Sat-based efficient solver for quantitory-frequency treatment of

Abstract

Techniques are described for providing a SAT-based solver for a quantifier string and bit vector theory. The solver may be used by an automatic inference service of a cloud provider network to analyze policies and results of policies. The solver simplifies an input formula to a Boolean satisfiability problem by encoding the input formula as an equivalently satisfiable propositional formula, where the satisfiability of the equivalently satisfiable propositional formula is determined by an SAT solver. The solver described herein does not use a conventional DPLL (T) type algorithm, but limits the length of variables in the input formula and simplifies the problem to a single formula, which may then be solved using an incremental SAT solution. The solvers may be used independently, or as part of a solver combination, for determining the satisfiability or non-satisfiability of certain formulas, e.g., corresponding to problems about user policies within a cloud provider network.

Description

BACKGROUND OF THE DISCLOSURE

[0001] A cloud provider network enables a user to use various computing-related resources, such as computing resources, storage resources, networking resources, etc. When a user or application interacts with the cloud provider network (e.g., using an application programming interface (API) or a command line interface (CLI) provided by the cloud provider network), the user or application typically needs to specify security credentials to indicate who the user or application is and whether the user or application has permission to access the requested resources. The cloud provider network then uses the security credentials to authenticate the user or application and authorize the user or application to perform various actions. Access to resources and actions within the cloud provider network can be further managed through policies. A policy is a data object that defines the permissions of a user or resource when associated with the user or resource. For example, a resource-based policy can be attached to a storage resource, a computing instance, an encryption key, etc., and can specify who can access the resource and what actions these identities can perform on the resource. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Various examples in accordance with the present disclosure will now be described with reference to the drawings, in which:

[0003] Figure 1 is a diagram showing a computing environment according to some examples, the computing environment including a solver for a quantifier-free theory that analyzes strings and bit vectors of policies within a cloud provider network.

[0004] Figure 2 is a diagram showing the generation of a formula expressed in first-order logic that corresponds to a policy problem involving policies managed by an identity and access management service of a cloud provider network.

[0005] Figure 3 is a diagram showing the use of a solver for a quantifier-free theory of strings and bit vectors to automatically reason about policies and policy consequences of a cloud provider network.

[0006] Figure 4 is a diagram showing the generation of a Boolean abstraction of an input formula used by the solver.

[0007] Figure 5 is a flowchart showing the operations of a method for analyzing policies and policy consequences of a cloud provider network using a SAT-based solver for a quantifier-free theory of strings and bit vectors.

[0008] Figure 6 shows an example provider network environment according to some examples.

[0009] Figure 7A block diagram of an example provider network that provides storage services and hardware virtualization services to customers according to some examples.

[0010] Figure 8 A block diagram showing an example computer system that may be used in some examples. Detailed Description

[0011] The present disclosure relates to methods, devices, systems, and non-transitory computer-readable storage media for providing a SAT-based solver for the quantifier-free theory of strings and bit vectors. According to some examples, the solver may be used by an automated reasoning service of a cloud provider network to analyze policies and policy consequences within the provider network (e.g., policies that define which actions certain principals may or may not perform with respect to certain cloud-based resources). As described in more detail herein, the solver simplifies an input formula (e.g., a formula representing a problem regarding one or more policies) to a Boolean satisfiability problem by encoding the input formula as an equisatisfiable propositional formula, where the satisfiability of the equisatisfiable propositional formula is determined by a SAT solver. The solver described herein does not use a traditional DPLL(T)-style algorithm, but rather limits the length of string variables in the input formula and reduces the problem to a single propositional formula, which can then be solved using incremental SAT solving. The solver may be used independently or as part of a solver combination to determine the satisfiability or unsatisfiability of certain formulas corresponding to, for example, problems regarding user policies within a cloud provider network.

[0012] As part of the computing-related services provided by a cloud provider network, many cloud providers offer identity and access management services. These services typically help users control access and permissions to the services and resources provided to users of the cloud provider network (e.g., compute instances, storage resources, etc.). For example, by using identity-based policies and resource-based policies, users can finely control which identities (e.g., users or roles) can access specific resources associated with the user account and how those identities can use the resources. The configuration of such policies often becomes quite complex, and as a result, users often have difficulty understanding all the implications of such policies and their interrelationships (e.g., whether these policies may inadvertently permit any undesired security or operation-related actions on the user's resources).

[0013] To alleviate some of these concerns, a cloud provider network can provide tools to help users analyze the characteristics of resources and the associated policies within their accounts. An example of such a security tool is an access analyzer, which can help users understand which identities can access certain resources associated with their accounts and, based on such information, help users identify whether their current policy configuration provides unexpected access to users outside their organization. In this example, the access analyzer service can perform such analysis in part by converting a user's or organization's storage policy into an equivalent logical statement (e.g., a statement expressed in first-order logic) and using a set of general and specialized logic solvers (e.g., a satisfiability modulo theories (SMT) solver) to verify whether certain security-related behaviors are possible. In this context, the logic solver reasons about propositional logic statements that include various string variables corresponding to aspects of the policy such as account identifiers, resource identifiers, etc. In addition to identity and access management services, some cloud provider networks also provide source code review and optimization services, program or computer network verification services, and other types of services that use automated reasoning to help analyze the correctness of various types of computing systems.

[0014] The satisfiability problem, or SAT, asks whether variable values (e.g., true or false) can be assigned to satisfy a set of constraints. The SMT solvers described above typically attempt to prove or disprove a formula expressed in first-order logic using a combination of theories such as Presburger arithmetic, uninterpreted functions, or strings. As previously mentioned, an automated reasoning service can take policies and problems as input, convert the policies and problems into SMT queries, and call a combination solver to obtain an answer. The combination solver calls multiple solvers in the backend and returns the result from the solver that returns an answer first. By leveraging the diversity of such solvers, where each solver can be more effective than others at analyzing certain types of policies and problems, the automated reasoning service can typically solve queries more quickly. However, even with multiple solvers, the automated reasoning service may not be able to effectively provide answers for certain types of problems. Therefore, adding additional solvers that can solve different subsets of such problems can improve the overall efficiency of these automated reasoning services.

[0015] According to the embodiments described herein, a new solver is proposed that effectively solves at least a subset of the policy problems described above, in part by using bounded model checking techniques for strings and other techniques. As described in more detail herein, the solver initially creates an abstraction of the input formula (e.g., a boolean framework). The solver then bounds the lengths of the string variables contained in the input formula and encodes the input formula as an equivalent satisfiable propositional formula with respect to the established upper bounds on the string variables. By reducing the input SMT formula to a single propositional formula, which can be solved using incremental SAT solving, many types of policy-related problems expressed in first-order logic can be solved more efficiently, thus helping to provide answers to the user's questions about their policies and helping users of the cloud provider network optimize their access policies, etc.

[0016] Figure 1FIG. 0 is a diagram showing an environment including an automated reasoning service according to some examples, the automated reasoning service being used to analyze policies associated with user accounts and user account organizations of a cloud provider network. A provider network 100 (or “cloud” provider network) provides users with the ability to use one or more of various types of computing-related resources, such as computing resources (e.g., executing virtual machine (VM) instances and / or containers, executing batch jobs, executing code without provisioning servers), data / storage resources (e.g., object storage, block-level storage, data archive storage, databases and database tables, etc.), network-related resources (e.g., configuring virtual networks (including computing resource groups), content delivery networks (CDNs), domain name services (DNS)), application resources (e.g., databases, application build / deployment services), access policies or roles, identity policies or roles, machine images, routers, and other data processing resources, etc. These and other computing resources may be provided as services, such as: a hardware virtualization service for executable computing instances, a storage service for storing data objects, etc. Users of the provider network 100 (or “customers”) may use one or more user accounts associated with a customer account, but these items may be used somewhat interchangeably depending on the usage context. A user may use one or more electronic devices 102 to interact with the provider network 100 via one or more intermediate networks 104 (e.g., the Internet) via one or more interfaces (such as by using application programming interface (API) calls), via a console implemented as a website or application, etc. An API refers to an interface and / or communication protocol between a client and a server such that if the client issues a request in a predefined format, the client should receive a response in a specific format or initiate a defined action. In a cloud provider network scenario, the API provides a gateway for a customer to access cloud infrastructure by allowing the customer to obtain data from or cause an action within the cloud provider network, enabling the development of applications that interact with resources and services hosted in the cloud provider network. The API may also enable different services of the cloud provider network to exchange data with each other. The interface may be part of or act as a front end to the control plane of the provider network 100, the control plane including “backend” services that support and implement services that can be provided more directly to customers.

[0017] For example, a cloud provider network (or simply referred to as "the cloud") generally refers to a large pool of accessible virtualized computing resources such as computing, storage, and networking resources, applications, and services. The cloud can provide convenient, on-demand network access to a shared pool of configurable computing resources, which can be programmatically provisioned and released in response to customer commands. These resources can be dynamically provisioned and reconfigured to adjust to variable loads. Thus, cloud computing can be regarded as both the applications delivered as a service through a publicly accessible network (e.g., the Internet, cellular communication network) and the hardware and software in the cloud provider data center that provides these services.

[0018] The cloud provider network 100 can be formed as a collection of regions, where a region is a geographical area within the cloud provider's cluster of data centers. Each region includes a plurality (e.g., two or more) of Availability Zones (AZs) connected to each other via a private high-speed network (e.g., fiber-optic communication connection). An AZ (also referred to as a "zone") provides an isolated failure domain that includes one or more data center facilities, which have separate power, separate networking, and separate cooling relative to the data center facilities in another AZ. A data center refers to a physical building or enclosure that houses the servers of the cloud provider network and provides power and cooling to the servers of the cloud provider network. Preferably, the AZs within a region are located far enough apart such that a natural disaster (or other failure-causing event) does not simultaneously affect more than one AZ or take more than one AZ offline.

