On the Scalability of Proof Carrying Code for

On the Scalability of Proof Carrying Code for Software Certification Andrew Ireland School of Mathematical & Computer Sciences Heriot-Watt University Edinburgh Dependable Systems Group © Andrew Ireland

Outline • • • High integrity software development Evidence based software certificates Scalability problems A planning approach Issues for discussion Dependable Systems Group © Andrew Ireland

The SPARK Approach SPARK code SPARK Examiner Revisions VCs SPADE Simplifier Unproven VCs Proofs X Tactics SPADE Proof Checker • SPARK is a subset of Ada with annotations (Praxis High Integrity Systems Ltd) • Supports data & information flow analysis and formal verification - in particular, exception freedom proofs • Euro. Fighter and Hawk projects, advocated by NSA, … Dependable Systems Group © Andrew Ireland

Nu. SPADE SPARK code SPARK Examiner Annotations VCs SPADE Simplifier Unproven VCs Proofs X Nu. SPADE Tactics SPADE Proof Checker • Nu. SPADE = proof planning + program analysis • Annotation generation motivated by proof-failure analysis Dependable Systems Group © Andrew Ireland

Nu. SPADE Unproven VCs Annotations Abstract Predicates Program Analyzer Proof Planner Tactics Co-operative style of integration, i. e. “productive use of failure” Dependable Systems Group © Andrew Ireland

Proof Plans Conjecture Theory Plan Proof Planner Tactic Proof Checker Dependable Systems Group Proof Failure © Andrew Ireland

SPARK and Certification • Z specifications + rigorous proofs • Data flow & information analysis • Code level proofs: – Exception freedom proofs: automatic + interactive proofs – Functional proofs: significant level of interactive proofs – Proof review files • Resource analysis Note: various levels of formal & rigorous evidence Dependable Systems Group © Andrew Ireland

Evidence Based Certification • Proof-Carrying Code (PCC) – a example of an evidence based approach to certification • Code is delivered with a certificate containing a condensed mathematical proof, i. e. a proof that the code satisfies desired safety properties • Responsibility for proof construction lies with the code producer, consumer performs proof checking • Trusted Computing Base (TCB) for PCC is small, i. e. safety properties, verification condition generator and proof checker Dependable Systems Group © Andrew Ireland

Properties, Proofs & Certificates • Properties typically simple, e. g. memory safety • Proof construction involves advanced type checking, i. e. no theorem proving • Certificates: – – LF proofs quadratic with respect to program size LFi proofs 2. 5 to 5 times program size Oracles strings on average 12% program size Proof tactics have also been used Dependable Systems Group © Andrew Ireland

Scalability Problems • Need for comprehensive properties, e. g. functional properties • MOBIUS: combining type-based and logicbased approaches • Need to exploit automated theorem proving techniques • Will current PCC architecture scale-up, e. g. oracles strings? Dependable Systems Group © Andrew Ireland

Proof Plans Conjecture Theory Plan Proof Planner Tactic Proof Checker Dependable Systems Group Proof Failure © Andrew Ireland

Proof Plans Conjecture Theory Plan Proof Planner Tactic Proof Checker Dependable Systems Group Proof Failure © Andrew Ireland

Proof Plans Conjecture Theory Plan Proof Planner Oracle Tactic Proof Checker Dependable Systems Group Proof Failure © Andrew Ireland

Planning Oracles as Certificates Conjecture Theory Plan Oracle Proof Planner Tactic Proof Checker Dependable Systems Group Proof Failure © Andrew Ireland

Planning Oracles as Certificates Conjecture Theory Plan Oracle identifies: • Proof plans and where they should be used • Relevant theories Proof Oracle • Search control hints, e. g. auxiliary. Planner lemmas and generalization steps Tactic Proof Checker Dependable Systems Group Proof Failure © Andrew Ireland

Certificate Generation Code + Spec Repositories (plans + theories) Certificate Generation (Oracle) (VCGen + Planner +Checker) Failure Dependable Systems Group ? Proof © Andrew Ireland

Certificate Validation Code + Spec CPU Repositories (plans + theories) Certificate (Oracle) Certificate Validation (VCGen + Planner +Checker) Failure ? Proof Note: Certificate transforming compiler Dependable Systems Group © Andrew Ireland

Discussion Issues • The proposed proof planning approach will add theory repositories (and specifications) to the TCB – is this acceptable? • For memory limited devices, proof planning oracles are not an option for on-device certificate validation – how important is on-device validation to certification management in general? • More comprehensive properties will require off-device validation – could a dedicated certificate validation device have a role to play? • Certificate transforming compiler or trusted compiler? Dependable Systems Group © Andrew Ireland

Conclusion • The SPARK Approach and proof automation via proof planning • The success of PCC as well and the limits of current architectures • Proposal for proof planning and proof planning oracles as a technique for addressing limitations Dependable Systems Group © Andrew Ireland