Deterministic computing architecture based on formalized proof and operation method thereof

Abstract

The invention discloses a deterministic computing architecture based on formalized proof and an operation method of the deterministic computing architecture, and belongs to the field of formalized verification, computer system structures, operating systems and security computing. And the trusted executor layer is constrained by the specification and runs on compatible hardware. The actuator comprises an optimal atomic execution path planner. According to the method, strict and verifiable isomorphic mapping is carried out on'formalized specifications' (a machine verifiable mathematical proof) which is used as a system basis and contains original first principle derivation and physical execution (hardware implementation) of the formalized specifications, a universal calculation execution environment is constructed, the environment can break through inherent contradictions in the prior art, and the method has the advantages of being high in calculation efficiency and high in practicability. Meanwhile, unprecedented efficiency, safety, certainty and autonomy are achieved, and an optimal calculation mode close to theory is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of formal verification, computer architecture, operating system and secure computing, and in particular to a deterministic computing architecture based on formal proof and its operating method. BACKGROUND

[0002] The existing computing systems universally suffer from fundamental flaws, rooted in their reliance on implicit trust assumptions and non-formal specifications. Specific flaws include:

[0003] Vulnerability and implicitness of trust roots: Existing systems rely on hardware, firmware, operating systems and software libraries that are not formally proven end-to-end, making them vulnerable to attacks. Trust is assumed, not mathematically verifiable.

[0004] Non-determinism and unpredictability of execution: Concurrency, scheduling and external interactions lead to unpredictable, non-reproducible and non-debuggable results.

[0005] Lack of formal auditability: Lack of mathematical proof of the validity of computing processes, the rationality of resource usage or the atomicity of operations.

[0006] Separation of policy and execution: Policy rules cannot be absolutely enforced at the physical execution level.

[0007] Domain specificity and interoperability barriers: Lack of a unified, provably secure cross-domain interaction framework.

[0008] Inherent conflict between provability and system scalability: Formal guarantees usually come at the cost of large-scale scalability.

[0009] Limitations of underlying axioms and lack of first principles: Existing computing and mathematical models are built on traditional axioms, which fail to fully unify or explain certain physical or complex system phenomena, or provide an absolute computational foundation. The core foundation of the present application - a set of original, machine-verifiable, formal proofs covering the first principles of mathematics, computing and physics - itself aims to address these deeper foundational issues. The formal specification of this foundation is derived from the inventor's formal derivation and revision of the underlying concepts of computing, mathematics and even the physical world, including numbers, space, time, conservation laws, information representation and measurement methods, from first principles. This work itself represents a deepening and refinement of existing axiom systems, aiming to establish a more rigorous and consistent computational foundation. Therefore, there is no direct precedent in existing literature to refer to, proving the originality and breakthrough nature of the foundation of the present application.

[0010] Performance overhead and real-time constraints: In addition, existing operating systems and virtualization layers introduce significant context-switching overhead, scheduling jitter, and resource contention, making it extremely difficult or impossible to achieve strict real-time performance guarantees on commodity hardware. Complex software stacks and protocol conversions also consume a large amount of computing resources, reducing end-to-end efficiency.

[0011] The deficiencies of the prior art force system designers to force trade-offs between key performance metrics, such as between performance and security, flexibility and reliability, development speed and formal guarantees.

[0012] The prior art lacks a fundamental computing architecture that can fundamentally eliminate these conflicts while achieving optimal status in multiple dimensions such as efficiency, cost, effectiveness, risk, and operational complexity. SUMMARY

[0013] The purpose of the present invention is to provide a completely new computing architecture and its operating method, by strictly and verifiably isomorphic mapping of the "formal specification" (a machine-verifiable mathematical proof) containing original first principle derivation as the basis of the system and its physical execution (hardware implementation), to build a general computing execution environment that can break through the inherent contradictions of the prior art, while achieving unprecedented efficiency, security, determinism and autonomy, approaching the theoretically optimal computing mode.

[0014] Technical solution: To solve the above technical problems, according to one aspect of the present invention, more specifically, a deterministic computing architecture based on formal proof and its operating method, by strictly and verifiably isomorphic mapping of the "formal specification" (a machine-verifiable mathematical proof) containing original first principle derivation as the basis of the system and its physical execution (hardware implementation), to build a general computing execution environment that can break through the inherent contradictions of the prior art, while achieving unprecedented efficiency, security, determinism and autonomy, approaching the theoretically optimal computing mode.

