EAGER-SAT-BASED SOLVER FOR A QUANTOR-FREE THEORY OF STRINGS AND BIT VECTORS

Abstract

Techniques are described for providing a SAT-based solver for a quantifier-free theory of strings and bit vectors. The solver can be used by an automated reasoning service of a cloud provider network to analyze policies and policy consequences. The solver reduces an input formula to a Boolean satisfiability problem by encoding the input formula into an equivalently satisfiable propositional formula, where the satisfiability of the equivalently satisfiable propositional formula is determined by a SAT solver. Instead of using a traditional DPLL(T)-style algorithm, the solver described here limits the length of variables in an input formula and reduces the problem to a single formula, which can then be solved using incremental SAT solving.The solver can be used independently or as part of a portfolio of solvers to determine the satisfiability or unsatisfiability of certain formulas corresponding, for example, to questions about user policies within a cloud provider network.

Description

GENERAL STATE OF THE ART

[0001] Cloud provider networks enable users to utilize a variety of computing-related resources, such as compute resources, storage resources, network resources, and the like. When a user or application interacts with a cloud provider's network (e.g., through an application programming interface (API) or command-line interface (CLI) provided by the cloud provider's network), the user or application is typically required to provide security credentials to identify who the user or application is and whether the user or application has permission to access the requested resources. A cloud provider network, in turn, uses the security credentials to authenticate the user or application and authorize them to perform various actions.Access to resources and actions within a network of cloud providers can be further managed through policies. A policy is a data object that, when associated with a user or resource, defines their permissions. For example, resource-based policies can be attached to a storage resource, a compute instance, encryption keys, etc., and specify who has access to the resource and what actions those identities are permitted to perform on the resource. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Various examples according to the present disclosure will be described with reference to the drawings, in which: Fig. Figure 1 is a diagram illustrating a computing environment with a solver for a quantifier-free theory of strings and bit vectors used to analyze policies within a cloud provider's network according to some examples. Fig. Figure 2 is a diagram illustrating the generation of a formula expressed in first-order logic corresponding to a policy question concerning a policy managed by an identity and access management service of a cloud provider's network, according to some examples. Fig. Figure 3 is a diagram illustrating the use of a solver for a quantifier-free theory of strings and bit vectors to automate reasoning about policies and policy consequences of a cloud provider's network according to some examples. Fig. Figure 4 is a diagram illustrating the generation of a Boolean abstraction of an input formula used by the solver according to some examples. Fig. Figure 5 is a flowchart illustrating the operations of a method for using a SAT-based solver for a quantifier-free theory of strings and bit vectors to analyze policies and policy consequences of a cloud provider network, using some examples. Fig. 6 illustrates an example provider network environment according to some embodiments. Fig. 7 is a block diagram of an example provider network providing a storage and hardware virtualization service to customers according to some embodiments. Fig. 8 is a block diagram illustrating an example computer system that may be used in some examples. DETAILED DESCRIPTION

[0003] The present disclosure relates to methods, apparatus, systems, and non-transitory computer-readable storage media for providing a SAT-based solver for a quantifier-free theory of strings and bit vectors. According to some examples, the solver may be used by an automated reasoning service of a cloud provider network to analyze policies and the consequences of policies within a provider network (e.g., policies that define what actions certain principals can or cannot perform with respect to certain cloud-based resources). As further described herein, the solver reduces an input formula (e.g., a formula expressing a question about one or more policies) to a Boolean satisfiability problem by encoding the input formula into an equivalently satisfiable propositional formula, where the satisfiability of the equivalently satisfiable propositional formula is determined by a SAT solver.Instead of using a traditional DPLL(T)-style algorithm, the solver described here limits the length of string variables in an input formula and reduces the problem to a single propositional formula, which can then be solved using incremental SAT solving. The solver can be used independently or as part of a portfolio of solvers to determine the satisfiability or unsatisfiability of specific formulas, for example, questions about user policies within a cloud provider network.

[0004] As part of the IT services provided by cloud provider networks, many cloud providers also offer identity and access management services. These services generally help users control access and permissions to the services and resources (e.g., compute instances, storage resources, etc.) provided to users of a cloud provider network. For example, by using identity-based and resource-based policies, users can control in detail which identities (e.g., users or roles) can access specific resources assigned to user accounts, and how these identities are permitted to use the resources. The configuration of such policies can often become quite complex, making it difficult for users to understand all the implications of such policies and their interrelationships (e.g.,whether the policies inadvertently permit unwanted security or operational actions on users' resources).

[0005] To alleviate some of these concerns, a cloud provider network can provide tools to help users analyze the properties of the resources and associated policies within their accounts. An example of such a security tool is an access analyzer, which can help users understand which identities can access specific resources associated with their account and, based on this information, can help users determine whether their current policy configurations may inadvertently provide access to users outside their organization. In this example, an access analysis service can perform such analyses by partially translating a user's or organization's stored policies into equivalent logical statements (e.g., expressed in first-order logic) and applying a series of general and specialized logical solvers (e.g.,Satisfiability Modulo Theories (SMT) solvers are used to verify whether certain security-relevant behaviors are possible or not. In this context, logical solvers reason about propositional logic statements, including various string variables that correspond to aspects of policies such as account identifiers, resource identifiers, and the like. In addition to identity and access management services, some cloud provider networks also offer source code review and optimization services, program or computer network verification services, and other types of services that use automated reasoning to help analyze the correctness of various types of computing systems.

[0006] Satisfiability problems, or SATs, ask whether it is possible to assign values ​​(e.g., true or false) to variables that satisfy a set of constraints. The SMT solvers described above generally attempt to prove or disprove formulas in first-order logic using combinations of theories such as Presburger arithmetic, uninterpreted functions, or strings. As mentioned earlier, an automated reasoning service can take a policy and a question as input, translate the policy and question into an SMT query, and invoke a portfolio solver to obtain an answer. A portfolio solver invokes multiple solvers in the backend and returns a result from the first solver to provide an answer.By leveraging the diversity of such solvers, each of which may be more efficient at analyzing certain types of policies and questions than the others, an automated reasoning service can typically solve queries more quickly. However, even with a variety of solution approaches, automated reasoning services may fail to provide efficient answers for certain types of problems. Adding additional solvers that can solve different subsets of such problems can therefore improve the overall efficiency of these automated reasoning services.

[0007] According to the embodiments described herein, a novel solver is proposed that efficiently solves at least a subset of the policy questions described above by, among other things, using bounded model checking techniques for strings. As described in more detail herein, the solver first creates an abstraction (e.g., a Boolean skeleton) of the input formula. The solver then bounds the lengths of the string variables included in the input formula and encodes the input formula into an equivalently satisfiable propositional formula, subject to the specified upper bounds on the string variables. By reducing an SMT input formula to a single propositional formula that can be solved using incremental SAT solving, many types of policy-related questions expressed in first-order logic can be solved more efficiently.Among other things, this helps answer users' questions about their policies and helps users of a cloud provider network optimize their access policies.

[0008] Fig. 1 is a diagram illustrating an environment with an automated reasoning service used to analyze policies associated with user accounts and user account organizations of a cloud provider network, according to some examples. A provider network 100 (or "cloud" provider network) provides users with the ability to use one or more types of compute-related resources, such as compute resources (e.g., running virtual machine (VM) instances and / or containers, running batch jobs, running code without deploying servers), data / storage resources (e.g., object storage, block storage, data archive storage, databases and database tables, etc.), network-related resources (e.g., configuring virtual networks including groups of compute resources, content delivery networks (CDNs), domain name service (DNS)), application resources (e.g.,Databases, application build / deployment services), access policies or roles, identity policies or roles, machine images, routers, and other computing resources, etc. These and other computing resources may be provided as services, e.g., as a hardware virtualization service that can run compute instances, as a storage service that can store data objects, etc. Users (or "customers") of provider networks 100 may use one or more user accounts associated with a customer account, although these terms may be used interchangeably, depending on the usage context. Users may use one or more electronic devices 102 to access computing resources through one or more intermediate networks 104 (e.g.,the Internet) through one or more interfaces with a provider network 100, for example, through the use of API (Application Programming Interface) calls, through a console implemented as a website or application, etc. An API refers to an interface and / or communication protocol between a client and a server such that, when the client makes a request in a predefined format, the client should receive a response in a specific format or initiate a defined action. In the context of the cloud provider's network, APIs provide customers with a gateway to access the cloud infrastructure by allowing customers to retrieve data from or initiate actions on the cloud provider's network. This enables the development of applications that interact with the resources and services hosted on the cloud provider's network.APIs can also enable different services within the cloud provider network to exchange data with each other. The interface(s) can be part of a control plane of the provider network 100 or serve as a frontend to a control plane that includes "backend" service support and enables services to be offered more directly to customers.

