The First-Order Logic of Hyperproperties Joint work with Bernd - PowerPoint PPT Presentation

The First-Order Logic of Hyperproperties Joint work with Bernd Finkbeiner (Saarland University) Martin Zimmermann Saarland University March, 3rd 2017 RWTH Aachen University, Aachen, Germany Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 1/19

Hyperproperties I secret O secret S I public O public Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 2/19

Hyperproperties I secret O secret S I public O public The system S is input-deterministic: for all traces t , t ′ of S t = I t ′ t = O t ′ implies Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 2/19

Hyperproperties I secret O secret S I public O public The system S is input-deterministic: for all traces t , t ′ of S t = I t ′ t = O t ′ implies Noninterference: for all traces t , t ′ of S t = I public t ′ t = O public t ′ implies Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 2/19

Hyperproperties Both properties are not trace properties, but hyperproperties, i.e., sets of sets of traces. A system S satisfies a hyperproperty H , if Traces ( S ) ∈ H . Many information flow properties can be expressed as hyperproperties. Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 3/19

Hyperproperties Both properties are not trace properties, but hyperproperties, i.e., sets of sets of traces. A system S satisfies a hyperproperty H , if Traces ( S ) ∈ H . Many information flow properties can be expressed as hyperproperties. Specification languages for hyperproperties [Clarkson et al. ’14] HyperLTL: Extend LTL by trace quantifiers. HyperCTL ∗ : Extend CTL ∗ by trace quantifiers. Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 3/19

HyperLTL HyperLTL = LTL + ψ ::= a | ¬ ψ | ψ ∨ ψ | X ψ | ψ U ψ where a ∈ AP (atomic propositions) Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 4/19

HyperLTL HyperLTL = LTL + trace quantification ϕ ::= ∃ π. ϕ | ∀ π. ϕ | ψ ψ ::= a π | ¬ ψ | ψ ∨ ψ | X ψ | ψ U ψ where a ∈ AP (atomic propositions) and π ∈ V (trace variables). Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 4/19

HyperLTL HyperLTL = LTL + trace quantification ϕ ::= ∃ π. ϕ | ∀ π. ϕ | ψ ψ ::= a π | ¬ ψ | ψ ∨ ψ | X ψ | ψ U ψ where a ∈ AP (atomic propositions) and π ∈ V (trace variables). Shortcuts as usual: G ψ = ¬ F ¬ ψ F ψ = true U ψ Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 4/19

Semantics ϕ = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) T ⊆ (2 AP ) ω is a model of ϕ iff Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics ϕ = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) T ⊆ (2 AP ) ω is a model of ϕ iff = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) {} | Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics ϕ = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) T ⊆ (2 AP ) ω is a model of ϕ iff = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) {} | = ∀ π ′ . G ( on π ↔ on π ′ ) { π �→ t } | for all t ∈ T Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics ϕ = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) T ⊆ (2 AP ) ω is a model of ϕ iff = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) {} | = ∀ π ′ . G ( on π ↔ on π ′ ) { π �→ t } | for all t ∈ T { π �→ t , π ′ �→ t ′ } | for all t ′ ∈ T = G ( on π ↔ on π ′ ) Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics ϕ = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) T ⊆ (2 AP ) ω is a model of ϕ iff = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) {} | = ∀ π ′ . G ( on π ↔ on π ′ ) { π �→ t } | for all t ∈ T { π �→ t , π ′ �→ t ′ } | for all t ′ ∈ T = G ( on π ↔ on π ′ ) { π �→ t [ n , ∞ ) , π ′ �→ t ′ [ n , ∞ ) } | = on π ↔ on π ′ for all n ∈ N Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

Semantics ϕ = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) T ⊆ (2 AP ) ω is a model of ϕ iff = ∀ π. ∀ π ′ . G ( on π ↔ on π ′ ) {} | = ∀ π ′ . G ( on π ↔ on π ′ ) { π �→ t } | for all t ∈ T { π �→ t , π ′ �→ t ′ } | for all t ′ ∈ T = G ( on π ↔ on π ′ ) { π �→ t [ n , ∞ ) , π ′ �→ t ′ [ n , ∞ ) } | = on π ↔ on π ′ for all n ∈ N on ∈ t ( n ) ⇔ on ∈ t ′ ( n ) Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 5/19

