Abstraction modeling and verification method for core transaction system architecture code implementation

Abstract

The invention relates to an abstract modeling and verification method for core transaction system architecture code implementation, which comprises the following steps of: A, modeling and verifying the architecture of a transaction system: extracting related information from a code implementation and development design document of an architecture framework, and constructing a behavior model of an existing system by using an abstract modeling technology, a UML sequence diagram is converted into a formalized model of a CSP by using a process communication process of a UML sequence diagram modeling system, and a PAT verifier is used for verification analysis of security properties; and B, modeling and verifying a cluster main selection module in the transaction system: constructing a state machine model of each node in a cluster main selection process, constructing a system dynamic model, and verifying and analyzing the correctness of the main selection process by using a PAT verifier. The method has the advantages that the problem of state transition modeling of each node in a communication process between processes and a cluster main selection process in a transaction system architecture is solved, and the modeling and security verification analysis capability is improved.

Description

Technical Field

[0001] The present invention relates to the field of abstract modeling and verification technology, and in particular to an abstract modeling and verification method for implementing a core transaction system architecture code. Background Art

[0002] UML modeling technology: Unified Modeling Language (UML) is a standardized graphical modeling language that is widely used in software engineering, system design, and business process modeling. It provides a series of graphical modeling elements to describe the structure, behavior, and interaction process of the system. The purpose of UML is to help developers, designers, and other relevant personnel to clearly and accurately model the system during the development process, thereby reducing misunderstandings and errors in development, helping designers build platform-independent models, and improving software development efficiency and quality. UML contains a variety of models, including class diagrams, use case diagrams, state machine diagrams, activity diagrams, sequence diagrams, etc. Each model diagram has a specific application scenario, which can achieve the static structure and dynamic behavior of the modeling system from different perspectives.

[0003] Among them, UML modeling technology includes two key models: sequence diagram and state machine diagram.

[0004] The sequence diagram is a dynamic model used to describe the interaction between objects or components in a system, especially to show the timing relationship of message passing. The sequence diagram uses a vertical "lifeline" to represent the life cycle of an object or component, and uses a horizontal arrow to represent the message passing, thus showing how objects interact and communicate with each other in chronological order. It can accurately show the participation process of each object in the system and the order of message passing, and is particularly suitable for complex business logic, distributed systems, or scenarios where multiple components collaborate. The main function of the sequence diagram is to help designers clearly understand and analyze the dynamic interaction process in the system. Through the sequence diagram, developers can clearly understand the behavior of each object at a specific point in time and accurately grasp the order and dependency of message passing in the system. In the process of system modeling, the sequence diagram can help identify potential performance bottlenecks or design defects, thereby optimizing the system architecture and process. It is particularly effective in showing the collaboration process between components in a complex system. Therefore, in the architecture design phase, sequence diagrams are usually used to model the interaction behavior between components.

[0005] A state machine diagram is a model used to describe the behavior of a system or component in different states and the transitions between states. It represents how a dynamic system reacts in different situations by defining a set of states, transition rules between states, and the behavior of the system in each state. State machines are widely used in control systems, embedded systems, protocol design, software engineering, and other fields. In particular, when it is necessary to describe the internal state changes of the system and the response to external events, state machines provide an effective modeling method. In a state machine model, the behavior of the system is composed of a finite number of states, each of which represents a possible working mode or situation of the system. The transitions between states are driven by specific triggering events or conditions, that is, when certain conditions are met, the system will transfer from one state to another. A state machine model usually consists of three basic elements: state, transition, and event. The state describes the current situation of the system, the transition describes the transition from one state to another, and the event triggers the occurrence of these state transitions. The role of state machines in system modeling is particularly important, especially when describing complex control logic, protocol processes, or the life cycle of the system. By using state machines, designers can intuitively express the various states of the system and their transition rules, thereby simplifying system design and analysis. Therefore, during the architecture design phase, using state machines to model the complex state transitions of key components, subsystems, and modules is crucial for modeling the complex behavior of the system.

[0006] CSP formal modeling technology: Communicating Sequential Processes (CSP) is a formal modeling technology for describing the behavior of concurrent systems. It was proposed by British computer scientist Tony Hoare in 1978. CSP is mainly used to describe the interaction and communication between multiple processes, and is particularly suitable for modeling concurrent systems, distributed systems, and process collaboration in multi-tasking environments. CSP uses process algebra to express the behavior and interaction of the system by defining formal rules for processes, communication, and synchronization. The core concepts of CSP are "process" and "communication". In CSP, processes are independent computing entities that can communicate through message passing. Communication between processes is usually synchronous, that is, the execution of one process will wait for the response or data transfer of another process. CSP uses events and channels to represent the interaction between processes. Events are the basic operations of processes, and channels are the medium for transmitting data between processes. By defining how processes interact through these events and channels, CSP can accurately describe the collaboration and synchronization of various processes in a concurrent system.