[0009] For example, a cloud provider network (or simply "cloud") typically refers to a large pool of accessible virtualized computing resources (such as compute power, storage, and network resources, applications, and services). A cloud can provide convenient, on-demand network access to a shared pool of configurable computing resources that can be programmatically provisioned and released upon customer commands. These resources can be dynamically provisioned and reconfigured to adapt to a variable load. Cloud computing can thus be viewed as both applications delivered as services over a publicly accessible network (e.g., the internet, a cellular network) and the hardware and software in cloud providers' data centers that deliver these services.

[0010] A cloud provider network 100 may be formed as a collection of regions, where a region is a geographic area in which the cloud provider clusters data centers. Each region includes multiple (e.g., two or more) availability zones (AZs) connected by a private high-speed network, such as a fiber optic connection. An AZ (also referred to as a "zone") provides an isolated failure domain comprising one or more data center facilities with separate power, networking, and cooling from those in another AZ. A data center is a physical building or site that houses the servers of the cloud provider network and provides them with power and cooling.Preferably, the AZs within a region are positioned far enough apart from each other so that a natural disaster (or other outage-causing event) does not affect or take offline more than one AZ at a time.

[0011] Users can connect to an AZ of the cloud provider's network over a publicly accessible network (e.g., the internet, a cellular network), such as a transit center (TC). TCs are the primary backbone locations that connect users to the cloud provider's network. They can be hosted at the facilities of other network providers (e.g., internet service providers (ISPs), telecommunications providers) and securely connected to the AZs (e.g., via a VPN or a direct connection). Each region can operate two or more TCs for redundancy. The regions are connected to a global mesh network that includes private network infrastructure (e.g., fiber optic links controlled by the cloud provider) that connects each region to at least one other region.The cloud provider's network can deliver content from points of presence (POPs) located outside these regions through edge locations and regional edge cache servers that are interconnected to these regions. This isolation and geographical distribution of computing hardware enables the cloud provider's network to provide users with low-latency resource access on a global scale with a high degree of fault tolerance and stability.

[0012] In general, the traffic and operation of a provider network can be roughly divided into two categories: control operations, which are handled through a logical control plane, and data operations, which are handled through a logical data plane. While the data plane represents the movement of user data through the distributed computing system, the control plane represents the movement of control signals through the distributed computing system. The control plane generally includes one or more control plane components distributed across and implemented by one or more control servers. Control plane traffic generally includes administrative operations such as system configuration and management (e.g., resource placement, hardware capacity management, diagnostic monitoring, system health information). The data plane includes user resources implemented in the provider network (e.g.,Data plane traffic generally involves non-administrative operations, such as transferring user data to and from user resources. Control plane components are typically implemented on a separate set of servers from the data plane servers, and control plane and data plane traffic may be sent over separate / different networks.

[0013] To provide these and other computing resource services, provider networks 100 often rely on virtualization techniques. For example, virtualization technologies can provide users with the ability to control or use computing resources (e.g., a "compute instance," such as a VM with a guest operating system (O / S) running with a hypervisor that may run on top of an underlying host operating system, a container that may run within a VM, or a compute instance that may run on "bare metal" hardware without an underlying hypervisor), where one or more computing resources can be implemented using a single electronic device. Thus, a user can directly use a computing resource hosted by the provider network (e.g., provided by a hardware virtualization service) to perform a variety of computing tasks.Additionally or alternatively, a user may use a compute resource indirectly by submitting code to be executed by the provider network (e.g., via an on-demand code execution service), which in turn uses one or more compute resources to execute the code—typically without the user having control over or knowledge of the underlying compute instance(s).

[0014] As described herein, one type of service a provider network may provide may be referred to as a "managed compute service," which executes code or provides compute resources to its users in a managed configuration. Examples of managed compute services include, for example, an on-demand code execution service, a hardware virtualization service, a container service, or the like.

[0015] An on-demand code execution service (referred to in various examples as a function computation service, function service, cloud function service, functions as a service, or serverless compute service) may enable users of the provider network 100 to run their code on cloud resources without having to select or manage the underlying hardware resources for executing the code. For example, a user may use an on-demand code execution service by uploading their code and using one or more APIs to request the service to identify, provision, and manage the resources required to execute the code. Thus, in various examples, a "serverless" function may include code provided by a user or another entity—such as the provider network itself—that can be executed on demand.Serverless functions can be managed within the provider network by an on-demand code execution service and can be associated with a specific user or account, or be generally accessible to multiple users / accounts. A serverless function can be associated with a Uniform Resource Locator (URL), a Uniform Resource Identifier (URI), or other reference that can be used to invoke the serverless function. A serverless function can be executed by a compute resource such as a virtual machine, container, etc., when triggered or invoked. In some examples, a serverless function can be invoked through an Application Programming Interface (API) call or a specially formatted HyperText Transport Protocol (HTTP) request message.Accordingly, users can define serverless functions that can be executed on demand, without requiring the user to maintain dedicated infrastructure to execute the serverless function. Instead, the serverless functions can be executed on demand using resources managed by the provider network 100. In some examples, these resources can be maintained in a "ready" state (e.g., by having a pre-initialized runtime environment configured to execute the serverless functions), allowing the serverless functions to execute in near real time.

[0016] A hardware virtualization service (referred to in various implementations as an elastic compute service, virtual machine service, computing cloud service, compute engine, or cloud compute service) may enable users of the provider network 100 to provision and manage computing resources such as virtual machine instances. Virtual machine technology allows multiple servers (each referred to as virtual machines) to run on a physical server, for example, using a hypervisor that may run on at least one offload card of the server (e.g., a card connected to the physical CPUs via PCI or PCIe), while other components of the virtualization host may be used for specific virtualization management components.Such a host offload card may contain one or more CPUs that are not available to user instances but are dedicated to instance management tasks such as managing virtual machines (e.g., a hypervisor), input / output virtualization for network-attached storage volumes, local migration management tasks, instance state monitoring, and the like. Virtual machines are often referred to as compute instances or simply "instances." As used herein, provisioning a virtual compute instance generally involves reserving resources (e.g., compute and memory resources) of an underlying physical compute instance for the client (e.g., from a pool of available physical compute instances and other resources), installing or starting required software (e.g.,an operating system) and the provision of the virtual computing instance to the client to perform tasks specified by the client.

[0017] Another type of managed compute service can be a container service, such as a container orchestration and management service (referred to in various implementations as a container service, cloud container service, container engine, or container cloud service), which enables users of the cloud provider's network to instantiate and manage containers. In some examples, the container service can be a Kubernetes-based container orchestration and management service (referred to in various implementations as a Container Service for Kubernetes, Azure Kubernetes Service, IBM Cloud Kubernetes Service, Kubernetes Engine, or Container Engine for Kubernetes). A container, as it is called here, packages code and all its dependencies, allowing an application (also referred to as a task, pod, or cluster in various container services) to run quickly and reliably from one compute environment to another.A container image is a self-contained, executable software package that includes everything needed to run an application process: code, runtime, system tools, system libraries, and settings. Container images become containers at runtime. Containers are therefore an abstraction of the application layer (i.e., each container simulates a different software application process). Although each container runs isolated processes, multiple containers can share a common operating system, for example, by being launched within the same virtual machine. In contrast, virtual machines represent an abstraction of the hardware layer (i.e., each virtual machine simulates a physical machine on which software can run).While multiple virtual machines can run on a physical machine, each virtual machine typically has its own copy of the operating system, applications, and associated files, libraries, and dependencies. Some containers may run on instances running a container agent, and some containers may run on bare-metal servers or on a server's offload card. As previously noted, a provider network 100 may further include a wide range of additional services, such as a source code analysis service 106, a storage service 108, a network service 110, and the like.

[0018] In some examples, an identity and access management service 112 is a service that enables users to securely control access to the cloud provider's network resources (e.g., compute resources associated with various network services of the provider, such as storage objects associated with a storage service 108, databases associated with a database service, compute instances associated with a hardware virtualization service, and the like). The identity and access management service 112 is generally used to control who is permitted to authenticate (e.g., log in) to the cloud provider's network 100 and who is authorized (e.g., has authorization) to use the resources provided by the cloud provider's network 100.In general, a resource is a concept used to capture the range of items that can be created, read, modified, or deleted by customers in a cloud provider network 100. Examples of resources also include identities (e.g., identities 114, including example users 116A, ..., 116N and roles 118A, ..., 118N) and policies 120 (e.g., including identity-based policies 122, resource-based policies 124, among other possible types of policies). Fig. 1 further illustrates the concept of an organization 126, which may include any number of associated accounts 128, which in turn may include any number of users and roles.

