yi
A Refinement of the Escape Property................................. 154
Patricia M. Hill, Fausto Spoto
VIII Table of Contents
Optimizations
Storage Size Reduction by In-place Mapping of Arrays.................. 167
Remko Tronc¸on, Maurice Bruynooghe, Gerda Janssens,
Francky Catthoor
Verifying BDD Algorithms through Monadic Interpretation ............. 182
Sava Krsti´c, John Matthews
Improving the Encoding of LTL Model Checking into SAT .............. 196
Alessandro Cimatti, Marco Pistore, Marco Roveri, Roberto Sebastiani
Types and Verification
Automatic Verification of Probabilistic Free Choice..................... 208
Lenore Zuck, Amir Pnueli, Yonit Kesten
An Experiment in Type Inference and Verification by Abstract
Interpretation ..................................................... 225
Roberta Gori, Giorgio Levi
Weak Muller Acceptance Conditions for Tree Automata ................ 240
Salvatore La Torre, Aniello Murano, Margherita Napoli
A Fully Abstract Model for Higher-Order Mobile Ambients ............. 255
Mario Coppo, Mariangiola Dezani-Ciancaglini
Temporal Logics and Systems
A Simulation Preorder for Abstraction of Reactive Systems ............. 272
Ferucio Lauren¸tiu T¸iplea, Aurora T¸iplea
Approximating ATL∗ in ATL........................................ 289
Aidan Harding, Mark Ryan, Pierre-Yves Schobbens
Model Checking Modal Transition Systems Using Kripke Structures ...... 302
Michael Huth
ParameterizedVerification of a Cache Coherence Protocol:
Safety and Liveness ................................................ 317
Kai Baukus, Yassine Lakhnech, Karsten Stahl
Author Index ................................................. 331
Combining Abstract Interpretation and Model
Checking for Analysing Security Properties of
Java Bytecode
Cinzia Bernardeschiand Nicoletta De Francesco
Dipartimentodi Ingegneria della Informazione
Universit`a di Pisa, Via Diotsalvi 2, 56126 Pisa, Italy
{cinzia, nico}@iet.unipi.it
Abstract. We present an approach enabling end-users to prove secu-
rity properties of the Java bytecode by statically analysing the code
itself,thuseliminatingtheruntimecheckfortheaccesspermission.The
approach is based on the combination of two well-known techniques:
abstract interpretationandmodelchecking.Bymeansofanoperational
abstractsemanticsofthebytecode,webuiltafinitetransitionsystemem-
bodyingsecurityinformations andabstracting from actual values.Then
we model check it against some formulae expressingsecurity properties.
WeusetheSMVmodelchecker.Amainpointofthepaperisthedefini-
tion ofthepropertiesthattheabstract semantics mustsatisfy toensure
the absence of security leakages.
1 Introduction and Motivation
Java Virtual Machine Language (referred to hereafter as JVML) [12] is becom-
ing a widely used medium for distributing platform-independent programs. In
multilevel secure systems, the problemof the disclosure of sensitive information
of programs written in JVML is particularly important. One of the main moti-
vations is avoiding the damages produced by malicious programs which try to
broadcast secret information. Mobile Java bytecode is checked by the Virtual
Machine for safety properties: a bytecode Verifier enforces static constraints on
Java bytecode to rule out type errors, access control violation, object initial-
isation failure and other dynamic errors. Moreover, to protect end-users from
hostile programs,Java security model assigns access privileges to code and pro-
videsacustomisable”sandbox”inwhichJavabytecoderuns.Atrun-timeaJava
bytecode can do anything within the boundaries of its sandbox, but it can not
take any action outside those boundaries.
Thispaperpresentsanapproachenablingend-userstoprovesecurityproper-
ties ofthe Javabytecodeby staticallyanalysingthe code itself,thus eliminating
the run time check for the access permission. The approach is based on the
combination of two well-known techniques: abstract interpretation and model
checking. Abstract interpretation [7] is a method for analyzing programs by col-
lecting approximate information about their run-time behavior. It is based on
A.Cortesi(Ed.):VMCAI2002,LNCS2294,pp.1–15,2002.
(cid:3)c Springer-VerlagBerlinHeidelberg2002