[0019] Users can connect to an AZ of the cloud provider network via a publicly accessible network (e.g., the Internet, cellular communication network), such as through a Transit Center (TC). The TC is the main backbone location that links users to the cloud provider network and can be co-located with other network provider facilities (e.g., Internet Service Provider (ISP), telecommunications provider) and securely connected to the AZ (e.g., via VPN or direct connection). Each region can operate two or more TCs for redundancy. The regions are connected to a global network, which includes private networking infrastructure (e.g., fiber-optic connections controlled by the cloud provider) that connects each region to at least one other region. The cloud provider network can deliver content from access points (or "POPs") located outside but networked with these regions through edge locations and regional edge cache servers. This partitioning and geographical distribution of computing hardware enables the cloud provider network to provide users with low-latency resource access globally with a high degree of fault tolerance and stability.

[0020] In general, the operations and activities of a provider network can be broadly categorized into two classes: control plane operations carried on the logical control plane and data plane operations carried on the logical data plane. The data plane represents the movement of user data through a distributed computing system, while the control plane represents the movement of control signals through the distributed computing system. The control plane typically includes one or more control plane components that are distributed across and implemented by one or more control servers. Control plane activities typically include administrative operations such as system configuration and management (e.g., resource placement, hardware capacity management, diagnostic monitoring, system status information). The data plane includes user resources implemented on the provider network (e.g., compute instances, containers, block storage volumes, databases, file storage). Data plane activities typically include non-administrative operations such as delivering user data to user resources and delivering user data from user resources. Control plane components are typically implemented on a separate set of servers from the data plane servers, and control plane activities and data plane activities can be sent over separate / distinct networks.

[0021] To provide these and other computing resource services, provider network 100 typically relies on virtualization technologies. For example, virtualization technologies can provide users with the ability to control or use computing resources (e.g., “compute instances” such as VMs using a guest operating system (O / S), where the guest O / S operates using a hypervisor that may or may not further operate on top of a underlying host O / S; containers that may or may not operate within a VM; compute instances that can execute on “bare metal” hardware without an underlying hypervisor), where one or more computing resources can be implemented using a single electronic device. Thus, users can directly use the computing resources hosted by the provider network (e.g., provided by a hardware virtualization service) to perform various computing tasks. Additionally or alternatively, users can indirectly use computing resources by submitting code to be executed by the provider network (e.g., via an on-demand code execution service), where the provider network then uses one or more computing resources to execute the code, and typically the user has no control or knowledge of the underlying computing instances involved.

[0022] As described herein, one type of service that a provider network can offer can be referred to as a “managed computing service”, which executes code or provides computing resources for its users in a managed configuration. Examples of managed computing services include, for example, on-demand code execution services, hardware virtualization services, container services, etc.

[0023] On-demand code execution services (referred to as function computing services, function services, cloud function services, functions as a service, or serverless computing services in various examples) enable users of a provider network 100 to execute their code on cloud resources without having to select or manage the underlying hardware resources used to execute the code. For example, a user can use an on-demand code execution service by uploading their code and using one or more APIs to request the service to identify, provision, and manage any resources required to run the code. Thus, in various examples, the "serverless" function can include code that can be executed on demand provided by the user or other entity (such as the provider network itself). The serverless function can be maintained within the provider network through an on-demand code execution service and can be associated with a specific user or account or generally accessible by multiple users / accounts. The serverless function can be associated with a uniform resource locator (URL), uniform resource identifier (URI), or other reference that can be used to invoke the serverless function. The serverless function can be executed by computing resources such as virtual machines, containers, etc. when triggered or invoked. In some examples, the serverless function can be invoked through an application programming interface (API) call or a special format hypertext transfer protocol (HTTP) request message. Thus, a user can define a serverless function that can be executed on demand without requiring the user to maintain dedicated infrastructure to execute the serverless function. Instead, resources maintained by the provider network 100 can be used to execute the serverless function on demand. In some examples, these resources can be maintained in a "ready" state (e.g., having a pre-initialized runtime environment configured to execute the serverless function), allowing for almost real-time execution of the serverless function.

[0024] Hardware virtualization services (referred to as elastic computing services, virtual machine services, compute cloud services, compute engines, or cloud computing services in various implementations) enable users of provider network 100 to provision and manage computing resources, such as virtual machine instances. Virtual machine technology can use a physical server, for example, using a hypervisor to run many equivalent forms of servers (each of which is referred to as a virtual machine), and the hypervisor can run at least on the offload card of the server (e.g., a card connected to the physical CPU via PCI or PCIe), and other components of the virtualized host can be used for some virtualization management components. Such offload cards of the host can include one or more CPUs that are not available for user instances but are dedicated to instance management tasks, such as virtual machine management (e.g., hypervisor), input / output virtualization of network-attached storage volumes, local migration management tasks, instance health monitoring, etc.). Virtual machines are often referred to as compute instances or simply "instances". As used herein, provisioning a virtual computing instance generally includes: reserving resources of an underlying physical computing instance (e.g., computing and memory resources) for a client (e.g., from a pool of available physical computing instances and other resources); installing or starting the required software (e.g., operating system); and making the virtual computing instance available to the client to perform client-specified tasks.

[0025] Another type of managed computing service can be a container service that allows users of a cloud provider network to instantiate and manage containers, such as a container orchestration and management service (referred to as a container service, cloud container service, container engine, or container cloud service in various implementations). In some examples, the container service can be a Kubernetes-based container orchestration and management service (referred to as a container service for Kubernetes, Azure Kubernetes Service, IBM Cloud Kubernetes Service, Kubernetes Engine, or container engine for Kubernetes in various implementations). As mentioned herein, a container packages code and all its dependencies so that an application (also referred to as a task, pod, or cluster in various container services) can run quickly and reliably across various computing environments. A container image is an independent executable software package that includes everything needed to run an application process: code, runtime, system tools, system libraries, and settings. A container image becomes a container at runtime. Thus, a container is an abstraction of the application layer (meaning that each container emulates a different software application process). Although each container runs an isolated process, multiple containers can share a common operating system, for example, by being launched within the same virtual machine. In contrast, a virtual machine is an abstraction of the hardware layer (meaning that each virtual machine emulates a physical machine on which software can run). While multiple virtual machines can run on one physical machine, each virtual machine typically has its own copy of the operating system, as well as the application and its associated files, libraries, and dependencies. Some containers can run on an instance of a container agent, and some containers can run on a bare-metal server or on an offload card of a server. As indicated, the provider network 100 can also include a wide range of additional services, such as a source code analysis service 106, a storage service 108, a network service 110, and so on.

[0026] In some examples, an identity and access management service 112 is a service that enables users to securely control access to cloud provider network resources (e.g., computing resources associated with various provider network services, such as storage objects associated with the storage service 108, databases associated with a database service, computing instances associated with a hardware virtualization service, etc.). The identity and access management service 112 is widely used to control who is permitted to authenticate (e.g., log in) to the cloud provider network 100 and who is authorized (e.g., has permission) to use the resources provided by the cloud provider network 100. Generally speaking, a resource is a domain concept used to capture items that can be created, read, modified, or deleted by customers in the cloud provider network 100. Examples of resources also include identities (e.g., identity 114, including example users 116A, …, 116N and roles 118A, …, 118N) and policies 120 (e.g., including identity-based policies 122, resource-based policies 124, and other possible types of policies).Figure 1 The concept of an organization 126 is also shown, which can include any number of associated accounts 128, and which can also include any number of users and roles.

[0027] When a person initially creates an account through the cloud provider network 100, this person can start with a single sign-on identity that has full access to all cloud provider network services and resources associated with the account (e.g., the root user of identity 114). For example, access to the root user identity can be obtained by logging in using the username (e.g., email address) and password used to create the account. The cloud provider network 100 generally recommends that users do not use the root user for most tasks, but instead create additional user accounts with limited permissions. Users can grant different permissions to different user accounts for different resources. For example, one user account can be configured to allow some users full access to hardware virtualization services, storage services 108, and other cloud provider network 100 resources. For other users, the user account can allow read-only access to some buckets or allow permission to manage some instances, etc.

[0028] In some examples, a principal represents a person or application that can issue an action or operation request for resources of the cloud provider network 100 via one or more identities, but sometimes the term principal can be used interchangeably with identity. A set of identities 114 associated with an account 128 can include any number of users and roles. When a principal uses an identity (e.g., a user or role) to send a request to perform an action or operation on a resource, a cloud provider network request occurs. The request can include some or all of the following information: the action or operation the principal wants to perform, the resource object on which the action or operation is to be performed, the person or application using the identity (e.g., a user or role) to send the request, environmental data (e.g., information about IP address, user agent, SSL enabled status, time of day, etc.), and resource data (e.g., data associated with the resource being requested, such as a resource identifier or tag name). In some examples, the identity and access management service 112 collects the information contained in the request into a request context, which is used to evaluate and authorize the request.

[0029] For a request to be completed, the Identity and Access Management Service 112 determines whether to authorize (e.g., permit) the requestor to complete the request. During authorization, the Identity and Access Management Service 112 uses the values included in the request context to check the policies applicable to the request. The Identity and Access Management Service 112 uses the identified policies to determine whether to allow or deny the request. In some examples, the policies are stored by the Identity and Access Management Service 112 as JavaScript Object Notation (JSON) documents (or using any other data format) and specify the permissions for a particular identity. In some examples, there are several types of policies 120 that may affect whether a request is authorized, including, for example, identity-based policies 122, trust policies, and other policies. For example, to provide a user with permissions to access resources in their own account, an identity-based policy can be configured, while a resource-based policy can be used to grant cross-account access to resources. In some examples, the Identity and Access Management Service 112 checks each policy applicable to the request context. If a single permission policy includes a denied action, the Identity and Access Management Service 112 denies the entire request. In some examples, the Identity and Access Management Service 112 denies requests by default, such that a request is authorized only if every part of the request is allowed by the applicable permission policies.