[0015] The present invention discloses a "provable deterministic execution environment", the core technical solution of which realizes the following seemingly contradictory objectives:

[0016] Layered Formal Specification and Execution Architecture: The core foundation of this architecture is a Layer 0 Formal Specification Layer, which is represented as a machine-verifiable mathematical proof artifact containing formalized derivations of first principles of computation and related physical domains, defining the core invariants of the system, allowed atomic operations, and their formalized resource cost functions. The architecture contains a Layer 1 Trusted Executor Layer, whose runtime logic and behavior is fully constrained by the Layer 0 specification and runs on compatible hardware.

[0017] Specification-Based Optimal Atomic Execution Method: The Layer 1 Executor contains an Optimal Atomic Execution Path Planner. This planner, based on the Layer 0 specification, computes for each received work request the unique atomic execution path (γgeo) that satisfies all invariants and has the lowest formalized defined resource cost. The Executor then deterministically executes this path, demonstrates success or failure through a binary verifiable execution certificate, and ensures finality or complete rollback through an atomic state commit mechanism, thus completing computational tasks in the most efficient manner possible while its execution behavior is fully predictable and reproducible.

[0018] Formal Interface Adaptation and Cross-Domain Interoperability: The Layer 0 specification can contain formalized equivalence proofs for defining the preservation structure mapping relationships between different information domains or physical domains, including analog interfaces and external system encapsulations. The Layer 1 Executor utilizes these proofs to generate Formal Interface Adapters, thus safely handling and converting heterogeneous data and control flows within a unified, formally guaranteed framework, breaking information silos while maintaining end-to-end formal guarantees.

[0019] Atomic State Commitment and Immutable Record: The enforcer contains an integrity checkpoint defined by the formal specification. The checkpoint atomically updates the system state to an immutable serialized state ledger based on the value of a verifiable execution credential or performs a complete rollback, providing irrefutable proof of the computation process and immediate result finality guarantees, enabling full auditability.

[0020] Specification-Hardware Co-Design and Enforcement: The level 1 enforcer runs on formal ISA hardware. The hardware is co-designed with the level 0 formal specification, with its instruction set and architecture features designed to directly enforce key invariants defined in the specification at the physical level, making it difficult or impossible to execute operations that violate the specification, fundamentally eliminating a specific class of software vulnerabilities and state inconsistency risks, enabling zero-trust execution.

[0021] Provable Secure Bootstrapping Process: The initialization process of the system itself is guaranteed by formal methods. A provable secure bootstrapper is responsible for verifying the integrity of the level 0 formal specification artifacts and securely initializing the level 1 trusted enforcer and its initial state, establishing a solid and unbreakable trust root.

[0022] The beneficial effects of the present application, a deterministic computing architecture based on formal proof and its operating method, are as follows:

[0023] (1) The architecture of the present application takes the "level 0 formal specification layer" as the core, which is a machine-verifiable mathematical proof artifact containing the first principle derivation of the computing and physical domains, and is immutable after verification. At the same time, through strict isomorphic mapping of specification and hardware execution, trust is transformed from "implicit assumption" to "mathematical proof", fundamentally solving the trust vulnerability problem of existing systems relying on unverified software and hardware, and realizing the basic guarantee of zero-trust execution.

[0024] According to the formal equivalence proof in the level 0 specification, a formal interface adapter is generated, heterogeneous data such as physical sensor data and legacy system protocol data can be mapped into a unified internal representation conforming to the specification; when the calculation result is converted into an external format, the end-to-end formal security guarantee is still maintained, breaking the information island and solving the pain point of "lack of unified security framework" in the existing cross-domain interaction

[0025] (2) The level 1 trusted executor of the application can calculate the unique and lowest resource cost execution path according to the cost function of the level 0 specification, and the execution process adopts deterministic serial processing, which completely avoids the race condition and timing uncertainty introduced by concurrency; the execution result is reproducible and predictable, and the task is completed with the smallest resource consumption, breaking the limitation of the existing system that "non-determinism and efficiency are difficult to be considered".

