Bounded Model Checking for Hyperproperties

TL;DR

This paper presents the first bounded model checking algorithm for hyperproperties expressed in HyperLTL, enabling efficient detection of security and concurrency property violations through SAT and QBF solving.

Contribution

It introduces a novel BMC algorithm for HyperLTL, extending traditional LTL BMC to handle multiple traces and hyperproperties, implemented in the HyperQube tool.

Findings

Successful model checking of various case studies

Efficient detection of security and concurrency violations

Demonstrated effectiveness of QBF-based BMC for hyperproperties

Abstract

Hyperproperties are properties of systems that relate multiple computation traces, including security and concurrency properties. This paper introduces a bounded model checking (BMC) algorithm for hyperproperties expressed in HyperLTL, which - to the best of our knowledge - is the first such algorithm. Just as the classic BMC technique for LTL primarily aims at finding bugs, our approach also targets identifying counterexamples. BMC for LTL is reduced to SAT solving, because LTL describes a property via inspecting individual traces. HyperLTL allows explicit and simultaneous quantification over traces and describes properties that involves multiple traces and, hence, our BMC approach naturally reduces to QBF solving. We report on successful and efficient model checking, implemented in a tool called HyperQube, of a rich set of experiments on a variety of case studies, including security, concurrent data structures, path planning for robots, and testing.