[0030] Once the request is authenticated and authorized, the Identity and Access Management Service 112 approves the actions or operations in the request. The operations are defined by the service and include actions that can be performed on or with respect to a resource, such as viewing, creating, editing, and deleting the resource. For example, the Identity and Access Management Service 112 can support actions such as creating users, deleting users, creating roles, and assuming roles, as well as many other possible actions. The Hardware Virtualization Service can support actions such as starting a VM instance, deleting a VM instance, etc. To allow a principal to perform an operation, the action is included in the policy applied to the principal or the affected resource.

[0031] According to the examples described herein, the Provider Network 100 includes an Automated Reasoning Service 130 to enable the analysis of policies and policy consequences within a cloud provider network. The Automated Reasoning Service 130 also includes a solver 132 for improving the service's ability to perform automated reasoning tasks related to policy analysis and other types of problems. As described in more detail below, the solver 132 is a SAT-based solver for first-order theories of strings and bit-vectors and can optionally be used as part of a combined solver that includes one or more other solvers 142 (including, for example, one or more SMT solvers).

[0032] As Figure 1As shown, the automated reasoning service 130 takes as input one or more policies 134 and one or more rules 136 (e.g., public read / write access to storage resources should not be allowed, server-side encryption should be enabled for storage resources, etc.). For example, it can analyze one or more resources and policies in response to a user request, or be automatically performed by one or more services of the cloud provider network. As described in more detail below, the automated reasoning service 130 broadly obtains one or more policies 134 and rules 136 at circles “1A” and “1B”, models the policies 134 and rules 136 as a string theory-based SMT formula 140 using a modeler 138 at circle “2”, and provides the formula 140 to a solver 132 or a combined solver of multiple solvers including a solver 142 at circle “3” to determine the satisfiability of the formula at circle “4”. The automated reasoning service 130 uses the result of the solver 132 (or solver 142) to notify a user or other systems whether the input policy 134 or policies comply with the rules 136, as shown by the findings 144. For example, the findings 144 can alert a user that the policy associated with the user permits public write access to a resource, which may be unintentional, or can provide the findings 144 to one or more downstream components that generate alerts, additional analysis, etc. As shown, the solver 132 generally includes a process of encoding the SMT formula 140 into an equivalent satisfiable propositional formula 146 and determining whether the encoded formula is satisfiable using a SAT solver 148, the details of which are shown in subsequent figures.

[0033] Figure 2 is a diagram showing the generation of a formula expressed in first-order logic according to some examples, the formula corresponding to a policy problem involving policies managed by an identity and access management service of a cloud provider network. As shown, the input to the modeler 138 can include one or more policies (e.g., policy 200 including the shown policy fragment) and one or more rules or questions (e.g., rule 202 indicating the desired conditions of policy 200). In this example, rule 202 indicates that it is desired that policy 200 does not allow public write access to any computing resources managed by policy 200. In general, questions regarding the desired conditions of a policy can include, for example: determining whether public write access to a computing resource is permitted; determining whether unencrypted write access to a computing resource is permitted; determining whether public read access to a computing resource is permitted; or determining whether a secure sockets layer (SSL) request is required to access a computing resource; or comparing the permissions of two policies relative to each other, etc.

[0034] In some examples, the modeler 138 transforms one or more input policies and rules into a formula 204 (or query) involving string theory. These statements can include boolean combinations (AND, OR, NOT), word equations (e.g., x = const and x = y, where x and y are string variables), and regular constraints. In Figure 2 the example of

[0035] Figure 3 a solver for quantifier-free theories of strings and bit vectors is shown to automatically reason about policies and policy consequences in a cloud provider network. Similar to the process described above with respect to Figure 1 the solver 132 initially obtains, at the circle "1" in Figure 3 an SMT formula 300 that models one or more relevant input policies and rules to be verified by the solver 132. Compared to many other types of solvers, the solver 132 solves the query by reducing it to a boolean satisfiability problem, which encodes the formula 300 as a propositional formula and uses a SAT solver 302 to search for solutions in the replacement space.

[0036] In some examples, the solver 132 supports input formulas from the following syntax:

[0037]

[0038] In the above example syntax, denotes any boolean variable, and '?' represents a regular wildcard that accepts any symbol in the alphabet.

[0039] In Figure 3 at the circle "2", the solver 132 initially abstracts the input formula 300 by replacing each atomic formula (or "theory atom", or simply "atom") within the input formula 300 with a new boolean variable. Generally, the solver 132 processes the input formula 300, and each time the solver encounters a new theory atom that the solver 132 has not yet encountered, the solver creates a new boolean variable and replaces the atom with the boolean variable.

[0040] The result of this abstraction process 304 is a boolean abstraction of the input formula 300 and a set of definitions expressed as equivalences in the theory. In some examples, the definitions are encoded based on ideas related to the Plaisted-Greenbaum transformation. For example, by encoding the definitions in this way, the solver 132 can typically consider only one direction of the definition / equivalence (e.g., a single implication d(a) → a or ) instead of both directions.

[0041] Figure 4is a diagram showing the generation of a boolean abstraction of an input formula to be analyzed by a solver. As Figure 4 shown, the process of generating the abstraction 304 starts from the input SMT formula 400, which is, for example, in negation normal form, and based on the formula, the solver 132 generates a boolean abstraction 402 of the input formula and a definition set 404. Each variable in the boolean abstraction 402 represents a constraint on one or more string variables, as shown in the definition set 404. The original SMT formula 400 is equisatisfiable with the conjunction of the boolean abstraction 402 and the conjunction of the definition set 404.

[0042] Returning to Figure 3 , at circle "3", the solver 132 determines the alphabet 306 to be used for the remainder of the solving process. For example, an SMT solver for formulas that contain string variables typically uses Unicode for possible interpretations of the string variables included in the analyzed formula. However, for use by the solver 132 in the context of an analysis strategy, a significantly smaller alphabet (e.g., an alphabet that contains fewer than all possible Unicode characters) is typically sufficient. In some examples, the solver 132 determines the alphabet to be used in the solving process by identifying the set of characters that occur in the problem (e.g., the set of characters that occur in one or more of the input strategies, rules, and resulting formulas) and adding an additional character for each string variable in the formula 300. In some examples, for instance, based on analyzing the characters associated with each string variable in the formula, a separate alphabet can be computed and used for each string variable in the formula 300.

[0043] For example, when fixing a different alphabet for each congruence closure in a conjunctive normal form formula and adding an unused extra character in the case where there is another closure inequality, satisfiability is maintained. Since at most each equality holds in the formula, the alphabet of any closure of a satisfying assignment is a subset of the alphabet of the closure that satisfies all equalities. Thus, the solver 132 computes the alphabet based on the assumption of satisfying all equalities in the formula and adds a single extra character for each variable.

[0044] In some examples, at Figure 3At the circle "4" in, the solver 132 determines 308 initial bounds for the string variables in the formula 300. Although in theory, the replacement of string variables can be of any length, a finite propositional formula can only encode a bounded number of replacements. By restricting the length of each string variable in the formula 300, the solver 132 can simplify the formula to a propositional formula and provide the propositional formula as input to the SAT solver. The initial bounded length assigned to each string variable can be based on the information about the string variable in the formula - for example, if the string variable x is at least partially based on the constraint "abc*", then any valid assignment to the variable x includes at least three characters (i.e., the characters "abc"). More generally, if the constraints involving string variables require the inclusion of some substring in any solution, the length of the string variable must be at least the length of the substring. The solver 132 can use these and other observations to determine the minimum initial bounds for each of the string variables in the formula 300. In some examples, as part of calling the solver 132 to analyze the formula, the user can provide initial bounds to be used as input to the solver 132 (e.g., provided as input to the automated reasoning service 130 or directly to the solver 132).

[0045] In some examples, at the circle "5", the solver 132 encodes 310 the set of definitions in propositional logic for the upper bounds of each of the string variables determined above. For example, again referring to Figure 4 , the solver 132 encodes a definition (e.g., the definition set 404) as a propositional logic statement based on the bounded lengths determined for each of the string variables (e.g., the string variables "x", "y", and "z" in the definition set 404), and each definition in the definition may include one or more string variables. To do this, the solver 132 treats the string variable as a sequence of characters of length n, where n represents the bounded length value determined for the variable (and where each string variable can be associated with the same or different bounded lengths). Each round of encoding causes an incremental call to the SAT solver 302 until in the Nth round, the solver 132 determines whether the encoding for the current length bounds is satisfiable or unsatisfiable, even if the solver 132 further increases the bounds.

[0046] For example, the encoding process generally involves converting a definition of a Boolean abstraction (e.g., the definition set 404) into a propositional formula that is satisfiable if and only if the corresponding theory predicate is satisfiable for the bounded lengths of the string variables. For each definition (or vice versa ), the solver 132 encodes the theory literal a (or ) as a propositional formula (conjunctive normal form), and the variable d(a) (or ) are assigned to all clauses. The combination of the encoded definition and the Boolean abstraction of the input formula is then provided to the SAT solver 302.