[0007] In system modeling, CSP is particularly suitable for describing complex concurrent systems. Traditional program models are usually executed sequentially, and the collaborative work of multiple processes in concurrent systems makes the problem more complicated. CSP provides a concise and powerful way to model these concurrent interactions. With CSP, designers can clearly define the behavior of each process and the synchronization and communication between them to ensure the correctness and consistency of the system. For example, in the fields of distributed computing, operating system process management, and real-time systems, CSP is widely used to model the coordination and resource sharing between concurrent tasks. One of the advantages of CSP is that it can formally express concurrent behavior, allowing system designers to verify the correctness of the system in a mathematical way. Through CSP modeling, developers can apply various formal verification techniques, such as model checking and formal reasoning, to ensure that the system will not deadlock or other inconsistent behaviors under concurrent execution. The precision of CSP has made it widely used in fields with high safety requirements, such as aerospace, financial systems, and embedded systems.

[0008] In addition, compared with other formal modeling languages, the biggest feature of CSP is that it places special emphasis on communication and synchronization, and its modeling process can flexibly express the interaction and collaboration of processes, which is suitable for complex concurrent or distributed environments. CSP can effectively describe the communication and collaboration of systems in an abstract way, thereby providing a theoretical basis and practical guidance for the design, verification and optimization of concurrent systems. Therefore, CSP can be used as a formal modeling language to accurately model the message communication process between various processes, components, and subsystems in complex systems, as well as the state transition of core functional modules, laying the foundation for verification analysis using formal verification technology.

[0009] PAT Verifier: PAT (Process Analysis Toolkit) Verifier is a tool for formal verification of concurrent system behavior. It is widely used in system verification based on CSP or other formal modeling languages. PAT Verifier provides an automated way to analyze and verify the behavior of each process in a concurrent system and its interactions to ensure that the system meets the specified specifications and requirements. By using PAT Verifier, developers can effectively discover potential errors, deadlocks, data inconsistencies and other problems in the system. Verification tools play a vital role, especially in complex concurrent and distributed systems.

[0010] The working principle of the PAT verifier is based on model checking technology. It automatically explores the system model to check whether the system satisfies the given properties or constraints on all possible execution paths. By inputting the system modeled in languages ​​such as CSP, the PAT verifier can traverse the state space of the system and check the system's security, activity, deadlock-free and divergence-free properties. The PAT verifier provides a visual verification tool interface that can implement verification analysis of the CSP model and generate counterexamples when errors are found. Through model simulation, designers can carefully analyze the message communication process between processes and simulate each step of the message communication; they can also simulate the state transition process of the system in the implementation of the core algorithm module, thereby facilitating the location of errors.

[0011] In the prior art, the master selection module design for the system cluster mainly relies on hardware devices, that is, the abnormal detection and recovery technology for redundant designs such as master-slave arbitration. In the prior art, the master-slave arbitration mechanism only includes partial formal verification, that is, only module-level verification is provided.

[0012] Therefore, it is urgent to design an abstract modeling and verification method for the core trading system architecture code implementation, so as to integrate formal modeling and verification technology in the early stage of architecture design, discover potential errors in the design, improve the accuracy and security of the architecture model, ensure that the system behaves as expected in different abnormal scenarios, and solve the modeling problems of communication between processes and state changes of cluster nodes in the trading system. Summary of the invention

[0013] The purpose of the present invention is to overcome the shortcomings of the prior art and provide an abstract modeling and verification method for the core trading system architecture code implementation, so as to integrate formal modeling and verification technology into the early stage of architecture design, discover potential errors in the design, improve the accuracy and security of the architecture model, ensure that the system behaves as expected in different abnormal scenarios, and solve the modeling problems of communication between processes and state changes of cluster nodes in the trading system.

[0014] In order to achieve the above purpose, an abstract modeling and verification method for the core trading system architecture code implementation is designed, and the method comprises: A. Modeling and verifying the architecture of the trading system: by extracting relevant information from the code implementation and development design documents of the architecture framework, using abstract modeling technology to build a behavioral model of the existing system, using UML sequence diagrams to model the process communication process of the system, converting the UML sequence diagrams into a formal model of CSP to describe the communication mechanism and synchronization behavior of the system, and using the PAT verifier to verify and analyze the security properties; B. Modeling and verifying the cluster leader election module in the trading system: constructing a state machine model of each node in the cluster leader election process to describe the state transition process of the cluster leader election, building a system dynamic model, and using the PAT verifier to verify and analyze the correctness of the leader election process.

