A formal proof method, device, system, electronic equipment and readable medium

Abstract

A formal proof method, apparatus, system, electronic device, and readable medium are disclosed. The method includes: acquiring a first source code and a first attribute description to be formally proven; obfuscating the first source code using a source code obfuscation strategy to obtain a second source code, and obfuscating the first attribute description using an attribute description obfuscation strategy to obtain a second attribute description; outputting the second source code and the second attribute description as prompts to a reduction generation system to generate formal model code and model attribute code; and, in response to receiving the formal model code and model attribute code from the reduction generation system, performing formal proof on the formal model code and model attribute code using a formal proof tool. By obfuscating the source code and attribute description within the formal proof system, privacy information is effectively protected, and the reuse of large formal modeling models across different institutions is achieved.

Description

Technical Field

[0001] This disclosure relates to a formal proof method, apparatus, system, electronic device, and readable medium. Background Technology

[0002] Formal proof, based on axiomatic formal semantics, model and attribute specification languages, and a predefined symbol system, builds models of requirements, solutions, and code, describes attribute specifications, and proves whether the attribute specifications conform to the model. Software source code developed by one organization can be verified using formal proof methods, but this requires access to the source code, i.e., formal proof modeling based on the source code. However, in scenarios involving collaboration among multiple different organizations, such as organization B developing a large formal model, which can be used to assist in formal modeling and generate formal proof specification code (including formal model code and model attribute code), organization B can not only use it internally but also provide services to external organizations. For example, organization A can use organization B's large formal model to model, obtain formal proof specification code, and verify it using organization A's internal formal proof tools. In this scenario, organization A needs to provide organization B with the source code and attribute descriptions. However, an organization often does not want to directly disclose its internal source code and attribute descriptions to other organizations. Therefore, effective privacy protection is needed for organization A's source code and attribute descriptions during formal proof. Summary of the Invention

[0003] This disclosure provides a formal proof method, apparatus, system, electronic device, and readable medium. By obfuscating the source code and attribute descriptions within the formal proof system, privacy information is effectively protected, and the reuse of large formal modeling models across different institutions is achieved.

[0004] To achieve the above technical objectives, the embodiments of this disclosure adopt the following technical solutions:

[0005] In a first aspect, embodiments of this disclosure provide a formal proof method applied to a formal proof system, the method comprising:

[0006] Obtain the first source code and first attribute description to be formally proven;

[0007] Obfuscate the first source code using a source code obfuscation strategy to obtain the second source code; obfuscate the first attribute description using an attribute description obfuscation strategy to obtain the second attribute description.

[0008] The second source code and the second attribute description are output as prompt words to the specification generation system to generate formal model code and model attribute code;

[0009] In response to receiving the formal model code and model attribute code sent by the specification generation system, the formal proof tool is used to perform formal proof on the formal model code and model attribute code.

[0010] In some possible implementations, the prompt words also include a formal proof tool identifier, so that the specification generation system can generate formal model code and model attribute code corresponding to the formal proof tool based on the formal proof tool identifier.

[0011] In some possible implementations, source code obfuscation strategies include at least one of the following: meaningless identifier substitution strategy, useless source code obfuscation insertion strategy, and control flow logic modification strategy.

[0012] In some possible implementations, the attribute description obfuscation strategy includes a meaningless identifier substitution strategy and / or a useless attribute description obfuscation insertion strategy; wherein, when the source code obfuscation strategy includes a meaningless identifier substitution strategy, the attribute description obfuscation strategy also includes a meaningless identifier substitution strategy, and the substitution method of the meaningless identifier substitution strategy in the attribute description obfuscation strategy is the same as the substitution method of the meaningless identifier substitution strategy in the source code obfuscation strategy.

[0013] Secondly, embodiments of this disclosure provide a formal proof method, the method comprising:

[0014] The formal proof system obtains the first source code and the first attribute description to be formally proven, obfuscates the first source code based on the source code obfuscation strategy to obtain the second source code, obfuscates the first attribute description based on the attribute description obfuscation strategy to obtain the second attribute description, and outputs the second source code and the second attribute description as prompt words to the reduction generation system.

[0015] The specification generation system generates and sends formal model code and model attribute code based on the second source code and the second attribute description;

[0016] The formal proof system receives the formal model code and model attribute code sent by the specification generation system, and uses formal proof tools to perform formal proof on the formal model code and model attribute code.

