Formal verification method and device for state transition implementation code and program product

Abstract

The invention provides a formal verification method and device for state transition implementation codes and a program product, and the method comprises the steps: compiling a first state transition function implemented by a C language Switch Case statement to obtain a bit code file; obtaining a Cryptol file, wherein the Cryptol file comprises a second state transfer function which is realized by using a Cryptol programming language; acquiring a first input parameter set and a first output value set corresponding to the first state transfer function, and acquiring a second input parameter set and a second output value set corresponding to the second state transfer function; simulating state transition function symbolic execution based on the first output value set, the second output value set, the first input parameter set and the second input parameter set, converting the state transition function symbolic execution into a satisfiability model theory problem, and solving the satisfiability model theory problem through an external solver to obtain a verification result of a state transition implementation code; the problem that whether state transition is implemented correctly or not cannot be guaranteed only through a manual checking mode can be solved, and the state transition code implementation correctness is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a formal verification method, device, and program product for state transition implementation code. Background Technology

[0002] A finite-state machine (FSM), also known as a finite-state automaton, is a mathematical model representing a finite number of states and the transitions and actions between these states. Since state transitions are the core of a finite-state machine's behavior, directly affecting the system's functionality, performance, and security, verifying state transitions can help identify and resolve potential problems in the system, thereby improving its quality and reliability. Therefore, verifying the state transition implementation code is crucial.

[0003] Verification of traditional state transition implementation code includes: determining whether the implementation code is correct through manual inspection.

[0004] However, most programs have relatively complex state transition systems, and the state systems differ when the program performs different functions. This increases the probability of errors during coding, and the code implementation may execute state transitions in unexpected ways. As a result, manual inspection alone is no longer sufficient to guarantee the correctness of the state transition implementation. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a formal verification method, device, and program product for state transition implementation code, to eliminate or improve one or more defects existing in the prior art. It can solve the problem that manual inspection alone is insufficient to guarantee the correctness of the state transition implementation.

[0006] One aspect of the present invention provides a formal verification method for state transition implementation code, the method comprising the following steps:

[0007] The first state transition function implemented by the C language SwitchCase statement is compiled to obtain a bit code file. The first state transition function is written based on the state of a finite state machine. The state of the finite state machine includes the state transition conditions, the parameter types of the input parameters, and the parameter values.

[0008] Obtain the Cryptol file, which contains a second state transition function implemented using the Cryptol programming language. The second state transition function defines the state transition conditions through the IFELSE statement and defines the state transition result and parameter changes through the return value. It is used to obtain the subsequent state of the finite state machine based on the current state and state transition conditions, so as to perform the state transition operation.

[0009] Obtain the input parameters corresponding to the first state transition function to obtain the first input parameter set; obtain the input parameters corresponding to the second state transition function to obtain the second input parameter set; the input parameters in the first input parameter set correspond one-to-one with the output parameters in the second input parameter set, and the data structures of the corresponding input parameters are different, but the parameter values ​​are the same;

[0010] The input parameters from the first set of input parameters are sequentially input into the first state transition function to obtain the first set of output values; the input parameters from the second set of input parameters are sequentially input into the second state transition function to obtain the second set of output values.

[0011] Based on the first set of output values, the second set of output values, the first set of input parameters, and the second set of input parameters, the symbolic execution of the first state transition function and the second state transition function is simulated and transformed into a satisfiability modular theory problem. The verification results of the state transition implementation code are obtained by solving the problem through an external solver. The verification results are used to indicate whether the first state transition function and the second state transition function can give the same output under the same parameter values.

[0012] Optionally, simulating the symbolic execution of the first state transition function and the second state transition function includes: reading and parsing the bitcode file and the Cryptol file through a software analysis workbench script, and converting the bitcode file and the Cryptol file into the software analysis workbench core;

[0013] The symbolic execution of the first and second state transition functions is simulated using the software analysis workbench core.

[0014] Optionally, before the symbolic execution of the first and second state transition functions is simulated by the software analysis workbench core, the following steps are also included:

[0015] The output values ​​of the first output value set and the output values ​​of the second output value set are transformed according to the core data structure of the software analysis workbench so that the data structure of the output values ​​in the first output value set is the same as that in the second output value set.

