Distributed state verification method and device, electronic equipment and storage medium

Abstract

This invention provides a distributed state verification method, apparatus, electronic device, and storage medium, belonging to the field of formal verification technology for distributed systems. The method acquires the operational semantics and state constraints of the distributed application to be verified and verifies their preservation. It then uses mathematical induction to derive global state equivalence based on initial state equivalence and single-step operation semantic preservation, theoretically proving the state consistency of the system under all possible operation sequences, significantly improving the comprehensiveness and fundamental reliability of the verification. During runtime, an independently referenced model is deployed, and based on the derivation of global state equivalence, a lightweight state summary is used to replace the full state for consistency comparison between the reference model and replica nodes. This avoids the state explosion problem caused by the increase in state size during full state comparison, significantly reducing network transmission and computational overhead, and achieving efficient, accurate, and complete verification of large-scale distributed system states.

Description

Technical Field

[0001] This invention relates to the field of formal verification technology for distributed systems, and in particular to a distributed state verification method, apparatus, electronic device, and storage medium. Background Technology

[0002] Currently, for distributed applications developed based on deterministic state machine replication (such as Byzantine fault-tolerant consensus frameworks), state consistency verification mainly relies on black-box testing based on state snapshot comparison, consistency verification based on log analysis, or fault-tolerant testing based on fault injection.

[0003] These methods have fundamental flaws when facing large-scale, high-reliability distributed applications: on the one hand, full-state comparison or log analysis can lead to state explosion as the state size increases, resulting in a surge in testing overhead and difficulty in covering large-scale state spaces; on the other hand, the asynchronous nature of distributed environments makes it difficult to accurately synchronize state acquisition times, leading to uncertainty interference and false alarms; in addition, traditional testing can only verify system behavior under a limited sequence of inputs, lacking the ability to prove the semantic correctness of operations and the order of operations, and cannot fundamentally guarantee the consistency of the system's state under all possible sequences of operations.

[0004] In summary, traditional distributed application state consistency verification schemes suffer from technical problems such as high testing overhead, poor accuracy, and incomplete testing. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a distributed state verification method, apparatus, electronic device and storage medium to alleviate the technical problems of high testing overhead, poor accuracy and incomplete testing in traditional distributed application state consistency verification schemes.

[0006] In a first aspect, the present invention provides a distributed state verification method, comprising: Obtain the operational semantics and state constraints of the distributed application to be verified, and verify the preservation of the operational semantics by the state constraints; In response to the retention verification passing, global state equivalence is derived based on initial state equivalence and single-step operation semantic preservation. When the distributed application to be verified is running, an independently running reference model is deployed, and based on the derivation of global state equivalence, a state summary is used instead of the full state to compare the consistency between the state of the reference model and the state of the replica node. In response to inconsistencies in the state digest, the specific operational steps and faulty replica nodes are located.

[0007] Furthermore, the state constraints include state invariants, and based on initial state equivalence and single-step operation semantic preservation, global state equivalence is derived, including: Verifying the equivalence of the initial states includes: determining that the initial state of the reference model and the initial state of the replica node satisfy the state invariant, and that the initial state of the reference model and the initial state of the replica node are the same. Verifying the preservation of the single-step operation semantics includes: determining that, under the current state that satisfies the state invariant, any atomic operation, after being executed according to the single-step operation semantics, still results in a new state that satisfies the state invariant; Based on mathematical induction, it is deduced that under any sequence of operations, the states of all replica nodes are always equivalent to the states of the reference model.

[0008] Further, verifying the preservation of the operational semantics with respect to the state invariant includes: Using the Hoare logic style, preconditions and postconditions are defined for each atomic operation described in the operation semantics; Using a theorem prover, it is automatically verified that for any state that satisfies the preconditions and the state invariant, the new state and return value obtained after performing the atomic operation satisfy the postconditions and the state invariant.

[0009] Furthermore, the consistency comparison between the reference model state and the replica node state is performed by replacing the full state with a state digest, including: State digests are collected from the reference model and the replica node respectively, and the state digests of the reference model and the replica node are compared for consistency. The state digests include state hashes or sets of key attributes.

[0010] Furthermore, after locating the specific operational steps and the faulty replica node, the method further includes: Output diagnostic information.

[0011] Furthermore, the method is applied to distributed systems based on deterministic state machine replication; The consensus protocol of the distributed system provides a global sequence number as an anchor point for the operation order, ensuring that all correct replica nodes execute the same operation sequence.

[0012] Furthermore, the diagnostic information includes a difference summary, an operation sequence number, and a verification certificate containing formal proof results.

[0013] Secondly, the present invention also provides a distributed state verification device, comprising: The acquisition and verification unit is used to acquire the operation semantics and state constraints of the distributed application to be verified, and to verify the retention of the operation semantics on the state constraints. The derivation unit is used to derive the global state equivalence in response to the retention verification passing, based on the initial state equivalence and the semantic preservation of single-step operations. The consistency comparison unit is used to deploy an independently running reference model during the runtime of the distributed application to be verified, and to compare the consistency between the reference model state and the replica node state by replacing the full state with a state summary based on the derivation conclusion of global state equivalence. The location unit is used to locate specific operational steps and faulty replica nodes in response to inconsistencies in the state digest.

[0014] Thirdly, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the computer program to implement the method described in the first aspect.

[0015] Fourthly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the method described in the first aspect.