[0015] Preferably, the present invention also includes: the method for modeling and verifying the architecture of the trading system is as follows: S1. Modeling the core trading system architecture process communication process based on the UML sequence diagram, including: S11. Identifying different functional modules in the trading system architecture; S12. Modeling the message transmission sequence, synchronous and asynchronous communication methods and triggering conditions of trading operations between modules through sequence diagrams; S13. By comparing the design documents and the actual code implementation, ensuring that the communication model described in the sequence diagram is consistent with the actual architecture of the system; S2. Constructing a formal model of the core trading system architecture process communication process based on CSP, including S21. It is necessary to convert the message transmission in the sequence diagram into events in CSP to ensure the accuracy of the communication behavior. and consistency; S22. Through the concurrency control mechanism of CSP, the synchronization and mutual exclusion relationship between multiple transaction processes in the modeling system is modeled to ensure that the system can efficiently and correctly handle concurrent transaction requests; S23. Property specifications are defined by assertions, and the property specifications of the sequence diagram model are deadlock-free and divergent-free; S3. Model verification is performed based on the PAT verifier. After constructing the CSP formal model, the constructed CSP model is verified by the PAT model verifier to ensure that the model meets the predefined property specifications, which include deadlock-free and divergent-free. The above specifications are formally defined by using the #assert assertion statement in the PAT verifier, thereby achieving a comprehensive verification of the dynamic behavior of the system.

[0016] Preferably, the present invention also includes: the method for modeling and verifying the architecture of the trading system also includes step S4. CSP formalized model optimization and feedback iteration, and optimization and feedback are performed according to the feedback results of PAT verification to ensure that the system design can be improved in each iteration.

[0017] Preferably, the present invention also includes: the method for modeling and verifying the cluster leader selection module in the trading system is as follows: S1. Modeling the cluster leader selection module of the core trading system based on the UML state machine diagram, including: S11. Analyzing the code implementation logic of the cluster leader selection module, abstracting the different working states that may appear in the cluster node during the leader selection process; S12. In-depth research on the state transition logic of the node, and clearly defining the transition conditions of each node between different states and its corresponding triggering events or operations through the UML state machine model; S13. Combining the design document and actual code implementation of the cluster leader selection module, comparing and verifying the state machine diagram to ensure that the state machine diagram accurately reflects the actual situation of the node behavior, thereby avoiding potential logical errors or inconsistencies; S2. CS of the cluster leader selection module The P model includes: S21. Mapping the state transitions and operations in the state machine diagram to the event sequence in the CSP model, and combining different migration conditions through concurrent operators; S22. Considering that nodes in the cluster may fail, the CSP model adds a fault state; S23. Defining property specifications through assertions, the property specifications of the state machine diagram include activity, safety and stability; S3. Verifying with the PAT model verifier. After constructing the CSP formal model, the CSP model is verified using the PAT model verifier to ensure that the system meets the predefined property requirements, including activity, safety and stability. The above specifications are formally defined using the #assert assertion statement in the PAT verifier, and the key behaviors of the model are fully verified.

[0018] Preferably, the present invention also includes: the method for modeling and verifying the cluster leader selection module in the trading system also includes step S4. CSP formalized model optimization and feedback iteration, and optimization and feedback are performed according to the feedback results of PAT verification to ensure that the system design can be improved in each iteration.

[0019] Compared with the prior art, the present invention has the following advantages: Integrate trusted modeling and verification technology into the architecture design of the trading system to ensure the correctness and security of the system architecture model, so as to find errors in the early stages of system development, reduce development costs, and improve system security. Solve the state transition modeling problem of each node in the communication process between processes in the trading system architecture and the cluster master election process.

[0020] The PAT verifier is used to formally verify and analyze the state transition model of the trading system architecture framework message communication model and the cluster master selection module. It can find potential errors in the trading system architecture design for different abnormal scenarios, and analyze the counterexamples obtained after the abnormal scenario verification, so as to help optimize the model design to ensure system security. This method has good versatility and can be extended to the modeling and security verification analysis of other design modules of the trading system. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart for modeling and verifying the architecture of the trading system for the present invention; Figure 2 A flow chart for modeling and verifying the cluster master selection module in the trading system according to the present invention; Figure 3 It is a schematic diagram of a sequence diagram model of the transaction system thread communication in the first embodiment of the present invention; Figure 4 This is a schematic diagram of a sequence diagram CSP model in the first embodiment of the present invention; Figure 5 It is a schematic diagram of the verification result of no deadlock and no divergence in the first embodiment of the present invention; Figure 6 A schematic diagram of a state machine model constructed using the Modelio tool in Embodiment 2 of the present invention; Figure 7 A schematic diagram of variable definition of a cluster master selection module CSP model in the second embodiment of the present invention; Figure 8 A schematic diagram of node definition of a cluster master selection module CSP model in the second embodiment of the present invention; Fig. 9 This is a schematic diagram of the specification definition of the properties of the cluster master election module in the second embodiment of the present invention; Fig.10 This is a schematic diagram of the result of the specification verification of the properties of the cluster master election module in the second embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, principle and structure of the present invention more clear, it is further described below in conjunction with the drawings and specific embodiments.