[0016] Optionally, if the verification result indicates that the outputs of the first state transition function and the second state transition function differ even with the same parameter values, the method further includes:

[0017] Record the current first input parameter and current first output value of the first state transition function, and the current second input parameter and current second output value of the second state transition function, and generate a combination of counterexamples;

[0018] If the symbolic execution of the first state transition function and the second state transition function is not completed, the remaining symbolic execution is performed.

[0019] Optionally, if the symbolic execution of the first state transition function and the second state transition function is completed, the method further includes:

[0020] A log file is generated based on the combination of counterexamples and the verification results; the log file is used to indicate the correctness of the state transition implementation of the first state transition function.

[0021] Optionally, the verification results of the state transition implementation code can be obtained by solving an external solver, including:

[0022] During the external solver's solution process, if the solution time is greater than or equal to the preset solution time, a pre-proven simplified function is obtained and imported into the first state transition function and the second state transition function.

[0023] Alternatively, the external solver may include the Z3 theorem prover or the Yices solver.

[0024] Another aspect of the present invention provides an electronic device including a processor, a memory, and a computer program / instructions stored in the memory. The processor is used to execute the computer program / instructions. When the computer program / instructions are executed, the electronic device implements the steps of the aforementioned formal verification method for state transition implementation code.

[0025] Another aspect of the present invention provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of the aforementioned formal verification method for state transition implementation code.

[0026] Another aspect of the present invention provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the steps of the aforementioned formal verification method for state transition implementation code.

[0027] The formal verification method, device, and program product for state transition implementation code of the present invention can solve the problem that manual inspection alone is no longer sufficient to guarantee the correctness of state transition implementation. By accurately defining a finite state machine using the Cryptol language, the correctness of the C language code implementation is verified based on this definition. Through rigorous formal proof and solving the satisfiability module theory problem, the problem of insufficient correctness assurance through manual code review is avoided. This reduces system defects caused by errors in manual coding, effectively ensures the correctness of state transition code implementation, and improves the reliability of the software system.

[0028] In addition, by adopting formal verification methods, the correctness of the state transition code implementation can be verified without constructing a large amount of test data, which can improve verification efficiency. At the same time, in the event of errors or inconsistencies, by providing combinations of counterexamples, users can quickly locate the cause of the problem.

[0029] Furthermore, if the C language code implementation is adjusted without changing the finite state, there is no need to rewrite the software analysis workbench code. Only the relevant parts of the Cryptol code definition need to be modified to re-verify, which can reduce the cost of re-verification caused by code changes.

[0030] In addition, a general verification framework for C language state transition implementation code based on Cryptol language and software analysis workbench tools is provided. It can be applied to various scenarios for verifying the correctness of state transition code, improving the efficiency and versatility of C language state transition implementation code verification.

[0031] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0032] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0033] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings:

[0034] Figure 1 A flowchart illustrating a formal verification method for state transition implementation code provided in an embodiment of the present invention;

[0035] Figure 2 A flowchart of a first state transition function implemented using the SwitchCase statement in C language, as provided in an embodiment of the present invention;

[0036] Figure 3 A flowchart of writing a second state transition function using IFELSE in the Cryptol programming language is provided as an embodiment of the present invention;

[0037] Figure 4 A flowchart illustrating the simulation of symbolic execution by writing a software analysis workbench script, as provided in an embodiment of the present invention;

[0038] Figure 5 A flowchart for generating log files based on a combination of counterexamples and verification results, provided in an embodiment of the present invention;

[0039] Figure 6 This is a block diagram of a formal verification device for state transition implementation code provided in an embodiment of the present invention;

[0040] Figure 7 A block diagram of an electronic device provided in yet another embodiment of the present invention. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0042] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0043] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0044] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0045] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0046] The following is an explanation of the terms involved in this invention:

[0047] Bitcode is an intermediate representation (IR) generated by the LLVM compiler. It is a platform-independent, low-level compiler intermediate representation. Unlike traditional target code (such as x86 or ARM instruction sets), bitcode is a highly optimized intermediate representation that can be further optimized by the LLVM compiler in later stages to ultimately generate target code specific to a particular platform.

[0048] Bitcode is primarily used for optimization and cross-platform compilation of the LLVM compiler. By compiling source code into Bitcode, subsequent optimizations and compilations can be performed on different platforms, thereby improving code performance and portability.