[0017] In some possible implementations, the specification generation system includes a formal modeling big model, based on which formal model code and model attribute code are generated.

[0018] In some possible implementations, the cue words also include formal proof tool identifiers, and the reduction generation system includes multiple large formal modeling models; the method also includes:

[0019] The specification generation system runs the corresponding formal modeling big model according to the formal proof tool identifier, and generates formal model code and model attribute code.

[0020] In some possible implementations, source code obfuscation strategies include at least one of the following: meaningless identifier substitution strategy, useless source code obfuscation insertion strategy, and control flow logic modification strategy.

[0021] In some possible implementations, the attribute description obfuscation strategy includes a meaningless identifier substitution strategy and / or a useless attribute description obfuscation insertion strategy; wherein, when the source code obfuscation strategy includes a meaningless identifier substitution strategy, the attribute description obfuscation strategy also includes a meaningless identifier substitution strategy, and the substitution method of the meaningless identifier substitution strategy in the attribute description obfuscation strategy is the same as the substitution method of the meaningless identifier substitution strategy in the source code obfuscation strategy.

[0022] Thirdly, embodiments of this disclosure provide a formal proof apparatus for use in a formal proof system, the apparatus comprising:

[0023] The input module is configured to obtain the first source code and the first attribute description to be formally proven.

[0024] The obfuscation module is configured to obfuscate the first source code based on a source code obfuscation strategy to obtain the second source code, and to obfuscate the first attribute description based on an attribute description obfuscation strategy to obtain the second attribute description.

[0025] The output module is configured to output the second source code and the second attribute description as prompt words to the specification generation system to generate formal model code and model attribute code;

[0026] The formal proof module is configured to formally prove the formal model code and model attribute code sent by the specification generation system in response to receiving them.

[0027] Fourthly, embodiments of this disclosure provide a formal proof system, the system comprising:

[0028] The formal proof system is configured to obtain a first source code and a first attribute description to be formally proven, obfuscate the first source code using a source code obfuscation strategy to obtain a second source code, obfuscate the first attribute description using an attribute description obfuscation strategy to obtain a second attribute description, and output the second source code and the second attribute description as prompt words to a reduction generation system; receive formal model code and model attribute code sent by the reduction generation system, and perform formal proof on the formal model code and model attribute code using a formal proof tool;

[0029] The specification generation system is configured to generate and send formal model code and model attribute code based on the second source code and the second attribute description.

[0030] Fifthly, embodiments of this application provide an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the methods as described in the first and second aspects.

[0031] Sixthly, embodiments of this application provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the methods of the first and second aspects.

[0032] The first aspect of the technical solution provided by the embodiments of this disclosure brings at least the following beneficial effects: The formal proof system obtains a first source code and a first attribute description to be formally proven; obfuscates the first source code using a source code obfuscation strategy to obtain a second source code, and obfuscates the first attribute description using an attribute description obfuscation strategy to obtain a second attribute description; outputs the second source code and the second attribute description as prompt words to a reduction generation system to generate formal model code and model attribute code; in response to receiving the formal model code and model attribute code sent by the reduction generation system, formal proof is performed on the formal model code and model attribute code using a formal proof tool. The embodiments of this disclosure, by obfuscating the source code and attribute description within the formal proof system, effectively protect privacy information, realize the reuse of large formal modeling models across different institutions, greatly expand the application scenarios of large formal modeling models, and improve the efficiency of formal proof.

[0033] It should be noted that the technical effects of any of the implementation methods in aspects two through six can be found in the technical effects of the corresponding implementation methods in aspect one, and will not be repeated here.

[0034] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments of this disclosure will be briefly described below. Clearly, the drawings described below only relate to some embodiments of this disclosure and are not intended to limit the scope of this disclosure.

[0036] Figure 1 A schematic diagram of a formal proof system according to at least one embodiment of the present disclosure is shown;

[0037] Figure 2A schematic diagram illustrating the main steps of a formal proof method according to at least one embodiment of the present disclosure is shown.

[0038] Figure 3 A schematic diagram of an electronic device according to at least one embodiment of the present disclosure is shown;

[0039] Figure 4 A schematic diagram of a computer-readable medium according to at least one embodiment of the present disclosure is shown. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0041] In the following text, any methods, apparatus, examples, and contents that do not fully correspond to the scope defined by the claims are not derived from the present invention. Such methods, apparatus, examples, and contents, as well as all subsequent descriptions, are for illustrative purposes only, or to highlight specific aspects or features of the claims.

