http://user.it.uu.se/~jarst116/slides/week4.pdf

Graph-Based Algorithms for Boolean Function Manipulation

We consider a fully SAT-based method of unbounded symbolic model checking based on computing Craig interpolants. In benchmark studies using a set of large industrial circuit verification instances, this method is greatly more efficient than BDD-based symbolic model checking, and compares favorably to some recent SAT-based model checking methods on positive instances.

Interpolation and SAT-based model checking

Im Jahre 1977 wurde der „Data Encryption Algorithm“ (DEA) vom „National Bureau of Standards“ (NBS, später „National Institute of Standards and Technology“ – NIST) zum amerikanischen Verschlüsselungsstandard für Bundesbehörden erklärt [NBS_77]. 1981 folgte die Verabschiedung der DEA-Spezifikation als ANSI-Standard „DES“ [ANSI_81]. Die Empfehlung des DES als StandardVerschlüsselungsverfahren wurde auf fünf Jahre befristet und 1983, 1988 und 1993 um jeweils weitere fünf Jahre verlängert. Derzeit liegt eine Neufassung des NISTStandards vor [NIST_99], in dem der DES für weitere fünf Jahre übergangsweise zugelassen sein soll, aber die Verwendung von Triple-DES empfohlen wird: eine dreifache Anwendung des DES mit drei verschiedenen Schlüsseln (effektive Schlüssellänge: 168 bit) [NIST_99]. Der DES basiert auf einer von Horst Feistel bei IBM entwickelten Blockchiffre („Lucipher“) mit einer Schlüssellänge von 128 bit. Da die amerikanische „National Security Agency“ (NSA) dafür gesorgt hatte, daß der DES eine Schlüssellänge von lediglich 64 bit besitzt, von denen nur 56 bit relevant sind, und spezielle Substitutionsboxen (den „kryptographischen Kern“ des Verfahrens) erhielt, deren Konstruktionskriterien von der NSA nicht veröffentlicht wurden, war das Verfahren von Beginn an umstritten. Kritiker nahmen an, daß es eine geheime „Trapdoor“ in dem Verfahren gäbe, die der NSA eine OnlineEntschlüsselung auch ohne Kenntnis des Schlüssels erlauben würde. Zwar ließ sich dieser Verdacht nicht erhärten, aber sowohl die Zunahme von Rechenleistung als auch die Parallelisierung von Suchalgorithmen machen heute eine Schlüssellänge von 56 bit zum Sicherheitsrisiko. Zuletzt konnte 1998 mit einer von der „Electronic Frontier Foundation“ (EFF) entwickelten Spezialmaschine mit 1.800 parallel arbeitenden, eigens entwickelten Krypto-Prozessoren ein DES-Schlüssel in einer Rekordzeit von 2,5 Tagen gefunden werden. Um einen Nachfolger für den DES zu finden, kündigte das NIST am 2. Januar 1997 die Suche nach einem „Advanced Encryption Standard“ (AES) an. Ziel dieser Initiative ist, in enger Kooperation mit Forschung und Industrie ein symmetrisches Verschlüsselungsverfahren zu finden, das geeignet ist, bis weit ins 21. Jahrhundert hinein amerikanische Behördendaten wirkungsvoll zu verschlüsseln. Dazu wurde am 12. September 1997 ein offizieller „Call for Algorithm“ ausgeschrieben. An die vorzuschlagenden symmetrischen Verschlüsselungsalgorithmen wurden die folgenden Anforderungen gestellt: nicht-klassifiziert und veröffentlicht, weltweit lizenzfrei verfügbar, effizient implementierbar in Hardund Software, Blockchiffren mit einer Blocklänge von 128 bit sowie Schlüssellängen von 128, 192 und 256 bit unterstützt. Auf der ersten „AES Candidate Conference“ (AES1) veröffentlichte das NIST am 20. August 1998 eine Liste von 15 vorgeschlagenen Algorithmen und forderte die Fachöffentlichkeit zu deren Analyse auf. Die Ergebnisse wurden auf der zweiten „AES Candidate Conference“ (22.-23. März 1999 in Rom, AES2) vorgestellt und unter internationalen Kryptologen diskutiert. Die Kommentierungsphase endete am 15. April 1999. Auf der Basis der eingegangenen Kommentare und Analysen wählte das NIST fünf Kandidaten aus, die es am 9. August 1999 öffentlich bekanntmachte: MARS (IBM) RC6 (RSA Lab.) Rijndael (Daemen, Rijmen) Serpent (Anderson, Biham, Knudsen) Twofish (Schneier, Kelsey, Whiting, Wagner, Hall, Ferguson).

