A consistency verification method, system and storage medium of a state transition model

Abstract

The application provides a state transition model consistency verification method, system and storage medium, the method comprises the following steps: obtaining the state transition model of the protocol and the implementation code, and obtaining the description of the configuration item and the state of the state transition model; determining the corresponding configuration items between the state transition models according to the description of the configuration items, and obtaining the position arrangement of the configuration items based on the position mapping function; screening out the valid configuration item code value sequence set based on the configuration item option conflict condition, the custom code meaning and the position arrangement of the configuration items; instantiating the state transition model by using the valid configuration item code value sequence set, and obtaining the state transition sequence set; determining and comparing the corresponding state parameters in the corresponding state transition sequence according to the description of the state, and taking the comparison result of the state transition sequence as the consistency verification result of the state transition model. The application can reasonably utilize the verification resources while ensuring the reliability and accuracy of the verification result.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a consistency verification method and system for a state transition model. Background Technology

[0002] In the design and implementation of modern communication and security protocols, various security protocols are designed based on protocol standards and specifications, such as TLS (Transport Layer Security), SSH (Secure Shell), IPSec (Internet Protocol Security), and QUIC (Quick UDP Internet Connections). These protocols constrain communication processes by explicitly defining state transition mechanisms, ensuring that core operations such as handshake negotiation and key exchange comply with standard requirements. Although protocol implementation code must strictly adhere to the corresponding standard specifications, the semantic gap between the natural language description of the protocol standard specifications and the implementation code, coupled with differences in design philosophies or coding implementation deviations among different developers, may lead to non-standard state transition behaviors in the protocol implementation code, thereby inducing security vulnerabilities or performance issues. Furthermore, even if multiple implementation codes describe the same protocol standard specification, the state transition models built by different implementation codes may differ significantly in naming conventions and structural design. Therefore, for the same security protocol, consistency verification of the state transition model built based on the standard specification and the implementation code is a crucial step in protocol development, performance optimization, and security assessment.

[0003] Each state transition model stores configuration items (which may also be referred to as input items in this application) and their parameters. Configuration items and parameters are key components for defining and managing state transition behavior, typically used to adjust the functionality, performance, and characteristics of the state transition model to meet specific needs. A configuration item refers to a specific function or module in the model that can be configured. Each configuration item can have multiple values, which are usually called configuration parameters. In the state transition model, configuration parameters can be used to set the state transition behavior specifically defined by the configuration item. Furthermore, because the configuration items in the state transition model have optionality (e.g., certain configuration items can be enabled or disabled to adjust the model's functionality according to requirements) and each configuration item can have multiple values, different configuration schemes can be formed by selecting different configuration items and their corresponding parameters. These configuration schemes can be used to define specific model behaviors or functional patterns; that is, each configuration scheme can represent a possible state or setting of the model.

[0004] On the one hand, the core principle of current state transition models for consistency verification lies in instantiating the model by enumerating configuration schemes and generating corresponding state transition sequences. If the code state transition model and the protocol standard state transition model output results completely consistent under each configuration scheme, then the state transition model is determined to be consistent; otherwise, it is necessary to locate the discrepancy nodes and trace the causes. However, since most protocols currently contain more than ten configuration items, the scale of the configuration schemes input to the state transition model will expand to an exponential multiple of the number of configuration items. Even when each input item has only two values, thousands of configuration schemes will still be formed. For example, suppose a state transition model selects three configuration items from a document, and each configuration item has two possible values: {Configuration item A: value 1, value 2; Configuration item B: value 3, value 4; Configuration item C: value 5, value 6}. Then the possible configuration schemes include the following eight: {(A: value 1, B: value 3, C: value 5), (A: value 1, B: value 3, C: value 6), (A: value 1, B: value 4, C: value 5), (A: value 1, B: value 4, C: value 6), (A: value 2, B: value 3, C: value 5), (A: value 2, B: value 3, C: value 6), (A: value 2, B: value 4, C: value 5), (A: value 2, B: value 4, C: value 6)}. Furthermore, protocol state transitions typically involve dozens of state nodes and complex logical branches. Current manual review methods are not only inefficient but also prone to missing some input configuration schemes and complex logical branches.

[0005] Current automated verification methods for state transition model consistency mainly follow two technical paths: one is fuzz testing, which detects state transition response behavior through random or semi-random configuration schemes. However, randomized testing cannot guarantee the exhaustion of all transition paths, posing a risk of missing critical paths and resulting in a lack of completeness assurance in the verification results; at the same time, since randomly generated inputs can only expose problems under limited configuration schemes, it is difficult to summarize the commonalities leading to the problems, further hindering the systematic classification and tracing of inconsistency problems.

[0006] The second approach is formal verification, which uses mathematical modeling and formal languages ​​to rigorously derive and verify the state transition model. Existing formal verification schemes achieve full input coverage through predefined model templates, but they still have the following significant limitations: the dependency on predefined templates or static rules leads to low efficiency in model structure adaptation, making it difficult to flexibly match naming and structural differences between different implementations, and the generation of redundant code significantly increases computational resource consumption.

[0007] Therefore, there is an urgent need for a new consistency verification method for state transition models, so as to make reasonable use of verification resources while ensuring the reliability and accuracy of verification results. Summary of the Invention

[0008] Therefore, embodiments of the present invention provide a consistency verification method for a state transition model, which can make reasonable use of verification resources while ensuring the reliability and accuracy of verification results.