[0016] This invention provides a distributed state verification method, comprising: acquiring the operational semantics and state constraints of the distributed application to be verified, and verifying the preservation of the operational semantics with respect to the state constraints; in response to the successful preservation verification, deriving global state equivalence based on initial state equivalence and single-step operational semantic preservation; during the runtime of the distributed application to be verified, deploying an independently running reference model, and comparing the consistency between the reference model state and the replica node state using a state digest instead of the full state based on the derivation conclusion of global state equivalence; and in response to a state digest inconsistency, locating the specific operational step and the faulty replica node. As described above, the distributed state verification method of this invention obtains the operational semantics and state constraints of the distributed application to be verified and verifies their preservation. It then uses mathematical induction to derive global state equivalence based on initial state equivalence and single-step operational semantic preservation, thus theoretically proving the state consistency of the system under all possible operation sequences. This overcomes the shortcomings of traditional tests, which can only cover a limited number of input sequences and lack the ability to prove universal propositions, significantly improving the comprehensiveness and fundamental reliability of the verification. Simultaneously, it deploys an independently referenced model at runtime and, based on the derivation of global state equivalence, uses a lightweight state summary to replace the full state for consistency comparison between the reference model and replica nodes. This not only avoids the state explosion problem caused by the increase in state scale during full state comparison and significantly reduces network transmission and computational overhead, but also eliminates the asynchronous interference of state acquisition caused by the asynchronous nature of the distributed environment through the deterministic execution of the reference model. This effectively solves the problems of high testing overhead, poor accuracy, and high false alarm rate in traditional schemes, achieving efficient, accurate, and complete verification of large-scale distributed system states. Attached Figure Description

[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 A flowchart of a distributed state verification method provided in an embodiment of the present invention; Figure 2 A diagram illustrating the BFT consensus application verification reasoning framework based on formal state machine reasoning provided in this embodiment of the invention. Figure 3 A schematic diagram illustrating the BFT consensus application verification mapping process based on formal state machine reasoning, as provided in an embodiment of the present invention. Figure 4 A flowchart for verifying the BFT consensus application based on formal state machine reasoning, provided for embodiments of the present invention; Figure 5 A schematic diagram of a distributed state verification device provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] To facilitate understanding of this embodiment, a distributed state verification method disclosed in this embodiment of the invention will first be described in detail.

[0021] Example 1: like Figure 1 As shown in the figure, this embodiment provides a distributed state verification method. This method achieves efficient consistency verification that is theoretically complete and decoupled from the overhead and state size by deeply integrating formal reasoning with runtime lightweight verification. The method mainly includes the following four core steps.

[0022] Step S100: Obtain the operation semantics and state constraints of the distributed application to be verified, and verify the preservation of the operation semantics on the state constraints.

[0023] Specifically, operational semantics defines the logical rules for how a distributed application transitions its state after receiving a specific request, while state constraints are abstractions of business rules that the state space must always satisfy. Verifying the preservation of state constraints by operational semantics means confirming that regardless of the operation applied, as long as the input state satisfies the state constraints, the output state will not violate these constraints. It should be understood that the specific manifestation of operational semantics is not limited to traditional state machine transition functions; it can also be an abstract representation of business logic code or a configuration script for a rule engine. State constraints are not limited to single business rules; they can be logical combinations of multiple constraints. The value of this step lies in providing the underlying logical foundation for subsequent inductive reasoning, ensuring that each step of state evolution occurs within a controlled and safe boundary.

[0024] The above acquisition process can be achieved through formal modeling and state machine semantic definition. Specifically, a formal model is established for the distributed application to be verified, defining the state space Σ, the initial state σ0∈Σ, and the formal semantic function (i.e., operation semantics) for each atomic operation:

[0025] The semantic function must satisfy determinism: under the same state and parameters, the successor state and return value are unique. At the same time, a global invariant set I (i.e., state constraints) is defined to characterize the business constraints that the state must always satisfy (such as key naming conventions, value length limits, and version number monotonicity).

[0026] Formal representation uses a specification language similar to TLA+ or Z3, for example, for the PUT operation of the configuration service: PUT(σ,key,val)=(σ',ok) Where σ'=σ∪{(key,val)} The following section will provide a detailed explanation of the process by which the semantics of the verification operation are preserved in relation to state constraints.

[0027] In step S200, in response to the retention verification being passed, global state equivalence is derived based on the initial state equivalence and the semantic retention of single-step operations.

[0028] Specifically, this step constructs a rigorous causal chain at the logical level: since it has been proven that operational semantics can preserve state constraints, then, combining the premises that all replica nodes and the reference model start from the same initial state (i.e., initial state equivalence) and that step S100 verifies the preservation of single-step operational semantics, a global conclusion can be derived through mathematical logic—under an operational sequence of arbitrary length, the state evolution of all replica nodes is logically completely equivalent (i.e., global state equivalence). This derivation has extremely important technical significance, as it reduces the complex global problem in distributed systems that originally required multi-node collaborative verification to a problem of proving the equivalence of single-node state evolution, fundamentally avoiding the dilemma of being unable to exhaustively verify due to state space explosion.

[0029] Step S300: When the distributed application to be verified is running, deploy an independently running reference model, and based on the derivation conclusion of global state equivalence, use state digest to replace the full state to compare the consistency between the reference model state and the replica node state.

[0030] Specifically, because the equivalence of the global state has been rigorously proven theoretically in step S200, a state digest with minimal overhead can be used to represent the massive full state for comparison during actual operation. The state digest is a highly condensed representation of the full state's features; its specific form is not limited to fixed-length state hash values, but can also be an extracted set of key attributes or feature fingerprints. As long as the digests are consistent, combined with the aforementioned reasoning premises, the consistency of the full state can be inferred. Here, a crucial logical defense must be clearly pointed out: without the theoretical premise of semantically preserving reasoning, simple digest comparison is extremely vulnerable in an asynchronous distributed environment, easily leading to false positives. For example, without reasoning guarantees, two completely different states may produce the same digest due to hash collisions or clock drift during data collection, causing the system to misjudge them as consistent; or two states that should be consistent may produce different digests due to network latency causing the snapshots to be collected at different operation steps, leading the system to misjudge them as inconsistent. This invention, by causally binding theoretical reasoning with runtime comparison, makes digest comparison no longer an isolated physical comparison, but a physical mapping of logical equivalence, completely eliminating the aforementioned hidden dangers of false positives. At the same time, this mapping reduces the original full-state alignment with a complexity of O(N) to a summary alignment with a complexity of O(1), achieving complete decoupling of verification overhead from state size.

[0031] In step S400, in response to the inconsistency in the state digest, the specific operation steps and faulty replica nodes are located.