Advanced Encryption Standard (AES).

https://link.springer.com/content/pdf/10.1057%2Fjors.1996.159.pdf

Modeling and Analysis of Stochastic Systems

An attack graph is a succinct representation of all paths through a system that end in a state where an intruder has successfully achieved his goal. Today Red Teams determine the vulnerability of networked systems by drawing gigantic attack graphs by hand. Constructing attack graphs by hand is tedious, error-prone, and impractical for large systems. By viewing an attack as a violation of a safety property, we can use off-the-shelf model checking technology to produce attack graphs automatically: a successful path from the intruder's viewpoint is a counterexample produced by the model checker In this paper we present an algorithm for generating attack graphs using model checking as a subroutine. Security analysts use attack graphs for detection, defense and forensics. In this paper we present a minimization analysis technique that allows analysts to decide which minimal set of security measures would guarantee the safety of the system. We provide a formal characterization of this problem: we prove that it is polynomially equivalent to the minimum hitting set problem and we present a greedy algorithm with provable bounds. We also present a reliability analysis technique that allows analysts to perform a simple cost-benefit trade-off depending on the likelihoods of attacks. By interpreting attack graphs as Markov Decision Processes we can use the value iteration algorithm to compute the probabilities of intruder success for each attack the graph.

Two Formal Analyses of Attack Graphs

This article addresses the following research question: How to compute no-wait schedules and multipath routings for large-scale time-sensitive networks (TSNs)? TSN must guarantee low latency and fault tolerance. The former requirement is achieved by sending the messages according to a no-wait schedule, whereas the latter is achieved by routing each message through multiple streams of disjoint paths. Computing such schedule and routing is an NP-hard problem. In this article, the aforementioned question is addressed by a three-fold solution: An iterated integer linear programming based scheduling (IIS) technique for scalability; the Degree of Conflict (DoC) between the IIS iterations is minimized by the DoC-aware streams partitioning (DASP) technique, which improves the success rate of the IIS; the fault-tolerance is guaranteed by a DoC-aware multipath routing technique, which integrates the DASP for further improvement in the success rate. Two hundred synthetic test cases are used for performance evaluation. The proposed method scales well, i.e., it handled networks of 21 bridges and 480 messages under 40 min timeout. The success rate of the highly utilized instances raised from 47% by random streams partitioning to 90% by the proposed method.

Routing and Scheduling of Time-Triggered Traffic in Time-Sensitive Networks

Using Ordered Binary Decision Diagrams (OBDD) to encode sets of states, the transition relations, and to perform an implicit enumeration of the state space, symbolic model checking has proven to be a very practical technique for the automatic verification of hardware designs at the propositional logic level. However, these methods still require the description of the design to be at the Boolean logic level, and thus in general they are not adequate for verifying circuits with large datapath again because of the state explosion problem. That is, the number of states in the model grows exponentially with the number of state variables and therefore, even with OBDD encoding the data structures become too large to fit typical current computer memories. 
In this thesis, we study the automatic model checking with a first-order branching time temporal logic. Compared to other researches, we raise the level of abstraction at which the problem is stated and explore model checking at a higher abstraction level. Our approach is based on abstract descriptions of state machines (ASMs). An ASM is encoded using Multiway Decision Graphs (MDGs), of which Reduced Ordered Binary Decision Diagrams (ROBDDs) are a special case. ASMs can be used to describe designs at Register Transfer Level (RTL). The verification of ASMs is based on state enumeration whose complexity is independent of the width of the datapath. 
The main task of the thesis is to define a first-order branching time temporal logic called Abstract-CTL* and develop property checking algorithms for a subset of Abstract-CTL* called LMDG, which includes safety properties and liveness properties with or without fairness constraints. The main property templates in LMDG include Ap, AGp, AF p, Ap Uq, AG( c =>(F p)) and AG(c => pU q), where c, p and q are Next_let_formulas which contain only the temporal operator X (“Next”), G, F, U means “always”, “eventually”, “until” respectively, and A means “for all computation paths”. In general, our approach to model checking is to automatically build additional ASMs that represent the Next_let_formulas appearing in a property, connect these additional ASMs to the original one to be verified, and then check a simpler property on the composite machine.