[0047] In some examples, the SAT solver 302 performs a conflict-driven clause learning (CDCL(T)) process in a single step, that is, the SAT solver 302 searches for a Boolean framework model that is consistent with (the encoding of) all predicates. Therefore, if the SAT solver 302 finds a model for the formula, then the input formula is also satisfiable (and therefore, if the SAT solver 302 returns a SAT result value 312, the solver 132 returns a SAT result 314). Otherwise, if the formula is UNSAT (e.g., the SAT solver 302 returns an UNSAT result value 318), then the corresponding bounded length of the string variable in that round is only UNSAT. In this case, the solver 132 analyzes 316 the UNSAT kernel generated by the SAT solver 302 to determine which predicates conflict and cause unsatisfiability. If the bounded length of the variable involved does not exceed the upper bound of the unsatisfiable predicate, the solver 132 increases 320 the length value of the variable and attempts to solve the problem in a larger search space (e.g., by again generating 310 a new encoding for the updated bounded length and calling the SAT solver 302 on the updated encoding).

[0048] More formally, solver 132 lets b k : Indicates For convenience, the solver 132 defines b0:Γ→{1} as a function of constant 1. Therefore, the solver uses the corresponding bounds b1, ..., b n Run n rounds so that for all k∈0..n–1: b k (x)≤b k+1 (x); and there exists at least one x∈Γ where b k (x) k +1(x). A round ends with an incremental call to the SAT solver 302 until, in round n, even if the bound is further increased, for b n The encoding of is either satisfiable or unsatisfiable.

[0049] For a literal a∈literals(ψ), the solver uses To refer to the upper bound b k The set of clauses generated by encoding a. In addition, for rounds k and k′, where k′ <k,假设 Already encoded, the solver uses To express the use of upper bound b k encodes a. That is, the solver ensures that ​stand, and the incremental encoding is correct. If the boundaries of the context are clear, it can be expressed more simply using In addition, sometimes the encoding of the solver introduces clauses that are valid only for a specific boundary b k but become invalid in a later round b k′ Since the interface of the SAT solver 302 may not allow clauses to be deleted, the solver 132 can introduce selector variables. Here, the selector variable is a new unused boolean variable s, whose negation is distributed over the clause set. For each incremental call that uses s as an assumption, it has no impact on the satisfiability of the clauses. In the incremental call that removes s from the assumption, all clauses trivially become satisfiable. The solver assumption (l) bk(x) means that the literal l is used as an assumption until the first round k′, where b k (x) < b k ′(x).

[0050] To perform string variable substitution, given a boundary n and an alphabet A, the solver 132 uses a new symbol λ not in A, and a string s of length k less than or equal to n is encoded as s.λ n-k . In this way, string variables of length no more than n are encoded as words of n characters over A ∪ {λ}. For example, in any given iteration of the solving process, the SAT solver 302 tries to find a solution that reaches the boundary for the given variables. Now that the solver 132 has string variables with an alphabet and a fixed length, the solver 132 then converts each string variable into a set of boolean variables. Thus, if there are n characters and the alphabet size is |A|, the solver 132 uses n(|A| + 1) boolean variables for each string. In some examples, the encoding of the string variables includes using one-hot propositional encoding for each character.

[0051] For example, assume that the string variable x is associated with a bounded length value of 5. Then, for each position in the string variable (i.e., at each of the character positions x0, x1, x2, x3, and x4), the solver 132 introduces a set of boolean variables and asserts that only one variable in the set is assigned true. And since the solver 132 has finitely bounded the length of the string variable and the alphabet is finite, the possible set of character assignments for the string is finite.

[0052] Then, the solver 132 encodes the constraints expressed in the formula. As described above, the types of constraints expressed in the formula can include, for example, regular expressions, equalities between variables, equalities between variables and constants, prefixes of constraints, suffixes of constraints, substrings of constraints, etc.

[0053] In some examples, encoding a regular expression constraint (e.g., x ∈ R) involves converting the regular expression to a non-deterministic finite automaton (NFA) and optionally removing any ε (epsilon) transitions. The constraint x ∈ R is then encoded as reachability of a final state in the NFA (e.g., determining whether the NFA recognizes a string is a reachability problem). Notably, this process also applies to negation. More formally, for a regular constraint x ∈ R (or its negation), the solver 132 compiles an NFA M that accepts R and additionally allows λ self-transitions on each state (e.g., allowing λ substitution). The solver 132 also includes specialized encodings for other types of constraints, such as equalities, constraint prefixes, etc.

[0054] In some examples, at circle “6”, the SAT solver 302 searches for a model consistent with the defined set. As previously mentioned, the SAT solver intuitively performs the CDCL(T) process in a single step, that is, it searches for a Boolean framework model consistent with the encoding of all predicates. Thus, if the SAT solver 302 finds a model for the formula, the input formula 300 is also satisfiable.

[0055] Otherwise, if the formula is unsatisfiable, it is only unsatisfiable with respect to the current bounds. In some examples, at circle “7”, the solver 132 analyzes the UNSAT core to identify which theory literals are part of the unsatisfiable subformula for the current bounds. These theory literals are analyzed to determine whether the formula is unsatisfiable regardless of what bounds are set. If the bounds on the variables involved do not exceed the upper bound of the unsatisfied predicates, the solver 132 increases the variable bounds and attempts to solve the problem in a larger search space.

[0056] If it is determined to increase the bounds of one or more of the string variables, at circle “8”, the current bounds of the identified theory literals are increased. This process also involves, if possible, determining the upper bounds of one or more string variables. For example, the upper bound of a variable can be inferred by observation: if x ∈ R has a solution, it also has a solution h where |h(x)| is less than or equal to the number of states in the NFA that accepts R. Conversely, if the SAT solver 302 does not find a solution with the bound x equal to the number of states, it can be determined that there is no solution. This idea applies to the conjunction of predicates (or the intersection of regular languages) that lead to an UNSAT result.

[0057] In some examples, the solver 132 collects the predicates marked as failed in circle “7” and partitions these predicates by their equivalence classes. That is, in the conflicting atoms, each string variable has a set of atoms, and if If the atomic failure of the form (where x and y are string variables), the sets of x and y will be merged into a single set. In another step, the solver 132 computes the maximum exact upper bound for each partition (or equivalence class) in part by: computing the power set of the partition; for each set in the power set, computing the NFA of the intersection of all the atoms contained therein; and finding the number of states of the maximum NFA.

[0058] If the concatenation of the failed atoms (per class) has a solution, it also has a solution with a length strictly less than the inferred maximum upper bound. Thus, once the maximum upper bound is found, the solver 132 checks which variables in the class currently have a filled value strictly less than the said upper bound. For those variables, the solver 132 increases the bounds for the next round. If there are no variables in the closure with a bound less than the maximum upper bound, increasing the bounds cannot make the atoms and the associated clauses satisfiable, then the solver 132 returns UNSAT (e.g., if the maximum length 322 is reached, the solver 132 will return the UNSAT result 324). If the bounds of at least one variable are increased, the solver 132 backtracks to the encoding process 310 and runs the said process again. In some examples, the upper bound can be provided as user input when calling the solver, or as a default upper bound for multiple calls to the solver 132.

[0059] In some examples, Figure 3 The loop shown by the circles "5" (generate encoding 310), "6" (call SAT solver 302), "7" (analyze 316 UNSAT core in response to the current encoding being determined as UNSAT 318 by the SAT solver 302), and "8" (update bounds 320) in uses incremental SAT solving. For example, when the solver 132 generates a SAT encoding for the increased bounds, only the new clauses are added to the SAT solver 302 via the incremental interface. As described above, the process is repeated until the solver can return SAT (e.g., SAT result 314), or it is found that further increasing the bounds cannot make the formula satisfiable, in which case it returns UNSAT (e.g., UNSAT result 324).

[0060] In some examples, the discovery result 144 returned by the solver 132 (or other combined solver 142) can be used in various ways. As an example, the automated reasoning service 130 can display information about the discovery result in a web-based console or other interface to indicate to the user, for example, one or more security or operational issues related to the current configuration of the user's policy. The discovery result 144 can also be used by the automated reasoning service 130, or provided to another component of the other service or provider network 100, and used to generate one or more recommendations to modify the user's policy to address one or more identified security or operational issues.

[0061] Figure 5 is a flowchart showing operation 500 of a method for analyzing policies and policy consequences of a cloud provider network using a SAT-based solver for a quantifier-free theory of strings and bit vectors. Some or all of operation 500 (or other processes described herein, or variations and / or combinations thereof) are performed under the control of one or more computer systems configured with executable instructions and are implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) that collectively execute on one or more processors. The code is stored, for example, in the form of a computer program including instructions executable by one or more processors on a computer-readable storage medium. The computer-readable storage medium is non-transitory. In some examples, one or more (or all) of operation 500 are performed by the automated reasoning service 130 of other figures.

[0062] At block 502, operation 500 includes obtaining, by a solver used by an automated reasoning service of a cloud provider network, a formula that includes one or more string variables, where the formula pertains to a question of a desired condition regarding policies managed by an identity and access management service of the cloud provider network.

[0063] At block 504, operation 500 further includes determining, for each of the one or more string variables, a corresponding length value that indicates a bounded length of possible assignments to the string variable.

[0064] Operation 500 further includes, at block 506, generating a propositional encoding of the formula for the corresponding length value of at least one of the one or more string variables.

[0065] At block 508, operation 500 further includes calling a SAT solver for the propositional encoding of the formula for the corresponding length value of at least one of the one or more string variables to obtain a result value indicating whether the formula is satisfiable or unsatisfiable.

[0066] At block 510, operation 500 further includes providing the result value to another component of the automated reasoning service.

[0067] In some examples, operation 500 further includes determining an alphabet for the propositional encoding of each atomic formula within a first-order logic formula, where the alphabet includes characters that appear in the first-order logic formula and additional characters (e.g., each variable); and where the propositional encoding of each atomic formula within the first-order logic formula is generated for the alphabet.