[0009] One aspect of the present invention provides a consistency verification method for a state transition model, the method comprising the following steps: Obtain the protocol standard state transition model and the code state transition model, which store configuration items and states. Obtain the descriptions of configuration items and states in the protocol standard state transition model and the code state transition model. The protocol standard state transition model and the code state transition model are constructed using the same cryptographic programming language and correspond to the same security protocol. Based on the descriptions of configuration items in the standard state transition model and the code state transition model, the correspondence between configuration items in the standard state transition model and the code state transition model is obtained based on semantic consistency. Then, using the correspondence and a pre-built position mapping function to map the corresponding configuration items to the same specific position, the positional arrangement of configuration items in the standard state transition model and the code state transition model is obtained. Based on pre-defined configuration item conflict conditions, the custom meaning of each digit in a specific number system for configuration item options, and the positional arrangement of configuration items, a set of valid configuration item digit value sequences is selected from a pre-defined set of configuration item digit value sequences. The pre-defined set of configuration item digit value sequences is a set of sequences represented in a specific number system, obtained by iterating through the values ​​of each configuration item in the positional arrangement of configuration items to each digit in a specific number system. The protocol standard state transition model and the code state transition model are instantiated using a set of valid configuration item digital value sequences, respectively, to obtain the first state transition sequence and the second state transition sequence corresponding to each valid configuration item digital value sequence; wherein, both the first state transition sequence and the second state transition sequence contain state parameters corresponding to the state; For the first state transition sequence and the second state transition sequence corresponding to the same valid configuration item digital value sequence, based on the state description in the protocol standard state transition model and the code state transition model, the correspondence between each state parameter in the first state transition sequence and the second state transition sequence is obtained based on semantic consistency. The first state transition sequence and the second state transition sequence are compared based on the correspondence between each state parameter, thereby obtaining the consistency verification result of the protocol standard state transition model and the code state transition model.

[0010] In some embodiments of the present invention, comparing the first state transition sequence and the second state transition sequence based on the correspondence between various state parameters includes: By comparing the corresponding state parameters in the first state transition sequence and the second state transition sequence one by one, the mapping relationship between each state parameter in the first state transition sequence and the corresponding state parameter in the second state transition sequence is obtained.

[0011] In some embodiments of the present invention, the method further includes: If the mapping relationship between the current state parameter in the first state transition sequence and the corresponding state parameter in the second state transition sequence is inconsistent, the inconsistency problem is recorded, and the inconsistency problem is filtered by adding, deleting, or modifying.

[0012] In some embodiments of the present invention, the effective set of configuration item digital value sequences is obtained in the following manner: A set of configuration schemes is obtained by using a pre-defined set of numerical value sequences for configuration items and the positional arrangement of configuration items; Based on the custom meaning of each digit in a specific number system for configuration options and the set of configuration schemes, configuration schemes that meet the pre-set conflict conditions of configuration options are filtered, thereby obtaining a valid set of configuration digit value sequences based on the filtered set of configuration schemes.

[0013] In some embodiments of the present invention, after obtaining the correspondence between the various state parameters in the first state transition sequence and the second state transition sequence, the method further includes: The state name mapping function replaces the names of states corresponding to state parameters that have a correspondence in the first state transition sequence and the second state transition sequence with the same set standard state name; wherein, the state name mapping function contains the mapping relationship between the set standard state name and the names of states corresponding to state parameters in the first state transition sequence or the second state transition sequence.

[0014] In some embodiments of the present invention, after obtaining the first state transition sequence and the second state transition sequence, the method further includes: for the first state transition sequence or the second state transition sequence, If the length of the current state transition sequence is less than the set sequence length, continue adding the last state parameter from the current state transition sequence until the length of the current state transition sequence reaches the set sequence length. If the length of the current state transition sequence is greater than the set sequence length, the last state parameter in the current state transition sequence is continuously deleted until the length of the current state transition sequence is shortened to the set sequence length.

[0015] In some embodiments of the present invention, the cryptographic programming language used to construct the protocol standard state transition model and the code state transition model is the Cryptol language, and the specific number system is binary; The protocol standard state transition model and the code state transition model are instantiated using a valid set of configuration item value sequences, including: Using the SAW tool, the protocol standard state transition model and the code state transition model are instantiated by traversing each valid configuration item digital value sequence in the set of valid configuration item digital value sequences.

[0016] Another aspect of the present invention provides a consistency verification system for a state transition model, including a processor, a memory, and a computer program / instructions stored in the memory. The processor is used to execute the computer program / instructions, and when the computer program / instructions are executed, the system implements the steps of the method described in any of the above embodiments.

[0017] Another aspect of the present invention provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the method described in any of the above embodiments.

[0018] Another aspect of the present invention provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in any of the above embodiments.

[0019] The consistency verification method and system for state transition models proposed in this invention use a specific number system (such as binary) to cover all valid configuration schemes, ensuring that every valid input case can be analyzed. This solves the verification problem caused by naming and structural differences between different state transition models, and can make reasonable use of verification resources while ensuring the reliability and accuracy of verification results.

[0020] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0021] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings: Figure 1 This is a flowchart illustrating the consistency verification method of the state transition model in one embodiment of the present invention.

[0023] Figure 2 This is a schematic diagram illustrating the process of obtaining the arrangement of configuration items in one embodiment of the present invention.

[0024] Figure 3 This is a schematic diagram of the process for filtering a set of valid configuration item digital value sequences in one embodiment of the present invention.

[0025] Figure 4 This is a schematic diagram illustrating the process of instantiating a model using a set of valid configuration item digital value sequences in one embodiment of the present invention.

[0026] Figure 5 This is a flowchart illustrating the comparison of state transition sequences and problem analysis in one embodiment of the present invention.

[0027] Figure 6 This is a flowchart illustrating the process of unifying state names in a state transition sequence according to an embodiment of the present invention.