[0023] The existing system availability assurance solutions mainly rely on hardware devices, that is, the anomaly detection and recovery technology for redundant designs such as master-slave arbitration, which does not have the ability to build an abstract model of a complex trading system and rigorously verify and analyze the abstract model with the help of formal verification tools, making it difficult to discover potential risks. The existing master-slave arbitration mechanism only includes partial formal verification, that is, it provides module-level security, and cannot generalize this empirical technology to distributed application scenarios, that is, it does not model and verify the arbitration model and business workflow based on the business framework. Existing formal technologies make it difficult to efficiently model the business workflow and master election algorithm of the trading system through a single model.

[0024] The present invention provides an abstract modeling and verification method for the implementation of the core trading system architecture code. Aiming at the code of the existing trading system, the dynamic behavior in its architecture is abstractly modeled, and the purpose is to use formal modeling and verification technology to analyze the potential security risks of the trading system architecture in the design and implementation, thereby improving the security of the system.

[0025] The present invention conducts research from both macro and micro perspectives. At the macro level, the architecture of the trading system is modeled and verified. By extracting relevant information from the code implementation and development design documents of the architecture framework, the behavior model of the existing system is constructed using abstract modeling technology, that is, the process communication process of the system is modeled using the UML sequence diagram. Subsequently, the UML sequence diagram is converted into a formal model of CSP to describe the communication mechanism and synchronization behavior of the system, and the PAT verifier is used to verify and analyze the security properties. At the micro level, the core module in the trading system, the cluster master selection module, is modeled and verified and analyzed, and the state machine model of each node in the cluster master selection process is constructed to describe the state transition process of the cluster master selection. The system dynamic model is constructed, and the PAT verifier is used to verify and analyze the correctness of the master selection process.

[0026] 1. See Figure 1 , the modeling and verification of the transaction system architecture framework are as follows: (1) Model the core transaction system architecture process communication process based on UML sequence diagram.

[0027] In this invention, we have conducted a detailed analysis of the code (C++ implementation) of the core trading system architecture, and used the sequence diagram in the unified modeling language UML to abstractly model the communication process between different processes in the architecture. We focus on the message communication process in which business messages in the architecture pass through the trading system architecture framework and perform specific business logic processing in each thread in turn. The core of this invention is to use abstract modeling technology to construct the static structure and dynamic behavior model of the core trading system, especially focusing on the process communication process in the trading system architecture. In the modeling process, abstract modeling is performed based on the existing code implementation of the system, accurately reflecting the message communication process in the actual code.

[0028] Specifically, we first need to identify the different functional modules in the trading system architecture. Secondly, we use sequence diagrams to model the message transmission order, synchronous and asynchronous communication methods, and trigger conditions of trading operations between modules. Finally, we compare the design documents with the actual code implementation to ensure that the communication model described in the sequence diagram is consistent with the actual architecture of the system.

[0029] By modeling the sequence diagram of the message interaction of the core transaction system architecture framework, the present invention can design an abstract model that is consistent with the actual code during the core transaction system architecture design phase, which has stronger expressive power and can effectively improve the reusability of the system model.

[0030] (2) Construct a formal model of the process communication process of the core transaction system architecture based on CSP.

[0031] Based on the communication behavior described in the UML sequence diagram, the corresponding CSP formal model is established to ensure that the system's communication process meets the required concurrency control and synchronization mechanism. First, the message passing in the sequence diagram needs to be converted into events in CSP to ensure the accuracy and consistency of the communication behavior. Secondly, through the concurrency control mechanism of CSP, the synchronization and mutual exclusion relationship between multiple transaction processes in the modeling system is ensured to ensure that the system can efficiently and correctly handle concurrent transaction requests. Finally, the property specification is defined by assertion, and the property specification of the sequence diagram model is deadlock-free and divergent-free.

[0032] (3) Model verification based on PAT validator.

[0033] After constructing the CSP formal model, the present invention further uses the PAT model verifier to verify the constructed CSP model to ensure that the model meets the predefined property specifications, including deadlock-free and divergence-free. By using the #assert assertion statement in the PAT verifier to formally define the above specifications, the dynamic behavior of the system can be fully verified.

[0034] (4) CSP formal model optimization and feedback iteration.

[0035] According to the feedback results of PAT verification, the present invention also introduces an optimization and feedback mechanism to ensure that the system design can be improved in each iteration.

[0036] 2. See Figure 2 ,The modeling and verification of the cluster master selection module of the ,trading system are as follows.