[0032] Specifically, when runtime comparison reveals inconsistencies in the state digest, this breaks the global equivalence conclusion derived in step S200, implying the existence of a faulty node in the system that violates semantic preservation or consensus protocols. At this point, the system utilizes deterministic anchor points in the operation sequence to quickly backtrack to the specific operational step that caused the inconsistency and precisely pinpoint the faulty replica node that generated the abnormal state digest. This precise location capability overcomes the limitation of traditional black-box testing, which can only detect inconsistencies but cannot trace the root cause of the fault, significantly shortening the fault diagnosis and repair cycle. It should be understood that the specific methods of location are not limited to simple log backtracking; they can also be combined with the parsing of difference digests or the comparison of state trees to achieve more granular fault analysis.

[0033] Through the above four steps, this embodiment constructs a complete closed loop from theoretical reasoning to runtime verification, which not only provides theoretical completeness at the universal proposition level, but also achieves efficient engineering implementation by decoupling overhead and state scale.

[0034] Based on the above step S200, the specific logical elements and formal proof methods of inductive reasoning are elaborated in detail.

[0035] First, state constraints include state invariants. Specifically, state invariants are abstractions of core business rules that the state space must always satisfy. In distributed configuration services, state invariants can be not only constraints on key naming validity, but also constraints on upper limits of value length, monotonically increasing version numbers, or logical combinations of multiple such constraints. The core value of state invariants as anchors for inference lies in their high degree of abstraction of the vast or even infinite state space. This allows inductive reasoning to avoid exhaustively enumerating all possible specific state snapshots, focusing only on whether the state always satisfies this abstract constraint, thus fundamentally avoiding the state explosion problem.

[0036] Based on this, verifying the equivalence of the initial states includes: determining that the initial state of the reference model and the initial state of the replica nodes satisfy state invariants, and that the initial state of the reference model and the initial state of the replica nodes are the same. For example, when the distributed configuration service starts, the reference model and all replica nodes start from the same empty mapping state. This empty mapping naturally satisfies preset invariants such as key-value format and length, and the physical states are completely identical, thus establishing a solid starting point for inductive reasoning.

[0037] Furthermore, verifying the preservation of single-step operation semantics includes: determining that, given an atomic operation in the current state that satisfies the state invariant, the new state obtained after execution according to the single-step operation semantics still satisfies the state invariant. This step is the core driving force of inductive reasoning. It ensures that regardless of the legal operation received by the system, as long as the input state is within the safety boundary characterized by the invariant, the output state after the operation will never exceed the boundary and will remain within the safety boundary. It should be understood that the preservation of single-step operation semantics is not limited to simple read and write operations; for atomic operations containing complex judgment logic (such as comparison and swap operations), it is also necessary to rigorously verify their preservation of the invariant of the new state.

[0038] Based on mathematical induction, it is deduced that the states of all replica nodes are always equivalent to the states of the reference model under any sequence of operations. Specifically, this derivation process constitutes a rigorous logical syllogism: the equivalence of the initial states forms the cornerstone of the induction, the invariance of the semantics of single-step operations forms the inductive steps, and thus, through mathematical induction, a global conclusion is naturally derived—under any sequence of operations, the state evolution of all replica nodes is logically completely equivalent. This derivation reduces distributed global consistency verification to equivalence reasoning of the state evolution of a single node, fundamentally solving the deficiency of traditional tests that cannot exhaustively enumerate all sequences of operations.

[0039] To ensure the absolute stability of the aforementioned inductive foundation, verifying the preservation of state invariants by operational semantics includes: adopting the Hoare logic style to define preconditions and postconditions for each atomic operation described by the operational semantics. Specifically, the Hoare logic style formalizes operational semantics as a Hoare triple {P}C{Q}, where P is the precondition, describing the constraints that the state and parameters must satisfy before the operation is executed; C is the operation command; and Q is the postcondition, describing the constraints that the new state and return value must satisfy after the operation is executed. For example, for a compare-and-swap operation, its precondition can be defined as the value of the specified key in the current state being equal to the expected value, and its postcondition can be defined as: if the match is successful, the value of the key in the new state is updated to the updated value and the return value is true; if the match fails, the state remains unchanged and the return value is false. It should be understood that the definitions of preconditions and postconditions are not limited to simple key-value storage operations, but can also cover complex business logic such as transaction operations in distributed databases and state transitions in blockchains.

[0040] Building upon this foundation, a theorem prover is used to automatically verify that for any state satisfying the preconditions and state invariants, the new state and return value obtained after performing atomic operations satisfy the postconditions and state invariants. The theorem prover, through symbolic execution and logical reasoning, automatically traverses all abstract state spaces satisfying the preconditions and state invariants, exhaustively enumerating all possible execution paths to verify the necessary validity of the postconditions and invariants. This process achieves a leap from finite testing to universal proposition proof, ensuring the absolute stability of the foundation of inductive reasoning and eliminating potential boundary vulnerabilities that might be missed by manual reasoning. As an optional example, the theorem prover can use the Z3 prover; however, it should be understood that this invention does not limit the specific prover type, and any theorem prover with similar symbolic reasoning and automatic verification capabilities (such as Why3, Coq, etc.) is applicable. Through the automatic verification of the theorem prover, this embodiment provides an unshakable logical premise for lightweight summary comparison at runtime at the theoretical level, making subsequent physical comparisons no longer isolated empirical judgments, but a necessary mapping of logical equivalence.

[0041] The above process of deriving global state equivalence can be summarized as a trajectory abstraction and inductive reasoning framework for operation sequences. Specifically: Let the operation sequence O = [o1, o2, ..., o n The execution trajectory T=(σ0,r1,σ1,…,r) n ,σ n Since the BFT consensus protocol guarantees that all correct replica nodes execute the exact same sequence of operations, the trajectory of any correct replica node is identical.

[0042] Define the state equivalence relation ≡: σ1≡σ2 if and only if I(σ1)∧I(σ2) and σ1=σ2 (in practice, it can be equivalent to the summary through state invariants).

[0043] Figure 2 The document illustrates a BFT consensus application verification reasoning framework based on formal state machine reasoning. For example... Figure 2 As shown, the test framework selects a "reference model" (usually the master node or any known correct replica node) in the consensus cluster and runs an independent state machine simulator (called the "reference model") that is exactly the same as the distributed application to be verified. The simulator receives the same operation sequence input as the consensus cluster and synchronously generates the expected trajectory T_expected.