[0026] (3) The application realizes "all commit or all rollback" based on the binary verifiable execution voucher through the "atomic state commit mechanism" and "immutable serialized state ledger": when the voucher is 1, all state changes are written into the ledger as atomic operations and update the resource account; when the voucher is 0, all intermediate states are completely revoked, which fundamentally eliminates the state inconsistency problem caused by partial failure; at the same time, the ledger record contains the complete execution trajectory and proof, providing irrefutable audit basis for the calculation process

[0027] (4) The application adopts "specification-hardware co-design", and the Formal ISA hardware enforces the core invariants (such as hardware atomic operation primitives and secure memory regions) of the level 0 specification at the physical level, which eliminates the operations violating the specification from the hardware layer; at the same time, the level 1 executor adopts a bare machine running mode, eliminating the context switching and scheduling jitter overhead of the traditional operating system and virtualization layer, and achieving performance improvement by orders of magnitude.

[0028] (5) The application cooperates with the hardware root of trust (RoT) through the "provable secure boot program (PSB)", and verifies the PSB integrity, level 0 specification artifact signature and level 1 executor logic in turn during the startup process; after verification, a "boot authorization seal" is generated and written into the hardware security latch; only the system that completes the whole process verification can enter the ready state, ensuring that the unbreakable root of trust is established from the startup stage, avoiding security vulnerabilities in the initialization stage. BRIEF DESCRIPTION OF DRAWINGS

[0029] The application will be further described in detail below in combination with the drawings and specific implementation methods.

[0030] Figure 1 : Overall hierarchical architecture schematic diagram.

[0031] Figure 2: Level 1 monolithic trusted enforcer detailed block diagram.

[0032] Figure 3 : Core execution loop and credential generation flowchart.

[0033] Figure 4 : Atomic state commit flowchart.

[0034] Figure 5 : Formal interface adapter conceptual diagram.

[0035] Figure 6 : Isomorphic mapping of formal specification to hardware execution diagram.

[0036] Figure 7 : Verifiable execution record structure diagram.

[0037] Figure 8 : Verifiable failure record structure diagram.

[0038] Figure 9 : Provable secure boot flowchart.

[0039] Figure 10 : Formal Instruction Set Architecture (Formal ISA) hardware overview diagram;

[0040] Figure 11 : Formal resource cost function and optimal path conceptual diagram.

[0041] Figure 12 : Binary verifiable execution credential generation logic schematic. DETAILED DESCRIPTION

[0042] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0043] In order to make the technical scheme of the present application clearer, the present application will be further described in detail below in combination with the drawings and specific embodiments.

[0044] Reference Figures 1-12 A formal proof-based deterministic computing architecture and its operation method, including the following embodiments:

[0045] Hierarchical architecture: building a trusted foundation The present application proposes a hierarchical computing architecture (see Figure 1 ). The foundation is the formal specification layer of level 0, which is the core of a machine-verifiable mathematical proof artifact. The artifact not only defines the axioms, invariants, allowed operation primitives and formal resource cost model of the system (see Figure 11), and possibly original formal derivations of fundamental concepts of computation, mathematics, and even physics. This artifact, once verified, is immutable and constitutes the "physical laws" of the system. Level 1 is the trusted executor layer, containing one or more Monolithic Trusted Executors (see Figure 2 ). The software logic of these executors is either directly generated from or formally verified against the Level 0 specification, ensuring that their behavior strictly conforms to the mathematical specification. Level 2 is the request interface layer, receiving external untrusted work requests. Level 3 represents the external world interface. This strict layering ensures that the trustworthiness of the execution core is not affected by upper-layer requests.

[0046] Core execution method: determinism and optimality

[0047] The core operation method of the Level 1 executor (see Figure 3 ) guarantees the determinism and optimality of computation. When a work request with boundary constraints is received, the "Optimal Atomic Execution Path Planner" (see Figure 2 ) inside the executor is initiated. This planner, based on the mathematical rules and cost functions in the Level 0 specification (see Figure 11 ), calculates the unique execution path (a series of atomic state transitions) that satisfies the request with the lowest cost. This optimality is not a heuristic approximation but a deterministic result based on formal proofs, ensuring that the work is completed with theoretically minimal resource consumption. The executor then strictly follows this path to perform state transitions, with its core execution logic using deterministic serial processing, avoiding race conditions and timing uncertainties introduced by concurrent execution, providing a solid foundation for real-time applications. After execution is complete, the "Certificate Generator" (see Figure 2 , Figure 12 ) generates a binary "Verifiable Execution Certificate" (with a value of 1 or 0) as a mathematical proof of the execution result.