[0037] (1) Model the cluster master selection module of the core transaction system based on the UML state machine diagram.

[0038] In the present invention, a detailed analysis is conducted on the code implementation of the cluster leader selection module, a key component in the core transaction system, and the process of the algorithm is formally modeled by using the state machine diagram in the unified modeling language UML. Focus is placed on the state transition of cluster nodes during the leader selection process, and the state transition of nodes under different triggering events is explored in depth to discover potential unsafe behaviors or design defects in the cluster leader selection module. The core method of the present invention is to construct an arbitration logic model of the cluster leader selection module through abstract modeling technology. This method has extremely high expressive power, can accurately model the state changes of each node in the leader selection process, and comprehensively reflect the interactions and state transfers between nodes in the cluster, providing a solid theoretical basis for subsequent model verification work.

[0039] In the specific implementation process, we first analyze the code implementation logic of the cluster leader selection module and abstract the different working states that may appear in the cluster node during the leader selection process, such as: waiting for leader selection state, master node state, slave node state, etc. Secondly, we deeply study the state transition logic of the node, and clearly define the transition conditions between different states of each node and its corresponding triggering events or operations through the UML state machine model. Finally, we compare and verify the state machine diagram based on the design document and actual code implementation of the cluster leader selection module to ensure that the state machine diagram accurately reflects the actual situation of the node behavior, thereby avoiding potential logical errors or inconsistencies.

[0040] Through the state diagram modeling method, the present invention can abstractly model the state transition process of cluster nodes in the design stage of the cluster master selection module, providing a strong guarantee for the high availability and security of the system.

[0041] (2) CSP model of cluster master selection module.

[0042] Based on the UML state machine diagram, a CSP model of node state migration is established to formally describe the state transitions and corresponding operations of each node in the cluster master election module. First, the state transitions and operations in the state machine diagram need to be mapped to event sequences in the CSP model, and different migration conditions are combined through concurrent operators. Secondly, considering that nodes in the cluster may fail, fault states are added to the CSP model. Finally, the property specifications are defined by assertions, and the property specifications for the state machine diagram include activity, safety, and stability.

[0043] (3) Use the PAT model validator for verification.

[0044] After constructing the CSP formal model, the present invention further uses the PAT model verifier to verify the CSP model to ensure that the system meets the predefined property requirements, including activity, safety, and stability. By formally defining the above specifications using the #assert assertion statement in the PAT verifier, the key behaviors of the model are fully verified.

[0045] (4) CSP formal model optimization and feedback iteration.

[0046] According to the feedback results of PAT verification, the present invention also introduces an optimization and feedback mechanism to ensure that the system design can be improved in each iteration.

[0047] The present invention conducts targeted research on the defects of the prior art: 1. The existing system cluster master selection module design scheme mainly relies on hardware equipment, that is, the abnormal detection and recovery technology for redundant designs such as master-slave arbitration.

[0048] The election security background of the core trading system is mainly due to the rapid development of the financial market and the improvement of regulatory requirements. With the surge in trading volume and the continuous refresh of trading peaks, the existing system faces huge challenges in stability and processing capacity. Such high-availability distributed systems usually implement fault detection mechanisms to timely identify and handle node or component failures, and complete fault recovery through service reconstruction or hot start.

[0049] In the fault recovery mechanism of the core trading system, multiple key components work together to ensure high availability of the system. Fault detection components (such as heartbeat detection and log analysis) continuously monitor the system status. When an anomaly is detected, an alarm is immediately triggered and the event processing framework starts the recovery process within the cluster. The detection mechanism is closely integrated with the redundancy design. The latter ensures that when the primary node fails, the backup node can quickly take over the work and maintain service continuity through master-slave switching and load balancing technology. The data backup and synchronization mechanism ensures the consistency and integrity of data during the failover process to prevent data loss.

[0050] Within the security protection scope of the current system, the implementation of the above-mentioned fault recovery mechanism only performs the maintenance function of the core trading system. Within the scope of intellectual property search, there is no relevant literature equivalent to the content protected by this patent (i.e., modeling and verification of the core trading system cluster election mechanism).

[0051] The present invention adopts a completely different approach from maintenance. Usually, these anomaly detection and recovery methods have not been formally verified and analyzed, and there may be some potential risks. As a complex state system in the context of a high-availability service cluster, fault detection in traditional cluster elections is highly dependent on technologies such as data mining or fault identification, and it is difficult to cover all failure modes. Secondly, if there are quality problems or incompleteness in the input data, it may affect the accuracy and efficiency of anomaly detection. Its recovery technology is usually used as an emergency measure when the system is unavailable, involving the restart of software, hardware or services, which may only be a temporary solution rather than a fundamental improvement in system security.