[0019] When a person initially creates an account with cloud provider network 100, the person may start with a single login identity that has full access to all cloud provider network services and resources associated with the account (e.g., a root user of identities 114). Access to the root user identity may be achieved, for example, by logging in with a username (e.g., an email address) and password used to create the account. Cloud provider networks 100 often advise users not to use a root user for most tasks and instead to set up additional user accounts with specific permissions. A user may grant different user accounts different permissions to different resources.For example, a user account might be configured to grant some users full access to a hardware virtualization service, a storage service 108, and other resources of the cloud provider network 100. For other users, a user account might grant read-only access to some storage buckets or permission to manage some instances, etc.

[0020] In some examples, a requester represents a person or application that can make a request for an action or operation on a resource of the cloud provider network 100 through one or more identities, although the term requester may sometimes be used interchangeably with an identity. The set of identities 114 associated with an account 128 may include any number of users and roles. A request to a cloud provider network occurs when a requester uses an identity (e.g., a user or role) to send a request for an action or operation to a resource. A request may include some or all of the following information: the action or operations the requester wishes to perform, the resource object with which the actions or operations will be performed, the person or application using an identity (e.g.,a user or role) used to send the request, environmental data (e.g., information about the IP address, user agent, SSL activation status, time of day, etc.), and resource data (e.g., data related to the requested resource, such as a resource identifier or tag name). In some examples, the identity and access management service 112 collects the information included in a request into a request context, which is used to evaluate and authorize the request.

[0021] For some requests to be completed, the identity and access management service 112 determines whether the requesting requestor is authorized (e.g., permitted) to complete the request. During authorization, the identity and access management service 112 uses the values ​​contained in the request context to check which policies apply to the request. The identity and access management service 112 uses the identified policies to decide whether to grant or deny the request. In some examples, the policies are stored by the identity and access management service 112 as JavaScript Object Notation (JSON) documents (or in another data format) and specify the permissions for specific identities. In some examples, there are multiple types of policies 120 that can affect whether a request is authorized, such as:identity-based policies 122, trust policies, and other policies. For example, identity-based policies can be configured to grant users access rights to resources within their own account, while resource-based policies can be used to grant cross-account access to resources. In some examples, the identity and access management service 112 examines each policy that applies to the context of a request. If an individual permission policy includes a denied action, the identity and access management service 112 denies the entire request. In some examples, an identity and access management service 112 denies requests by default, so a request is only authoritative if each part of a request is granted by applicable permission policies.

[0022] Once a request is authenticated and authorized, the identity and access management service 112 approves the actions or operations in the request. Operations are defined by a service and include actions that can be performed on or with respect to a resource, such as viewing, creating, editing, and deleting that resource. For example, the identity and access management service 112 may support actions such as CreateUser, DeleteUser, CreateRole, and AssumeRole, among many other possible actions. A hardware virtualization service may support actions such as starting a VM instance, deleting a VM instance, etc. To grant a principal the ability to perform an operation, the action is included in a policy applicable to the principal or the affected resource.

[0023] According to the examples described herein, a provider network 100 includes an automated reasoning service 130 to enable the analysis of policies and policy consequences within a cloud provider network. The automated reasoning service 130 further includes a solver 132 that enhances the service's ability to perform automated reasoning tasks related to policy analysis and other types of problems. The solver 132, described in more detail below, is a SAT-based solver for a first-order theory of strings and bit vectors and can optionally be used as part of a portfolio solver that includes one or more other solvers 142 (e.g., one or more SMT solvers).

[0024] As in Fig. As shown in Figure 1, an automatic reasoning service 130 takes as input one or more policies 134 and one or more rules 136 (e.g., no public read / write access should be granted for storage resources, server-side encryption should be enabled for a storage resource, etc.). The analysis of one or more resources and policies may, for example, be performed upon a user request or automatically by one or more services of a cloud provider network.As described in more detail below, the automated reasoning service 130 generally obtains the one or more policies 134 and rules 136 in circles "1A" and "1B," uses a modeler 138 in circle "2" to model the policies 134 and rules 136 as an SMT formula 140 via the theory of strings, and in circle "3" provides the formula 140 to a solver 132 or a portfolio of solvers, including solver 142, to determine the satisfiability of the formula in circle "4." The automated reasoning service 130 uses the result of the solver 132 (or solvers 142) to communicate to a user or other system that the input policy 134 or policies either satisfy the rules 136 or do not satisfy them, illustrated as determinations 144.For example, the results 144 may alert a user that a policy associated with the user allows public write access to a resource, which may not be intended, or the results 144 may be provided to one or more downstream components that generate warnings, additional analysis, or the like. As shown, the solver 132 broadly involves a process of encoding 146 the SMT formula 140 into an equivalently satisfiable propositional formula and using a SAT solver 148 to determine whether the encoded formula is satisfiable, the details of which are illustrated in the subsequent figures.

[0025] Fig. 2 is a diagram illustrating the generation of a formula expressed in first-order logic corresponding to a policy question concerning a policy managed by an identity and access management service of a cloud provider's network, according to some examples. As shown, the input to a modeler 138 may include one or more policies (e.g., a policy 200 including the illustrated policy snippet) and one or more rules or questions (e.g., a rule 202 specifying a desired condition of jurisdiction 200). In this example, rule 202 specifies that policy 200 should not allow public write access to a compute resource governed by policy 200.In general, a question about the desired condition of the policy may include, for example, determining whether public write access to a computing resource is allowed, determining whether unencrypted writes to a computing resource are allowed, determining whether public read access to a computing resource is allowed, or determining whether Secure Socket Layer (SSL) requirements are required to access a computing resource, comparing the permissibility of two policies relative to each other, or the like.

[0026] In some examples, the modeler 138 translates the one or more input policies and rules into a formula 204 (or query) that embodies a theory of strings. The statements may include Boolean combinations (and, or, not), word equations (e.g., x=const. and x=y, where x and y are string variables), and regular constraints. In the example from Fig. 2, formula 204 is a quantifier-free formula expressed in first-order logic.

[0027] Fig. Figure 3 illustrates the use of a solver for a quantifier-free theory of strings and bit vectors to automate the reasoning about policies and the consequences of policies of a cloud provider's network according to some examples. Similar to the approach described above with respect to Fig. 1, the solver 132 first obtains in circle “1” in Fig. 3, an SMT formula 300 that models the relevant input policy or policies and the rule or rules to be verified by the solver 132. Unlike many other types of solvers, the solver 132 solves queries by reducing them to the Boolean satisfiability problem, which encodes the formula 300 into a propositional formula and uses a SAT solver 302 to search the space of substitutions for a solution.

[0028] In some examples, a solver supports 132 input formulas with the following syntax:

[0029] In the example syntax above, xB refers to any Boolean variable and “?” denotes the regular wildcard character that accepts any symbol of the alphabet.

[0030] In circle “2” in Fig. 3, the solver 132 first abstracts 304 the input formula 300 by replacing each atomic formula (or "theory atom" or simply "atom") within the input formula 300 with a new Boolean variable. In general, the solver 132 processes the input formula 300, and each time the solver encounters a new theory atom that the solver 132 does not yet know, the solver creates a new Boolean variable and replaces the atom with the Boolean variable.

[0031] The result of this abstraction process 304 is a Boolean abstraction of the input formula 300 and a set of definitions in the theory, expressed as equivalences. In some examples, the definitions are encoded based on ideas related to the Plaisted-Greenbaum transform. By encoding the definitions in this way, the solver 132 can, for example, often consider only one direction of a definition / equivalence (e.g., a single implication d(a) → a or ¬d(a) -> ¬a) instead of both directions.

[0032] Fig. Figure 4 is a diagram illustrating the generation of a Boolean abstraction of an input formula that is analyzed by a solver according to some examples. As in Fig. 4, the process of generating abstraction 304 begins with an input SMT formula 400, expressed, for example, in negation normal form, and based on the formula, solver 132 generates a Boolean abstraction 402 of the input formula and a set of definitions 404. Each variable in Boolean abstraction 402 represents a constraint on one or more string variables, as shown in definition set 404. The original SMT formula 400 is equivalently satisfiable with the conjunction of Boolean abstraction 402 and the conjunction of definition set 404.