[0049] Finite-State Machine (FSM): Also known as a finite-state automaton, it is a mathematical model that represents a finite number of states and the transitions and actions between these states. It divides events in a computer program into multiple complete states, with each state progressing to the next through inputs and outputs. The transitions between these states then describe the operation of the computer program – this is the essence of state machine thinking.

[0050] Finite state machines can decouple multiple states and the transition conditions between states in a program, reducing program coupling, making program maintenance easier, and improving code readability. A finite state machine is an abstraction of logic; it can be used to describe program logic that involves numerous judgments and operations requiring state transitions.

[0051] Finite state machines are easy to understand and communicate, and their implementation is not complex. In C language code, the SwitchCase statement can be used to design state transition functions, which implement a finite state machine based on the current state, transition conditions, and transition actions.

[0052] Cryptol files: Cryptol files are cryptographic algorithm specifications and implementation files written in the Cryptol language, used to describe and verify the behavior of Cryptol algorithms.

[0053] Cryptol Programming Language: Cryptol is a language used for specifying, designing, and verifying Cryptol algorithms. It allows developers to describe cryptographic algorithms in a high-level abstraction and perform formal verification. Cryptol files typically contain the Cryptol algorithm specification and implementation written in the Cryptol language.

[0054] Software Analysis Workbench Script (SAWScript): This is a scripting language used in the Software Analysis Workbench (SAW), a tool for formally verifying software. SAW allows users to perform security and correctness analysis on software using formal methods.

[0055] SAWCore: The core component of the Software Analysis Workbench (SAW), it is an intermediate representation (IR) used to represent programs and perform formal analysis. SAWCore provides a general, neutral representation that can be used to represent programs in various programming languages ​​and offers rich formal analysis capabilities.

[0056] SAWCore provides a variety of features for formal analysis of programs, including:

[0057] Symbolic execution: SAWCore can perform symbolic execution on a program to deduce the program's execution path and possible states.

[0058] Model checking: SAWCore can use model checking technology to verify the properties of a program, such as security and correctness.

[0059] Theorem Proof: SAWCore provides theorem proof functionality, allowing users to deduce the properties of a program using formal logic.

[0060] Code Transformation and Optimization: SAWCore provides code transformation and optimization features, allowing users to rewrite and optimize programs to improve their performance and maintainability.

[0061] The formal verification method for the state transition implementation code provided in this application will be described in detail below.

[0062] Optionally, the execution subject of the formal verification method for the state transition implementation code provided in this application is an electronic device, which can be a terminal such as a computer, mobile phone, or tablet computer, or it can be a server. This embodiment does not limit the implementation method of the electronic device.

[0063] This embodiment provides a formal verification method for state transition implementation code, such as... Figure 1 As shown, the formal verification method for the state transition implementation code includes at least steps S101 to S105:

[0064] Step S101: Compile the first state transition function implemented by the C language SwitchCase statement to obtain a bit code file.

[0065] The first state transition function is derived from the state of the finite state machine. The state of the finite state machine includes the state transition conditions, the parameter types of the input parameters, and the parameter values.

[0066] In this embodiment, the transition conditions, parameter types, and parameter values ​​of the finite state machine are first determined based on its specification and state transition diagram. The specification of the finite state machine refers to the formal description of the behavior of the finite state machine system, which can use different forms, including natural language, graphical representation, and mathematical symbols.

[0067] When specifying a finite state machine, the following aspects are typically included: the set of states, the set of inputs, the set of outputs, the transition rules, and the initial state.

[0068] Here, the state set refers to the set of all possible states that the system can be in, with each state representing a specific situation or configuration of the system at a certain moment; the input set refers to the set of all possible inputs that the system can accept, which can be external events, signals, or conditions; the output set refers to the set of all possible outputs that the system can generate, which can be the result of responding to the input, an indication of a state change, or other feedback; the state transition rules refer to the conditions and actions that define the system's transition from one state to another, and these rules describe how the inputs affect the changes in the system's state; and the initial state refers to the initial state that the system is in when it starts up.

[0069] A state transition diagram is a graphical representation of a finite state machine (FSM) used to describe its behavior. A typical FSM includes the following elements: states, transitions between states, inputs, and outputs.