[0052] Strictly speaking, these traditional solutions lack the ability to strictly verify and prove system security from the abstract model level. This also means that although they can partially respond to and recover from known failure modes, they may not be able to fully predict and prevent unknown system failures, thus limiting the long-term guarantee of system availability.

[0053] 2. The existing master-slave arbitration mechanism only includes partial formal verification, that is, it only provides module-level verification.

[0054] The improved Raft leader election algorithm between ETCD, arbitrators, and cluster nodes can achieve consistency and fault recovery in distributed systems, and reach consensus in each stage to achieve fault recovery. After searching intellectual property and academic literature, there are three relevant technical solutions for verifying the consistency of the native Raft leader election algorithm, namely logical analysis based on TLA+, analysis of the Raft leader election protocol based on the TLC model checker, and verification of the Raft algorithm using the Stateright model checker. These three methods mainly analyze the formalization of the Raft algorithm itself, but they do not provide security guarantees that are closely related to the actual business of the core system transactions, and their effects are similar, so they will not be expanded in detail. The following briefly lists the core contents of these three methods: The first solution is logical analysis based on TLA+ (Temporal Logic of Actions). This solution uses TLA+ for formal modeling. By using TLA+, the various components and state transitions of the Raft algorithm can be modeled and their correctness can be verified.

[0055] The second solution: Raft leader election protocol analysis method based on TLC. TLC is a model checker for the TLA+ (Temporal Logic of Actions) formal language. This solution provides a formal specification of the Raft protocol and uses the TLC model checker to verify the case with a small number of protocol participants. This work not only provides a formal description of Raft, but also verifies its correctness.

[0056] The third solution: Stateright model verification. Stateright is widely used to verify distributed consensus algorithms such as the Raft protocol and the Paxos protocol, especially in research and academic fields. It is used to check the behavior of the protocol under various failure conditions such as fault recovery, node failure, and network partition. This solution uses the Stateright model checker to verify the Raft Lite algorithm. By implementing a CheckerRunner, the Raft Lite algorithm is wrapped into a model checker. The key part is the step function, which handles any event and returns the action that the node should take, so that the algorithm behaves like a state machine.

[0057] The present invention finds the defects of the prior art: 1. Existing system availability assurance solutions mainly rely on hardware devices, that is, anomaly detection and recovery technologies for redundant designs such as master-slave arbitration. They do not have the ability to build abstract models of complex trading systems and to conduct rigorous verification and analysis of abstract models with the help of formal verification tools, making it difficult to discover potential risks.

[0058] 2. The existing master-slave arbitration mechanism only includes partial formal verification, that is, it provides module-level security, and cannot generalize this empirical technology to distributed application scenarios, that is, it does not model and verify the arbitration model and business workflow based on the business framework.

[0059] 3. Existing formal technologies make it difficult to efficiently model both the business workflow and the master selection algorithm of a trading system through a single model.

[0060] The key points of the technical improvements of the present invention can be summarized as follows: 1. Architecture modeling and verification method adapted to business scenarios of trading systems. This invention proposes a core trading system architecture modeling and verification method designed specifically for trading business scenarios. Its advantage is that formal modeling and verification technology is integrated into the early stage of architecture design to discover potential errors in the design in a rigorous proof manner. Integrating trusted modeling and verification technology into the system architecture design stage can ensure the accuracy and security of the architecture model. Through this method, developers can identify potential problems at an early stage and make adjustments in a timely manner, thereby reducing the development cycle, reducing costs and improving the security of the system.

[0061] 2. UML dynamic model abstraction and process communication and state transition modeling for core trading systems. The present invention proposes a method for abstracting dynamic system models (such as sequence diagrams and state machine diagrams) from design documents and codes, aiming to solve the modeling problems of inter-process communication and cluster node state transitions in trading systems. Through this method, the message transmission order between modules within the trading system, the synchronous / asynchronous communication mode, and the state changes of nodes in the master election algorithm can be clarified, thereby ensuring the operability and logical consistency of the system architecture. This method can discover potential risks that cannot be discovered in testing, and is an important technology to ensure high availability and high security of the system.

[0062] 3. Formal verification and exception analysis of CSP model. The present invention proposes a method for formal modeling and verification of trading system architecture based on process algebra CSP. This method can strictly formally verify the architectural model of the trading system to ensure that the behavior of the system in different abnormal scenarios is in line with expectations. Through this method, potential defects in the architectural design can be systematically identified, and counterexamples can be automatically generated during the verification process. Detailed analysis of counterexamples helps to accurately locate errors or loopholes in the system design, providing an important basis for subsequent design optimization. This verification mechanism not only improves the security of the system architecture, but also ensures that the system can always maintain stability in complex abnormal environments, avoiding potential risks caused by architectural defects, thereby providing a strong guarantee for the security of the trading system.