[0042] Note that the examples described below are merely specific examples and are not intended to limit the embodiments of this disclosure to the specific shapes, hardware, connections, operations, values, conditions, data, sequences, etc., shown and described. Those skilled in the art can utilize the concepts of this disclosure to construct further embodiments not mentioned herein by reading this specification.

[0043] The terminology used in this disclosure is that which is currently widely used in the art in consideration of the functionality of this disclosure; however, these terms may vary depending on the intent, precedent, or new technology of those skilled in the art. Furthermore, specific terms may be chosen by the applicant, and in such cases, their detailed meanings will be described in the detailed description of this disclosure. Therefore, the terminology used in this specification should not be construed as simple names, but rather based on the meaning of the terms and the overall description of this disclosure.

[0044] To better understand the embodiments of this disclosure, the relevant terms involved in this disclosure will first be defined and explained.

[0045] Formal proof refers to the process of building models of requirements, solutions, code, etc., describing attribute specifications, and proving whether the attribute specifications conform to the model, based on axiomatic formal semantics, model and attribute specification languages, and predefined symbol systems. The objects of formal proof include software systems, solutions, and code. Formal proof methods can reveal implicit inconsistencies in software systems and find various potential errors, thus it is a software quality testing and verification method used in many important information systems. Formal proof methods include model checking, symbolic execution, constraint solving, and theorem proving. Among various formal proof techniques, model checking is currently the most mature formal proof method in industry, and many implementation tools have been launched.

[0046] Model verification is a technique for automatically verifying finite-state concurrent systems. It typically uses automata mechanisms to describe system behavior and mathematical logic such as sequential logic to describe system properties. Then, the model verification tool determines whether the system satisfies the given properties by traversing all states or execution paths of the system model.

[0047] Large language models are a class of highly parameterized artificial intelligence systems that use deep learning techniques, particularly neural networks based on the Transformer architecture, to process and generate natural language text. These models are trained on large-scale text datasets to learn complex patterns and structures of language, and integrate various techniques such as unsupervised learning, supervised learning, and reinforcement learning, giving them powerful inductive and reasoning capabilities.

[0048] It should be noted that the technical solutions in this disclosure, including the collection, updating, analysis, processing, use, transmission, and storage of user personal information, all comply with relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken to prevent unauthorized access to user personal information data and to safeguard user personal information security, network security, and national security.

[0049] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0050] Formal proof methods are widely used in software systems, but they also present numerous challenges, including: large code size (modern software systems often contain a large number of lines of code, and the time and resources required for formal proof increase exponentially with the code size); system complexity (software interacts with external systems (such as databases and network interfaces), requiring consideration of more factors during formal proof); programming language characteristics (different programming languages ​​have their own unique syntax and semantic rules); abstract business logic (the business logic behind the software code can be very complex and abstract, such as risk assessment models in financial software, which involve complex mathematical formulas and financial rules); and tool compatibility issues (different formal proof tools may use different syntaxes and models, and when a software system is written in multiple programming languages ​​or involves multiple development teams using different tools, integrating these tools for formal proof can encounter compatibility problems, making effective and comprehensive verification impossible). Therefore, it is difficult for an institution to have the ability to generate formal specifications, especially the ability to generate formal specifications that support multiple formal proof tools. At the same time, when an institution has the ability to generate a certain type of formal specification, using it only internally limits its application scope. Providing the ability to output formal specifications to external entities to enable reuse among various institutions is also very important for reducing development costs and improving code verification capabilities in this field.

[0051] Taking the financial sector as an example, when a financial institution needs to formally prove its code, if it lacks the ability to generate formal specifications, it needs to rely on the formal specification generation capabilities of external institutions to formally prove the source code. However, the relevant code and attribute descriptions of financial institutions are often highly private information and cannot be provided to other institutions. Therefore, this disclosure proposes a formal proof modeling method that enhances privacy protection. Specifically, the source code to be proved by institution A and the attribute descriptions to be proved are first obfuscated. Then, the obfuscated source code and attribute descriptions are submitted to institution B for modeling and generating formal specifications. Subsequently, institution A uses formal proof tools to verify the generated formal specifications internally. This disclosure effectively protects privacy information by using a large formal model in multi-institutional collaboration scenarios, realizes the reuse of the large formal model among different institutions, greatly expands the application scenarios of the large formal model, and improves the efficiency of formal proof.

