The First-order Logic of Hyperproperties Joint work with Bernd - - PowerPoint PPT Presentation

▶

the first order logic of hyperproperties

The First-order Logic of Hyperproperties Joint work with Bernd - - PowerPoint PPT Presentation

Jan 06, 2023 215 likes •496 views

The First-order Logic of Hyperproperties Joint work with Bernd Finkbeiner (Saarland University) Martin Zimmermann Saarland University September, 13th 2017 Highlights Conference, London, UK Martin Zimmermann Saarland University The

slide-1

SLIDE 1

The First-order Logic of Hyperproperties

Joint work with Bernd Finkbeiner (Saarland University)

Martin Zimmermann

Saarland University

September, 13th 2017

Highlights Conference, London, UK

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 1/8

slide-2

SLIDE 2

LTL vs. First-order Logic

Theorem (Kamp ’68, Gabbay et al. ’80)

LTL and FO[<] are expressively equivalent.

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 2/8

slide-3

SLIDE 3

HyperLTL

A new logic: ∀π∀π′. F onπ ↔ onπ′ Extend LTL by trace quantifiers to express security, privacy, and information flow properties

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 3/8

slide-4

SLIDE 4

HyperLTL

A new logic: ∀π∀π′. F onπ ↔ onπ′ Extend LTL by trace quantifiers to express security, privacy, and information flow properties Models are sets of traces!

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 3/8

slide-5

SLIDE 5

HyperLTL

A new logic: ∀π∀π′. F onπ ↔ onπ′ Extend LTL by trace quantifiers to express security, privacy, and information flow properties Models are sets of traces! Is there a first-order logic that is expressively equivalent to HyperLTL?

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 3/8

slide-6

SLIDE 6

An Example

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ)

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 4/8

slide-7

SLIDE 7

An Example

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 4/8

slide-8

SLIDE 8

An Example

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · ·

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 4/8

slide-9

SLIDE 9

An Example

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ ∀π. ∃π′. F (aπ ∧ X aπ′) {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · ·

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 4/8

slide-10

SLIDE 10

An Example

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ ∀π. ∃π′. F (aπ ∧ X aπ′) {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ {a} ∅ ∅ ∅ ∅ ∅ ∅ · · ·

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 4/8

slide-11

SLIDE 11

An Example

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ ∀π. ∃π′. F (aπ ∧ X aπ′) {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ {a} ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ ∅ {a} ∅ ∅ ∅ ∅ ∅ · · ·

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 4/8

slide-12

SLIDE 12

An Example

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ ∀π. ∃π′. F (aπ ∧ X aπ′) {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ {a} ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ ∅ {a} ∅ ∅ ∅ ∅ ∅ · · · ∅ ∅ ∅ {a} ∅ ∅ ∅ ∅ · · · . . . . . . . . . . . . . . . . . . . . . . . .

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 4/8

slide-13

SLIDE 13

An Example

Fix AP = {a} and consider the conjunction ϕ of ∀π. (¬aπ) U (aπ ∧ X G ¬aπ) ∃π. aπ ∀π. ∃π′. F (aπ ∧ X aπ′) {a} ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ {a} ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ ∅ {a} ∅ ∅ ∅ ∅ ∅ · · · ∅ ∅ ∅ {a} ∅ ∅ ∅ ∅ · · · . . . . . . . . . . . . . . . . . . . . . . . . The unique model of ϕ is {∅n {a} ∅ω | n ∈ N}.

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 4/8

slide-14

SLIDE 14

First-order Logic for Hyperproperties

· · · <

N

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 5/8

slide-15

SLIDE 15

First-order Logic for Hyperproperties

· · · <

N

· · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 5/8

slide-16

SLIDE 16

First-order Logic for Hyperproperties

· · · <

N

· · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A

E

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 5/8

slide-17

SLIDE 17

First-order Logic for Hyperproperties

· · · <

N

· · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A

E FO[<, E]: first-order logic with equality over the signature {<, E} ∪ {Pa | a ∈ AP} over structures with universe A × N.