[0068] In some examples, the result value indicates that the formula is unsatisfiable, and the operations further include: obtaining an unsatisfiable core of the formula from a SAT solver, where the unsatisfiable core of the formula includes a subset of the atomic formulas of the formula; identifying a subset of one or more string variables in the unsatisfiable core; determining, for each string variable in the subset of string variables, an updated bounded length by increasing a corresponding bounded length currently assigned to the string variable; obtaining an updated propositional encoding of the formula based on the respective updated bounded lengths of each string variable in the subset of one or more string variables; and invoking a SAT solver on the updated propositional encoding of the formula.

[0069] In some examples, a string variable among the one or more string variables is part of an atomic formula that includes a regular expression, and the operations further include: converting the atomic formula that includes the regular expression constraint into a non-deterministic finite automaton (possibly without ε-transitions).

[0070] In some examples, determining the respective length values of the string variables includes iterating through the string predicates of the string variables and determining the length of the smallest word that satisfies the string predicate.

[0071] In some examples, invoking a SAT solver on the updated propositional encoding of the formula includes using the incremental solving feature of the SAT solver.

[0072] In some examples, the result value indicates that a first-order logic formula is unsatisfiable, and operation 500 further includes: obtaining an unsatisfiable core of the formula from a SAT solver, where the unsatisfiable core of the formula includes a subset of the atomic formulas of the first-order logic formula; identifying a subset of one or more string variables in the unsatisfiable core; for each string variable of the subset, determining that an upper bound of each string variable of the subset has been reached; and determining that the first-order logic formula is unsatisfiable.

[0073] In some examples, questions regarding desired conditions of a policy include at least one of the following items: determining whether to permit public write access to computing resources; determining whether to permit unencrypted write access to computing resources; determining whether to permit public read access to computing resources; or determining whether a Secure Sockets Layer (SSL) request is required to access computing resources; or comparing the permissions of two policies relative to each other.

[0074] In some examples, the operations further include receiving an input indicating an initial length value used by one or more string variables in the formula; and wherein determining the respective length values that indicate bounded lengths of possible assignments to the string variables is based on the input indicating the initial length values.

[0075] In some examples, operation 500 also includes causing information indicating whether the policy meets the desired conditions of the policy to be displayed.

[0076] In some examples, operation 500 also includes generating a recommendation related to the policy based on the result value, where the recommendation identifies potential modifications to the policy.

[0077] In some examples, operation 500 also includes receiving a user-specified input indicating an upper bound.

[0078] In some examples, operation 500 also includes receiving a user-specified input indicating an upper bound to be used by the solver.

[0079] Figure 6 An example provider network (or "service provider system") environment according to some examples is shown. Provider network 600 can provide resource virtualization to customers via one or more virtualization services 610, and the one or more virtualization services allow customers to purchase, lease, or otherwise obtain instances 612 of virtualized resources (including but not limited to computing resources and storage resources) implemented on devices within one or more provider networks in one or more data centers. A local Internet Protocol (IP) address 616 can be associated with the resource instance 612; the local IP address is the internal network address of the resource instance 612 on the provider network 600. In some examples, the provider network 600 can also provide a public IP address 614 and / or a public IP address range (e.g., Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6) addresses) that customers can obtain from the provider 600.

[0080] Conventionally, a provider network 600 may, via virtualization services 610, allow a customer of a service provider (e.g., a customer operating one or more customer networks 650A - 650C (or “client networks”) including one or more customer devices 652) to dynamically associate at least some public IP addresses 614 allocated or assigned to the customer with a particular resource instance 612 assigned to the customer. The provider network 600 may also allow the customer to remap a public IP address 614 previously mapped to a virtualized computing resource instance 612 assigned to the customer to another virtualized computing resource instance 612 also assigned to the customer. Using the virtualized computing resource instances 612 and public IP addresses 614 provided by the service provider, a customer of the service provider, such as an operator of customer networks 650A - 650C, may, for example, implement customer - specific applications and present the customer's applications on an intermediate network 640 (such as the Internet). Then, other network entities 620 on the intermediate network 640 may generate traffic to the destination public IP addresses 614 published by customer networks 650A - 650C; the traffic is routed to the service provider data center and, at the data center, is routed via the network substrate to the local IP address 616 of the virtualized computing resource instance 612 currently mapped to the destination public IP address 614. Similarly, response traffic from the virtualized computing resource instances 612 may be routed back via the network substrate to the source entity 620 on the intermediate network 640.

[0081] As used herein, a local IP address refers to, for example, an internal or “private” network address of a resource instance in a provider network. The local IP address may be within an address block reserved by Request for Comments (RFC) 1918 of the Internet Engineering Task Force (IETF) and / or have an address format specified by IETF RFC 4193, and may be variable within the provider network. Network traffic originating outside the provider network is not directly routed to the local IP address; rather, the traffic uses the public IP address mapped to the local IP address of the resource instance. The provider network may include networking devices or apparatuses that provide network address translation (NAT) or similar functionality to perform the mapping from the public IP address to the local IP address and from the local IP address to the public IP address.

[0082] A public IP address is an Internet - variable network address assigned to a resource instance by a service provider or a customer. Traffic is routed, for example, via a 1:1 NAT translation to the public IP address and forwarded to the corresponding local IP address of the resource instance.

[0083] Some public IP addresses can be allocated by a provider network infrastructure to specific resource instances; these public IP addresses can be referred to as standard public IP addresses, or simply standard IP addresses. In some examples, the mapping of a standard IP address to the local IP address of a resource instance is the default boot configuration for all resource instance types.

[0084] At least some public IP addresses can be allocated to or obtained by a customer of provider network 600; the customer can then allocate its allocated public IP address to a specific resource instance allocated to the customer. These public IP addresses can be referred to as customer public IP addresses, or simply customer IP addresses. Instead of being allocated to a resource instance by provider network 600 as in the case of standard IP addresses, a customer IP address can be allocated to a resource instance by the customer, e.g., via an API provided by a service provider. Different from standard IP addresses, a customer IP address is allocated to a customer account and can be remapped to other resource instances by the corresponding customer as needed or desired. A customer IP address is associated with a customer account rather than a specific resource instance, and the customer controls the IP address until the customer chooses to release the IP address. Different from a conventional static IP address, a customer IP address allows a customer to mask a resource instance or availability zone failure by remapping the customer's public IP address to any resource instance associated with the customer account. For example, a customer IP address enables a customer to resolve an issue with the customer's resource instance or software by remapping the customer IP address to an alternative resource instance.

[0085] Figure 7 FIG. 7 is a block diagram of an example provider network environment that provides storage services and hardware virtualization services to a customer according to some examples. Hardware virtualization service 720 provides a customer with multiple computing resources 724 (e.g., computing instances 725 such as VMs). Computing resources 724 can be provided as a service, e.g., to a customer of provider network 700 (e.g., a customer implementing customer network 750). Each computing resource 724 can be provided with one or more local IP addresses. Provider network 700 can be configured to route packets from the local IP address of computing resource 724 to a public Internet destination, and to route packets from a public Internet source to the local IP address of computing resource 724.

[0086] A provider network 700 may provide the ability to implement a virtual computing system 792 via a hardware virtualization service 720 for a customer network 750, which is coupled to an intermediate network 740, for example, via a local network 756. In some examples, the hardware virtualization service 720 may provide one or more APIs 702, such as a web service interface, via which the customer network 750 may access functions provided by the hardware virtualization service 720, for example, via a console 794 of a customer device 790 (e.g., a web-based application, a stand-alone application, a mobile application, etc.). In some examples, at the provider network 700, each virtual computing system 792 at the customer network 750 may correspond to computing resources 724 that are leased, rented, or otherwise provided to the customer network 750.

[0087] From an instance of the virtual computing system 792 and / or another customer device 790 (e.g., via the console 794), a customer may access functions of the storage service 710, for example, via one or more APIs 702, to access data from storage resources 718A to 718N of a virtualized data repository 716 (e.g., a folder or "bucket", a virtualized volume, a database, etc.) provided by the provider network 700 and to store data into the storage resources. In some examples, a virtualized data storage gateway (not shown) may be provided at the customer network 750, which may locally cache at least some data (e.g., frequently accessed data or critical data) and may communicate with the storage service 710 via one or more communication channels to upload new or modified data from the local cache, such that a primary data repository (the virtualized data repository 716) is maintained. In some examples, a user may install and access volumes of the virtualized data repository 716 via the storage service 710, which acts as a storage virtualization service, via the virtual computing system 792 and / or another customer device 790, and these volumes may appear to the user as local (virtualized) storage 798.

[0088] Although Figure 7 not shown in the figure, virtualization services may also be accessed from resource instances within the provider network 700 via the API 702. For example, a customer, a device service provider, or other entity may access virtualization services from within a corresponding virtual network on the provider network 700 via the API 702 to request allocation of one or more resource instances within the virtual network or within another virtual network.

[0089] In some examples, a system implementing some or all of the techniques described herein may include a general-purpose computer system (such as Figure 8The computer system 800 shown, the general computer system includes or is configured to access one or more computer-accessible media. In the example shown, the computer system 800 includes one or more processors 810 coupled to the system memory 820 via an input / output (I / O) interface 830. The computer system 800 also includes a network interface 840 coupled to the I / O interface 830. Although Figure 8 the computer system 800 is shown as a single computing device, in various examples, the computer system 800 may include one computing device or any number of computing devices configured to work together as a single computer system 800.

[0090] In various examples, the computer system 800 can be a single-processor system including one processor 810 or a multi-processor system including several processors 810 (e.g., two, four, eight, or another suitable number). The processor 810 can be any suitable processor capable of executing instructions. For example, in various examples, the processor 810 can be a general-purpose or embedded processor implementing any one of various instruction set architectures (ISAs) (such as, x86, ARM, PowerPC, SPARC, or MIPS ISA or any other suitable ISA). In a multi-processor system, each of the processors 810 often but not necessarily implements the same ISA.