[0052] Figure 1A schematic diagram of a formal proof system according to at least one embodiment of the present disclosure is shown. The system includes system A 110 (i.e., the formal proof system) and system B 120 (i.e., the specification generation system). For example, system A 110 could be a bank system that needs to formally prove its internally developed source code 210; system B 120 could be another bank system that has formal specification generation capabilities, or any other third-party institution that can provide formal specification generation services externally.

[0053] System 110 of Institution A includes an input module 111, a confusion module 112, an output module 113, and a formal proof module 114. System 120 of Institution B includes one or more formal modeling large models 121. The confusion module 112 further includes a source code confusion module 1121 and an attribute confusion module 1122. The formal proof module 114 includes one or more formal proof tools 1141. It is understandable that many open-source or commercial model verification tools have been launched in the industry. Open-source tools such as Nusmv, TLA, SPIN, CBMC, and UPPAAL use different symbol systems (development languages), employ different mathematical reduction logics, possess different system attribute proof capabilities, and are suitable for different system objects. For example, among different model verification tools, some are suitable for verifying chips, while others are suitable for verifying cryptographic protocols. Therefore, in order to ensure that the formal specification code (including formal model code 240 and model attribute code 250) generated by system 120 of institution B can be verified by the formal proof tool 1141 of system 110 of institution A, the formal modeling big model 121 of system 120 of institution B needs to correspond and match with the formal proof tool 1141.

[0054] Specifically, the formal modeling large model 121 can be obtained through fine-tuning training based on a specific formal proof tool 1141 training corpus; the training corpus includes, for example, a model validation tool encoding modeling dataset, a model validation attribute reduction dataset, a model validation example dataset, and a dataset of abstract and refined advanced modeling techniques, etc. The specific training process is as follows:

[0055] The model learns and trains on a general-purpose large language model on a model validation tool coding modeling dataset, primarily learning the symbolic language, syntax rules, coding logic, and expressions of the model validation tool; it also learns and trains on a model validation attribute reduction dataset, mainly learning the semantics of relevant attribute reductions and reduction expression methods, such as linear temporal logic (LTL) and computational tree logic (CTL) reductions; it learns and trains on a model validation example dataset, which consists of model validation cases implemented and validated using previous manual coding methods; and it learns abstraction, refinement, and other formal proof advanced modeling methods on an abstraction and refinement advanced modeling technique dataset.

[0056] The source code obfuscation module 1121 obfuscates the source code 210 (i.e., the first source code) input by the input module 111 based on a source code obfuscation strategy; the attribute obfuscation module 1122 obfuscates the attribute description 220 (i.e., the first attribute description) input by the input module 111 based on an attribute description obfuscation strategy. Here, source code 210 is the first source code to be formally proven in the system 110 of organization A. The source code obfuscation strategy includes at least one of the following: a meaningless identifier substitution strategy, a useless source code obfuscation insertion strategy, and a control flow logic modification strategy. The attribute description obfuscation strategy includes a meaningless identifier substitution strategy and / or a useless attribute description obfuscation insertion strategy; wherein, when the source code obfuscation strategy includes a meaningless identifier substitution strategy, the attribute description obfuscation strategy also includes a meaningless identifier substitution strategy, and the substitution method of the meaningless identifier substitution strategy in the attribute description obfuscation strategy is the same as the substitution method of the meaningless identifier substitution strategy in the source code obfuscation strategy.

[0057] Figure 2 A schematic diagram illustrating the main steps of a formal proof method according to at least one embodiment of the present disclosure is shown. The specific steps of the method are as follows:

[0058] In step S210, the input module 111 of system A (Organization A) obtains the first source code (source code 210) and the first attribute description (attribute description 220) to be formally proven. System A (Organization A) can obtain the source code 210 through any development method, such as self-development, collaborative development, or commissioned development. This disclosure does not limit this; it only requires ensuring that system A (Organization A) obtains the source code 210 and inputs it into the obfuscation module 112. In this embodiment, the source code refers to the software program code that needs to be verified for correctness. It is a set of instructions written by software developers according to the syntax rules of a specific programming language to implement various functions of the software. For example, for a simple calculator software, its source code may contain function definitions that implement addition, subtraction, multiplication, division, and other operations, as well as user interface interaction code. The main purpose of formal proof is to verify whether the source code meets the expected functions and properties. Example of source code before obfuscation:

[0059] def calculateTotal(price,tax):

[0060] total = price + (price * tax)

[0061] return total

[0062] total_price=calculateTotal(100,0.08)

[0063] An attribute description is a precise, formalized expression of the properties, characteristics, or behaviors expected to be possessed by software source code. These attributes can include functional attributes (such as specific functions the software should implement), security attributes (such as data confidentiality and integrity), and reliability attributes (such as the probability that the software will function normally within a certain period of time). For example, for a network communication software, its attribute description might include "the transmitted data will not be tampered with during transmission" (security attribute) and "the software can automatically reconnect after a network failure is resolved" (reliability attribute). Therefore, the attribute description clarifies the goal of formal proof. An example of an attribute description before obfuscation would be:

[0064] "When payment process a is in the critical section, order update process b cannot attempt to enter."

[0065] Step S220: Obfuscate the first source code using a source code obfuscation strategy to obtain the second source code; obfuscate the first attribute description using an attribute description obfuscation strategy to obtain the second attribute description. The obfuscation strategy helps prevent system B 120 from understanding the source code and / or attribute description of system A 110 when using a large model for formal modeling. The obfuscation strategy does not affect the correctness of the source program, and various related strategies can be used in combination. Source code obfuscation strategies for source code obfuscation may include one or more of the following:

[0066] 1. Meaningless identifier substitution strategy.

[0067] Meaningful identifiers are widely used in the initial development and team collaboration stages of code. For example, in the code of an e-commerce system, variable names such as "customerName," "productPrice," and "orderQuantity" allow developers to immediately understand the meaning of these variables. This helps improve code readability, especially when dealing with complex business logic. Developers can quickly understand the functionality of the code, reducing the time and effort required to comprehend it. Furthermore, when maintaining or debugging the code, meaningful identifiers provide clear clues, making it easier to identify and resolve problems.

[0068] However, when source code needs to be shared externally, meaningful identifiers, due to their high readability, can compromise code security. In such cases, using meaningless identifiers can increase the difficulty of reverse engineering. For example, in commercial software, if function names and variable names are meaningful, such as "calculateUserBalance" (to calculate user balance), attackers can easily deduce the software's functional logic and key data processing flow based on these identifiers. Using meaningless identifiers, such as "func1" and "var2," makes it difficult for attackers to understand the code's true intent, thus protecting the software's core algorithms. Furthermore, replacing meaningless identifiers helps hide sensitive information. In security-sensitive code, such as password processing and encryption algorithm-related code, using meaningless identifiers can hide the storage location and processing methods of sensitive information. For example, naming the variable storing the user password hash "data1" instead of "userPasswordHash" can prevent attackers from easily locating password-related code, reducing security risks.

[0069] In this embodiment of the disclosure, System 110 of Organization A obfuscates the source code (e.g., code written in high-level languages ​​such as Java and C) that requires formal proof. This includes renaming identifiers, i.e., changing the names of variables, functions, classes, etc., in the source code to make the original logic difficult to understand. Specifically, for example, if the source code includes values ​​such as calculateTotal, price, tax, total, and total_price, these are replaced with ambiguous and relatively meaningless identifiers a, b, c, d, and e. An exemplary source code obfuscation process is as follows:

[0070]

[0071] 2. Useless source code obfuscation insertion strategy. This obfuscation strategy helps increase the difficulty of reverse engineering Organization B's System 120. Suppose Organization B's System 120 attempts to decompile software code to obtain its core algorithms or business logic; this useless code will interfere with their analysis. For example, inserting a large number of function calls without actual functionality, redundant variable definitions and assignments, etc., will make the decompiled code structure complex and chaotic, increasing the difficulty of extracting useful information. An exemplary source code obfuscation process is as follows:

[0072]

[0073] 3. Control Flow Logic Modification Strategy. By altering the control flow logic of the source code program, its execution path can be made more complex, thus increasing the difficulty of understanding it. For example, a loop structure can be expanded into a particularly complex loop. In practice, very complex control flow changes can be made, such as adding new loops within branch loops. These practices will increase the difficulty of cracking the source code. An exemplary source code obfuscation process is as follows:

[0074]

[0075]

[0076] Attribute description obfuscation strategies for addressing attribute description obfuscation can include one or more of the following:

[0077] 1. Meaningless identifier substitution strategy. It is understandable that if the source code obfuscation strategy uses a meaningless identifier substitution strategy, then the attribute description obfuscation strategy should use the same meaningless identifier substitution method to ensure that the same identifiers in the source code and attribute descriptions correspond to the same variable names, function names, class names, etc.