[0033] Back to Fig. 3: At circle "3," solver 132 determines an alphabet 306 to be used during the remainder of the solution process. For example, an SMT solver for formulas that include string variables typically uses Unicode for possible interpretations of the string variables contained in the analyzed formulas. However, a significantly smaller alphabet (e.g., one that includes fewer than all possible Unicode characters) is usually sufficient for solver 132 to use for policy analysis. In some examples, solver 132 determines the alphabet to be used during the solution by identifying the set of characters occurring in the problem (e.g., a set of characters that appear in one or more of the input policies, rules, and the resulting formula) and inserting one additional character per string variable into formula 300.In some examples, a separate alphabet can be calculated and used for each string variable in formula 300, for example, based on an analysis of the characters that appear in association with each string variable in the formula.

[0034] For example, satisfiability is preserved if, in a conjunctive normal formula, a unique alphabet is specified for each congruent closure and an unused extra character is added whenever an inequality to another closure exists. Since at most every equality in a formula holds, the alphabet of a closure in any satisfying assignment is a subset of the alphabet of the closure where all equalities are satisfied. Thus, the solver 132 computes the alphabets assuming that all equalities in a formula are satisfied, adding a single extra character per variable.

[0035] In some examples, for example in circle “4” in Fig. 3, solver 132 determines 308 initial bounds for the string variables in formula 300. While a substitution for a string variable can theoretically be of any length, a finite propositional formula can only encode a finite number of substitutions. By limiting the length of each string variable in formula 300, solver 132 can reduce the formula to a propositional formula and provide the propositional formula as input to a SAT solver. The initial bounded length assigned to each string variable can be based on information about the string variable in the formula—for example, if a string variable x is based at least in part on the constraint “abc*,” then any valid assignment to variable x includes at least three characters (i.e., the characters “abc”).More generally, if a constraint involving a string variable requires that a substring be included in any solution, then the length of the string variable must be at least the length of the substring. These and other comments may be used by solver 132 to determine a minimum initial bound for each of the string variables in formula 300. In some examples, a user may provide an initial binding to use as input to solver 132 when invoking solver 132 to analyze a formula (e.g., as input to an automatic reasoning service 130 or directly to solver 132).

[0036] In circle "5," in some examples, the solver 132 encodes 310 the set of definitions in propositional logic with respect to the upper bounds determined above for each string variable. For example, the solver 132 encodes, again referring to Fig. 4 definitions (e.g., a set of definitions 404), each of which may contain one or more string variables, into propositional logic statements based on a bounded length determined for each of the string variables (e.g., the string variables "x," "y," and "z" in the set of definitions 404). To this end, the solver 132 treats the string variables as sequences of characters of length n, where n represents the bounded length value determined for a variable (and where each string variable may be associated with a same or different bounded length). Each round of encoding results in an incremental call to the SAT solver 302 until the solver 132 determines in round N that the encoding is satisfiable or unsatisfiable with respect to the current length bounds, even if the solver 132 continues to increment the bounds.

[0037] For example, the encoding process broadly involves translating the definitions of the Boolean abstraction (e.g., the set of definitions 404) into propositional formulas that are satisfiable only if the corresponding theory predicate is satisfiable with respect to the bounded lengths of the string variables. For each definition d(a) ⇒ a (or conversely ¬d(a) ⇒ ¬a), the solver 132 encodes the theory literal a (or ¬a) into a propositional formula (in conjunctive normal form) and distributes the variable d(a) (or ¬d(a)) among all clauses. The conjunction of the encoded definitions and the Boolean abstraction of the input formula is then passed to the SAT solver 302.

[0038] In some examples, the SAT solver 302 performs the process of conflict-driven clause learning (CDCL(T)) in a single step, i.e., the SAT solver 302 searches for a model of the Boolean skeleton that is consistent with all (the encodings of) the predicates. Thus, if the SAT solver 302 finds a model for the formula, the input formula is also satisfiable (and if the SAT solver 302 returns a SAT 312 result value, a SAT 314 result is returned by the solver 302). Otherwise, if the formula is UNSAT (e.g., if the SAT solver 302 returns an UNSAT 318 result value), then it is only UNSAT for the respective bounded lengths of the string variables in that round. In this case, the solver 132 analyzes 316 the UNSAT kernel generated by the SAT solver 302 to determine which predicates conflict and lead to unsatisfiability.If the bounded lengths of the variables involved do not exceed the upper bounds of the unsatisfied predicates, the solver 132 increases 320 the length values ​​of the variables and attempts to solve the problem in a larger search space (e.g., by regenerating 310 a new encoding with respect to the updated bounded lengths and calling the SAT solver 302 with the updated encoding).

[0039] Formally, the solver denotes 132 by b k : Γ → ℕ which in round k ∈ℕ ≥1 valid upper bounds. For simplicity, the solver 132 defines b0: Γ → {1} as the constant 1-function. Thus, the solver runs n rounds with corresponding bounds b1, ..., b n such that for all k ∈ 0..n - 1: b k (x) ≤ b k+1 (x), and there is at least one x ∈ Γ with b k (x) < b k +1(x). A round ends with an incremental call to the SAT solver 302 until in round n the encoding with respect to b nis either achievable or unachievable, even if the limits are further increased.

[0040] For a literal a ∈ literals(ψ) the solver uses 〚a〛bk, to refer to the set of clauses used to encode a in relation to the ceilings b k is generated. For the rounds k, k' with k' < k the solver uses 〚a〛bk'bk, to encode a using the upper bounds b k to describe, since 〚a〛bk' has already been coded. This means that the solver ensures that 〚a〛bk≡〚a〛bk'∧〚a〛bk'bk for correct incremental coding. If the boundaries are clear from the context, this can be done more easily by 〚a〛 In addition, the coding of the solver sometimes introduces clauses that are only valid for a certain limit b k are valid, but in a later round b k'become invalid. Since an interface to a SAT solver 302 may not allow clause removal, the solver 132 may introduce selector variables. Here, a selector variable is a Boolean variable s whose negation ¬s is distributed over a set of clauses. For each incremental call where s is used as an assumption, the ¬s has no effect on the satisfiability of the clauses. For an incremental call where s is removed from the assumptions, all clauses become trivially satisfiable. The solver assumes(l )bk(x) to show that the literal l is replaced by b until the first round k' k (x) < b k '(x) is used as an assumption.

[0041] To perform replacements of string variables, given a limit n and an alphabet A, the solver 132 uses a new symbol λ that is not contained in A, and a string s with length k less than or equal to n is called s.λn-k encoded. In this way, string variables of length at most n are encoded as n-character words of A ∪ {λ}. For example, the SAT solver 302 attempts to find solutions up to the limit for a given variable at each iteration of the solving process. Now that the solver 132 has an alphabet and fixed-length string variables, the solver 132 converts each string variable into a set of Boolean variables. Thus, if there are n characters and the alphabet has a size of |A|, then the solver 132 uses n(|A|+1) Boolean variables per string. In some examples, encoding the string variables involves using a one-hot propositional encoding for each character.

[0042] For example, consider a string variable x that has been assigned a bounded length value of 5. Then, for each position in the string variable (i.e., at each of the character positions x0, x1, x2, x3, and x4), solver 132 introduces a set of Boolean variables and asserts that exactly one variable in this set is assigned true. And since solver 132 has finitely bounded the length of the string variable and there is a finite alphabet, there is a finite set of possible character assignments to this string.

[0043] The solver 132 then encodes the constraints expressed in the formula. As mentioned above, the types of constraints expressed in a formula can include, for example, regular expressions, equalities between variables, equalities between variables and constants, constraint prefixes, constraint suffixes, constraint substrings, and so on.

[0044] In some examples, encoding constraints on regular expressions (e.g., x ∈ R) involves transforming the regular expression into a nondeterministic finite automaton (NFA) and optionally removing epsilon transitions. The constraint x ∈ R is then encoded as the reachability of final states in the NFA (e.g., determining whether a string is recognized by an NFA is a reachability problem). Note that this procedure also works for negations. For a regular constraint x ∈ R (or its negation), solver 132 compiles an NFA M that accepts R and additionally grants a λ-self-transition for each state (e.g., to allow λ substitutions). Solver 132 further includes specialized encodings for other types of constraints, such as equalities, constraint prefixes, etc.

[0045] In some examples, the SAT solver 302 searches circle "6" for a model consistent with the set of definitions. As mentioned above, the SAT solver intuitively performs the CDCL(T) process in a single step, i.e., it searches for a model of the Boolean skeleton consistent with all (encodings of) the predicates. Therefore, if the SAT solver 302 finds a model for the formula, the input formula 300 is also satisfiable.