[0044] Since the reference model and the distributed application to be verified use the same operational semantic function and have the same input operation sequence, the trajectory of the reference model is the ideal trajectory that the system should achieve. According to the properties of the BFT consensus protocol, as long as all correct replica nodes correctly implement the operational semantic function, their trajectories will necessarily be completely consistent with T_expected.

[0045] Therefore, verifying the correctness of the system is transformed into verifying: for each operation i, the state σ generated by the reference model. i ^ref and the actual state σ of all replica nodes i Whether the replicas are consistent. However, traditional comparison methods require collecting the status of all replica nodes. This invention proposes a formal equivalence reasoning method to avoid actual state comparison.

[0046] Define a state equivalence relation: Two states are equivalent if and only if they satisfy a predefined set of invariants I (i.e., state invariants). State invariants are an abstraction of the state space that can characterize the core business constraints of the application (such as "all key-value pairs satisfy a certain format"), and the semantic functions of operations should preserve these invariants.

[0047] The core inference algorithm is as follows: Inductive reasoning principle: Basic: σ0^ref≡σ0^replica (initial state is consistent).

[0048] Induction: Assume σ_{i-1}^ref ≡ σ_{i-1}^replica, then for operation o i Semantic determinism: σ i ^ref=apply(σ_{i-1}^ref,o i )=apply(σ_{i-1}^replica,o i )=σ i ^replica.

[0049] Therefore σ i ^ref≡σ i^replica. The induction is valid.

[0050] Initial equivalence: Before the test begins, all replica nodes and the reference model start from the same initial state σ0, and obviously σ0^ref ≡ σ0^replica (which holds true for all replicas).

[0051] Inductive steps: Assume that after the (i-1)th operation, the states of all replica nodes are equivalent to the states of the reference model, i.e., σ_{i-1}^ref ≡ σ_{i-1}^replica (this holds true for all replicas). Now execute operation o. i The reference model is used to calculate σ. i ^ref=apply(σ_{i-1}^ref,o i Each replica node actually executes o. i σ i ^replica=apply(σ_{i-1}^replica,o i Consistency derivation: Since the semantic function apply is deterministic, and σ_{i-1}^ref ≡ σ_{i-1}^replica, according to the invariant preservation property, we have σ i ^ref≡σ i ^replica. Therefore, if the initial states are equivalent and the semantics of the operations remain unchanged, then the induction holds that the states are equivalent after all operations.

[0052] Therefore, it can be proven that the states of all replica nodes remain equivalent throughout the entire execution process by verifying the following two premises: Initial state equivalence: The initial configuration ensures that all replica nodes are in the same state.

[0053] Operation semantic preservation: For any state σ that satisfies invariant I and any operation o, apply(σ, o) also satisfies I, and apply(σ, o) is uniquely determined.

[0054] The above verification of the preservation of the semantics of the operation with respect to the state invariant can be summarized as a formal verification of the preservation of the semantics of the operation (assisted by the theorem prover). Specifically, each operation is represented as a precondition / postcondition in Hoare logic form, and the theorem prover (Z3, Why3) is used to automatically verify that for any state σ that satisfies Pre(σ) and I(σ), after performing the operation, σ' is obtained, and I(σ') and Post(σ,σ') must hold.

[0055] Specifically, for each atomic operation o, the following is defined: Preconditions Pre(σ,params): The conditions that state σ must satisfy, and the constraints that the parameters must satisfy.

[0056] Postcondition Post(σ,σ',params,ret): The relationship between the new state σ' and the old state σ, and the relationship between the return value ret and σ.

[0057] For example, for the CAS operation (compare and swap): Pre(σ,key,expect,update):σ(key)=expect Post(σ,σ',key,expect,update,ret): (ret=true∧σ'=σ[key→update])∨(ret=false∧σ'=σ) Automatic verification using the theorem prover: For any σ and parameter that satisfy Pre, the state σ' and return value ret obtained after applying must satisfy Post.

[0058] Furthermore, we define a global invariant I and verify that each operation (i.e., atomic operation) preserves I: for any σ that satisfies Pre(σ)∧I(σ), I(σ') holds.

[0059] Once the semantic preservation of all operations is formally proven, and combined with the operation sequence consistency guaranteed by the BFT consensus protocol, it can be deduced that the entire system can maintain the equivalent state of all replica nodes under any operation sequence, that is, the system satisfies the security property.

[0060] This step proves that all operations remain invariant, thus ensuring the stability of the foundation of inductive reasoning.

[0061] Based on the above steps S300 and S400, this embodiment elaborates on the engineering implementation details of lightweight runtime summary comparison and precise fault location.

[0062] First, a state digest is used instead of the full state for consistency comparison between the reference model state and the replica node state. This includes: collecting state digests from both the reference model and the replica nodes, and comparing the consistency of the reference model's state digest with that of the replica nodes. The state digest includes a state hash or a set of key attributes. Specifically, the reference model has irreplaceable value as a comparison benchmark. It runs independently of the distributed cluster, receives the same deterministic operation sequence input as the cluster, and executes state evolution logic synchronously. Because the reference model is unaffected by abnormal factors such as network latency, node failures, or Byzantine behavior in the distributed environment, the state digest it generates represents the absolute standard that the system should achieve under ideal conditions. Without this independent benchmark, relying solely on comparisons between replicas within the cluster will fail to identify collective errors when extreme failures occur where a majority of nodes simultaneously deviate from the correct semantics, leading to the failure of the verification system. It should be understood that the deployment of the reference model is not limited to simulators on independent physical machines; it can also be isolated container instances or logically decoupled bypass verification engines, as long as they are protected from contamination by anomalies within the cluster.