[0078] Specifically, depending on the identifier obfuscation during the source code obfuscation phase, the identifier objects in the corresponding attribute descriptions are modified. For example, to prove that the source program has an attribute description: "When payment process a is in the critical section, order update process b cannot attempt to enter," if during the code obfuscation phase, the identifier of payment process a has been replaced with P1 and the identifier of order update process b has been replaced with P2 through identifier obfuscation, then the new attribute description would be "When P1 is in the critical section, P2 cannot attempt to enter."

[0079]

[0080] 2. Useless attribute descriptions obscure the insertion method.

[0081] Based on the original attribute descriptions, additional attribute descriptions are added to hide the original attributes. For example, if organization A, system 110, wants to prove that its source code has three security attributes, during the obfuscation phase, several other attributes can be added based on these three security attributes. These additional attributes can be counterexamples to the previous attributes or other attributes in general. The purpose of these additional attribute descriptions is to hide the true attributes to be proven.

[0082]

[0083] In step S230, the second source code and the second attribute description are output as prompts to the specification generation system (Institution B System 120) to generate formal model code and model attribute code. Optionally, the prompts may further include a formal proof tool identifier, so that Institution B System 120 generates formal model code and model attribute code corresponding to the formal proof tool 1141 based on the formal proof tool identifier. Specifically, Institution B System 120 runs the corresponding formal modeling large model 121 based on the formal proof tool identifier in the received prompts to generate formal model code and model attribute code.

[0084] Specifically, system 120 of institution B performs reasoning based on prompt words to obtain the formal specification code corresponding to the formal proof tool 1141 (such as TLA, SPIN, Nusmv, etc.) used by system 110 of institution A, including:

[0085] 1. Formal model code, which is a model built based on obfuscated source code (C or Java) after reasoning. The model code is expressed in a specific language in fields such as TLC, SMV, Promela, and Spin.

[0086] 2. Model attribute code, which is the temporal logic generated based on the obfuscated attribute description. For example, the natural language attribute description "When P1 is in the critical section, P2 cannot attempt to enter" will become a logical language specification description such as "SPEG AG! (P1 = critical & P2 = trying)".

[0087] In step S240, in response to receiving the formal model code and model attribute code sent by the organization B system 120, the organization A system 110 performs formal proof on the formal model code and model attribute code using the formal proof tool 1141.

[0088] The embodiments disclosed herein effectively protect privacy information by obfuscating the source code and attribute descriptions within the formal proof system, enabling the reuse of large formal modeling models across different institutions, greatly expanding the application scenarios of large formal modeling models, and improving the efficiency of formal proof.

[0089] It should be noted that the above application scenarios are merely exemplary, intended to describe one or more aspects of this disclosure in specific scenarios. However, these aspects are not essential, and various modifications can be made to the application scenario. It is readily understood that the specific application scenarios described in this disclosure are not limited.

[0090] At least some embodiments of this disclosure also provide an electronic device. Figure 3 A schematic diagram of an electronic device 300 according to at least one embodiment of the present disclosure is shown.

[0091] like Figure 3 As shown, the electronic device 300 includes one or more processors 310 and a memory 320. The memory 320 includes one or more computer program modules 321. These computer program modules 321 are stored in the memory 320 and are executed by the processor 310. Each computer program module 321 includes instructions for executing a formal proof method and its additional aspects according to at least one embodiment of the present disclosure. When executed by the processor 310, these instructions can perform one or more steps of the formal proof method and its additional aspects according to at least one embodiment of the present disclosure. The memory 320 and the processor 310 can be interconnected via a bus system and / or other forms of connection mechanisms (not shown). For example, the bus may be a Peripheral Component Interconnect Standard (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus may be divided into an address bus, a data bus, a control bus, etc.