[0046] If the formula is otherwise unsatisfiable, then it is only unsatisfiable for the current bounds. In circle "7," in some examples, solver 132 analyzes the UNSAT kernel to determine which theory literals are part of an unsatisfiable subformula with respect to the current bounds. These theory literals are analyzed to determine whether the formula is unsatisfiable regardless of the bounds. If the bounds of the variables involved do not exceed the upper bounds of the unsatisfied predicates, solver 132 increases the variable bounds and attempts to solve the problem in a larger search space.

[0047] If it is determined that the bounds for one or more of the string variables need to be increased, in circle "8," the current bounds for the identified theory literals are increased. This also includes determining an upper bound for one or more string variables, if possible. An upper bound for variables can be derived, for example, by commenting that if x ∈ R has a solution, then there is also a solution h such that |h(x)| is less than or equal to the number of states in an NFA that R accepts. Conversely, if the SAT solver 302 does not find a solution such that the bound x is equal to the number of states, then it can be determined that no solution exists. This idea is applied to the conjunction (or regular language intersection) of predicates that lead to the UNSAT result.

[0048] In some examples, the solver collects 132 predicates marked as failed in circle "7" and partitions these predicates according to their equivalence class. That is, there is a set of atoms per string variable occurring in the conflicting atoms, and if an atom of the form x ≐ y has failed (where x and y are string variables), the sets for x and y are merged into a single set. In a further step, the solver 132 calculates the maximum exact upper bound for each partition (or equivalence class) by, among other things, computing the power set of the partition, computing for each set in the power set the NFA of the intersection of all contained atoms, and determining the number of states of the largest of the NFAs.

[0049] If the conjunction of the failed atoms (per class) has any solution at all, then it also has a solution with a length strictly less than the derived maximum upper bound. Thus, once the maximum upper bound is found, solver 132 checks which variables in the class currently have a population strictly less than the upper bound. For these variables, solver 132 increases their bounds for the next round. If there is no variable in the closure whose bound is less than the maximum upper bound, increasing the bounds may make the atoms and their associated clauses unsatisfiable, and solver 132 returns UNSAT (e.g., if the maximum length 322 is reached, solver 132 returns the UNSAT result 324). If the bound of at least one variable has been increased, solver 132 returns to encoding process 310 and repeats the process.In some examples, the upper bound may be specified as user input when invoking the solver or as a default upper bound for multiple invocations of the solver 132.

[0050] In some examples, the loop is represented by circles '5' (generate encoding 310), '6' (invoke SAT solver 302), '7' (analyze 316 an UNSAT kernel in response to a determination by SAT solver 302 that the current encoding is UNSAT 318), and '8' (update boundaries 320) in Fig. 3, uses incremental SAT solving. For example, when the solver 132 generates the SAT encoding for extended bounds, only new clauses are added to the SAT solver 302 via an incremental interface. As mentioned above, the operation is repeated until the solver can either return SAT (e.g., SAT result 314) or determines that further increasing the bounds cannot make the formula satisfiable, in which case it returns UNSAT (e.g., UNSAT result 324).

[0051] In some examples, the results 144 provided by the solver 132 (or other portfolio solvers 142) can be used in various ways. For example, the automated reasoning service 130 can cause information about the results to be displayed in a web-based console or other interface, for example, to indicate to a user one or more security or operational concerns regarding the user's current policy configuration. The results 144 can also be used by the automated reasoning service 130 or provided to another component, service, or the provider network 100 and used to generate one or more recommendations to modify a user's policies to address one or more identified security or operational concerns.

[0052] Fig. 5 is a flowchart illustrating operations 500 of a method for using a SAT-based solver for a quantifier-free theory of strings and bit vectors to analyze policies and policy consequences of a cloud provider network using some examples. Some or all of operations 500 (or other processes described herein, or variations and / or combinations thereof) may be performed under the control of one or more computer systems configured with executable instructions and may be implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) executing together on one or more processors.The code may be stored on a computer-readable storage medium, for example, in the form of a computer program comprising instructions executable by one or more processors. The computer-readable storage medium is non-transitory. In some examples, one or more (or all) of the operations 500 are performed by an automated reasoning service 130 of the other figures.

[0053] The operations 500 include, at block 502, obtaining, by a solver used by an automated reasoning service of a cloud provider network, a formula that includes one or more string variables, where the formula relates to a question about a desired condition of a policy managed by an identity and access management service of a cloud provider network.

[0054] The operations 500 further include, at block 504, determining a respective length value for each string variable of the one or more string variables that indicates a bounded length of possible assignments to the string variable.

[0055] The operations 500 further include, at block 506, generating a propositional encoding of the formula with respect to the respective length value for at least one of the one or more string variables.

[0056] The operations 500 further include, at block 508, calling a SAT solver for the propositional encoding of the formula to obtain a result value indicating whether the formula is satisfiable or unsatisfiable with respect to the respective length value for the at least one string variable of the one or more string variables.

[0057] The operations 500 further include, at block 510, providing the result value to another component of the automatic reasoning service.

[0058] In some examples, operations 500 further include determining an alphabet for the propositional encoding of each atomic formula within the first-order logical formula, wherein the alphabet includes characters that appear in the first-order logical formula and one additional character (e.g., per variable); and wherein generating the propositional encoding of each atomic formula within the first-order logical formula is performed with respect to the alphabet.

[0059] In some examples, the result value indicates that the formula is unsatisfiable, and wherein the operations further include: obtaining an unsatisfiable kernel of the formula from the SAT solver, wherein the unsatisfiable kernel of the formula includes a subset of atomic formulas of the formula; identifying a subset of the one or more string variables in the formula within the unsatisfiable kernel; determining an updated bounded length for each string variable of the subset of the one or more string variables by incrementing a respective bounded length currently assigned to the string variable; obtaining an updated propositional encoding of the formula based on the respective updated bounded length for each string variable of the subset of the one or more string variables; and invoking the SAT solver for the updated propositional encoding of the formula.

[0060] In some examples, a string variable of the one or more string variables is part of an atomic formula that includes a regular expression constraint, and wherein the operations further comprise: translating the atomic formula that includes the regular expression constraint into a nondeterministic finite state machine (possibly without epsilon transitions).

[0061] In some examples, determining the particular length value for a string variable involves iterating through the string predicates for a string variable and determining the length of the smallest word that satisfies the string predicate.

[0062] In some examples, calling the SAT solver on the updated propositional encoding of the formula involves using the incremental solving functionality of the SAT solver.

[0063] In some examples, the result value indicates that the first-order logical formula is unsatisfiable, and operations 500 further include obtaining an unsatisfiable kernel of the formula from the SAT solver, wherein the unsatisfiable kernel of the formula includes a subset of the atomic formulas of the first-order logical formula; identifying a subset of the one or more string variables in the first-order logical formula within the unsatisfiable kernel; determining, for each string variable of the subset, that an upper bound for each string variable of the subset has been reached; and determining that the first-order logical formula is unsatisfiable.

[0064] In some examples, the question of the desired condition of the policy includes at least one of the following: determining whether public write access to a compute resource is allowed, determining whether unencrypted writes to a compute resource are allowed, determining whether public read access to a compute resource is allowed, or determining whether Secure Socket Layer (SSL) requirements are required to access a compute resource, or comparing the permissibility of two policies relative to each other.

[0065] In some examples, the operations further include receiving an input specifying an initial length value to be used for one or more string variables in the formula; and wherein determining the respective length value specifying the limited length of possible assignments to a string variable is based on the input specifying the initial length value.

[0066] In some examples, operations 500 further include causing a display of information indicating whether the policy matches the desired condition of the policy.

[0067] In some examples, operations 500 further include generating a recommendation regarding policy based on the result value, the recommendation identifying a potential change to the policy, and causing the recommendation to be displayed.

[0068] In some examples, operations 500 further include receiving a user-defined input indicating the upper limit.

[0069] In some examples, operations 500 further include receiving a user-defined input that specifies the upper bound to be used by the solver.

[0070] Fig. 6 illustrates an example environment of a provider network (or "service provider system") according to some examples. A provider network 600 may provide resource virtualization to customers through one or more virtualization services 610 that enable customers to purchase, rent, or otherwise obtain instances 612 of virtualized resources, including, but not limited to, compute and storage resources implemented on devices within the provider network or on networks in one or more data centers. The resource instances 616 may be associated with local Internet Protocol (IP) addresses 612; the local IP addresses are the internal network addresses of the resource instances 612 on the provider network 600. In some examples, the provider network 600 may also include public IP addresses 614 and / or public IP address ranges (e.g.,Internet Protocol Version 4 (IPv4) or Internet Protocol Version 6 (IPv6) addresses) that customers can obtain from the provider 600.