[0028] Figure 7 This is a flowchart illustrating the consistency verification method for the state transition model in another embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0030] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0031] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0032] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0033] Generally, a security protocol may have a protocol standard specification (usually in the form of natural language) and be implemented through a code language, such as C or Java. Both the protocol standard specification and the protocol implementation code can be represented in the form of a state transition model. In this application, the state transition model built based on the protocol standard specification can be called the protocol standard state transition model, and the state transition model built based on the protocol implementation code can be called the code state transition model. However, for the same security protocol, the state transition behavior of state transition models built by different protocol implementation codes may differ for the same configuration scheme; that is, the protocol implementation code may produce non-standard state transition behavior. Therefore, it is necessary to verify the state transition model built by the protocol implementation code. Furthermore, in the current process of verifying the code state transition model, the state transition model built based on the protocol standard specification is usually used as a standard for consistency comparison with the code state transition model.

[0034] The principle of state transition model consistency verification lies in instantiating the standard state transition model and the code state transition model using all configuration schemes to generate corresponding state transition sequences, thereby achieving consistency verification of the state transition model. Existing technologies developed based on the aforementioned consistency verification principle, such as fuzz testing and template-based verification, either rely on random input leading to missed detections or are limited by static templates, making it difficult to adapt to different models, and thus cannot achieve full input coverage and dynamic parameter mapping. Therefore, this application proposes a consistency verification method for state transition models. The entire verification process includes several key steps, from unified encoding and automated sequence generation to the standardization and comparison of state transition sequences. Each step is closely linked and works in concert to form an efficient and reliable verification method. This method, through a systematic and structured process, ensures the comprehensiveness and accuracy of state transition model consistency verification, possessing irreplaceable flexibility, coverage, and efficiency. It provides a novel and practically valuable solution for the consistency verification of state transition models in security protocols.

[0035] Figure 1 This is a flowchart illustrating the consistency verification method of the state transition model in one embodiment of this application. Figure 1 As shown, the method includes steps S110 to S150.

[0036] Step S110: Obtain the protocol standard state transition model and the code state transition model corresponding to the same security protocol; both types of state transition models store configuration items and states, so it is also possible to obtain the descriptions of configuration items and states in the protocol standard state transition model, as well as the descriptions of configuration items and states in the code state transition model.

[0037] More specifically, the protocol standard state transition model and the code state transition model can be constructed using the same cryptographic programming language to facilitate the standardization of configuration item mapping and configuration parameter conversion in subsequent steps, thereby unifying the input space. This application does not specifically limit the language used to construct the protocol standard state transition model and the code state transition model; these languages ​​can be varied according to requirements. For example, this application can use Cryptol or other domain-specific programming languages ​​for cryptography to construct the protocol standard state transition model and the code state transition model. Furthermore, the descriptions of configuration items and states can also be expressed using languages ​​supported by the protocol standard state transition model and the code state transition model.

[0038] As an example, the descriptions of configuration items and states in the standard protocol state transition model can be obtained from the corresponding standard protocol documentation, while the descriptions of configuration items and states in the code-based state transition model can be obtained from the corresponding code and documentation. The description of a configuration item is a detailed explanation of the various configuration options, parameters, and functions of a state. A state represents a specific configuration or condition of the model at a given moment, and its description typically includes the state name, state parameters, and state entry conditions.

[0039] Furthermore, the configuration items and states stored in both the protocol standard state transition model and the code state transition model can be determined according to the corresponding security protocol (which contains configuration items and state information). Since the protocol standard state transition model and the code state transition model correspond to the same security protocol, the meanings of the configuration items in the protocol standard state transition model and their corresponding configuration items in the code state transition model are the same, and the meanings of the states in the protocol standard state transition model and their corresponding states in the code state transition model are also the same. However, the meanings of the various input items included in the security protocol are different; therefore, the semantics of the various configuration items or states stored in the protocol standard state transition model (or the code state transition model) are not the same.

[0040] Step S120: As Figure 2As shown, since the protocol standard state transition model and the code state transition model corresponding to the same security protocol are built based on the same cryptographic programming language, the correspondence between the configuration items in the protocol standard state transition model and the code state transition model can be obtained based on semantic consistency according to the description of the configuration items in the protocol standard state transition model and the code state transition model. Furthermore, based on the obtained correspondence and the pre-built position mapping function, the corresponding configuration items in the protocol standard state transition model and the code state transition model can be mapped to the same specific position, thereby obtaining the sequence position arrangement of the configuration items in the protocol standard state transition model and the code state transition model. The pre-built position mapping function is used to map the corresponding configuration items to the same specific position. This application uses step S120 to map the input items of the state transition model, which can ensure the standardized conversion of input items between different state transition models in subsequent steps.

[0041] More specifically, the naming of configuration items may differ across state transition models. Therefore, the descriptions of configuration items can be used to identify semantically identical configuration items in both the protocol standard state transition model and the code state transition model. Furthermore, the semantics of each configuration item in either the protocol standard state transition model or the code state transition model are distinct (i.e., two semantically identical configuration items must belong to different models, one in the protocol standard state transition model and the other in the code state transition model). Therefore, a correspondence can be established between configuration items with the same semantics in both models. Additionally, this step can employ techniques such as semantic understanding models or large-scale models to determine semantically consistent configuration items (and states), but this invention is not limited to these methods.

[0042] The core principle of state transition model consistency verification lies in determining all configuration schemes by traversing the values ​​of all configuration items in the security protocol to instantiate the state transition model. Each configuration scheme consists of the various configuration items and their values ​​included in the security protocol. This application designs a unified input space approach to simplify the input representation of the state transition model: the relative arrangement of each configuration item is determined through a position mapping function, and the values ​​of the configuration items are determined based on a specific number system. Then, only the values ​​of the configuration items are used as input to instantiate the model, thereby obtaining the corresponding state transition sequence. This simplifies the subsequent process of traversing configuration schemes and instantiating the model without needing to study the specific state transition behavior. For example, taking the code state transition model as an example, assuming that the configuration items stored in the code state transition model contain {A,B,C,D}, and a certain configuration scheme П can be represented as {A=0,B=1,C=1,D=0}, this application can pre-design the position arrangement of the configuration items in the code state transition model as (A,B,D,C) through the position mapping function. Then, the configuration item digital value sequence corresponding to the configuration scheme П can be represented as (0,1,0,1). By instantiating the code state transition model using the configuration item digital value sequence (0,1,0,1), the state transition sequence corresponding to the configuration scheme П can be obtained.