[0092] For example, processor 310 may be a central processing unit (CPU), a digital signal processor (DSP), or other processing unit with data processing and / or program execution capabilities, such as a field-programmable gate array (FPGA). Processor 310 may be a general-purpose processor or a special-purpose processor, capable of controlling other components in electronic device 300 to perform desired functions.

[0093] Exemplarily, memory 320 may include any combination of one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), USB memory, flash memory, etc. One or more computer program modules 321 may be stored on the computer-readable storage medium, and processor 310 may run one or more computer program modules 321 to implement various functions of electronic device 300. The computer program modules include multiple computer-executable instructions. Various application programs and various data, as well as various data used and / or generated by the application programs, may also be stored in the computer-readable storage medium.

[0094] For example, electronic device 300 may also include input devices such as touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, and gyroscopes; output devices such as liquid crystal displays, speakers, and vibrators; storage devices such as magnetic tapes and hard disks (HDDs or SDDs); and communication devices such as network interface cards like LAN cards and modems. The communication devices allow electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data and perform communication processing via networks such as the Internet. A drive is connected to the I / O interface as needed. Removable storage media, such as disks, optical disks, magneto-optical disks, and semiconductor memories, are installed on the drive as needed so that computer programs read from them can be installed into the storage device as required.

[0095] For example, the electronic device 300 may further include a peripheral interface (not shown in the figure). This peripheral interface can be various types of interfaces, such as a USB interface, a Lightning interface, etc. The communication device can communicate wirelessly with networks and other devices, such as the Internet, intranets and / or wireless networks such as cellular telephone networks, wireless local area networks (LANs) and / or metropolitan area networks (MANs). Wireless communication can use any of a variety of communication standards, protocols, and technologies, including but not limited to Global System for Mobile Communications (GSM), Enhanced Data GSM Environment (EDGE), Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Bluetooth, Wi-Fi (e.g., based on IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, and / or IEEE 802.11n standards), Voice over Internet Protocol (VoIP), Wi-MAX, protocols for email, instant messaging, and / or Short Message Service (SMS), or any other suitable communication protocol.

[0096] The electronic device 300 may be, for example, a system-on-a-chip (SOC) or a device including the SOC. For instance, it can be any device such as a mobile phone, tablet computer, laptop computer, e-reader, game console, television, digital photo frame, navigator, home appliance, communication base station, industrial controller, server, etc., or any combination of data processing devices and hardware. The embodiments of this disclosure do not limit this. The specific functions and technical effects of the electronic device 300 can be found in the foregoing description of the formal proof method and its additional aspects according to at least one embodiment of this disclosure, and will not be repeated here.

[0097] Figure 4 A schematic diagram of a readable storage medium 400 according to at least one embodiment of the present disclosure is shown.

[0098] like Figure 4 As shown, a computer program 410 is stored on a readable storage medium 400, which is a computer-readable storage medium. When the computer program 410 is executed by a processor, it performs one or more steps of the formal proof method and its additional aspects as described above.

[0099] For example, when the program code is read by a computer, the computer can execute the program code stored in the computer storage medium to perform one or more steps to implement, for example, the formal proof method and its additional aspects according to at least one embodiment of the present disclosure.

[0100] For example, the readable storage medium may include a memory card of a smartphone, a storage component of a tablet computer, a hard disk of a personal computer, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), flash memory, and other readable storage media or any combination thereof. The readable storage medium 400 may be a non-transitory readable storage medium.

[0101] At least some of the embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other.

[0102] It should be noted that, in this disclosure, relational terms such as "first," "second," etc., are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0103] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved; that is, the preceding or following operations are not necessarily executed precisely in sequence. Instead, various steps may be processed in reverse order or simultaneously as needed. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0104] The units described in the embodiments of this disclosure can be implemented in software or hardware. The described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0105] The following points should be noted regarding this disclosure:

[0106] (1) The accompanying drawings of the embodiments of this disclosure only involve the structures involved in the embodiments of this disclosure. Other structures can be referred to the general design.

[0107] (2) Where there is no conflict, the embodiments of this disclosure and the features in the embodiments can be combined with each other to obtain new embodiments.

[0108] The above are merely exemplary embodiments of this disclosure and are not intended to limit the scope of protection of this disclosure, which is determined by the appended claims.