LTL vs. HyperLTL LTL has many desirable properties. 1. Every satisfiable LTL formula is satisfied by an ultimately periodic trace, i.e., by a finite and finitely-represented model. 2. LTL and FO[ < ] are expressively equivalent. 3. LTL satisfiability and model-checking are PSpace -complete. Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 6/19

LTL vs. HyperLTL LTL has many desirable properties. 1. Every satisfiable LTL formula is satisfied by an ultimately periodic trace, i.e., by a finite and finitely-represented model. 2. LTL and FO[ < ] are expressively equivalent. 3. LTL satisfiability and model-checking are PSpace -complete. Only partial results for HyperLTL. 3a. HyperLTL satisfiability [F. & Hahn ’16] : alternation-free: PSpace -complete ∃ ∗ ∀ ∗ : ExpSpace -complete ∀ ∗ ∃ ∗ : undecidable 3b. HyperLTL model-checking is decidable [F. et al. ’15] . Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 6/19

The Models of HyperLTL Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 7/19

What about Finite Models? Fix AP = { a } and consider the conjunction ϕ of ∀ π. ( ¬ a π ) U ( a π ∧ X G ¬ a π ) Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models? Fix AP = { a } and consider the conjunction ϕ of ∀ π. ( ¬ a π ) U ( a π ∧ X G ¬ a π ) ∃ π. a π Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models? Fix AP = { a } and consider the conjunction ϕ of ∀ π. ( ¬ a π ) U ( a π ∧ X G ¬ a π ) ∃ π. a π { a } ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models? Fix AP = { a } and consider the conjunction ϕ of ∀ π. ( ¬ a π ) U ( a π ∧ X G ¬ a π ) ∃ π. a π ∀ π. ∃ π ′ . F ( a π ∧ X a π ′ ) { a } ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models? Fix AP = { a } and consider the conjunction ϕ of ∀ π. ( ¬ a π ) U ( a π ∧ X G ¬ a π ) ∃ π. a π ∀ π. ∃ π ′ . F ( a π ∧ X a π ′ ) { a } ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ { a } ∅ ∅ ∅ ∅ ∅ ∅ · · · Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models? Fix AP = { a } and consider the conjunction ϕ of ∀ π. ( ¬ a π ) U ( a π ∧ X G ¬ a π ) ∃ π. a π ∀ π. ∃ π ′ . F ( a π ∧ X a π ′ ) { a } ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ { a } ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ ∅ { a } ∅ ∅ ∅ ∅ ∅ · · · . . . . . . . . . . . . . . . . . . . . . . . . The unique model of ϕ is {∅ n { a } ∅ ω | n ∈ N } . Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Finite Models? Fix AP = { a } and consider the conjunction ϕ of ∀ π. ( ¬ a π ) U ( a π ∧ X G ¬ a π ) ∃ π. a π ∀ π. ∃ π ′ . F ( a π ∧ X a π ′ ) { a } ∅ ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ { a } ∅ ∅ ∅ ∅ ∅ ∅ · · · ∅ ∅ { a } ∅ ∅ ∅ ∅ ∅ · · · . . . . . . . . . . . . . . . . . . . . . . . . The unique model of ϕ is {∅ n { a } ∅ ω | n ∈ N } . Theorem There is a satisfiable HyperLTL sentence that is not satisfied by any finite set of traces. Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 8/19

What about Countable Models? Theorem Every satisfiable HyperLTL sentence has a countable model. Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19

What about Countable Models? Theorem Every satisfiable HyperLTL sentence has a countable model. Proof W.l.o.g. ϕ = ∀ π 0 . ∃ π ′ 0 . · · · ∀ π k . ∃ π ′ k . ψ with quantifier-free ψ . Fix a Skolem function f j for every existentially quantified π ′ j . Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19

What about Countable Models? Theorem Every satisfiable HyperLTL sentence has a countable model. Proof W.l.o.g. ϕ = ∀ π 0 . ∃ π ′ 0 . · · · ∀ π k . ∃ π ′ k . ψ with quantifier-free ψ . Fix a Skolem function f j for every existentially quantified π ′ j . t Martin Zimmermann Saarland University The First-Order Logic of Hyperproperties 9/19