[0063] Furthermore, the state digest includes a state hash or a set of key attributes. The state hash maps the state space, regardless of its size, to a fixed-length feature fingerprint by cryptographically compressing the entire state data (e.g., the SHA-256 algorithm); the set of key attributes is a subset of attributes extracted from the entire state that can represent the core business logic (e.g., a list of version numbers for all keys in a configuration service). Both of these forms reduce the complexity of the original O(N) full-state byte-level comparison to a digest comparison with a complexity of O(1), achieving a complete decoupling of verification overhead from the state size. Even if the state space expands to millions of key-value pairs or several GB of blockchain state, each verification only requires calculating and transmitting a fixed-length digest, reducing the time from seconds to milliseconds, and decreasing storage requirements by more than 99%. Here, a crucial logical boundary must be clearly pointed out: "identical states" is the result of physical-level digest comparison, while "equivalent states" is a conclusion of logical-level inductive reasoning; the two are mapped but not confused. Physical-level summary consistency is an external representation of logical-level state equivalence at runtime; however, physical-level summary comparison itself can never replace logical-level equivalence proof. Only summary comparison based on semantic-preserving reasoning has the legitimate validity of inferring global consistency.

[0064] Next, in response to the inconsistency in the state digest, the system locates the specific operational step and the faulty replica node, outputting diagnostic information. Specifically, when the replica node digest collected at runtime is inconsistent with the reference model digest, it means that the replica has broken the globally equivalence conclusion derived from the above content, and there must be a faulty behavior that violates semantic preservation or consensus protocol. At this time, the system uses the global sequence number provided by the distributed consensus protocol as a time anchor to quickly backtrack and locate the specific operational step that caused the inconsistency. For example, if the reference model executes the operation with sequence number 100 and the digest is H_ref, while a replica with the same sequence number has the digest H_fault, the system can accurately locate sequence number 100 as the fault occurrence point and mark the replica that generated H_fault as the faulty node. This precise location capability overcomes the serious deficiency of traditional black-box testing, which can only find inconsistencies but cannot trace the root cause of the fault, and significantly shortens the fault diagnosis and repair cycle. It should be understood that the specific location methods are not limited to simple sequence number comparison; they can also be combined with the parsing of difference digests or the layer-by-layer comparison of the state tree to achieve more granular fault analysis. Finally, the diagnostic information includes a difference summary, an operation sequence number, and a verification certificate containing formal proof results. Specifically, the difference summary details the specific deviations in state characteristics between the fault copy and the reference model, providing developers with direct debugging clues; the operation sequence number precisely identifies the global timing location of the fault; and the verification certificate containing formal proof results binds the semantically preserving proof conclusions (such as the Hoare logic verification report) automatically generated using the theorem prover to the runtime fault scenario. This design achieves a fully traceable closed loop from theoretical proof to runtime testing, not only informing developers where the system went wrong but also proving, through the verification certificate, how the system should theoretically operate correctly, providing the highest level of correctness assurance for systems with high reliability requirements. It should be understood that the specific format of the verification certificate is not limited to a text report; it can also be a machine-readable digital signature certificate or a structured log to adapt to the needs of different automated operation and maintenance platforms.

[0065] The above consistency comparison and fault location process can be summarized as theory-application mapping and lightweight runtime verification, fault diagnosis and verification certificate generation in actual testing.

[0066] Table 1. Representation of theoretical components in practical applications

[0067] During testing, after each operation, a state summary is collected from the reference model and a few replicas. Inductive reasoning is used to conclude that if the summaries are consistent, all replicas are inferred to be consistent; if the summaries are inconsistent, detailed diagnostics are triggered to locate the inconsistent operations and replicas.

[0068] While formal proofs can guarantee the correctness of code implementations, in actual operation, hardware failures and Byzantine behavior may cause deviations in the replica state. This invention introduces lightweight runtime verification during testing: Instead of a full state comparison, state summaries (such as state hashes) are collected only from the reference model and a few randomly selected replicas.

[0069] Using the results of formal reasoning: if the state digests are inconsistent, then there must be a copy that violates the operational semantics or consensus protocol.

[0070] By analyzing the differences in status summaries, specific operational steps can be located, and diagnosis can be performed in conjunction with operation logs.

[0071] When the runtime digest comparison fails, the system outputs a difference digest, operation sequence number and involved copies, and, in conjunction with the operation log, locates the specific operation that violates the semantics, and generates a verification certificate containing formal proof results.

[0072] The testing framework outputs a formal verification report, including: Formal specifications for operational semantics.

[0073] The proof results of the preconditions / postconditions and invariants for each operation (generated by the theorem prover).

[0074] Runtime verification summary comparison records.

[0075] If inconsistencies are found, output a summary of the differences and their location information.

[0076] Based on the overall process described above, as a supplementary explanation of the environmental prerequisites, the acquisition of the prerequisites for the deterministic operation sequence and the environmental adaptation are elaborated in detail.

[0077] The method of this invention is applied to distributed systems based on deterministic state machine replication. Specifically, deterministic state machine replication is a core paradigm for ensuring consistency in distributed systems (i.e., distributed applications), requiring all replica nodes in the system to produce identical output state sequences given the same initial state and the same sequence of input operations. It should be understood that this determinism is not limited to traditional Byzantine Fault Tolerance (BFT) consensus frameworks, but can also be found in distributed databases based on the Raft protocol, distributed configuration centers based on the Paxos protocol, or any distributed storage system that can guarantee global consistency of operation order. As long as the system possesses the property of deterministic state machine replication, the verification method proposed in this invention is applicable.

[0078] Furthermore, consensus protocols in distributed systems provide global sequence numbers as anchors for operation order, ensuring that all correct replica nodes execute the same sequence of operations. Specifically, after reaching a consensus decision, the consensus protocol assigns a monotonically increasing global sequence number to each submitted operation request. This global sequence number acts as a natural time anchor in the distributed environment; it does not rely on precise synchronization of physical clocks but rather ensures through protocol logic that all correct replica nodes execute operations strictly in ascending order of their sequence numbers. For example, in the BFT-SMaRt consensus framework, the request sequence number proposed by the master node becomes an immutable global order anchor after being confirmed by a vote of all replicas in the network; in the Raft protocol, the log index number assigned by the leader also serves as a global sequence number. It should be understood that the specific generation mechanism and naming method of the global sequence number vary from protocol to protocol, but its core function—providing deterministic guarantees for operation order—is common.