[0043] As an example, to achieve a unified input space, this application requires pre-constructing a position mapping function that includes the mapping relationship between configuration items and specific element positions. The pre-constructed position mapping function is used to map the current configuration item in the protocol standard state transition model and the corresponding current configuration item in the code state transition model to the same specific position for each configuration item, thus obtaining the positional arrangement of the configuration items.

[0044] Furthermore, if the correspondence between configuration items in the standard protocol state transition model and the code state transition model is not determined when constructing the position mapping function, the position mapping function may include the mapping relationship between configuration items in the standard protocol state transition model or the code state transition model and the position of a specific element. If the correspondence between configuration items in the standard protocol state transition model and the code state transition model is determined when constructing the position mapping function, the position mapping function may include the mapping relationship between configuration items in the standard protocol state transition model and / or the code state transition model and the position of a specific element. Additionally, the position mapping function can be constructed using the same cryptographic programming language used to construct the standard protocol state transition model and the code state transition model.

[0045] As an example, the position mapping function applies to all configuration items included in the security protocol corresponding to the code state transition model, and the specific element position of each pair of corresponding configuration items can be randomly determined. Furthermore, the arrangement of configuration item positions can be represented as two associated sequences, where one configuration item occupies one element position in either sequence, or as a sequence containing configuration items from both the protocol standard state transition model and the code state transition model, where a pair of corresponding configuration items occupies one element position. For example, suppose the configuration items in the code state transition model include {A, B, C, D}, and the configuration items in the protocol standard state transition model include {E, F, G, H}. A pre-constructed position mapping function indicates that the positional arrangement of each configuration item in the code state transition model is (A, B, D, C), and the correspondence between the configuration items in the protocol standard state transition model and the configuration items in the code state transition model is A corresponds to E, B to F, C to G, and D to H. Then, the positional arrangement of the configuration items can be represented as (A / E, B / F, D / H, C / G), or it can be represented by both (A, B, D, C) and (E, F, H, G). The aforementioned representation of the configuration item positional arrangement is merely an example; other methods can also be used to represent it, as long as the positional arrangement of the configuration items reflects the correspondence between configuration items and the mapping relationship between configuration items and element positions. Furthermore, this application does not specifically limit the mapping relationship between configuration items and element positions, as long as the configuration items in the protocol standard state transition model or code state transition model are located in different element positions to form a configuration item position arrangement.

[0046] This application cleverly solves the verification challenge caused by naming and structural differences between different state transition models through step S120. This not only effectively simplifies the input processing flow but also lays a solid foundation for subsequent automated verification. In practical applications, regardless of the different names of the input items or the model structure of the state transition models, as long as the model contains semantically consistent input items, they can be uniformly processed through a specific number system encoding method, thereby ensuring the consistency and accuracy of verification and avoiding verification errors or omissions caused by differences in input items.

[0047] Step S130: Based on pre-defined configuration option conflict conditions, the meaning of each digit in a custom number system for configuration option choices, and the positional arrangement of configuration items, a valid set of configuration option digit value sequences can be selected from a pre-defined set of configuration option digit value sequences. Step S130 further ensures the effectiveness of the configuration scheme. The pre-defined configuration option conflict conditions can be determined from the protocol standard document and the corresponding documentation for the code state transition model, including option conflict conditions for configuration items in both the protocol standard state transition model and the code state transition model.

[0048] In some embodiments of this invention, the configuration parameters of the same configuration item may differ in different security protocols. To further unify the input representation and make the method proposed in this application applicable to multiple security protocols, this application designs a digital representation of the values ​​of each configuration item in the configuration scheme using a specific number system. Specifically, by using the digital representation of each configuration item in the positional arrangement of the configuration items in the specific number system, a sequence set containing multiple configuration item digital value sequences can be obtained, which replaces the instantiation of the state transition model based on all configuration schemes determined according to the configuration items contained in the security protocol. This application may refer to the obtained sequence set as the configuration item digital value sequence set (i.e., the configuration item digital value sequence set is represented using a specific number system), and the specific number system may be binary, octal, decimal, etc.

[0049] This application standardizes and unifies input items by mapping input items with the same semantics to the same element position and representing the values ​​of each configuration item in the configuration scheme using a specific number system. Through dynamic exploration of the input space, this application can complete efficient consistency verification with minimal code, maximizing the efficiency of consistency verification.

[0050] As an example, assume that each configuration item in the security protocol has only two possible values, and that the binary system (with a base of 2, which is sufficient to encompass the possible values ​​of the configuration items, but other number systems can also be used) is used to set the sequence of numerical values ​​for the configuration items. If the value of a configuration item is based on its options (options of a configuration item are used to represent different choices or settings of the configuration item, such as enabling / disabling options), then the meaning of each number in a specific number system for the configuration item options can be customized. For example, for the binary numbers 0 and 1, it can be assumed that 0 indicates that the current input item setting is not enabled, and 1 indicates that the current input item setting is enabled (this invention does not specifically limit the meaning of the customized numbers; for example, it can also be assumed that 0 indicates that the current input item setting is enabled, and 1 indicates that the current input item setting is not enabled). If the positional arrangement of the configuration items is determined to be (A / E, B / F, D / H, C / G), then the values ​​of each element position in the configuration item positional arrangement are traversed. If the positional arrangement of the configuration items is represented as (A, B, D, C) and (E, F, H, G), then considering that the effective configuration item digital value sequence set of the input protocol standard state transition model and the code state transition model is the same when the model is instantiated later, the values ​​of each element position in any sequence can be traversed. Therefore, when the specific number system is binary, the set of configuration item digit value sequences obtained by integrating the binary values ​​of all element positions can be represented as {(0,0,0,0),(1,0,0,0),(0,1,0,0),(0,0,1,0),(0,0,0,1),(1,1,0,0),(1,0,1,0),(1,0,0,1),(0,1,1,0),(0,1,0,1),(0,0,1,1),(1,1,1,0),(1,1,0,1),(1,0,1,1),(0,1,1,1),(1,1,1,1)}. That is, for a state transition model containing n configuration items (such as a code state transition model), the pre-defined binary range of the configuration item digit value sequence set is 0 to 2. n -1.