[0091] The system memory 820 can store instructions and data accessible by the processor 810. In various examples, the system memory 820 can be implemented using any suitable memory technology, such as random access memory (RAM), static RAM (SRAM), synchronous dynamic RAM (SDRAM), non-volatile / flash-type memory, or any other type of memory. In the example shown, the program instructions and data implementing one or more desired functions (such as those methods, techniques, and data described above) are shown as stored in the system memory 820 as the automated reasoning service code 825 (e.g., executable to fully or partially implement the automated reasoning service 130) and data 826.

[0092] In some examples, I / O interface 830 may be configured to coordinate I / O traffic between processor 810, system memory 820, and any peripheral devices in the device, including network interface 840 and / or other peripheral interfaces (not shown). In some examples, I / O interface 830 may perform any necessary protocol, timing, or other data transformations to convert a data signal from one component (e.g., system memory 820) into a format suitable for use by another component (e.g., processor 810). In some examples, for instance, I / O interface 830 may include support for devices attached via various types of peripheral buses, such as variants of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard. In some examples, for instance, the functionality of I / O interface 830 may be split into two or more separate components, such as a north bridge and a south bridge. Additionally, in some examples, some or all of the functionality of I / O interface 830 (such as the interface to system memory 820) may be incorporated directly into processor 810.

[0093] For example, network interface 840 may be configured to permit the exchange of data between computer system 800 and other devices 860 attached to one or more networks 850, such as Figure 1 other computer systems or devices as shown. In various examples, for instance, network interface 840 may support communication via any suitable wired or wireless general data network, such as various types of Ethernet networks. Additionally, network interface 840 may support communication via a telecommunications / telephone network, such as an analog voice network or a digital fiber-optic communication network, via a storage area network (SAN), such as a Fibre Channel SAN, and / or via any other suitable type of network and / or protocol.

[0094] In some examples, computer system 800 includes one or more offload cards 870A or 870B (including one or more processors 875 and possibly including one or more network interfaces 840), and the one or more offload cards are connected using an I / O interface 830 (e.g., a version of the Peripheral Component Interconnect Express (PCI-E) standard or a bus of another interconnect such as QuickPath Interconnect (QPI) or UltraPath Interconnect (UPI)). For example, in some examples, computer system 800 may act as a host electronic device that hosts computing resources such as computing instances (e.g., operating as part of a hardware virtualization service), and one or more offload cards 870A or 870B execute a virtualization manager that can manage the computing instances executed on the host electronic device. As an example, in some examples, offload cards 870A or 870B may perform computing instance management operations such as pausing and / or unpausing a computing instance, starting and / or terminating a computing instance, performing memory transfer / copy operations, etc. In some examples, these management operations may be performed by offload cards 870A or 870B in cooperation with a hypervisor (e.g., in response to a request from the hypervisor) executed by other processors 810A to 810N of computer system 800. However, in some examples, the virtualization manager implemented by offload cards 870A or 870B may accommodate requests from other entities (e.g., from the computing instance itself) and may not cooperate with (or serve) any separate hypervisor.

[0095] In some examples, system memory 820 can be an example of a computer-accessible medium configured to store program instructions and data as described above. However, in other examples, program instructions and / or data may be received, sent, or stored on different types of computer-accessible media. Generally, computer-accessible media can include any non-transitory storage medium or memory medium, such as magnetic or optical media, e.g., a disk or DVD / CD coupled to computer system 800 via I / O interface 830. Non-transitory computer-accessible storage media can also include any volatile or non-volatile media that may be included as system memory 820 or another type of memory in some examples of computer system 800, such as RAM (e.g., SDRAM, Double Data Rate (DDR) SDRAM, SRAM, etc.), read-only memory (ROM), etc. Additionally, computer-accessible media can include a transmission medium or a signal transmitted via a communication medium (such as a network and / or a wireless link), such as an electrical signal, an electromagnetic signal, or a digital signal, where the communication medium can be implemented via network interface 840.

[0096] The various examples discussed or presented herein can be implemented in a variety of operating environments, and in some cases, the operating environments may include one or more user computers, computing devices, or processing devices that can be used to operate any of a number of applications. The user device or client device can include any of a number of general-purpose personal computers, such as a desktop computer or laptop computer running a standard operating system, as well as cellular devices, wireless devices, and handheld devices that run mobile software and are capable of supporting a number of networking and messaging protocols. Such systems can also include a number of workstations that run various commercially available operating systems and any of a number of other known applications for purposes such as development and database management. These devices can also include other electronic devices, such as dumb terminals, thin clients, gaming systems, and / or other devices capable of communicating over a network.

[0097] Most examples use at least one network familiar to those skilled in the art to support communication using any of a variety of widely available protocols, such as Transmission Control Protocol / Internet Protocol (TCP / IP), File Transfer Protocol (FTP), Universal Plug and Play (UPnP), Network File System (NFS), Common Internet File System (CIFS), Extensible Messaging and Presence Protocol (XMPP), AppleTalk, etc. The network can include, for example, a local area network (LAN), a wide area network (WAN), a virtual private network (VPN), the Internet, an intranet, an extranet, a public switched telephone network (PSTN), an infrared network, a wireless network, and any combination thereof.

[0098] In examples using a web server, the web server can run any of a variety of server or middle-tier applications, including an HTTP server, a File Transfer Protocol (FTP) server, a Common Gateway Interface (CGI) server, a data server, a Java server, a business application server, etc. The server may also be capable of executing programs or scripts in response to requests from user devices, such as by executing one or more web applications that can be implemented as one or more scripts or programs written in any programming language (such as C, C#, or C++) or any scripting language (such as Perl, Python, PHP, or TCL) and combinations thereof. The server can also include a database server, including but not limited to database servers commercially available from Oracle(R), Microsoft(R), Sybase(R), IBM(R), etc. The database server can be relational or non-relational (e.g., “NoSQL”), distributed or non-distributed, etc.

[0099] The environments disclosed herein may include various data repositories as well as other memories and storage media as discussed above. These may reside in various locations, such as on (and / or within) storage media local to one or more computers, or on storage media remote from any or all of the computers on a network. In a particular set of examples, the information may reside in a storage area network (SAN) familiar to those skilled in the art. Similarly, any necessary files for performing the functions attributed to a computer, server, or other network device may be stored locally and / or remotely as appropriate. In cases where the system includes computerized devices, each such device may include hardware elements electrically coupled via a bus, the elements including, for example, at least one central processing unit (CPU), at least one input device (e.g., a mouse, keyboard, controller, touchscreen, or keypad), and / or at least one output device (e.g., a display device, printer, or speaker). Such a system may also include one or more storage devices, such as hard disk drives, optical storage devices, and solid-state storage devices such as random access memory (RAM) or read-only memory (ROM), as well as removable media devices, memory cards, flash cards, etc.

[0100] Such devices may also include a computer-readable storage medium reader, a communication device (e.g., a modem, network card (wireless or wired), infrared communication device, etc.), and working memory as described above. The computer-readable storage medium reader may be connected to or configured to receive a computer-readable storage medium, which represents a remote, local, fixed, and / or removable storage device and storage medium for temporarily and / or more permanently containing, storing, transmitting, and retrieving computer-readable information. The system and various devices will generally also include many software applications, modules, services, or other elements located within at least one working memory device, including an operating system and application programs, such as client applications or web browsers. It should be understood that alternative examples may have many variations different from those described above. For example, custom hardware may also be used, and / or certain elements may be implemented in hardware, software (including portable software, such as applets), or both. Additionally, connections to other computing devices such as network input / output devices may be employed.

[0101] Storage media and computer-readable media for accommodating code or portions of code can include any suitable media known or used in the art, including storage media and communication media, such as but not limited to volatile and non-volatile media, removable and non-removable media implemented by any method or technology for storing and / or transmitting information (such as computer-readable instructions, data structures, program modules, or other data), including RAM, ROM, electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic tape cartridges, tapes, magnetic disk storage or other magnetic storage devices, or any other media that can be used to store the desired information and can be accessed by a system device. Based on the present disclosure and the teachings provided herein, those of ordinary skill in the art will understand other ways and / or methods of implementing the various examples.

[0102] In the foregoing description, various examples have been described. For purposes of explanation, specific configurations and details have been set forth in order to provide a thorough understanding of the examples. However, it will also be apparent to those skilled in the art that the examples may be practiced without these specific details. Additionally, well-known features may be omitted or simplified in order not to obscure the described examples.

[0103] In this document, bracketed text and boxes with dashed borders (e.g., em dashes, en dashes, dot dashes, and dots) are used to illustrate optional aspects of adding additional features to some examples. However, such notation should not be construed to mean that these are the only options or optional operations, and / or that in some examples, boxes with solid borders are not optional.

[0104] Reference numerals with suffix letters (e.g., 718A through 718N) can be used to indicate one or more instances of the entity mentioned in various examples, and when multiple instances exist, each instance need not be the same, but may share some general characteristics or operate in a common form. Additionally, unless explicitly indicated to the contrary, the particular suffix used does not imply the existence of a specific quantity of the entity. Thus, in various examples, two entities with the same or different suffix letters may or may not have the same number of instances.

[0105] Reference to "an example", "examples", etc. indicates that the described examples may include a particular feature, structure, or characteristic, but each example may not necessarily include the particular feature, structure, or characteristic. Additionally, such phrases do not necessarily refer to the same example. Moreover, when a particular feature, structure, or characteristic is described in connection with an example, it should be considered that implementing such feature, structure, or characteristic in connection with other examples is also within the knowledge of those skilled in the art, whether or not explicitly described.