[0070] In this diagram, a state refers to a node in the state transition diagram, representing the various states the system can be in. Each node is typically represented by a circle or square, with the state name or identifier labeled inside. A transition between states refers to an arrow in the state transition diagram, indicating the transition between states. The arrow is labeled with the input condition or event that triggers the transition. Transitions can be unidirectional or bidirectional, depending on the characteristics of the system. An input refers to the input condition or event that triggers the transition, indicating the conditions under which the system will transition from one state to another. An output refers to the output corresponding to the transition marked in the state transition diagram, representing the possible response or action the system may produce when a state transition occurs.

[0071] In this embodiment, a first state transition function implemented using the SwitchCase statement in C language performs conditional judgments and executes the state transition operation, defining the legality of the state transition with the return value. The first state transition function is compiled using the Clang compiler, processing the C language code into a Low Level Virtual Machine (LLVM) bitcode file. A bitcode file is a platform-independent compiler front-end intermediate product that can be read and symbolically executed by the Software Analysis Workbench (SAW) tool.

[0072] Specifically, refer to Figure 2 The first state transition function, implemented using the SwitchCase statement in C language, includes the following steps: Step S1011, determining the states of the finite state machine based on its canonical description and state transition diagram. Step S1012, writing the first state transition function using the SwitchCase statement to obtain its C language code. Step S1013, compiling and linking the C language code of the first state transition function to obtain the bit code file.

[0073] Step S102: Obtain the Cryptol file, which includes a second state transition function implemented using the Cryptol programming language.

[0074] The second state transition function defines the state transition conditions through the IFELSE statement and defines the state transition result and parameter changes through the return value. It is used to obtain the subsequent state of the finite state machine based on the current state and state transition conditions of the finite state machine, so as to perform the state transition operation.

[0075] In this embodiment, Cryptol code needs to be written based on the design of the finite state machine to describe the state transitions of the finite state machine. Cryptol, as a functional programming language, is highly compatible with the software analysis workbench and can be directly imported and analyzed.

[0076] In the Cryptol programming language, a second state transition function is written using IF-ELSE. This function obtains the subsequent state based on the current state of the finite state machine and the transition conditions, and then performs the state transition operation. The function's return value reflects the subsequent state and the parameter changes caused by the state transition operation.

[0077] Specifically, such as Figure 3 As shown, writing a second state transition function using IFELSE in the Cryptol programming language includes at least the following steps:

[0078] Step S1021: Determine the state of the finite state machine based on the specification description and state transition diagram of the finite state machine.

[0079] Step S1022: Write the second state transition function using the IFELSE statement.

[0080] Step S1023: Based on the C language code of the first state transition function, define the return value of the second state transition function to obtain the Cryptol file.

[0081] In this embodiment, the Cryptol code serves as the basis for the correctness of the C language code. When the two are consistent, the C language code is considered to have correctly implemented the finite state machine described by the Cryptol code. When writing the Cryptol code, it is also necessary to refer to the definitions of state parameters and the judgment functions for transition conditions in the C language code to reduce abstraction costs.

[0082] Step S103: Obtain the input parameters corresponding to the first state transition function to obtain the first input parameter set; obtain the input parameters corresponding to the second state transition function to obtain the second input parameter set.

[0083] In this embodiment, the input parameters of the first state transition function and the second state transition function include the current state, state transition condition-related parameters, etc. These parameters will be input into the first state transition function and the second state transition function with the same values ​​but different forms.

[0084] Specifically, the input parameters in the first set of input parameters correspond one-to-one with the output parameters in the second set of input parameters, and the data structures of the corresponding input parameters are different, but the parameter values ​​are the same.

[0085] Step S104: Input the input parameters in the first input parameter set into the first state transition function in sequence to obtain the first output value set; input the input parameters in the second input parameter set into the second state transition function in sequence to obtain the second output value set.

[0086] The outputs of the first state transition function and the second state transition function include changes in the function return value and input parameters.

[0087] Step S105: Based on the first set of output values, the second set of output values, the first set of input parameters, and the second set of input parameters, simulate the symbolic execution of the first state transition function and the second state transition function, and transform it into a satisfiability modular theory problem. Solve the problem through an external solver to obtain the verification result of the state transition implementation code.