[0071] Conventionally, via the virtualization services 610, the provider network 600 may enable a customer of the service provider (e.g., a customer operating one or more customer networks 650A-650C (or "client networks") including one or more customer devices 652) to dynamically associate at least some public IP addresses 614 assigned or allocated to the customer with particular resource instances 612 assigned to the customer. The provider network 600 may also enable the customer to reassign a public IP address 614 previously assigned to one virtualized computing resource instance 612 assigned to the customer to another virtualized computing resource instance 612 also assigned to the customer.For example, using the virtualized computing resource instances 612 and public IP addresses 614 provided by the service provider, a customer of the service provider, such as the operator of the customer network(s) 650A-650C, can implement customized applications and expose the customer's applications on an intermediate network 640, such as the Internet. Other network entities 620 in the intermediate network 640 can then generate traffic to a public destination IP address 614 published by the customer networks 650A-650C. The traffic is forwarded to the service provider's data center and, within the data center, is routed over a network substrate to the local IP address 616 of the virtualized computing resource instance 612 currently associated with the public destination IP address 614.Similarly, response traffic from the virtualized computing resource instance 612 may be routed back to the intermediate network 640 to the source device 620 via the network substrate.

[0072] Local IP addresses here refer to the internal or "private" network addresses of, for example, resource instances in a provider's network. Local IP addresses can be located within address blocks reserved by Internet Engineering Task Force (IETF) Request for Comments (RFC) 1918 and / or conform to an address format specified by IETF RFC 4193, and can be modified within the provider's network. Network traffic originating from outside the provider's network is not forwarded directly to local IP addresses but uses public IP addresses mapped to the local IP addresses of the resource instances. The provider's network may include network devices or equipment that provide Network Address Translation (NAT) or similar functions to perform the mapping of public IP addresses to local IP addresses and vice versa.

[0073] Public IP addresses are variable network addresses on the internet that are assigned to resource instances by either the service provider or the customer. Traffic routed to a public IP address is translated, for example, via 1:1 NAT, and forwarded to the respective local IP address of a resource instance.

[0074] Some public IP addresses may be assigned to specific resource instances by the provider's network infrastructure. These public IP addresses may be referred to as default public IP addresses or simply default IP addresses. In some examples, mapping a default IP address to a resource instance's local IP address is the default startup configuration for all resource instance types.

[0075] At least some public IP addresses may be assigned to or obtained from customers of the provider network 600; a customer may then associate their assigned public IP addresses with specific resource instances associated with the customer. These public IP addresses may be referred to as customer public IP addresses or simply customer IP addresses. Instead of being assigned to resource instances by the provider network 600 as is the case with standard IP addresses, customer IP addresses may also be assigned to resource instances by the customers, for example, via an API provided by the service provider. Unlike standard IP addresses, customer IP addresses are assigned to customer accounts and may be assigned to other resource instances by the respective customers as needed or desired.A customer IP address is associated with a customer account, not with a specific resource instance, and the customer controls that IP address until they release it. Unlike traditional static IP addresses, customer IP addresses allow the customer to mask resource instance or availability zone outages by remapping the customer's public IP addresses to any resource instance associated with the customer account. Using customer IP addresses, a customer can, for example, work around issues with their resource instances or software by remapping the customer IP addresses to spare resource instances.

[0076] Fig. 7 is a block diagram of an example provider network environment that provides a storage service and a hardware virtualization service to customers, according to some examples. A hardware virtualization service 720 provides customers with multiple computing resources 724 (e.g., computing instances 725, such as VMs). The computing resources 724 may, for example, be provided as a service to customers of a provider network 700 (e.g., to a customer implementing a customer network 750). Each computing resource 724 may be provided with one or more local IP addresses. The provider network 700 may be configured to forward packets from the local IP addresses of the computing resources 724 to public Internet destinations and from public Internet sources to the local IP addresses of the computing resources 724.

[0077] The provider network 700 may provide the ability for the customer network 750, coupled to an intermediate network 740, for example, via a local area network 756, to implement virtual computing systems 792 via the hardware virtualization service 720 coupled to the intermediate network 740 and the provider network 700. In some embodiments, the hardware virtualization service 720 may provide one or more APIs 702, such as a web service interface, through which the customer network 750 may access functionality provided by the hardware virtualization service 720, for example, via a console 794 (e.g., a web-based application, standalone application, mobile application, etc.) of a customer device 790.In some examples, in the provider network 700, each virtual computing system 792 in the customer network 750 may correspond to a computing resource 724 that is leased, rented, or otherwise made available to the customer network 750.

[0078] From an instance of the virtual computing system(s) 792 and / or another customer device 790 (e.g., via the console 794), the customer may access the functionality of a storage service 710, e.g., via the one or more APIs 702, to store data to and from storage resources 718A-718N of a virtual data store 716 (e.g., a folder or "bucket," a virtualized volume, a database, etc.) provided by the provider network 700. In some examples, a virtualized data store gateway (not shown) may be deployed in the customer network 750 that may locally cache at least some data, such as frequently accessed or critical data, and that may communicate with the storage service 710 via one or more communication channels to upload new or changed data from a local cache, thereby maintaining the primary data store (the virtualized data store 716).In some examples, a user may provision and access virtual data stores 716 via the virtual computing system 792 and / or another customer device 790 through the storage service 710 acting as a storage virtualization service, and these volumes may be presented to the user as local (virtualized) storage 798.

[0079] Although in Fig. 7, the virtualization services may also be accessed from resource instances within the provider network 700 via the API(s) 702. For example, a customer, appliance service provider, or other entity may access a virtualization service via the API(s) 702 from within a corresponding virtual network in the provider network 700 to request allocation of one or more resource instances within the virtual network or within another virtual network.

[0080] In some examples, a system implementing some or all of the techniques described herein may include a general-purpose computer system, such as that described in Fig. 8, which includes or is configured to access one or more computer-accessible media. In the illustrated embodiment, the computer system 800 includes one or more processors 810 connected to a system memory 820 via an input / output (I / O) interface 830. The computer system 800 further includes a network interface 840 coupled to the I / O interface 830. While Fig. 8 depicts computer system 800 as a single computing device, in various examples, computer system 800 may include one or any number of computing devices configured to cooperate as a single computer system 800.

[0081] In various embodiments, computer system 800 may be a single-processor system having one processor 810 or a multi-processor system having multiple processors 810 (e.g., two, four, eight, or another suitable number). The processor(s) 810 may be any suitable processor capable of executing instructions. For example, in various examples, the processor(s) 810 may be general-purpose or embedded processors implementing any of a variety of instruction set architectures (ISAs), such as the x86, ARM, PowerPC, SPARC, or MIPS ISAs, or another suitable ISA. In multi-processor systems, each of the processors 810 may typically, but not necessarily, implement the same ISA.

[0082] System memory 820 may store instructions and data accessible by processor(s) 810. In various examples, system memory 820 may be implemented using any suitable memory technology, such as random access memory (RAM), static RAM (SRAM), synchronous dynamic RAM (SDRAM), non-volatile / flash memory, or any other memory type. In the illustrated example, program instructions and data implementing one or more desired functions, such as the methods, techniques, and data described above, are represented as automated reasoning service code 825 (e.g., executable to implement all or part of automated reasoning service 130) and data 826 stored in system memory 820.

[0083] In some examples, the I / O interface 830 may be configured to coordinate I / O traffic between the processor 810, the system memory 820, and any peripheral devices in the device, including the network interface 840 and / or other peripheral interfaces (not shown). In some examples, the I / O interface 830 may perform any necessary protocol, timing, or other data transformations to convert data signals from one component (e.g., the system memory 820) into a format suitable for use by another component (e.g., the processor 810). In some examples, the I / O interface 830 may include support for devices connected via various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard.In some examples, the functionality of I / O interface 830 may be separated into two or more separate components, such as a northbridge and a southbridge. Additionally, in some examples, some or all of the functionality of I / O interface 830, such as an interface to system memory 820, may be integrated directly into processor 810.

[0084] The network interface 840 may be configured to enable data exchange between the computer system 800 and other devices 860 connected to one or more networks 850, such as other computer systems or devices, as in Fig.1. In various examples, network interface 840 may support communication over any suitable wired or wireless general data network, such as Ethernet network types. Furthermore, network interface 840 may support communication over telecommunications / telephony networks, such as analog voice networks or digital fiber optic communication networks, over storage area networks (SANs), such as Fibre Channel SANs, and / or over any other suitable network type and / or protocol.