[0048] Trusted executor device: physical embodiment of the specification

[0049] The trusted executor device (see Figure 2 , Figure 6 ) of the invention is the physical embodiment of the Level 0 formal specification. Its runtime logic is generated from the specification artifact through a provable construction process, ensuring consistency between the code and the specification. The device is designed to run on compatible Formal ISA Hardware (see Figure 10) runs natively on bare metal, eliminating the performance overhead and latency of traditional operating system kernels, system calls, and virtualization layers. The enforcer contains core components such as path planner, credential generator, state management module, and hardware interaction interface. Its key feature is that, since its logic is derived from formal proofs, it is physically impossible for it to perform any operation that violates the core specification—such operations do not exist or cannot be represented in its state space or instruction set, and its execution time is highly predictable.

[0050] Verifiable execution credential: mathematical proof of work

[0051] The binary verifiable execution credential (see Figure 12 ) generated after each execution path completion is an important component of the invention. It is not just a simple status code, but an independently verifiable mathematical proof artifact. A credential value of 1 proves that: (a) the execution has successfully completed; (b) the execution process strictly adhered to all invariants defined in Tier 0; (c) the resources consumed by the execution are within the boundaries specified by the requestor. A credential value of 0 proves that the execution failed or violated the constraints. This credential is the basis for subsequent atomic state commits.

[0052] Atomic state commit: guaranteeing finality and consistency

[0053] To ensure the consistency of the system state and the finality of the operations, the enforcer contains an “integrity checkpoint” mechanism (see Figure 2 , Figure 4 ). This mechanism receives the execution credential. If the credential value is 1, the checkpoint commits all the state changes (e.g., memory updates, register modifications, ledger writes) caused by the execution path as an indivisible atomic operation to the system’s persistent state storage (“immutable serialized state ledger”). At the same time, the corresponding resource cost is accounted for and deducted. The checkpoint then generates and writes a successful verifiable execution record (see Figure 7 ). If the credential value is 0, the checkpoint guarantees that all intermediate state changes are completely undone or never happened, and records the failure state (see Figure 8 ). This mechanism fundamentally eliminates the problem of state inconsistency caused by partial failures, providing irrefutable auditability and immediate finality.

[0054] Formal interface adaptation: connecting the heterogeneous world

[0055] To enable the formal core to interact safely with the diverse external world (including physical sensors, analog signals, legacy systems, network interfaces of different protocols, etc.), the invention introduces an interface adapter based on formal equivalence proofs (see Figure 5). Level 0 specifications can contain formal models of external data formats, physical units, communication protocols, legacy system APIs or analog signal sampling processes, along with mathematical proofs that demonstrate the existence of a Homomorphism between these external models and the internal specification representations of the enforcer. Level 1 enforcers use these proofs to generate or validate corresponding “formal interface adapters” (see Figure 2 ). This enables enforcers to safely receive external inputs, convert them into internally processable formal representations, perform computations, and safely convert the results back into external formats, all while guaranteeing that the entire process adheres to the core specification, breaking down information silos.

[0056] Specification-Hardware Co-Design: Physical Enforcement

[0057] This invention emphasizes the co-design between Level 0 specifications and the hardware that Level 1 enforcers run on (see Figure 6 , Figure 10 ). The design of Formal ISA Hardware aims to physically support and enforce key invariants from Level 0 specifications, such as through hardware atomic operation primitives, specialized instructions for formal verification checks, secure memory regions, hardware resource counters, or secure boot modules (see Figure 10 ). This co-design allows high-level operations from formal specifications to be directly mapped to efficient hardware instructions, bypassing multiple layers of software abstraction, achieving orders of magnitude performance and efficiency improvements, and extending the root of trust down to the hardware level.