[0088] In this embodiment, by writing software analysis workbench script code, the software analysis workbench tool is used to import bit code files and Cryptol files, define verification logic and simulate symbolic execution, extract all possible states and parameter value ranges, specify the state before function execution, simulate the symbolic execution of the function and verify the state after function execution, and perform comprehensive verification of the behavior of the first state transition function and the behavior of the second state transition function.

[0089] The symbolic execution of the first and second state transition functions includes: reading and parsing the bitcode file and Cryptol file through the software analysis workbench script, converting the bitcode file and Cryptol file into the software analysis workbench core; and simulating the symbolic execution of the first and second state transition functions through the software analysis workbench core.

[0090] like Figure 4 As shown, by writing script code for the software analysis workbench and using the software analysis workbench tools to import bitcode files and Cryptol files, define verification logic, and simulate symbolic execution, the process includes at least the following steps:

[0091] Step S1051: The software analysis workbench script reads and parses the bit code file and the Cryptol file, and converts the bit code file and the Cryptol file into the software analysis workbench core.

[0092] Step S1052: Define the state before the execution of the first state transition function and the state before the execution of the second state transition function.

[0093] Step S1053: Define the state after the execution of the first state transition function and the state after the execution of the second state transition function.

[0094] Step S1054: The symbolic execution of the first state transition function and the second state transition function is simulated by the core simulation of the software analysis workbench.

[0095] In addition, before the symbolic execution of the first and second state transition functions is simulated by the core of the software analysis workbench, the following steps are also included: transforming the output values ​​of the first output value set and the output values ​​of the second output value set according to the data structure of the core of the software analysis workbench, so that the data structure of the output values ​​in the first output value set is the same as the data structure of the output values ​​in the second output value set.

[0096] In this embodiment, the verification result is used to indicate whether the first state transition function and the second state transition function can give the same output under the same parameter values.

[0097] If the verification result indicates that the parameters have the same value and the output of the first state transition function is different from the output of the second state transition function, the method further includes: recording the current first input parameter and the current first output value of the first state transition function and the current second input parameter and the current second output value of the second state transition function, and generating a counterexample combination; if the symbolic execution of the first state transition function and the second state transition function is not completed, the remaining symbolic execution is performed.

[0098] After the symbolic execution of the first state transition function and the second state transition function is completed, the method further includes: generating a log file based on the combination of counterexamples and the verification results; the log file is used to indicate the correctness of the state transition implementation of the first state transition function.

[0099] like Figure 5 As shown, generating a log file based on a combination of counterexamples and verification results includes at least the following steps:

[0100] Step S1061: The verification result of the state transition implementation code is obtained by solving the problem using an external solver.

[0101] Step S1062: Determine whether the output of the first state transition function is the same as the output of the second state transition function. If the output of the first state transition function is the same as the output of the second state transition function, proceed to step S1064; otherwise, proceed to step S1063.

[0102] Step S1063: Generate counterexample combinations.

[0103] Step S1064: Determine whether the verification is complete. If the verification is complete, proceed to step S1065; otherwise, proceed to step S1061.

[0104] Step S1065: Generate a log file based on the combination of counterexamples and the verification results.

[0105] In this embodiment, verification is performed by calling an external solver within the software analysis workbench script. Optionally, the external solver includes a Z3 theorem prover or a Yices solver.

[0106] If the verification passes, it proves that the C language code and the Cryptol code are consistent, and it can be inferred that the state transition function implemented in the C language code meets the requirements of a finite state machine. If the verification fails, a counterexample that causes the inconsistency between the two will be given, so that users can check the counterexample to further infer possible problems in the code implementation.

[0107] Furthermore, simplified functions can be introduced to accelerate the proof process. These simplified functions are derived from functions used within the first and second state transition functions and are used for state transition operations. These functions have separately declared function bodies, and some contain complex decision logic. Pre-proving these functions and importing them into the proofs of the first and second state transition functions can alleviate the slow proof process caused by unfolding complex logic.

[0108] Specifically, the verification results of the state transition implementation code are obtained by solving the external solver, including: when the solution time is greater than or equal to the preset solution time during the external solver solution process, obtaining the pre-proven simplified function and importing it into the first state transition function and the second state transition function.