[0106] In addition, in the various examples described above, unless otherwise specifically indicated, disjunctive language such as the phrase "at least one of A, B, or C" is intended to be understood to mean A, B, or C, or any combination thereof (e.g., A, B, and / or C). Similarly, language such as "at least one or more of A, B, and C" (or "one or more of A, B, and C") is intended to be understood to mean A, B, or C, or any combination thereof (e.g., A, B, and / or C). Thus, disjunctive language is not intended nor should it be understood to imply that each of at least one of A, at least one of B, and at least one of C must be present in a given example.

[0107] As used herein, the term "based on" (or similar) is an open-ended term used to describe one or more factors that affect a determination or other action. It should be understood that the term does not exclude additional factors that may affect the determination or action. For example, a determination may be based solely on the listed factors or on the stated factors and one or more additional factors. Thus, if action A is "based on" B, it should be understood that B is one factor that affects action A, but this does not exclude the action also being based on one or more other factors, such as factor C. However, in some cases, action A may be based entirely on B.

[0108] Unless otherwise explicitly stated, articles such as "a / an" should generally be interpreted to include one or more of the described items. Thus, phrases such as "a device configured to..." or "a computing device" are intended to include one or more of the recited devices. Such one or more of the recited devices may be jointly configured to perform the stated operations. For example, "a processor configured to perform operations A, B, and C" may include a first processor configured to perform operation A working in conjunction with a second processor configured to perform operations B and C.

[0109] At least some embodiments of the disclosed technology may be described in view of the following clauses:

[0110] 1. A computer-implemented method, comprising:

[0111] generating, by an automated reasoning service of a cloud provider network, a first-order logic formula, wherein the first-order logic formula is generated based on policies managed by an identity and access management service of the cloud provider network and based on rules, wherein the rules represent desired conditions of the policies, and wherein the first-order logic formula includes one or more string variables;

[0112] generating a boolean abstraction of the first-order logic formula, wherein the boolean abstraction of the first-order logic formula includes one or more boolean variables, each boolean variable representing an atomic formula of the first-order logic formula;

[0113] Determine a respective length value for each of the one or more string variables, the respective length value indicating a bounded length of possible string assignments to the string variable;

[0114] Generate a propositional encoding of each atomic formula within the first-order logic formula based on the respective length value of each string variable;

[0115] Invoke a SAT solver on the boolean abstraction of the first-order logic formula and the propositional encoding of each atomic formula in the first-order logic formula to obtain a result value, the result value indicating whether the first-order logic formula is satisfiable or unsatisfiable for the respective length values of each string variable;

[0116] Based on the result value, determine whether the policy meets the desired conditions of the policy expressed by the rule; and

[0117] Cause information indicating whether the policy meets the desired conditions of the policy expressed by the rule to be displayed.

[0118] 2. The computer-implemented method as described in clause 1, wherein the result value indicates that the first-order logic formula is unsatisfiable for the respective length values of each string variable, and wherein the method further comprises:

[0119] Obtain an unsatisfiability core of the first-order logic formula from the SAT solver, wherein the unsatisfiability core of the first-order logic formula comprises a subset of the atomic formulas of the first-order logic formula;

[0120] Identify a subset of the one or more string variables in the first-order logic formula within the unsatisfiability core;

[0121] Determine an updated bounded length for each string variable in the subset of the one or more string variables by increasing the currently assigned bounded length to the string variable;

[0122] Obtain an updated propositional encoding of the first-order logic formula based on the respective updated bounded lengths of each string variable in the subset of the one or more string variables; and

[0123] Invoke the SAT solver on the updated propositional encoding of the first-order logic formula.

[0124] 3. The computer-implemented method as described in any one of clauses 1 or 2, further comprising:

[0125] Determine an alphabet for the proposition encoding of each atomic formula within the first-order logic formula, where the alphabet includes the characters appearing in the first-order logic formula and includes additional characters; and

[0126] where generating the proposition encoding of each atomic formula within the first-order logic formula is performed for the alphabet.

[0127] 4. A computer-implemented method, comprising:

[0128] Obtain a formula including one or more string variables by a solver used by an automated reasoning service of a cloud provider network, where the formula pertains to a question regarding a desired condition of a policy managed by an identity and access management service of the cloud provider network;

[0129] Determine a corresponding length value for at least one of the one or more string variables, where the corresponding length value indicates a bounded length of possible assignments to the string variable;

[0130] Generate a proposition encoding of the formula for the corresponding length value of at least one of the one or more string variables;

[0131] For the corresponding length value of at least one of the one or more string variables, call a SAT solver for the proposition encoding of the formula to obtain a result value indicating whether the formula is satisfiable or unsatisfiable; and

[0132] Provide the result value to another component of the automated reasoning service.

[0133] 5. The computer-implemented method according to clause 4, where the result value indicates that the formula is unsatisfiable, and where the method further comprises:

[0134] Obtain an unsatisfiability core of the formula from the SAT solver, where the unsatisfiability core of the formula includes a subset of the atomic formulas of the formula;

[0135] Identify a subset of the one or more string variables in the formula within the unsatisfiability core;

[0136] Determine an updated bounded length for each string variable in the subset of the one or more string variables by increasing the currently assigned bounded length to the string variable;

[0137] Obtain an updated proposition encoding of the formula based on the corresponding updated bounded length of each string variable in the subset of the one or more string variables; and

[0138] The updated propositional encoding of the formula invokes the SAT solver.

[0139] 6. The computer-implemented method according to any one of clauses 4 or 5, further comprising:

[0140] Determining an alphabet for the propositional encoding of each atomic formula within the formula, wherein the alphabet includes the characters occurring in the formula and includes additional characters; and

[0141] wherein generating the propositional encoding of each atomic formula within the formula is performed for the alphabet.

[0142] 7. The computer-implemented method according to any one of clauses 4 to 6, wherein the string variable among the one or more string variables is part of an atomic formula containing a regular expression constraint, and wherein the method further comprises: converting the atomic formula containing the regular expression constraint into a non-deterministic finite automaton.

[0143] 8. The computer-implemented method according to any one of clauses 4 to 7, wherein determining the respective length values of the string variables comprises: iterating the string predicates of the string variables and determining the length of the smallest word that satisfies the string predicates.

[0144] 9. The computer-implemented method according to any one of clause 5, wherein invoking the SAT solver for the updated propositional encoding of the formula comprises: using the incremental solving function of the SAT solver.

[0145] 10. The computer-implemented method according to any one of clauses 4 to 9, wherein the result value indicates that the formula is unsatisfiable, and wherein the method further comprises:

[0146] Obtaining an unsatisfiability core of the formula from the SAT solver, wherein the unsatisfiability core of the formula includes a subset of the atomic formulas of the formula;

[0147] Identifying a subset of the one or more string variables in the formula within the unsatisfiability core;

[0148] For each string variable of the subset, determining that an upper bound of each string variable of the subset has been reached; and

[0149] Determining that the formula is unsatisfiable.

[0150] 11. A computer-implemented method as described in any one of clauses 4 to 10, wherein the question of the desired conditions regarding the policy includes at least one of the following: determining whether to permit public write access to computing resources; determining whether to permit unencrypted write access to computing resources; determining whether to permit public read access to computing resources; or determining whether a Secure Sockets Layer (SSL) request is required to access computing resources; or comparing the permissions of two policies relative to each other.

[0151] 12. A computer-implemented method as described in any one of clauses 4 to 11, further comprising:

[0152] receiving an input indicating an initial length value for use of one or more string variables in the formula; and

[0153] wherein determining the corresponding length value indicating a bounded length of a possible assignment to the string variable is based on the input indicating the initial length value.

[0154] 13. A computer-implemented method as described in clause 10, further comprising: receiving a user-specified input indicating an upper bound to be used by the solver.

[0155] 14. A computer-implemented method as described in any one of clauses 4 to 13, further comprising: causing information indicating whether the policy meets the desired conditions of the policy to be displayed.

[0156] 15. A computer-implemented method as described in any one of clauses 4 to 14, further comprising:

[0157] generating a recommendation related to the policy based on the result value, wherein the recommendation identifies potential modifications to the policy; and

[0158] causing the recommendation to be displayed.

[0159] 16. A system, comprising:

[0160] One or more first electronic devices for implementing an automated reasoning service in a multi-tenant provider network, wherein the automated reasoning service includes instructions that, when executed, cause the automated inference service to:

[0161] generate a first-order logic formula, wherein the first-order logic formula is generated based on a policy managed by an identity and access management service of a cloud provider network and based on rules, wherein the rules represent desired conditions of the policy, and wherein the first-order logic formula includes one or more string variables; and

[0162] A second one or more electronic devices for implementing an automated reasoning solver in the multi-tenant provider network, wherein the automated reasoning solver includes instructions that, when executed, cause the automated reasoning service to:

[0163] Generate a Boolean abstraction of the first-order logic formula, wherein the Boolean abstraction of the first-order logic formula includes one or more Boolean variables, each Boolean variable representing an atomic formula of the first-order logic formula;

[0164] Determine a corresponding length value for each string variable among the one or more string variables, the corresponding length value indicating a bounded length of possible string assignments to the string variable;

[0165] Based on the corresponding length value of each string variable, generate a propositional encoding of each atomic formula within the first-order logic formula;

[0166] Invoke a SAT solver for the Boolean abstraction of the first-order logic formula and the propositional encoding of each atomic formula in the first-order logic formula to obtain a result value, the result value indicating whether the first-order logic formula is satisfiable or unsatisfiable for the corresponding length value of each string variable;

[0167] Based on the result value, determine whether the policy conforms to the desired conditions of the policy expressed by the rule; and

[0168] Cause information indicating whether the policy conforms to the desired conditions of the policy expressed by the rule to be displayed.