[0058] Secure Boot: Establishing the Trust Anchor

[0059] The initial startup process of a system (see Figure 9 ) is critical to ensuring the trustworthiness of the entire architecture. This invention employs a provably secure boot process. A minimal, verifiable Secure Bootstrapper runs on top of the Hardware Root of Trust. It is responsible for verifying the integrity and authenticity of the Level 0 formal specification artifacts stored in memory. Upon successful verification, it safely loads and initializes the Level 1 trusted enforcer, setting its initial secure state, and possibly performing a series of specification-compliance benchmark tests. Only after successfully completing this process does the bootstrapper generate a “boot authorization seal” (e.g., a MIRACLE token) and write it to a hardware secure module (such as a Secure Boot Latch), authorizing the enforcer to start processing external requests and writing the first legitimate ledger record.

[0060] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the patent scope of the present application. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, several modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A deterministic computing architecture based on formal proof, characterized in that, comprises: a formal specification layer (Layer 0) defining core invariants of the system, allowed atomic operations and their formalized resource cost functions; and a trusted executor layer (Layer 1) whose runtime logic and behavior is constrained by the formal specification layer and runs on compatible hardware, the trusted executor layer comprising: an optimal atomic execution path planner for computing atomic execution paths that satisfy a work request and have the lowest cost according to the formal specification layer; and an atomic state commit mechanism for ensuring finality or complete rollback of operation results of the atomic execution paths.

2. The deterministic computing architecture based on formal proof of claim 1, wherein, The logic of the executors in the trusted executor layer is generated or verified from a machine-verifiable mathematical proof artifact of the formal specification layer by a provably constructed process.

3. The deterministic computing architecture based on formal verification of claim 1, wherein, The trusted executor layer further comprises: a formal interface adapter generated or verified based on formal equivalence proofs contained in the formal specification layer for safely processing and converting heterogeneous data and control flows from different information domains or physical domains within a unified framework.

4. A deterministic computing system based on formal proof, characterized by, comprises: a formal proof-based deterministic computing architecture according to claim 1; and a formal instruction set architecture hardware co-designed with the formal specification layer whose instruction set or architecture features are designed to directly support or enforce key invariants or atomic operations defined in the specification layer at the physical level. comprises the steps of:

5. A deterministic computing method based on formal proof, executed in a trusted executor constrained by formal specification, characterized in that, receiving a work request with boundary constraints; computing an atomic execution path that satisfies the work request and has the lowest cost according to the formal specification; deterministically executing the atomic execution path; generating a binary verifiable execution credential indicating success or failure of the execution; and based on the value of the binary verifiable execution credential, atomically updating system state to an immutable ledger or performing complete state rollback via an atomic state commit mechanism. The step of generating a binary verifiable execution credential comprises:

6. The deterministic computing method based on formal proof according to claim 5, characterized in that, collecting formal proof traces of each atomic step in the execution of the atomic execution path; aggregating and combining the proof traces; and verifying, according to the formal specification, whether the aggregated proof conforms to global invariants and resource consumption is within the boundary constraints of the work request. The step of atomically updating system state or performing complete state rollback specifically comprises: if the credential value is 1, atomically committing all state changes resulting from the execution path to the immutable ledger and accounting for resource costs; if the credential value is 0, ensuring that all intermediate state changes are completely undone.

7. The deterministic computing method based on formal proof of claim 5, wherein, In the step of executing the atomic execution path, heterogeneous data from different information domains or physical domains are safely processed or converted using a formal interface adapter generated or verified based on equivalence proofs in the formal specification. 8.The deterministic computing method based on formal verification of claim 5, wherein, Further comprising the step of performing real-time resource accounting according to cost functions defined in the formal specification during execution of the atomic execution path and updating resource accounts at atomic commit.

9. The deterministic computing method based on formal proof of claim 5, wherein, comprises the steps of:

10. A method of booting a trusted computing environment, characterized by, using a verifiable secure boot program running on a hardware root of trust; ​ The boot program verifies the integrity and authenticity of a formal specification artifact; If the verification passes, the boot program securely loads and initializes a trusted enforcer whose behavior is constrained by the formal specification artifact; and The boot program generates a boot authorization seal that authorizes the trusted enforcer to begin running.

Images