[0109] In summary, the formal verification method for state transition implementation code provided in this embodiment, by combining formal methods to describe the finite state machine, verifies whether the behavior of the C language implementation code and the finite state machine is consistent. The Cryptol code defines the state transitions of the finite state machine. The software analysis workbench tool combines the Cryptol code and the C language code, transforming it into a provable and solvable satisfiability modular theory problem, and calls an external solver for proof. This solves the problem that manual inspection alone cannot guarantee the correctness of the state transition implementation. By accurately defining the finite state machine in Cryptol, the C language code implementation is verified to meet the requirements. Through rigorous formal proof and solving the satisfiability modular theory problem, the problem that manual code review alone cannot ensure correctness is avoided. This reduces system defects caused by errors in manual coding, effectively ensuring the correctness of the state transition code implementation, and improving the reliability of the software system.

[0110] In addition, by adopting formal verification methods, the correctness of the state transition code implementation can be verified without constructing a large amount of test data, which can improve verification efficiency. At the same time, in the event of errors or inconsistencies, by providing combinations of counterexamples, users can quickly locate the cause of the problem.

[0111] Furthermore, if the C language code implementation is adjusted without changing the finite state, there is no need to rewrite the software analysis workbench code. Only the relevant parts of the Cryptol code definition need to be modified to re-verify, which can reduce the cost of re-verification caused by code changes.

[0112] In addition, a general verification framework for C language state transition implementation code based on Cryptol language and software analysis workbench tools is provided. It can be applied to various scenarios for verifying the correctness of state transition code, improving the efficiency and versatility of C language state transition implementation code verification.

[0113] This embodiment provides a formal verification device for state transition implementation code, such as... Figure 6 As shown, the device includes at least the following modules: function compilation module 610, file acquisition module 620, parameter acquisition module 630, output acquisition module 640, and code verification module 650.

[0114] The function compilation module 610 is used to compile the first state transition function implemented by the C language SwitchCase statement to obtain a bit code file; the first state transition function is written based on the state of a finite state machine; the state of the finite state machine includes the state transition conditions, the parameter types of the input parameters, and the parameter values;

[0115] The file acquisition module 620 is used to acquire the Cryptol file, which includes a second state transition function implemented using the Cryptol programming language. The second state transition function defines the state transition conditions through the IFELSE statement and defines the state transition result and parameter changes through the return value. It is used to obtain the subsequent state of the finite state machine based on the current state and state transition conditions of the finite state machine, so as to perform the state transition operation.

[0116] The parameter acquisition module 630 is used to acquire the input parameters corresponding to the first state transition function to obtain a first input parameter set; acquire the input parameters corresponding to the second state transition function to obtain a second input parameter set; the input parameters in the first input parameter set correspond one-to-one with the output parameters in the second input parameter set, and the corresponding input parameters have different data structures but the same parameter values;

[0117] The output acquisition module 640 is used to sequentially input the input parameters from the first input parameter set into the first state transition function to obtain the first output value set; and to sequentially input the input parameters from the second input parameter set into the second state transition function to obtain the second output value set.

[0118] The code verification module 650 is used to simulate the symbolic execution of the first state transition function and the second state transition function based on the first output value set, the second output value set, the first input parameter set, and the second input parameter set, and transform it into a satisfiability module theory problem. The verification result of the state transition implementation code is obtained by solving it through an external solver. The verification result is used to indicate whether the first state transition function and the second state transition function can give the same output under the same parameter values.

[0119] For relevant details, please refer to the methods and embodiments described above.

[0120] It should be noted that the formal verification device for state transition implementation code provided in the above embodiments is only illustrated by the division of the above functional modules when performing formal verification of state transition implementation code. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the formal verification device for state transition implementation code can be divided into different functional modules to complete all or part of the functions described above. In addition, the formal verification device for state transition implementation code provided in the above embodiments and the formal verification method embodiments for state transition implementation code belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0121] This embodiment provides an electronic device, such as... Figure 7 As shown. The electronic device includes at least a processor 701 and a memory 702.

[0122] Processor 701 may include one or more processing cores, such as a quad-core processor or an octa-core processor. Processor 701 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 701 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 701 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 701 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0123] The memory 702 may include one or more computer-readable storage media, which may be non-transitory. The memory 702 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 702 are used to store at least one instruction, which is executed by the processor 701 to implement the formal verification method for the state transition implementation code provided in the method embodiments of this application.