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 5/8

slide-18

SLIDE 18

First-order Logic for Hyperproperties

· · · <

N

· · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . · · · · · · . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A

E FO[<, E]: first-order logic with equality over the signature {<, E} ∪ {Pa | a ∈ AP} over structures with universe A × N.

Proposition

For every HyperLTL sentence there is an equivalent FO[<, E] sentence.

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 5/8

slide-19

SLIDE 19

A Setback

Let ϕ be the following property of sets T ⊆ (2{a})ω: There is an n such that a / ∈ t(n) for every t ∈ T.

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 6/8

slide-20

SLIDE 20

A Setback

Let ϕ be the following property of sets T ⊆ (2{a})ω: There is an n such that a / ∈ t(n) for every t ∈ T.

Theorem (Bozzelli et al. ’15)

ϕ is not expressible in HyperLTL.

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 6/8

slide-21

SLIDE 21

A Setback

Let ϕ be the following property of sets T ⊆ (2{a})ω: There is an n such that a / ∈ t(n) for every t ∈ T.

Theorem (Bozzelli et al. ’15)

ϕ is not expressible in HyperLTL. But, ϕ is easily expressible in FO[<, E]: ∃x ∀y E(x, y) → ¬Pa(y)

Corollary

FO[<, E] strictly subsumes HyperLTL.

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 6/8

slide-22

SLIDE 22

HyperFO

∃Ix and ∀Ix: quantifiers restricted to initial positions. ∃Gy ≥ x and ∀Gy ≥ x: if x is initial, then quantifiers restricted to positions on the same trace as x.

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 7/8

slide-23

SLIDE 23

HyperFO

∃Ix and ∀Ix: quantifiers restricted to initial positions. ∃Gy ≥ x and ∀Gy ≥ x: if x is initial, then quantifiers restricted to positions on the same trace as x. HyperFO: ∀Ix1 ∀Ix2 ∀Gy1 ≥ x1 ∀Gy2 ≥ x2 E(y1, y2) → (Pon(y1) ↔ Pon(y2))

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 7/8

slide-24

SLIDE 24

HyperFO

∃Ix and ∀Ix: quantifiers restricted to initial positions. ∃Gy ≥ x and ∀Gy ≥ x: if x is initial, then quantifiers restricted to positions on the same trace as x. HyperFO: ∀Ix1 ∀Ix2 ∀Gy1 ≥ x1 ∀Gy2 ≥ x2 E(y1, y2) → (Pon(y1) ↔ Pon(y2))

quantify

initial positions ∼ = trace quantification

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 7/8

slide-25

SLIDE 25

HyperFO

∃Ix and ∀Ix: quantifiers restricted to initial positions. ∃Gy ≥ x and ∀Gy ≥ x: if x is initial, then quantifiers restricted to positions on the same trace as x. HyperFO: ∀Ix1 ∀Ix2 ∀Gy1 ≥ x1 ∀Gy2 ≥ x2 E(y1, y2) → (Pon(y1) ↔ Pon(y2))

quantify

initial positions ∼ = trace quantification

quantify arbitrary

positions on already quantified traces

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 7/8

slide-26

SLIDE 26

HyperFO

∃Ix and ∀Ix: quantifiers restricted to initial positions. ∃Gy ≥ x and ∀Gy ≥ x: if x is initial, then quantifiers restricted to positions on the same trace as x. HyperFO: ∀Ix1 ∀Ix2 ∀Gy1 ≥ x1 ∀Gy2 ≥ x2 E(y1, y2) → (Pon(y1) ↔ Pon(y2))

quantify

initial positions ∼ = trace quantification

quantify arbitrary

positions on already quantified traces

FO[<, E] kernel

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 7/8

slide-27

SLIDE 27

Conclusion

Theorem

HyperLTL and HyperFO are equally expressive.

Martin Zimmermann Saarland University The First-order Logic of Hyperproperties 8/8