[0085] In some examples, computer system 800 includes one or more offload cards 870A or 870B (including one or more processors 875 and possibly including one or more network interfaces 840) connected using I / O interface 830 (e.g., a bus implementing a version of the Peripheral Component Interconnect - Express (PCI-E) standard, or another connection such as a QuickPath interconnect (QPI) or an UltraPath interconnect (UPI)). For example, in some examples, computer system 800 may function as an electronic host device (e.g., operating as part of a hardware virtualization service) that hosts computing resources such as computing instances, and one or more offload cards 870A or 870B execute a virtualization manager that may manage computing instances executing on the electronic host device.For example, in some examples, the offload cards 870A or 870B may perform management operations for compute instances, such as pausing and / or resuming compute instances, starting and / or terminating compute instances, performing memory transfer / copy operations, etc. These management operations may, in some examples, be performed by the offload cards 870A or 870B in coordination with (e.g., at the request of) a hypervisor executed by the other processors 810A-810N of the computer system 800. However, in some examples, the virtualization manager implemented by the offload card(s) 870A or 870B may handle requests from other entities (e.g., from the compute instances themselves) and may not coordinate with (or service) a separate hypervisor.

[0086] In some examples, system memory 820 may be an example of a computer-accessible medium configured to store program instructions and data as described above. However, in other examples, program instructions and / or data may be received, sent, or stored on other types of computer-accessible media. Generally speaking, a computer-accessible medium may include any non-volatile storage medium or storage media, such as magnetic or optical media, e.g., a floppy disk or DVD / CD, connected to computer system 800 via I / O interface 830. A non-volatile computer-accessible storage medium may also include any volatile or non-volatile medium, such as RAM (e.g., SDRAM, Double Data Rate (DDR) SDRAM, SRAM, etc.), read-only memory (ROM), etc., which may be included as system memory 820 or as another type of memory in some embodiments of computer system 800.Furthermore, a computer-accessible medium may include transmission media or signals, such as electrical, electromagnetic, or digital signals, that are transmitted over a communication medium, such as a network and / or a wireless connection, such as may be implemented via the network interface 840.

[0087] The various examples may further be implemented in a wide variety of operating environments, which in some cases may include one or more user computers, computing devices, or processing devices that can be used to run any of a variety of applications. User or client devices may include any number of general-purpose computers, such as desktop or laptop computers running a standard operating system, as well as cellular, wireless, and portable devices running mobile software and capable of supporting a variety of networking and messaging protocols. Such a system may also include a number of workstations running any of a variety of commercially available operating systems and other known applications for purposes such as development and database management.These devices may also include other electronic devices such as dummy terminals, thin clients, gaming systems, and / or other devices capable of communicating over a network.

[0088] Most examples use at least one network known to those skilled in the art to support communications using a variety of widely used protocols, such as Transmission Control Protocol / Internet Protocol (TCP / IP), File Transfer Protocol (FTP), Universal Plug and Play (UPnP), Network File System (NFS), Common Internet File System (CIFS), Extensible Messaging and Presence Protocol (XMPP), AppleTalk, etc. The networks can include, for example, a local area network (LAN), a wide area network (WAN), a virtual private network (VPN), the Internet, an intranet, an extranet, a public switched telephone network (PSTN), an infrared network, a wireless network, and any combination thereof.

[0089] In examples that use a web server, the web server may run a variety of server or mid-tier applications, including HTTP servers, File Transfer Protocol (FTP) servers, Common Gateway Interface (CGI) servers, data servers, Java servers, business application servers, etc. The server(s) may also be capable of executing programs or scripts in response to requests from user devices, such as by executing one or more web applications, which may be implemented as one or more scripts or programs written in any programming language such as Java®, C, C#, or C++, or any scripting language such as Perl, Python, PHP, or TCL, and combinations thereof. The servers may also include database servers, including, but not limited to, those commercially available from Oracle®, Microsoft®, Sybase®, IBM®, etc. The database servers may be relational or non-relational (e.g.,“NoSQL”), distributed or non-distributed, etc.

[0090] The environment disclosed herein may include a variety of data stores and other storage and other storage media, as discussed above. These may be located in a variety of locations, such as on a storage medium local to (and / or located within) one or more of the computers or remote from any or all of the computers across the network. In one particular set of examples, the information may be stored in a Storage Area Network (SAN) known to those skilled in the art. Likewise, any files necessary to perform the functions assigned to the computers, servers, or other network devices may be stored locally and / or remotely, as needed.When a system includes computer-based devices, each such device may include hardware elements that may be electrically coupled via a bus, where the elements may include, for example, at least one central processing unit (CPU), at least one input device (e.g., a mouse, a keyboard, a controller, a touchscreen, or a keypad), and / or at least one output device (e.g., a display device, a printer, or a speaker). Such a system may also include one or more storage devices, such as disk drives, optical storage devices, and solid-state storage devices such as random access memory (RAM) or read-only memory (ROM), as well as removable media devices, memory cards, flash cards, etc.

[0091] Such devices may also include a computer-readable storage media reader, a communication device (e.g., a modem, a network card (wireless or wired), an infrared communication device, etc.), and memory, as described above. The computer-readable storage media reader may be connected to or configured to receive a computer-readable storage medium, which may include remote, local, fixed, and / or removable storage devices, as well as storage media for temporarily and / or permanently containing, storing, transmitting, and retrieving computer-readable information.The system and the various devices also typically include a number of software applications, modules, services, or other elements located within at least one memory device, including an operating system and application programs, such as a client application or a web browser. It should be understood that alternative examples may include numerous variations from that described above. For example, custom hardware may also be used, and / or special elements may be implemented in hardware, software (including portable software such as applets), or both. Furthermore, a connection to other computing devices, such as network input / output devices, may be used.

[0092] Storage media and computer-readable media containing code or portions of code may include any convenient media known or used in the art, including storage media and communication media, such as, but not limited to, volatile and non-volatile, removable and non-removable media, implemented in any method or technique for storing and / or transmitting information, such as computer-readable instructions, data structures, program modules, or other data, including RAM, ROM, electrically erasable programmable read-only memory ("EEPROM"), flash memory or other storage technology, compact disc read-only memory ("CD-ROM"), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used toto store the desired information and which can be accessed by a system device. Based on the disclosure and teachings provided herein, one of ordinary skill in the art will understand that other possibilities and / or methods exist to implement the various examples.

[0093] In the foregoing description, various examples are described. For purposes of explanation, specific configurations and details are set forth to provide a thorough understanding of the examples. However, it will also be apparent to those skilled in the art that the examples may be practiced without the specific details. Furthermore, well-known features may be omitted or simplified to make the described example unclear.

[0094] Text in parentheses and blocks with dashed borders (e.g., capital dashes, small dashes, semicolons, and periods) are used here to illustrate optional aspects that add additional functionality to some examples. However, such notation should not be understood to imply that these are the only options or optional operations and / or that blocks with solid borders are not optional in certain examples.

[0095] Reference numbers with appended letters (e.g., 718A-718N) may be used to indicate that there may be one or more instances of the referenced entity in various embodiments. Where multiple instances are present, they need not all be identical, but may instead share some common characteristics or act in a common manner. Furthermore, the suffixes used do not imply that a particular quantity of the entity is present unless explicitly stated otherwise. Therefore, two entities using the same or different suffix letters may or may not have the same number of instances in different examples.

[0096] References to "an example," etc., indicate that the described example may include a particular feature, structure, or property, but not every example necessarily includes that particular feature, structure, or property. Furthermore, such language does not necessarily refer to one and the same example. Furthermore, it should be understood that where a particular feature, structure, or property is described in connection with one example, it is within the skill of the art to produce such a feature, structure, or property in connection with other examples, whether explicitly described or not.

[0097] Furthermore, in the various examples described above, unless explicitly stated otherwise, disjunctive language such as the phrase "at least one of A, B, or C" is to be understood to mean either A, B, or C, or any combination thereof (e.g., A, B, and / or C). Likewise, expressions such as "at least one or more of A, B, and C" (or "one or more of A, B, and C") are to be understood to mean A, B, or C, or any combination thereof (e.g., A, B, and / or C). Thus, such disjunctive language is not intended to imply that a given example requires that at least one of A, at least one of B, and at least one of C be present.

[0098] The term "based on" (or similar) is an open-ended term used to describe one or more factors influencing a determination or other action. This term does not exclude additional factors that may influence a decision or action. For example, a determination may be based solely on the listed factor(s) or on that factor(s) and one or more additional factors. Thus, if an action A is "based on B," it is presumed that B is a factor influencing action A, but this does not preclude the action also being based on one or more other factors, such as factor C. However, in some cases, action A may be based entirely on B.