Claims

1. A formal proof method, characterized in that, The method, applied to formal proof systems, includes: Obtain the first source code and first attribute description to be formally proven; The first source code is obfuscated using a source code obfuscation strategy to obtain the second source code, and the first attribute description is obfuscated using an attribute description obfuscation strategy to obtain the second attribute description; The second source code and the second attribute description are output as prompt words to the specification generation system to generate formal model code and model attribute code; In response to receiving the formal model code and the model attribute code sent by the specification generation system, a formal proof tool is used to perform a formal proof on the formal model code and the model attribute code.

2. The method according to claim 1, characterized in that, The prompt words also include a formal proof tool identifier, so that the specification generation system generates the formal model code and the model attribute code corresponding to the formal proof tool based on the formal proof tool identifier.

3. The method according to claim 1, characterized in that, The source code obfuscation strategy includes at least one of the following: meaningless identifier replacement strategy, useless source code obfuscation insertion strategy, and control flow logic modification strategy.

4. The method according to claim 3, characterized in that, The attribute description obfuscation strategy includes a meaningless identifier substitution strategy and / or a useless attribute description obfuscation insertion strategy; wherein, when the source code obfuscation strategy includes a meaningless identifier substitution strategy, the attribute description obfuscation strategy also includes a meaningless identifier substitution strategy, and the substitution method of the meaningless identifier substitution strategy in the attribute description obfuscation strategy is the same as the substitution method of the meaningless identifier substitution strategy in the source code obfuscation strategy.

5. A formal proof method, characterized in that, The method includes: The formal proof system obtains the first source code and the first attribute description to be formally proven, obfuscates the first source code based on the source code obfuscation strategy to obtain the second source code, obfuscates the first attribute description based on the attribute description obfuscation strategy to obtain the second attribute description, and outputs the second source code and the second attribute description as prompt words to the specification generation system. The specification generation system generates and sends formal model code and model attribute code based on the second source code and the second attribute description; The formal proof system receives the formal model code and the model attribute code sent by the specification generation system, and uses a formal proof tool to perform formal proof on the formal model code and the model attribute code.

6. The method according to claim 5, characterized in that, The specification generation system includes a formal modeling large model, and generates the formal model code and the model attribute code based on the formal modeling large model.

7. The method according to claim 5, characterized in that, The prompt words also include formal proof tool identifiers, and the reduction generation system includes multiple large formal modeling models; the method also includes: The specification generation system runs the corresponding formal modeling big model according to the formal proof tool identifier, and generates the formal model code and the model attribute code.

8. The method according to claim 5, characterized in that, The source code obfuscation strategy includes at least one of the following: meaningless identifier replacement strategy, useless source code obfuscation insertion strategy, and control flow logic modification strategy.

9. The method according to claim 8, characterized in that, The attribute description obfuscation strategy includes a meaningless identifier substitution strategy and / or a useless attribute description obfuscation insertion strategy; wherein, when the source code obfuscation strategy includes a meaningless identifier substitution strategy, the attribute description obfuscation strategy also includes a meaningless identifier substitution strategy, and the substitution method of the meaningless identifier substitution strategy in the attribute description obfuscation strategy is the same as the substitution method of the meaningless identifier substitution strategy in the source code obfuscation strategy.

10. A formal proof apparatus, characterized in that, The apparatus, used in a formal proof system, comprises: The input module is configured to obtain the first source code and the first attribute description to be formally proven. The obfuscation module is configured to obfuscate the first source code based on a source code obfuscation strategy to obtain the second source code, and to obfuscate the first attribute description based on an attribute description obfuscation strategy to obtain the second attribute description. The output module is configured to output the second source code and the second attribute description as prompt words to the specification generation system to generate formal model code and model attribute code; The formal proof module is configured to, in response to receiving the formal model code and the model attribute code sent by the specification generation system, perform formal proof on the formal model code and the model attribute code using a formal proof tool.

11. A formal proof system, characterized in that, The system includes: A formal proof system is configured to: acquire a first source code and a first attribute description to be formally proven; obfuscate the first source code using a source code obfuscation strategy to obtain a second source code; obfuscate the first attribute description using an attribute description obfuscation strategy to obtain a second attribute description; output the second source code and the second attribute description as prompt words to a reduction generation system; receive the formal model code and the model attribute code sent by the reduction generation system; and perform formal proof on the formal model code and the model attribute code using a formal proof tool. The specification generation system is configured to generate and send formal model code and model attribute code based on the second source code and the second attribute description.

12. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-9.

13. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-9.

Images