[0124] In some embodiments, the electronic device may also optionally include: a peripheral device interface and at least one peripheral device. The processor 701, memory 702, and peripheral device interface can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface via a bus, signal line, or circuit board. Indicatively, peripheral devices include, but are not limited to: radio frequency circuitry, a touch display screen, audio circuitry, and a power supply.

[0125] Of course, electronic devices may also include fewer or more components, and this embodiment does not limit this.

[0126] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned formal verification method for state transition implementation code. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0127] This invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the aforementioned formal verification method for state transition implementation code.

[0128] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0129] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0130] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0131] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A formal verification method for state transition implementation code, characterized in that, The method includes the following steps: The first state transition function implemented by the C language SwitchCase statement is compiled to obtain a bit code file; the first state transition function is written based on the state of a finite state machine; the state of the finite state machine includes the state transition conditions, the parameter types of the input parameters, and the parameter values; Obtain the Cryptol file, which includes a second state transition function implemented using the Cryptol programming language. The second state transition function defines the state transition conditions through an IFELSE statement and defines the state transition result and parameter changes through a return value. It is used to obtain the subsequent state of the finite state machine based on the current state of the finite state machine and the state transition conditions, so as to perform a state transition operation. Obtain the input parameters corresponding to the first state transition function to obtain a first set of input parameters; obtain the input parameters corresponding to the second state transition function to obtain a second set of input parameters; the input parameters in the first set of input parameters correspond one-to-one with the output parameters in the second set of input parameters, and the data structures of the corresponding input parameters are different, but the parameter values ​​are the same; The input parameters in the first set of input parameters are sequentially input into the first state transition function to obtain the first set of output values; the input parameters in the second set of input parameters are sequentially input into the second state transition function to obtain the second set of output values. Based on the first set of output values, the second set of output values, the first set of input parameters, and the second set of input parameters, the symbolic execution of the first state transition function and the second state transition function is simulated and transformed into a satisfiability modular theory problem. The verification result of the state transition implementation code is obtained by solving the problem through an external solver. The verification result is used to indicate whether the first state transition function and the second state transition function can give the same output under the same parameter values.

2. The method according to claim 1, characterized in that, The symbolic execution of the simulated first state transition function and second state transition function includes: The software analysis workbench script reads and parses the bit code file and the Cryptol file, and converts the bit code file and the Cryptol file into the software analysis workbench core; The symbolic execution of the first state transition function and the second state transition function is simulated through the core of the software analysis workbench.

3. The method according to claim 2, characterized in that, Before the symbolic execution of the first and second state transition functions is simulated by the core of the software analysis workbench, the following steps are also included: The output values ​​in the first output value set and the output values ​​in the second output value set are transformed according to the data structure of the core of the software analysis workbench, so that the data structure of the output values ​​in the first output value set is the same as the data structure of the output values ​​in the second output value set.

4. The method according to claim 1, characterized in that, If the verification result indicates that the parameters have the same value and the output of the first state transition function is different from the output of the second state transition function, the method further includes: Record the current first input parameter and current first output value of the first state transition function and the current second input parameter and current second output value of the second state transition function, and generate a combination of counterexamples; If the symbolic execution of the first state transition function and the second state transition function is not completed, the remaining symbolic execution is performed.

5. The method according to claim 4, characterized in that, When the symbolic execution of the first state transition function and the second state transition function is completed, the method further includes: A log file is generated based on the combination of counterexamples and the verification results; the log file is used to indicate the correctness of the state transition implementation of the first state transition function.

6. The method according to claim 1, characterized in that, The verification results of the state transition implementation code obtained by solving through an external solver include: During the external solver's solution process, if the solution time is greater than or equal to the preset solution time, a pre-proven simplified function is obtained and imported into the first state transition function and the second state transition function.

7. The method according to claim 1, characterized in that, The external solver includes the Z3 theorem prover or the Yices solver.

8. An electronic device comprising a processor, a memory, and a computer program / instructions stored in the memory, characterized in that, The processor is used to execute the computer program / instructions, and when the computer program / instructions are executed, the electronic device implements the steps of the method as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 7.

Images