[0079] This premise is of paramount technical significance, as it elucidates how distributed global verification can be reduced to verifying the equivalence of a single node and the reference model. In traditional distributed testing, verifying global consistency often requires cross-referencing state snapshots of all replicas at the same physical moment. This is virtually impossible in asynchronous networks because network latency, clock drift, and other factors make the definition of "the same physical moment" extremely ambiguous. This invention utilizes the global sequence number provided by the consensus protocol as a logical time anchor, shifting the verification benchmark from "physical moment" to "operational boundary." As long as all correct replica nodes execute the sequence of operations with the same sequence number, combined with the semantic preservation proven above, it can be logically and rigorously deduced that the states of all replicas are necessarily equivalent. Therefore, verifying distributed global consistency is reduced to verifying the state equivalence of a single replica node and an independently running reference model after operations with the same sequence number, completely eliminating the complexity and uncertainty of multi-node collaborative data collection.

[0080] Meanwhile, this premise completely eliminates the dependence on system time synchronization, avoiding false positives caused by asynchronous interference. In the absence of a global sequence number anchor, even if the system state is actually consistent, differences in processing speed and network latency among different replica nodes can lead to the test framework collecting state summaries at different physical moments that are at different operational steps. For example, replica A may have completed the operation at sequence number 100, while replica B, due to network latency, may only have completed the operation at sequence number 99. Comparing the state summaries of these two replicas will inevitably produce inconsistent false positives. This invention, through a global sequence number anchor, ensures that the comparison operation is performed only at the same operational boundary (i.e., after the same sequence number has been executed), making the state summary comparison result truly reflect logical equivalence, rather than the misalignment of physical acquisition time. This design fundamentally shields the interference of the asynchronous environment, resulting in highly robust and reliable verification results. It should be understood that although this embodiment emphasizes the role of the global sequence number, in actual engineering implementation, the mechanism by which the test framework listens to the ordered request sequence output by the cluster consensus layer and drives the synchronous execution of the reference model can also be implemented in various ways such as event-driven or callback notification, as long as it can ensure that the reference model and the replica node evolve in the same operational boundary.

[0081] The method of this invention is a formalized approach that can theoretically infer the correctness of state machines and efficiently verify the consistency of actual operation. By utilizing the properties of the consensus protocol itself, the global verification of a distributed system is reduced to the semantic verification of a single replica, thus achieving lightweight and complete testing.

[0082] Taking the CAS (Compare and Exchange) operation of a distributed configuration service as an example, this paper demonstrates the close correspondence between formal reasoning and actual testing.

[0083] State space definition Define state σ as a partial mapping from key to value: σ:Key→Value Initial state σ0= (Empty mapping). For a distributed configuration service, the state space Σ contains all possible combinations of key-value pairs.

[0084] CAS operation semantics The CAS operation accepts three parameters: key, expected value, and update value. Its deterministic semantic function is defined as:

[0085] Where, σ[key [update] means updating the value corresponding to the key in σ to update, while other keys remain unchanged.

[0086] Invariant definition Define a global invariant I(σ) to characterize the business constraints that the state must always satisfy: I(σ)≡ k∈dom(σ):isValidKey(k)∧isValidValue(σ(k)) Here, isValidKey and isValidValue are predefined predicates. For example: isValidKey(k): The key is not empty and its length does not exceed 256 characters, and it conforms to the naming convention. isValidValue(v): The value length does not exceed 1MB and its format is correct.

[0087] Definition of equivalence relation Define the state equivalence relation ≡: Two states σ1 and σ2 are equivalent if and only if they satisfy the same invariant and are completely identical: σ1≡σ2 σ1=σ2∧I(σ1)∧I(σ2) In reasoning, invariants are used for abstraction, making the reasoning more concise.

[0088] Inductive hypothesis Suppose the sequence of operations submitted during the test is O = [o1, o2, …, o n For each i (0≤i≤n), let: σ i ^ref: Refers to the state of the model (independent simulator) after the i-th operation.

[0089] σ i ^replica: The actual state of any correct replica node after the i-th operation.

[0090] Inductive hypothesis: σ_{i-1}^ref ≡ σ_{i-1}^replica (states are equivalent after the (i-1)th step) Summary of CAS operation steps Step 1: Perform CAS operation Assume the i-th operation is CAS(key, expect, update). The reference model and replica nodes execute the following respectively: Reference model: σ i ^ref = apply_CAS(σ_{i-1}^ref, key, expect, update) Replica node: σ i ^replica = apply_CAS(σ_{i-1}^replica, key, expect, update) Step 2: Apply deterministic semantics Since σ_{i-1}^ref ≡ σ_{i-1}^replica, that is, σ_{i-1}^ref = σ_{i-1}^replica and both satisfy I, therefore, σ_{i-1}^ref(key) = σ_{i-1}^replica(key).

[0091] Based on the determinism of CAS semantics, there are two scenarios: Scenario A: Match successful If σ_{i-1}^ref(key) = expect, then: σ i ^ref = σ_{i-1}^ref[key [update] σ i ^replica = σ_{i-1}^replica[key [update] Since σ_{i-1}^ref = σ_{i-1}^replica, therefore σ i ^ref = σ i ^replica.

[0092] Scenario B: Matching failed If σ_{i-1}^ref(key) ≠ expect, then: σ i ^ref = σ_{i-1}^ref σ i ^replica = σ_{i-1}^replica Since σ_{i-1}^ref = σ_{i-1}^replica, therefore σ i ^ref = σ i ^replica.

[0093] Step 3: Verify invariant preservation Proof: If I(σ_{i-1}) holds, then I(σ i It also holds true.

[0094] For a successful match: the new state is only updated to "update" at the key, while other keys remain unchanged. Since "update" satisfies "isValidValue" (guaranteed by the operation), and other keys still satisfy the invariant, I(σ) i It was established.

[0095] For the case of a failed match: the state remains unchanged, therefore I(σ) i The condition ) = I(σ_{i-1}) holds true.

[0096] Step 4: Summarize the conclusions Based on the inductive hypothesis and the determinism of the semantics of the CAS operation, σ is proved. i ^ref = σ i ^replica, and I(σ) i ) holds true, therefore σ i ^ref ≡ σ i ^replica. The induction is valid.