[0051] This application design replaces the configuration scheme by determining the sequence of values ​​for each configuration item using a specific number system, and then replaces manual verification with an automated mapping mechanism, effectively solving the problem of the completeness of the configuration scheme by manually traversing the traditional structure representation method.

[0052] In some embodiments of the present invention, after pre-setting a set of configuration item digital value sequences, it is also necessary to identify invalid configuration schemes caused by logical dependencies or conflicts between input items, that is, to filter out valid configuration item digital value sequences from the pre-set set of configuration item digital value sequences. For example... Figure 3 As shown, the valid set of configuration item digital value sequences can be obtained in the following ways: A configuration scheme set is obtained by using a pre-defined set of configuration item numeric value sequences and the positional arrangement of configuration items. Based on the meaning of each numeric value in a custom number system for configuration item options and the configuration scheme set, configuration schemes that meet pre-defined configuration item option conflict conditions are filtered out. Thus, a valid set of configuration item numeric value sequences is obtained from the filtered configuration scheme set. The valid set of configuration item numeric value sequences contains one or more valid configuration item numeric value sequences.

[0053] By combining the constraints between input items, this invention can identify and eliminate invalid configuration schemes. This ability to dynamically generate valid configuration schemes allows the verification process to be more accurately targeted at actually feasible input situations, avoiding invalid or impossible verification of configuration schemes, improving the efficiency and relevance of verification, ensuring the rational use of verification resources, and making the verification results more consistent with actual operating conditions.

[0054] As an example, the process of obtaining a valid set of configuration item digital value sequences is implemented through a filtering function, thereby selecting valid configuration item digital value sequences that conform to logic and specifications. The filtering function can be constructed using a cryptographic programming language that builds code state transition models. Furthermore, the pre-defined configuration item conflict conditions can be constraints between configuration items obtained from protocol standard documents, or they can be custom constraints between configuration items. For example, constraints between configuration items may include the requirement that enabling one input item requires enabling another input item. Considering that the constraints between configuration items are mostly constraints between configuration item options, the configuration item conflict conditions in this application can also be called configuration item option conflict conditions.

[0055] In step S130, this application combines specific number system encoding and filtering rules to achieve dynamic mapping of configuration items. By standardizing the configuration scheme through specific number system encoding and using filtering rules to select valid numerical value sequences for configuration items, this not only solves the limitations and inefficiencies of parameter mapping in traditional methods but also provides strong support for the flexibility and accuracy of the verification process.

[0056] Step S140: Instantiate the protocol standard state transition model and the code state transition model using the set of valid configuration item digital value sequences, and obtain the first state transition sequence and the second state transition sequence corresponding to each valid configuration item digital value sequence in the set of valid configuration item digital value sequences.

[0057] Instantiation refers to the process of concretizing a protocol standard state transition model or a code state transition model into a specific instance to adapt to a particular application scenario or dataset. For a given state transition model, one configuration scheme corresponds to one state transition sequence. Even if the input representation used for instantiation in this application differs from existing schemes, a valid sequence of configuration item values ​​still corresponds to one state transition sequence. For example, with m configuration schemes, each of the two state transition models (i.e., the protocol standard state transition model and the code state transition model) generates m state transition sequences.

[0058] Moreover, the first state transition sequence and the second state transition sequence in this application are only used to distinguish the outputs of the protocol standard state transition model and the code state transition model, and do not represent the order. For example, instantiating the protocol standard state transition model can yield the first state transition sequence, and instantiating the code state transition model can yield the second state transition sequence.

[0059] In some embodiments of the present invention, both the first state transition sequence and the second state transition sequence include state parameters corresponding to the states. Each state parameter in the first state transition sequence and the second state transition sequence has a specific element position in the state transition sequence, and in this application, each element position in the state transition sequence can be regarded as a state node. One state parameter corresponds to one state node, and different state parameters in the same state transition sequence correspond to different state nodes.

[0060] As an example, when the language for constructing the protocol standard state transition model and the code state transition model is Cryptol, this application can use the SAW (Software Analysis Workbench) tool, which is fully compatible with Cryptol, to perform step S140 (i.e., using the SAW tool to instantiate the protocol standard state transition model and the code state transition model by traversing each valid configuration item value sequence in the set of valid configuration item value sequences), thus avoiding the adaptation costs of porting the state transition model to other scripting languages ​​(such as Python). Moreover, the SAW tool is used to traverse the input valid configuration item value sequences to instantiate the model, eliminating the need to instantiate the model separately for each configuration scheme, thus eliminating the generation of redundant code. The method of automatically generating state transition sequences using the SAW tool differs from existing formal modeling verification methods, providing dual guarantees for the reliability and verification efficiency of the state transition model. The above use of the SAW tool as a looper is merely an example; other automated tools can also be used, and this application is not limited to this.