[0063] Compared with the existing technology, it certainly has better technical effects: 1. Integrate trusted modeling and verification technology into the architecture design process to ensure the correctness and security of the system architecture model, so as to detect errors in the early stages of system development, reduce development costs, and improve system security.

[0064] 2. Solve the problem of modeling the state transition of each node in the communication process between processes in the trading system architecture and the cluster leader election process.

[0065] 3. Supports the use of PAT verifier to conduct formal verification and analysis on the state transition model of the trading system architecture framework message communication model and cluster master selection module. It can discover potential errors in the trading system architecture design for different abnormal scenarios, and analyze the counterexamples obtained after the abnormal scenario verification, so as to help optimize the model design to ensure system security. It has good versatility and can be promoted to the modeling and security verification analysis of other design modules of the trading system.

[0066] Example 1: Core transaction system architecture framework thread communication modeling and verification See also Figures 3 to 5 .

[0067] The sequence diagram model constructed by the Modelio tool is as follows: Figure 3 As shown in the figure, the model defines eight thread entities, including Event_Assembler, Pre_processor, Biz_Processor, Event_Main, Transaction_Main, Query_Processor, Transaction_Processor and RC. The information indicated by the arrows in the figure is derived from the system code implementation and has been abstracted. Among them, the get_xx series of messages belong to the transaction collection queue request message set in the event processing framework, and the event_xx series of messages belong to the event submission message set in the main process workflow.

[0068] The CSP model is constructed as follows: The conversion process from the sequence diagram model to the CSP model is as follows: Figure 4 As shown. During the conversion process, we used the enum keyword to define three types of enumeration variables: request message REQ set, event EVENT set, and content PROTOCAL_SEND set transmitted through the UDP protocol. Then, five message channels were defined using the channel keyword, and the variable values ​​of these channels were set to 0, indicating that synchronous communication was adopted. The five message channels are Event_Assemble_Que, Call_Function, RC_Channel, Biz_Query_Que, and Self_Channel. In order to simulate the communication process between entities in the core transaction system, we split the event processing framework into four thread entities: event framework main thread, event collector, event preprocessor, and business processor. Through the process algebra CSP, we abstract these four thread entities into Event_Main process, Event_Assembler process, Pre_Processor process, and Biz_Processor process respectively. At the same time, the business processing framework is split into three thread entities: transaction thread, query thread, and business processing thread, which are abstracted into Event_Main, Event_Assembler, Pre_Processor, and Biz_Processor respectively. In addition, the risk control cluster is abstracted as an RC process. Finally, we use the concurrent operator || to combine the above eight processes into the System() process, and use the #assert assertion to ensure that the system is divergence-free and deadlock-free.

[0069] The verification results are analyzed as follows: Figure 5As shown in Figure 1, the system successfully passed the verification. According to the verification results, the time complexity of the core trading system thread communication verification process is in the millisecond level and the space complexity is in the MB level. Specifically, Figure 5 The deadlock-free and divergence-free verification process shown takes about 5.2 milliseconds and occupies about 8.7MB of space. Since threads use synchronous communication and the message content is in a single form, the time complexity and space complexity of the verification process are relatively low.

[0070] Embodiment 2: Modeling and verification of cluster master election module state machine.

[0071] Overview of the cluster leader election system implementation: According to the implementation logic of the code, we know that the implementation of the cluster leader election system covers two initial states: init state and join state. To facilitate explanation and analysis, this article has made necessary simplifications and abstractions, focusing only on the transition process of the init state, and not considering the join state. At the same time, related variables such as TierStatus and the details of etcd's participation have also been simplified. The simplified system, using the state machine model built by the Modelio tool, is shown below: Figure 6 shown.

[0072] State machine transition model and CSP model construction: By abstracting the specific code implementation, we extracted the state machine transition model of the cluster master election module. Then, based on the UML state machine transition model, we further constructed the CSP model. Figure 7 The variable definitions in the CSP model of the master election algorithm are shown. #define N 4 defines the total number of nodes in the system as 4, and #define STATENUMBER 5 defines the five possible states of each node in the system. The variables involved in the state transition logic are defined through the var statement. For example, when is_etcd_avail is true, etcd is ready, and when is_masterNode_crash is false, the master node is not down. The IfIsLeader() function is used to determine whether a node is a leader node. Figure 8 The migration conditions between nodes in the master election algorithm are defined in detail.

[0073] The properties and specifications of the cluster leader election module are as follows: Fig. 9As shown. The Initialization() function is responsible for setting all nodes to the init state, and the LeaderElection() function defines the entire process of the leader election algorithm. #assert assertions define property specifications including oneLeader and stable. The oneLeader assertion is used to verify the activity and security of the system to ensure that only one and only one leader node is eventually elected; the stable assertion is used to verify whether the system has reached a stable state, that is, whether the weight of the selected node is the maximum weight initially set (that is, the leader election is successful).