[0097] Formal Specification (Z3 Style): operation CAS(key, expect, update): requires: state[key] == expect ensures:(result == true&&state' = state[key→update]) || (result == false&&state' = state) invariant I(state): k: (state[k] exists) isValidKey(k) ∧isValidValue(state[k]) Actual code implementation (Java): public synchronized boolean compareAndSet(String key, byte[] expect,byte[]update) { byte[] cur = store.get(key); if (Arrays.equals(cur, expect)) { store.put(key, update); / / Update the status return true; } return false; } The verification process is as follows Figure 3 As shown, Figure 3 The verification mapping process of BFT consensus application based on formal state machine reasoning is shown.

[0098] 1. Using Z3 to automatically prove: If the original state satisfies I and the precondition is true, then the new state still satisfies I and the postcondition is true.

[0099] 2. The test framework starts with 4 replica nodes and an independent reference model, all of which are initially empty.

[0100] 3. The client submits CAS("app.version", "1.0.0", "1.0.1"), BFT SMaRt assigns serial number 100.

[0101] 4. The reference model is executed synchronously, updating the state to {"app.version":"1.0.1"} and calculating the state hash H_ref.

[0102] 5. All replica nodes perform the same operation, and the primary replica status hash H_replica = H_ref.

[0103] 6. The test framework compares H_ref and H_replica. If they match, it continues. If a replica has a different state due to Byzantine behavior, the digest is inconsistent. The replica and operation sequence number are immediately recorded and located.

[0104] 7. Finally, a verification report is generated, which includes all operation summary comparison records and formal proof results.

[0105] Figure 4 The diagram shows a flowchart of the BFT consensus application verification based on formal state machine reasoning.

[0106] The implementation process of this invention will be described in detail below using a specific application of distributed configuration services.

[0107] 1. Test environment setup Deploy 4 BFTs SMaRt replica nodes (tolerating 1 Byzantine node), each running a configuration service instance. The test framework is deployed on a separate control node and includes a reference model, operation sequence generator, state summary collector, and theorem prover interface.

[0108] 2. Formal Modeling and Proof Z3 is used to write preconditions / postconditions and invariants for each operation, automatically verifying semantic preservation. After the proof is passed, a proof script is generated and embedded in the test framework.

[0109] 3. Test Execution Process Initialize all copies and reference models to the same initial state (empty storage).

[0110] Generate operation sequences in order: PUT, PUT, CAS, GET, CREATE_SNAPSHOT, PUT, ROLLBACK, GET, etc.

[0111] For each operation performed, the test framework obtains the state hash from the reference model and a random replica, and compares them.

[0112] If the hashes match, proceed to the next step; if they do not match, record the error message and interrupt the test, outputting the details of the difference.

[0113] After all operations are completed, a verification report is generated, which includes the hash comparison record and a summary of the formal proof results for each operation.

[0114] 4. Result Verification Tests show that the state hashes of all correct replicas are consistently consistent with the reference model, and that digest comparison immediately detects inconsistencies and locates malicious replicas when a Byzantine fault is injected. Formal proofs guarantee that the system maintains consistency even for sequences of unexecuted operations. Through the above implementation, this method achieves rigorous theoretical verification and efficient runtime detection of state machine operations in BFT consensus applications, significantly improving the reliability and efficiency of testing.

[0115] The method of the present invention has the following effects: Theoretical completeness: By formally verifying the invariance of operational semantics, it can be proven that the system satisfies state consistency under all possible operation sequences, covering scenarios that traditional tests cannot exhaustively enumerate.

[0116] High efficiency: Only state summaries need to be compared at runtime, avoiding full state comparison, which greatly reduces test overhead and is suitable for large-scale state spaces.

[0117] Precise fault location: When the summary is inconsistent, it can be accurate to the specific operation and copy, shortening the debugging cycle.

[0118] Scalability: The method is independent of specific business logic. It can automatically complete the verification by simply providing a formal specification for the operation. It is suitable for BFT applications that replicate any deterministic state machine.

[0119] High degree of automation: Combining theorem provers and testing frameworks, a fully automated pipeline is achieved from formal proof to runtime testing.

[0120] This invention brings the following industrial value: Enhanced quality assurance capabilities: Formal proof provides the highest level of assurance for system correctness, applicable to fields with extremely high reliability requirements such as finance, aerospace, and military. Significantly reduced testing costs: Lightweight verification methods enable large-scale state-space testing, reducing testing time from hours to minutes and storage costs by over 99%. Significantly improved development efficiency: Automated verification and precise fault location shorten the problem discovery and repair cycle by over 70%, accelerating product iteration. Wide range of applications: The general framework can be applied to various BFT consensus applications, including blockchain, distributed databases, and financial trading systems, possessing extremely high technology reuse value.

[0121] Example 2: This invention also provides a distributed state verification device, which is mainly used to execute the distributed state verification method provided in Embodiment 1 of this invention. The following is a detailed description of the distributed state verification device provided in this invention.

[0122] Figure 5 This is a schematic diagram of a distributed state verification device according to an embodiment of the present invention, such as... Figure 5 As shown, the device mainly includes: an acquisition and verification unit 10, a derivation unit 20, a consistency comparison unit 30, and a positioning unit 40, wherein: The acquisition and verification unit is used to acquire the operational semantics and state constraints of the distributed application to be verified, and to verify the preservation of the operational semantics by the state constraints. The derivation unit is used to derive the global state equivalence in response to the retention verification passing, based on the initial state equivalence and the semantic preservation of single-step operations. The consistency comparison unit is used to deploy an independently running reference model when the distributed application to be verified is running, and to compare the consistency between the reference model state and the replica node state by replacing the full state with a state summary based on the derivation of global state equivalence. The location unit is used to locate specific operational steps and faulty replica nodes in response to inconsistencies in the state digest.

[0123] In the apparatus of this invention, the operational semantics and state constraints of the distributed application to be verified are acquired and their preservation is verified. Mathematical induction is used to derive global state equivalence based on initial state equivalence and single-step operational semantic preservation, thus theoretically proving the state consistency of the system under all possible operation sequences. This overcomes the shortcomings of traditional tests, which can only cover a limited number of input sequences and lack the ability to prove universal propositions, significantly improving the comprehensiveness and fundamental reliability of the verification. Simultaneously, an independent reference model is deployed at runtime, and based on the derivation of global state equivalence, a lightweight state summary is used to replace the full state for consistency comparison between the reference model and replica nodes. This not only avoids the state explosion problem caused by the increase in state size during full state comparison and significantly reduces network transmission and computational overhead, but also eliminates the asynchronous interference of state acquisition caused by the asynchronicity of the distributed environment through the deterministic execution of the reference model. This effectively solves the problems of high testing overhead, poor accuracy, and high false alarm rate of traditional solutions, achieving efficient, accurate, and complete verification of large-scale distributed system states.