[0061] If the SAW tool is used as the looper for the Cryptol model, such as Figure 4As shown, the process of instantiating two state transition models using a valid set of configuration item digital value sequences in step S140 is as follows: Based on the valid set of configuration item digital value sequences, the input range is set in the SAW tool to cover all configuration schemes to be verified (i.e., all valid configuration item digital value sequences are set in the SAW tool), indicating that the outputs of the protocol standard state transition model and the code state transition model are both state transition sequences. The SAW tool is used to automatically traverse each valid configuration item digital value sequence and instantiate the model for execution, obtaining the state transition sequences corresponding to the two models respectively, and recording the state transition sequences under different configuration item digital value sequences.

[0062] In some embodiments of the present invention, after obtaining the first state transition sequence and the second state transition sequence, the method further includes: for the first state transition sequence or the second state transition sequence, if the length of the current state transition sequence is less than a set sequence length, continuously adding the last state parameter of the current state transition sequence after the last state parameter of the current state transition sequence until the length of the current state transition sequence reaches the set sequence length (for example, if the set sequence length is 10, and the current state transition sequence is (0,1,1,0,1,1), its length is 6, then the length of the current state transition sequence can be increased to 10, and the current state transition sequence after the length increase can be represented as (0,1,1,0,1,1,1,1,1,1)); for the first state transition sequence or the second state transition sequence, if the length of the current state transition sequence is greater than the set sequence length, continuously deleting the last state parameter of the current state transition sequence until the length of the current state transition sequence is shortened to the set sequence length. By defining a uniform state transition sequence length, the state transition sequences output by the two state transition models under the same input conditions are ensured to be comparable, avoiding comparison failures due to length differences.

[0063] In step S140, the present invention can traverse the input configuration item digital value sequence to instantiate the state transition model, thereby obtaining the state transition sequences of two different models. This not only significantly improves work efficiency but also ensures the stability and reproducibility of the output state transition sequences. Furthermore, when faced with a large number of configuration schemes and complex model structures, the SAW tool can be used to automatically generate state transition sequences. This automated sequence generation process can quickly and accurately generate the required state transition sequences, providing a reliable data foundation for subsequent sequence comparison and problem analysis.

[0064] Step S150: For the first and second state transition sequences corresponding to the same valid configuration item digital value sequence, based on the state descriptions in the protocol standard state transition model and the code state transition model, determine the correspondence between the states corresponding to each state parameter in the first and second state transition sequences based on semantic consistency. Based on the correspondence between states, obtain the correspondence between each state parameter in the first and second state transition sequences. Then, compare the first and second state transition sequences based on the correspondence between each state parameter to obtain the consistency verification result of the protocol standard state transition model and the code state transition model. Note that there is a correspondence between the states and the state parameters in the output state transition sequence.

[0065] More specifically, since there is no direct correspondence between the states output by different state transition models, even if the same valid configuration item digital value sequence is used to instantiate the protocol standard state transition model and the code state transition model, a correspondence still needs to be established between the resulting first state transition sequence and the second state transition sequence. Similar to configuration items, a correspondence needs to be established between semantically consistent states based on the state descriptions in the protocol standard state transition model and the code state transition model (two semantically identical states must have one corresponding to the protocol standard state transition model and the other to the code state transition model), thereby establishing a correspondence between various state parameters based on the correspondence between the states and the state parameters in the state transition sequence.

[0066] In some embodiments of the present invention, the consistency verification results of the protocol standard state transition model and the code state transition model are obtained by comparing the first state transition sequence and the second state transition sequence based on the correspondence between various state parameters, including: By comparing the corresponding state parameters in the first and second state transition sequences one by one, the mapping relationship between each state parameter in the first state transition sequence and its corresponding state parameter in the second state transition sequence is obtained. Based on the consistency result of the mapping relationship, the consistency verification result of the protocol standard state transition model and the code state transition model is obtained. In this application, the mapping relationship between state parameters is used to represent the transformation function used when a certain state parameter in the first state transition sequence is transformed into its corresponding state parameter in the second state transition sequence.

[0067] Furthermore, based on the obtained mapping relationships between state parameters, the consistency verification results of the protocol standard state transition model and the code state transition model are obtained. Specifically, the method includes: if the mapping relationships between each state parameter in the first state transition sequence and the corresponding state parameter in the second state transition sequence are consistent, the protocol standard state transition model and the code state transition model can be considered consistent; during the comparison of state parameters one by one, if the mapping relationship between the current state parameter in the first state transition sequence and the corresponding state parameter in the second state transition sequence is inconsistent (i.e., the protocol standard state transition model and the code state transition model are inconsistent), the inconsistency problem needs to be recorded, and filtered by adding, deleting, or modifying. After filtering the problem, the next state parameter can be compared. That is, in the case of inconsistent state parameters, the position of the state parameter with the inconsistent mapping relationship in the second state transition sequence can be determined, thereby identifying the state node with the inconsistency problem in the second state transition sequence; the problem is recorded and filtered at the state node with the inconsistency problem.

[0068] As an example, the method of filtering inconsistencies by adding, deleting, or modifying in this application can be as follows: Assume that for a valid configuration item digital value sequence, the first state transition sequence output by the protocol standard state transition model contains s state parameters, while the second state transition sequence output by the code state transition model may contain k state parameters (k is not necessarily equal to s). During the process of comparing state parameters one by one, if the mapping relationship between the current state parameter in the first state transition sequence and the corresponding state parameter in the second state transition sequence is inconsistent, then the current state parameter in the first state transition sequence is added to a specific element position in the second state transition sequence (in this example, it is assumed that the state transition sequence output by the code state transition model is the second state transition sequence) (the element position preceding the state parameter corresponding to the current state parameter in the first state transition sequence is the specific element position), or the state parameter corresponding to the current state parameter in the second state transition sequence is deleted, or the state parameter corresponding to the current state parameter in the second state transition sequence is modified, so that the mapping relationship between the modified state parameter and the current state parameter in the first state transition sequence is consistent with the mapping relationship between other state parameters.