[0074] Verification result analysis: Verification results are as follows: Fig.10 As shown in the figure, the system has successfully passed the verification. According to the verification results, the time complexity of the cluster master selection module verification process is at the second level, and the space complexity is at the MB level. Specifically, the activity and safety verification process takes about 0.5 seconds and consumes about 47.8MB of space.

[0075] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent substitutions or changes according to the technical solutions and novel concepts of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. An abstract modeling and verification method for the implementation of the core trading system architecture code, characterized in that: The method comprises: A. Model and verify the architecture of the trading system: By extracting relevant information from the code implementation and development design documents of the architecture framework, using abstract modeling technology to build a behavioral model of the existing system, using UML sequence diagrams to model the process communication process of the system, converting the UML sequence diagram into a formal model of CSP to describe the communication mechanism and synchronization behavior of the system, and using the PAT verifier to verify and analyze the security properties; B. Modeling and verification of cluster leader selection module in trading system: Construct a state machine model of each node in the cluster leader election process to describe the state transition process of cluster leader election, build a system dynamic model, and use the PAT verifier to verify and analyze the correctness of the leader election process.

2. The abstract modeling and verification method for the core transaction system architecture code implementation as claimed in claim 1, characterized in that: The method for modeling and verifying the architecture of the trading system is as follows: S1. Model the core transaction system architecture process communication process based on UML sequence diagram, including: S11. Identify different functional modules in the trading system architecture; S12. Model the message transmission sequence between modules, synchronous and asynchronous communication methods, and triggering conditions of transaction operations through sequence diagrams; S13. Ensure that the communication model described in the sequence diagram is consistent with the actual architecture of the system by comparing the design document with the actual code implementation; S2. Construct a formal model of the core transaction system architecture process communication process based on CSP, including: S21. It is necessary to convert the message passing in the sequence diagram into events in CSP to ensure the accuracy and consistency of communication behavior; S22. Through the concurrency control mechanism of CSP, the synchronization and mutual exclusion relationship between multiple transaction processes in the modeling system is established to ensure that the system can efficiently and correctly handle concurrent transaction requests; S23. Define property specifications by assertion, and ensure that the property specifications of the sequence diagram model are free of deadlock and divergence; S3. Perform model verification based on the PAT verifier. After constructing the CSP formal model, the constructed CSP model is verified using the PAT model verifier to ensure that the model meets the predefined property specifications, which include deadlock-free and divergence-free. The above specifications are formally defined using the #assert assertion statement in the PAT verifier, thereby achieving comprehensive verification of the dynamic behavior of the system.

3. The abstract modeling and verification method for the core transaction system architecture code implementation as claimed in claim 2, characterized in that: The method for modeling and verifying the architecture of the trading system also includes step S4. CSP formalized model optimization and feedback iteration, and optimization and feedback are performed according to the feedback results of the PAT verification to ensure that the system design can be improved in each iteration.

4. The abstract modeling and verification method for the core transaction system architecture code implementation as claimed in claim 1, characterized in that: The method for modeling and verifying the cluster leader selection module in the trading system is as follows: S1. Model the cluster master selection module of the core transaction system based on UML state machine diagram, including: S11. Analyze the code implementation logic of the cluster leader election module and abstract the different working states that may occur in the cluster node during the leader election process; S12. In-depth study of the state transition logic of nodes, and clearly define the transition conditions between different states of each node and its corresponding triggering events or operations through the UML state machine model; S13. Compare and verify the state machine diagram based on the design documents and actual code implementation of the cluster master election module to ensure that the state machine diagram accurately reflects the actual situation of the node behavior, thereby avoiding potential logical errors or inconsistencies; S2. The CSP model of the cluster leader selection module includes: S21. Map the state transitions and operations in the state machine diagram to event sequences in the CSP model, and combine different migration conditions through concurrent operators; S22. Considering that nodes in the cluster may fail, a failure state is added to the CSP model; S23. Define property specifications by assertion. The property specifications for state machine graphs include activity, safety, and stability. S3. Use the PAT model verifier for verification. After building the CSP formal model, use the PAT model verifier to verify the CSP model to ensure that the system meets the predefined property requirements, including activity, safety, and stability. By using the #assert assertion statement in the PAT verifier to formally define the above specifications, the key behaviors of the model are fully verified.

5. The abstract modeling and verification method for the core transaction system architecture code implementation as claimed in claim 4, characterized in that: The method for modeling and verifying the cluster leader selection module in the trading system also includes step S4. CSP formalized model optimization and feedback iteration, and optimization and feedback are performed according to the feedback results of PAT verification to ensure that the system design can be improved in each iteration.

Images