[0124] Optionally, the state constraints include state invariants, and the derivation unit is further used to: verify the equivalence of the initial states, which includes: determining that the initial state of the reference model and the initial state of the replica node satisfy the state invariants, and that the initial state of the reference model and the initial state of the replica node are the same; verify the preservation of single-step operation semantics, which includes: determining that any atomic operation, in the current state that satisfies the state invariants, after being executed according to the single-step operation semantics, still results in a new state that satisfies the state invariants; and, based on mathematical induction, derive that the states of all replica nodes and the states of the reference model are always equivalent under any sequence of operations.

[0125] Optionally, the acquisition and verification unit is also used to: define preconditions and postconditions for each atomic operation described in the operation semantics using the Hoare logic style; and automatically verify, using a theorem prover, that for any state that satisfies the preconditions and state invariants, the new state and return value obtained after performing the atomic operation satisfy the postconditions and state invariants.

[0126] Optionally, the consistency comparison unit is also used to: collect state digests from the reference model and the replica node respectively, and perform a consistency comparison between the state digest of the reference model and the state digest of the replica node, wherein the state digest includes a state hash or a set of key attributes.

[0127] Optionally, the device is also used to output diagnostic information.

[0128] Optionally, it can be applied to distributed systems based on deterministic state machine replication; the consensus protocol of the distributed system provides a global sequence number as an anchor point for the operation order, ensuring that all correct replica nodes execute the same sequence of operations.

[0129] Optionally, the diagnostic information includes a difference summary, operation sequence number, and a verification certificate containing formal proof results.

[0130] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0131] like Figure 6 As shown in the embodiment of this application, an electronic device 600 includes a processor 601, a memory 602, and a bus. The memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 via the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the distributed state verification method described above.

[0132] Specifically, the memory 602 and processor 601 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 601 runs the computer program stored in the memory 602, it can execute the above-mentioned distributed state verification method.

[0133] The processor 601 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 601 or by instructions in software form. The processor 601 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 602, and processor 601 reads the information from memory 602 and, in conjunction with its hardware, completes the steps of the above method.

[0134] Corresponding to the above-described distributed state verification method, this application embodiment also provides a computer-readable storage medium storing machine-executable instructions. When the machine-executable instructions are invoked and executed by a processor, the machine-executable instructions cause the processor to perform the steps of the above-described distributed state verification method.

[0135] The distributed state verification device provided in this application embodiment can be specific hardware on a device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this application embodiment are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0136] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0137] For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0138] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0139] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0140] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the distributed state verification method described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0141] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0142] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method of distributed state verification, the method comprising: include: Obtain the operational semantics and state constraints of the distributed application to be verified, and verify the preservation of the operational semantics by the state constraints; In response to the retention verification passing, global state equivalence is derived based on initial state equivalence and single-step operation semantic preservation. When the distributed application to be verified is running, an independently running reference model is deployed, and based on the derivation of global state equivalence, a state summary is used instead of the full state to compare the consistency between the state of the reference model and the state of the replica node. In response to inconsistencies in the state digest, the specific operational steps and faulty replica nodes are located.

2. The distributed state verification method of claim 1, wherein, The state constraints include state invariants. Based on initial state equivalence and single-step operation semantic preservation, global state equivalence is derived, including: Verifying the equivalence of the initial states includes: determining that the initial state of the reference model and the initial state of the replica node satisfy the state invariant, and that the initial state of the reference model and the initial state of the replica node are the same. Verifying the preservation of the single-step operation semantics includes: determining that, under the current state that satisfies the state invariant, any atomic operation, after being executed according to the single-step operation semantics, still results in a new state that satisfies the state invariant; Based on mathematical induction, it is deduced that under any sequence of operations, the states of all replica nodes are always equivalent to the states of the reference model.

3. The method of claim 2, wherein, Verifying the preservation of the operation semantics with respect to the state invariant includes: Using the Hoare logic style, preconditions and postconditions are defined for each atomic operation described in the operation semantics; Using a theorem prover, it is automatically verified that for any state that satisfies the preconditions and the state invariant, the new state and return value obtained after performing the atomic operation satisfy the postconditions and the state invariant.

4. The method of claim 1, wherein, The consistency comparison between the reference model state and the replica node state is performed by replacing the full state with a state digest, including: State digests are collected from the reference model and the replica node respectively, and the state digests of the reference model and the replica node are compared for consistency. The state digests include state hashes or sets of key attributes.

5. The method of claim 4, wherein, After locating the specific operational steps and the faulty replica node, the method further includes: Output diagnostic information.

6. The method of claim 1, wherein, The method is applied to distributed systems based on deterministic state machine replication; The consensus protocol of the distributed system provides a global sequence number as an anchor point for the operation order, ensuring that all correct replica nodes execute the same operation sequence.

7. The method of claim 5, wherein, The diagnostic information includes a difference summary, an operation sequence number, and a verification certificate containing formal proof results.

8. A distributed state verification apparatus characterized by comprising: include: The acquisition and verification unit is used to acquire the operation semantics and state constraints of the distributed application to be verified, and to verify the retention of the operation semantics on the state constraints. The derivation unit is used to derive the global state equivalence in response to the retention verification passing, based on the initial state equivalence and the semantic preservation of single-step operations. The consistency comparison unit is used to deploy an independently running reference model during the runtime of the distributed application to be verified, and to compare the consistency between the reference model state and the replica node state by replacing the full state with a state summary based on the derivation conclusion of global state equivalence. The location unit is used to locate specific operational steps and faulty replica nodes in response to inconsistencies in the state digest.

9. An electronic device comprising a memory, a processor, the memory having stored therein a computer program executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to perform the method of any one of claims 1 to 7.

Images