[0069] like Figure 5As shown, the process of comparing and analyzing state transition sequences can be as follows: Each state transition sequence output by the protocol standard state transition model and the code state transition model is compared to determine their consistency. If inconsistent sequences exist, the specific problems causing the differences are identified and recorded in the known problem list. Simultaneously, a script is used to filter identified problems to eliminate their impact on subsequent comparisons. This process of comparing sequences, identifying problems, and filtering problems is repeated until the comparison of the first and second state transition sequences corresponding to all valid configuration item value sequences is completed. Finally, a complete problem list is output to comprehensively demonstrate the differences in state transition behavior between the protocol standard state transition model and the code state transition model.

[0070] After step S150, considering the differences in naming rules among different state transition models (i.e., the names of states with the same semantics differ in different state transition models), to facilitate the comparison of state transition sequences, the names of the states corresponding to the state parameters in the first and second state transition sequences can be unified in step S160. The specific process is as follows: After obtaining the correspondence between each state parameter in the first and second state transition sequences, the names of the states corresponding to the state parameters in the first and second state transition sequences are replaced with the same set standard state names based on the state name mapping function (and the set standard state names corresponding to each state parameter in the first or second state transition sequence are different); wherein, the state name mapping function contains the mapping relationship between the names of the states corresponding to the state parameters in the state transition sequence and the set standard state names.

[0071] As an example, similar to the position mapping function, if the correspondence between the state parameters in the first and second state transition sequences is not determined when constructing the state name mapping function, the state name mapping function may include the mapping relationship between the state names in the protocol standard state transition model or the code state transition model and the set standard state names; if the correspondence between the state parameters in the first and second state transition sequences is determined when constructing the state name mapping function, the state name mapping function may include the mapping relationship between the state names in the protocol standard state transition model and / or the code state transition model and the set standard state names.

[0072] More specifically, such as Figure 6As shown, for the first state transition sequence and the second state transition sequence corresponding to the same valid configuration item digital value sequence, the corresponding state parameters are identified (the states corresponding to the corresponding state parameters have the same semantics but may have different names). A unified standard state name is selected, and the original state names in the protocol standard state transition model and the code state transition model are replaced in batches through a pre-built automated mapping script to eliminate the differences in state names between different state transition models, thereby outputting a state transition sequence with consistent state name naming specifications.

[0073] For example, the names of states in the standard state transition model can be used as the set standard state names, and only the names of the states corresponding to the state parameters in the state transition sequence output by the code state transition model are replaced with the set standard state names. This application does not specifically limit the method of replacing the set standard state names; as long as the names of the states corresponding to the state parameters in the first state transition sequence and the second state transition sequence are consistent through step S160.

[0074] In step S160, the present invention can, according to a preset state name mapping rule, batch replace the original state names corresponding to the state parameters in the first state transition sequence and the second state transition sequence with unified standard state names (for example, automated replacement can be achieved by constructing an automated mapping script). The standardized mapping mechanism (including state name mapping rules and logic) adopted for the state transition sequences resolves the naming differences between the protocol standard state transition model and the code state transition model. This mechanism effectively eliminates the differences in state naming between different models, enabling state transition sequences from different models to be compared under the same naming convention. Through this standardized mapping, state transition sequences generated by both the protocol standard state transition model and the code state transition model can be unified into a standard framework, thereby ensuring the comparability of state transition sequences. This provides the necessary prerequisite for accurately identifying inconsistent nodes between models, making the verification results more accurate and reliable.

[0075] Unlike traditional verification methods that require parsing specific state transition behaviors, this invention focuses on verifying the equivalence of input and output behaviors for protocol standard state transition models and code state transition models built using the same cryptographic coding language. On one hand, it constructs a standardized input space based on the same language, corresponding to equivalent inputs for different state transition models. On the other hand, it instantiates the model by traversing all valid configuration schemes, generating corresponding state transition sequences, and performing consistency checks on the state nodes in the state transition sequences.

[0076] Specifically, such as Figure 7As shown, in step S120, this application unifies the input space based on the state transition model built in the same language. In step S130, all possible configuration schemes are pre-generated, and the validity of the configuration schemes is explored to eliminate invalid combinations (in this application, the configuration schemes are represented by a sequence of configuration item values). In step S140, the model is instantiated iteratively and all valid configuration schemes are output as state transition sequences. In step S150, the state transition sequences are compared one by one and inconsistent nodes are identified, finally locating all implementation differences of the code state transition model. The consistency verification method of the state transition model proposed in this application has the following significant advantages: ① Accuracy: Formal modeling and symbolic execution techniques are used to ensure the accuracy and comprehensiveness of the verification process. This invention, through precise formal models and rigorous symbolic execution procedures, can accurately correspond to the state transition sequence of each configuration scheme.

[0077] ② Flexibility: Not reliant on a fixed model template, this invention can adapt to different protocol implementation codes and model structures for consistency analysis. This allows it to maintain good applicability and effectiveness even when faced with diverse protocol implementations and complex, ever-changing model structures. Whether it's a model built by different developers or different versions of protocol implementation code, this invention can flexibly perform consistency verification without requiring large-scale adjustments or modifications to the model, thus adapting to the complex and ever-changing needs of practical applications.

[0078] ③ Comprehensiveness: By using binary encoding to cover all valid configuration schemes, this invention avoids verification omissions. It employs binary encoding to comprehensively cover all possible configuration schemes, combined with conflict constraints to filter invalid combinations, ensuring that every valid configuration scheme is analyzed.

[0079] ④ High Efficiency: This application can quickly generate and compare state transition sequences through automated tools, significantly improving verification efficiency. Specifically, the method of this invention utilizes the efficient combination of Cryptol language and SAW tools, avoiding a large amount of manual operation and repetitive work in traditional methods, enabling the verification process to be completed quickly. This advantage is particularly evident when dealing with state transition models of complex protocols, enabling the processing of a large number of configuration schemes and state transition sequences in a short time, greatly improving the efficiency of verification work.