[0169] 17. The system of clause 16, wherein the result value indicates that the first-order logic formula is unsatisfiable for the corresponding length value of each string variable, and wherein the automated reasoning solver further includes instructions that, when executed, cause the automated reasoning service to:

[0170] Obtain an unsatisfiable core of the first-order logic formula from the SAT solver, wherein the unsatisfiable core of the first-order logic formula includes a subset of the atomic formulas of the first-order logic formula;

[0171] Identify a subset of the one or more string variables in the first-order logic formula within the unsatisfiable core;

[0172] Determine an updated bounded length for each string variable in the subset of the one or more string variables by increasing the currently assigned bounded length to the string variable;

[0173] Obtain an updated propositional encoding of the first-order logic formula based on the respective updated bounded lengths of each string variable in the one or more subsets of string variables; and

[0174] Invoke the SAT solver on the updated propositional encoding of the first-order logic formula.

[0175] 18. The system according to any one of clauses 16 or 17, wherein the automated reasoning solver further comprises instructions that, when executed, cause the automated reasoning service to:

[0176] Determine an alphabet for the propositional encoding of each atomic formula within the first-order logic formula, wherein the alphabet includes the characters that appear in the first-order logic formula and includes additional characters; and

[0177] wherein generating the propositional encoding of each atomic formula within the first-order logic formula is performed for the alphabet.

[0178] 19. The system according to any one of clauses 16 to 18, wherein the string variable among the one or more string variables is part of an atomic formula that includes a regular expression constraint, and wherein the automated reasoning solver further comprises instructions that, when executed, cause the automated inference service to:

[0179] Convert the atomic formula that includes the regular expression constraint into a non-deterministic finite automaton.

[0180] 20. The system according to any one of clauses 16 to 19, wherein determining the respective length values of the string variables includes iterating through the string predicates of the string variables and determining the length of the smallest word that satisfies the string predicate.

[0181] In addition, the words "may" or "can" are used in a permissive sense (i.e., meaning having a certain possibility), rather than in a mandatory sense (i.e., meaning must). The words "include", "including", and "includes" are used to indicate an open-ended relationship and thus mean including but not limited to. Similarly, the words "have", "having", and "has" also indicate an open-ended relationship and thus mean having but not limited to. As used herein, the terms "first", "second", "third", etc. are used as labels for the nouns that follow them and do not imply any type of ordering (e.g., spatial, temporal, logical, etc.) unless such ordering is expressly indicated otherwise. Similarly, the values of such numerical labels generally are not used to indicate the required amount of a particular noun in the claims recited herein, and thus a "fifth" element generally does not mean that there are four other elements present unless those elements are expressly included in the claim or are otherwise clearly shown to be present in some other way.

[0182] The specification and drawings are accordingly to be regarded in an illustrative rather than a restrictive sense. It will, however, be apparent that various modifications and changes may be made therein without departing from the broader scope of the disclosure as set forth in the claims.

Claims

1. A computer-implemented method, comprising: Obtaining, by a solver used by an automated reasoning service of a cloud provider network, a formula that includes one or more string variables, where the formula pertains to a question of a desired condition regarding a policy managed by an identity and access management service of the cloud provider network; Determining, for at least one of the one or more string variables, a corresponding length value that indicates a bounded length of possible assignments to the string variable; Generating, for the corresponding length value of at least one of the one or more string variables, a propositional encoding of the formula; Invoking, for the corresponding length value of at least one of the one or more string variables, a SAT solver on the propositional encoding of the formula to obtain a result value indicating whether the formula is satisfiable or unsatisfiable; And Providing the result value to another component of the automated reasoning service.

2. The computer-implemented method according to claim 2, wherein the result value indicates that the formula is unsatisfiable, and wherein the method further comprises: Obtaining, from the SAT solver, an unsatisfiability core of the formula, where the unsatisfiability core of the formula includes a subset of atomic formulas of the formula; Identifying, within the unsatisfiability core, a subset of the one or more string variables in the formula; Determining, for each string variable in the subset, an updated bounded length by increasing a currently assigned bounded length to the string variable; Obtaining, based on the corresponding updated bounded lengths of each string variable in the subset of the one or more string variables, an updated propositional encoding of the formula; And Invoking the SAT solver on the updated propositional encoding of the formula.

3. The computer-implemented method according to any one of claims 1 or 2, further comprising: Determining, for the propositional encoding of each atomic formula within the formula, an alphabet that includes characters that appear in the formula and includes additional characters; And Wherein generating the propositional encoding of each atomic formula within the formula is performed for the alphabet.

4. The computer-implemented method according to any one of claims 1 to 3, wherein the string variable among the one or more string variables is part of an atomic formula that includes a regular expression constraint, and wherein the method further comprises: Converting the atomic formula that includes the regular expression constraint into a non-deterministic finite automaton.

5. The computer-implemented method according to any one of claims 1 to 4, wherein determining the respective length value of the string variable comprises: Iterating string predicates of the string variable and determining a length of a minimum word that satisfies the string predicate.

6. The computer-implemented method according to claim 2, wherein invoking the SAT solver for the updated propositional encoding of the formula comprises: Using an incremental solving function of the SAT solver.

7. The computer-implemented method according to any one of claims 1 to 6, wherein the result value indicates that the formula is unsatisfiable, and wherein the method further comprises: Obtaining, from the SAT solver, an unsatisfiability core of the formula, where the unsatisfiability core of the formula includes a subset of atomic formulas of the formula; Identifying, within the unsatisfiability core, a subset of the one or more string variables in the formula; For each string variable in the subset, determining that an upper bound of each string variable in the subset has been reached; And Determining that the formula is unsatisfiable.

8. The computer-implemented method according to any one of claims 1 to 7, wherein the question about the desired condition of the policy includes at least one of the following items: determining whether to permit public write access to computing resources; Determine whether to permit unencrypted writing to computing resources; Determine whether to permit public read access to computing resources; Or determine whether a Secure Sockets Layer (SSL) request is required to access computing resources; Or compare the permissions of two policies relative to each other.

9. The computer-implemented method according to any one of claims 1 to 8, further comprising: Cause information indicating whether the policy meets the desired conditions of the policy to be displayed.

10. The computer-implemented method according to any one of claims 1 to 9, further comprising: Based on the result value, generate a recommendation related to the policy based on the result value, wherein the recommendation identifies potential modifications to the policy; And Cause the recommendation to be displayed.

11. A system, comprising: One or more first electronic devices for implementing an automated reasoning service in a multi-tenant provider network, wherein the automated reasoning service includes instructions that, when executed, cause the automated inference service to: Generate a first-order logic formula, wherein the first-order logic formula is generated based on policies managed by an identity and access management service of a cloud provider network and based on rules, wherein the rules represent desired conditions of the policies, and wherein the first-order logic formula includes one or more string variables; And One or more second electronic devices for implementing an automated reasoning solver in the multi-tenant provider network, wherein the automated reasoning solver includes instructions that, when executed, cause the automated reasoning service to: Generate a Boolean abstraction of the first-order logic formula, wherein the Boolean abstraction of the first-order logic formula includes one or more Boolean variables, each Boolean variable representing an atomic formula of the first-order logic formula; Determine a corresponding length value for each string variable in the one or more string variables, the corresponding length value indicating a bounded length of possible string assignments to the string variable; Based on the corresponding length value of each string variable, generate a propositional encoding of each atomic formula within the first-order logic formula; Call a SAT solver on the Boolean abstraction of the first-order logic formula and the propositional encoding of each atomic formula in the first-order logic formula to obtain a result value, the result value indicating whether the first-order logic formula is satisfiable or unsatisfiable for the corresponding length value of each string variable; Based on the result value, determine whether the policy meets the desired conditions of the policy expressed by the rules; And Cause information indicating whether the policy meets the desired conditions of the policy expressed by the rules to be displayed.

12. The system according to claim 11, wherein the result value indicates that the first-order logic formula is unsatisfiable for the corresponding length value of each string variable, and wherein the automated reasoning solver further includes instructions that, when executed, cause the automated reasoning service to: Obtain an unsatisfiable core of the first-order logic formula from the SAT solver, wherein the unsatisfiable core of the first-order logic formula includes a subset of the atomic formulas of the first-order logic formula; Identify a subset of the one or more string variables in the first-order logic formula within the unsatisfiable core; Determine an updated bounded length for each string variable in the subset of the one or more string variables by increasing a current bounded length assigned to the string variable; Obtain an updated propositional encoding of the first-order logic formula based on the respective updated bounded lengths of each string variable in the subset of the one or more string variables; And Invoke the SAT solver on the updated propositional encoding of the first-order logic formula.

13. The system according to any one of claims 11 or 12, wherein the automated reasoning solver further comprises instructions which, when executed, cause the automated reasoning service to: Determine an alphabet for the propositional encoding of each atomic formula within the first-order logic formula, wherein the alphabet includes characters that appear in the first-order logic formula and includes additional characters; and Wherein generating the propositional encoding of each atomic formula within the first-order logic formula is performed for the alphabet.

14. The system according to any one of claims 11 to 13, wherein a string variable among the one or more string variables is part of an atomic formula that includes a regular expression constraint, and wherein the automated reasoning solver further comprises instructions which, when executed, cause the automated inference service to: Convert the atomic formula that includes the regular expression constraint into a non-deterministic finite automaton.

15. The system according to any one of claims 11 to 14, wherein determining the respective length values of the string variables includes iterating string predicates of the string variables and determining the length of a smallest word that satisfies the string predicate.

Images