/pdf/model-checking-for-a-first-order-temporal-logic-using-2f6a67k9vk.pdf

Model Checking for a First-Order Temporal Logic Using Multiway Decision Graphs

SysML activity diagrams are OMG/INCOSE standard diagrams used for modeling and specifying probabilistic systems. They support systems composition by call behavior and send/receive artifacts. For verification, the existing approaches dedicated to these diagrams are limited to a restricted set of artifacts. In this paper, we propose a formal verification framework for these diagrams that supports the most important artifacts. It is based on mapping a composition of SysML activity diagrams to the input language of the probabilistic symbolic model checker called ''PRISM''. To prove the soundness of our mapping approach, we capture the underlying semantics of both the SysML activity diagrams and their generated PRISM code. We found that the probabilistic equivalence relation between both semantics preserve the satisfaction of the system requirements. Finally, we demonstrate the effectiveness of our approach by presenting real case studies.

A formal verification framework for SysML activity diagrams

On the non-termination of M DG -based abstract state enumeration

description of state machine is a model used for describing hardware designs at the RTL. Using ASMs, a data value can be represented by a single variable of abstract type, rather than by a vector of Boolean variables, and a data operation is represented by an uninterpreted function symbol. The model checking method based on a first-order linear-time temporal logic as developed in this paper allows to verify properties on designs represented by ASMs. Thus, it is necessary to review first the terminology related to ASMs. 2.1. A many-sorted first-order logic As in an ordinary many-sorted first-order logic, the vocabulary consists of sorts, constants , variables and function symbols(or operators). Constants and variables have sorts. We deviate from standard many-sorted firstorder logic by introducing a distinction between concrete (or enumerated ) sorts and abstract sorts ; the difference is that concrete sorts have enumerations , while abstract sorts do not. The enumeration of a concrete sort α is a set of distinct constants of sort α. We refer to constants occurring in enumerations as individual constantsand to other constants as generic constants . The distinction between abstract and concrete sorts leads to a distinction between three kinds of function symbols. Let f be a function symbol of type α1 × α2 × · · · × αn → αn+1. If αn+1 is an abstract sort then f is an abstract function symbol . If all the α1, . . . , αn+1 are concrete, f is a concrete function symbol . If αn+1 is concrete while at least one of α1, . . . , αn is abstract, then f is referred to as a crossoperator.Both abstract function symbols and cross-operators may be uninterpreted, or partially interpretedby conditional rewrite rules. The termsand their types(sorts) are defined inductively as follows: a constant or a variable of sort α is a term of type α; and if f is a function symbol of type α1 × α2 × · · · × αn → αn+1, n ≥ 1, and A1, . . . , An are terms of types α1, . . . , αn, then f (A1, . . . , An) is a term of type αn+1. We say that a term, variable or constant is concrete (resp. abstract) to indicate that it is of concrete (resp. abstract) sort. A term is concretely reduced if it only contains: (i) the individual constants; (ii) the abstract generic constants; (iii) the abstract variables; and (iv) the terms of the form f (A1, . . . , An) where f is a function symbol and A1, . . . , An are concretely reduced terms. Thus, the concretely reduced The Computer Journal, Vol. 47, No. 1, 2004 Model Checking for a First-Order Temporal Logic 73 terms are those that have no concrete subterms other than individual constants. A term of the form f (A1, . . . , An) where f is a cross-operator and A1, . . . , An are concretely reduced terms is called a cross-term. An equation is an expression A1 = A2 where A1 and A2 are terms of same type α. Atomic formulasare the equations, plus T (truth) and F (falsity). Formulas are built from the atomic formulas in the usual way using logical connectives and quantifiers. An interpretationis a mapping ψ that assigns a denotation to each sort, constant and function symbol such that: (i) The denotation ψ(α) of an abstract sort α is a non-empty set. (ii) If α is a concrete sort with enumeration {a1, a2, . . . , an} then ψ(α) = {ψ(a1), ψ(a2), . . . , ψ(an)} and ψ(ai) = ψ(aj ) for 1 ≤ i < j ≤ n. (iii) If c is a generic constant of sort α, then ψ(c) ∈ ψ(α). If f is a function symbol of type α1 × · · · × αn → αn+1, then ψ(f ) is a function from the Cartesian product ψ(α1) × · · · × ψ(αn) into the set ψ(αn+1). Let X be a set of variables, a variable assignment with domain X compatible with an interpretation ψ is a function φ that maps every variable x ∈ X of sort α to an element φ(x) of ψ(α). We write ψX for the set of ψ-compatible assignments to the variables in X, ψ , φ |= P if a formula P denotes truth under an interpretation ψ and a ψ-compatible variable assignment φ to the variables that occur free in P , |= P if a formulaP denotes truth under every interpretationψ and every ψ-compatible variable assignment to the variables that occur free in P . 