[0080] ⑤ Scalability: Facilitates horizontal comparison of the security and efficiency of different protocol implementations. The method proposed in this invention is not only applicable to the verification of a single protocol implementation, but can also be extended to the verification of multiple protocol libraries. Through a unified verification process and protocol standard specifications, it is easy to conduct horizontal comparisons of different protocol implementations and analyze their performance in terms of security and efficiency.

[0081] Corresponding to the above method, the present invention also provides a consistency verification system for a state transition model. The system includes a computer device, which includes a processor and a memory. The memory stores computer programs / instructions, and the processor is used to execute the computer programs / instructions stored in the memory. When the computer programs / instructions are executed by the processor, the system implements the steps of the method described above.

[0082] This invention also provides a computer-readable storage medium storing a computer program / instructions thereon, which, when executed by a processor, implements the steps of the aforementioned edge computing server deployment method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0083] This invention also provides a computer program product storing a computer program / instructions thereon, which, when executed by a processor, implements the steps of the aforementioned edge computing server deployment method. The computer program product can be a tangible product, such as random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of product known in the art.

[0084] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0085] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0086] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0087] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A consistency verification method for a state transition model, characterized in that, The method includes the following steps: Obtain a protocol standard state transition model and a code state transition model that store configuration items and states, and obtain the descriptions of configuration items and states in the protocol standard state transition model and the descriptions of configuration items and states in the code state transition model; wherein the protocol standard state transition model and the code state transition model are constructed using the same cryptographic programming language and correspond to the same security protocol. Based on the descriptions of configuration items in the protocol standard state transition model and the code state transition model, the correspondence between configuration items in the protocol standard state transition model and configuration items in the code state transition model is obtained based on semantic consistency. Then, using the correspondence and a pre-built position mapping function for mapping corresponding configuration items to the same specific position, the positional arrangement of configuration items in the protocol standard state transition model and the code state transition model is obtained. Based on pre-defined configuration item option conflict conditions, the custom meaning of each digit in a specific number system for configuration item options, and the positional arrangement of the configuration items, a set of valid configuration item digit value sequences is selected from a pre-defined set of configuration item digit value sequences; wherein, the pre-defined set of configuration item digit value sequences is a set of sequences represented in a specific number system obtained by iterating through the values ​​of each configuration item in the positional arrangement of the configuration items to each digit in a specific number system. The protocol standard state transition model and the code state transition model are instantiated using the set of valid configuration item digital value sequences, respectively, to obtain a first state transition sequence and a second state transition sequence corresponding to each valid configuration item digital value sequence; wherein, both the first state transition sequence and the second state transition sequence contain state parameters corresponding to the state; For the first state transition sequence and the second state transition sequence corresponding to the same valid configuration item digital value sequence, based on the state description in the protocol standard state transition model and the code state transition model, the correspondence between each state parameter in the first state transition sequence and the second state transition sequence is obtained based on semantic consistency. Based on the correspondence between each state parameter, the first state transition sequence and the second state transition sequence are compared, thereby obtaining the consistency verification result of the protocol standard state transition model and the code state transition model.

2. The method according to claim 1, characterized in that, The comparison of the first state transition sequence and the second state transition sequence based on the correspondence between various state parameters includes: By comparing the corresponding state parameters in the first state transition sequence and the second state transition sequence one by one, the mapping relationship between each state parameter in the first state transition sequence and the corresponding state parameter in the second state transition sequence is obtained.

3. The method according to claim 2, characterized in that, The method further includes: If the mapping relationship between the current state parameter in the first state transition sequence and the corresponding state parameter in the second state transition sequence is inconsistent, the inconsistency problem is recorded, and the inconsistency problem is filtered by adding, deleting, or modifying.

4. The method according to claim 1, characterized in that, The valid set of configuration item digital value sequences is obtained through the following method: A configuration scheme set is obtained by using a pre-defined set of configuration item digital value sequences and the positional arrangement of the configuration items; Based on the custom meaning of each digit in a specific number system for configuration options and the set of configuration schemes, configuration schemes that meet the pre-set conflict conditions for configuration options are filtered, thereby obtaining a valid set of configuration digit value sequences based on the filtered set of configuration schemes.

5. The method according to claim 1, characterized in that, After obtaining the correspondence between the state parameters in the first state transition sequence and the second state transition sequence, the method further includes: The state name mapping function replaces the names of states corresponding to state parameters that have a correspondence in the first state transition sequence and the second state transition sequence with the same set standard state name; wherein, the state name mapping function contains the mapping relationship between the set standard state name and the names of states corresponding to state parameters in the first state transition sequence or the second state transition sequence.

6. The method according to claim 1, characterized in that, After obtaining the first state transition sequence and the second state transition sequence, the method further includes: for the first state transition sequence or the second state transition sequence, If the length of the current state transition sequence is less than the set sequence length, continue adding the last state parameter from the current state transition sequence until the length of the current state transition sequence reaches the set sequence length. If the length of the current state transition sequence is greater than the set sequence length, the last state parameter in the current state transition sequence is continuously deleted until the length of the current state transition sequence is shortened to the set sequence length.

7. The method according to claim 1, characterized in that, The cryptographic programming language used to construct the protocol standard state transition model and the code state transition model is the Cryptol language, and the specific number system is binary; The instantiation of the protocol standard state transition model and the code state transition model using the valid configuration item digital value sequence set includes: Using the SAW tool, the protocol standard state transition model and the code state transition model are instantiated by traversing each valid configuration item digital value sequence in the set of valid configuration item digital value sequences.

8. A consistency verification system for a state transition model, comprising a processor, a memory, and a computer program / instructions stored in the memory, characterized in that, The processor is configured to execute the computer program / instructions, and when the computer program / instructions are executed, the system implements the steps of the method as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 7.

Images