2.2. Directed formulas Given two disjoint sets of variables U and V , a directed formula (DF) of type U → V is a formula in disjunctive normal form (DNF) such that: (i) Each disjunct is a conjunction of equations of the form A = a, where A is a term of concrete sort α of the form ‘f (B1, . . . , Bn)’ (f is thus a cross-operator) that contains no variables other than elements of U , and a is an individual constant in the enumeration of α, or w = a, where w ∈ (U ∪V ) is a variable of concrete sort α and a is an individual constant in the enumeration of α, or v = A, where v ∈ V is a variable of abstract sort α and A is a term of type α containing no variables other than elements of U . (ii) In each disjunct, the left-hand sides (LHSs) of the equations are pairwise distinct. (iii) Every abstract variable v ∈ V appears as the LHS of an equation v = A in each of the disjuncts. (Note that there need not be an equation v = a for every concrete variable v ∈ V .) Intuitively, in a DF of type U → V , the U variables play the role of independent variables, the V variables play the role of dependent variables, and the disjuncts enumerate possible cases. In each disjunct, the equations of the form u = a and A = a specify a case in terms of the U variables, while the other equations specify the values of (some of the)V variables in that case. The cases need not be mutually exclusive, nor exhaustive. A DF is said to be concretely reducediff every A in an equation A = a is a cross-term, and every A in an equation v = A is a concretely reduced term. It is easy to see that every DF is logically equivalent to a concretely reduced DF, given complete specifications of the concrete function symbols and concrete generic constants; the reduction can be accomplished by case splitting. From now on, by DF we shall mean concretely reducedDF. Let P be a DF of type U → V . For a given interpretation ψ , P can be used to represent the set of vectors SetψV (P ) = {φ ∈ ψV |ψ, φ |= (∃U)P }. In the following sections, DFs are used for two distinct purposes: to represent sets (viz. sets of states as well as sets of input vectors and output vectors) and to represent relations (viz. the transition and output relations). 2.3. Abstract description of state machines An ASM M is a tuple D = (X, Y, Z, FI , FT , FO), where (i) X, Y and Z are sets of variables, viz. the input, state and output variables, respectively. Let η be a one-to-one function that maps each state variable y to a distinct variable η(y) obtained, for example, by adorning y with a prime. The variables in Y ′ = η(Y ) are used as the nextstate variables. X, Y and Z must be disjointed from Y ′. Given an interpretation ψ , an input vector of the state machine M represented by D is a ψ-compatible assignment to the set of input variables X; thus the set of input vectors, or input alphabet, is ψX. Similarly, ψ Z is the set of output vectors. A state is a ψ-compatible assignment to the set of state variables Y ; hence, the state space is ψY . A state φ can also be described by an assignment φ′ = φ ◦η−1 ∈ ψY to the next state variables. A variable in X ∪ Y ∪ Z is called an ASM_variable. (ii) FI is a DF representing the set of initial states, of type U → Y , where U is a set of abstract variables disjoint from X ∪ Y ∪ Y ′ ∪ Z. Typically, FI is a one-disjunct DF representing the set of initial states. Given an interpretation ψ , a state φ ∈ ψY is an initial state iff ψ, φ |= (∃U)FI . Thus the set of initial statesis SI = Set(FI ) = {φ ∈ ψY |ψ, φ |= (∃U)FI }. (iii) FT is a DF of type (X ∪ Y ) → Y ′ representing the transition relation. Given an interpretation ψ , an input vector φ ∈ ψX and a state φ′ ∈ ψY , a state φ′′ ∈ ψY is a possible next state iff ψ, φ ∪φ′ ∪φ′′ ◦η−1 |= FT . Thus the transition relation of the state machine M represented by D is RT = {(φ, φ′, φ′′) ∈ ψX × ψY × ψY |ψ, φ ∪ φ′ ∪ (φ′′ ◦ η−1) |= FT }. (iv) FO is a DF of type (X ∪ Y ) → Z representing the output relation. The Computer Journal, Vol. 47, No. 1, 2004

Otmane Ait Mohamed

Papers

Routing and Scheduling of Time-Triggered Traffic in Time-Sensitive Networks

Model Checking for a First-Order Temporal Logic Using Multiway Decision Graphs

A formal verification framework for SysML activity diagrams

On the non-termination of M DG -based abstract state enumeration

Model Checking for a First-Order Temporal Logic Using Multiway Decision Graphs (MDGs)