[0099] Unless explicitly stated otherwise, articles such as "a" or "an" should generally be interpreted to include one or more of the described items. Accordingly, phrases such as "a device configured therefor" or "a computing device" are intended to include one or more of the recited devices. Any one or more of these devices may be collectively configured to perform the recited operations. For example, "a processor configured to perform operations A, B, and C" may include a first processor configured to perform operation A in cooperation with a second processor configured to perform operations B and C.

[0100] At least some embodiments of the disclosed technologies may be described with respect to the following sections: 1. A computer-implemented method comprising: Generating a first-order logical formula by an automated reasoning service of a cloud provider network, wherein the first-order logical formula is generated based on a policy and a rule managed by an identity and access management service of the cloud provider network, wherein the rule expresses a desired condition of the policy, and wherein the first-order logical formula includes one or more string variables; Generating a Boolean abstraction of the first-order logical formula, wherein the Boolean abstraction of the first-order logical formula includes one or more Boolean variables each representing an atomic formula of the first-order logical formula; Determining a respective length value for each string variable of the one or more string variables that indicates a bounded length of possible string assignments to the string variable; Generating a propositional encoding of each atomic formula within the first-order logical formula based on the respective length value for each string variable; Invoking a SAT solver for the Boolean abstraction of the first-order logical formula and the propositional encoding of each atomic formula in the first-order logical formula to obtain a result value indicating whether the first-order logical formula is satisfiable or unsatisfiable with respect to the respective length value for each string variable; Determine, based on the result value, whether the policy matches the desired policy restriction expressed by the rule; and Display information indicating whether the policy matches the desired condition of the policy. 2. The computer-implemented method of clause 1, wherein the result value indicates that the first-order logical formula is unsatisfiable with respect to the respective length value for each string variable, and wherein the method further comprises: Obtaining an unsatisfiable kernel of the first-order logical formula from the SAT solver, wherein the unsatisfiable kernel of the first-order logical formula includes a subset of atomic formulas of the first-order logical formula; identifying a subset of the one or more string variables in the first-order logical formula within the unsatisfiable kernel; determining an updated bounded length for each string variable of the subset of the one or more string variables by increasing a respective bounded length currently assigned to the string variable; Obtaining an updated propositional encoding of the first-order logical formula based on the respective updated bounded length for each string variable of the subset of the one or more string variables; and Calling the SAT solver for the updated propositional encoding of the first-order logical formula. 3. A computer-implemented method according to clause 1 or 2, further comprising: Determining an alphabet for the statement encoding of each atomic formula within the first-order logical formula, the alphabet including characters that occur in the first-order logical formula and one additional character; and where the generation of the propositional encoding of each atomic formula within the first-order logical formula is performed with respect to the alphabet. 4. A computer-implemented method comprising: Obtaining, by a solver used by an automated reasoning service of a cloud provider network, a formula involving one or more string variables, wherein the formula relates to a question about a desired condition of a policy managed by an identity and access management service of a cloud provider network; Determining a respective length value for at least one string variable of the one or more string variables that indicates a limited length of possible assignments to the string variable; Generating a statement encoding of the formula with respect to the respective length value for at least one string variable of the one or more string variables; Calling a SAT solver for the propositional encoding of the formula to obtain a result value indicating whether the formula is satisfiable or unsatisfiable with respect to the respective length value for the at least one string variable of the one or more string variables; and Providing the result value to another component of the automatic reasoning service. 5. The computer-implemented method according to clause 4, wherein the result value indicates that the formula is unsatisfiable, and wherein the method further comprises: Obtaining an unsatisfiable kernel of the formula from the SAT solver, wherein the unsatisfiable kernel of the formula includes a subset of atomic formulas of the formula; identifying a subset of the one or more string variables in the formula within the unsatisfiable kernel; determining an updated bounded length for each string variable of the subset of the one or more string variables by increasing a respective bounded length currently assigned to the string variable; Obtaining an updated propositional encoding of the formula based on the respective updated bounded length for each string variable of the subset of the one or more string variables; and Call the SAT solver for the updated propositional encoding of the formula. 6. Computer-implemented methods according to any of clauses 4 or 5, further comprising: Determining an alphabet for the statement encoding of each atomic formula within the formula, the alphabet including characters that occur in the formula and one additional character; and where the generation of the propositional encoding of each atomic formula within the formula is performed with respect to the alphabet. 7. The computer-implemented method of any of clauses 4-6, wherein a string variable of the one or more string variables is part of an atomic formula including a regular expression constraint, and wherein the method further comprises translating the atomic formula including the regular expression constraint into a non-deterministic finite state machine. 8. The computer-implemented method of any of clauses 4-7, wherein determining the respective length value for a string variable comprises traversing the string predicates for a string variable and determining the length of the smallest word satisfying the string predicate. 9. The computer-implemented method of any one of clause 5, wherein calling the SAT solver on the updated propositional encoding of the formula includes using the incremental solving functionality of the SAT solver. 10. The computer-implemented method of any of clauses 4-9, wherein the result value indicates that the formula is unsatisfiable, and wherein the method further comprises: Obtaining an unsatisfiable kernel of the formula from the SAT solver, wherein the unsatisfiable kernel of the formula includes a subset of atomic formulas of the formula; identifying a subset of the one or more string variables in the formula within the unsatisfiable kernel; Determining, for each string variable of the subset, that an upper bound for each string variable of the subset has been reached; and Determine that the formula is unsatisfiable. 11. A computer-implemented procedure as defined in any of clauses 4-10, where the question regarding the desired condition of the policy includes at least one of the following: Determine whether public write access to a compute resource is allowed, determine whether unencrypted write operations to a compute resource are allowed, determine whether public read access to a compute resource is allowed, or determine whether Secure Socket Layer (SSL) requirements are required to access a compute resource, or compare the permissibility of two policies relative to each other. 12. A computer-implemented method according to any one of clauses 4-11, further comprising: Receiving input that specifies an initial length value to be used for one or more string variables in the formula; and where determining the respective length value specifying the limited length of possible assignments to a string variable is based on the input specifying the initial length value. 13. The computer-implemented method of clause 10, further comprising receiving a user-specified input specifying the upper bound to be solved by the solver. 14. A computer-implemented method according to any of clauses 4-13, further comprising causing information indicating whether the policy conforms to the desired condition of the policy to be displayed. 15. A computer-implemented method according to any one of clauses 4-14, further comprising: Generating a recommendation regarding policy based on the recommendation value, wherein the recommendation identifies a potential change to the policy; and

[0101] Initiate the display of the recommendation. 16. System comprising: a first one or more electronic devices for implementing an automatic reasoning service in a multi-tenant provider network, the automatic reasoning service including instructions that, when executed, cause the automatic reasoning service to: Generating a first-order logical formula, wherein the first-order logical formula is generated based on a policy managed by an identity and access management service of a cloud provider network and a rule, wherein the rule expresses a desired condition of the policy, and wherein the first-order logical formula includes one or more string variables; and a second one or more electronic devices to provide an automatic To implement an argument solver in the multi-tenant provider network, wherein the automated argument solver includes instructions that, when executed, cause the automated argument service to: Generating a Boolean abstraction of the first-order logical formula, wherein the Boolean abstraction of the first-order logical formula includes one or more Boolean variables each representing an atomic formula of the first-order logical formula; Determining a respective length value for each string variable of the one or more string variables that indicates a bounded length of possible string assignments to the string variable; Generating a propositional encoding of each atomic formula within the first-order logical formula based on the respective length value for each string variable; Invoking a SAT solver for the Boolean abstraction of the first-order logical formula and the propositional encoding of each atomic formula in the first-order logical formula to obtain a result value indicating whether the first-order logical formula is satisfiable or unsatisfiable with respect to the respective length value for each string variable; Determine, based on the result value, whether the policy matches the desired policy restriction expressed by the rule; and Display information indicating whether the policy matches the desired condition of the policy. 17. The system of clause 16, wherein the result value indicates that the first-order logical formula is unsatisfiable with respect to the respective length value for each string variable, and wherein the automated reasoning solver further includes instructions that, when executed, cause the automated reasoning service to: Obtaining an unsatisfiable kernel of the first-order logical formula from the SAT solver, wherein the unsatisfiable kernel of the first-order logical formula includes a subset of atomic formulas of the first-order logical formula; identifying a subset of the one or more string variables in the first-order logical formula within the unsatisfiable kernel; determining an updated bounded length for each string variable of the subset of the one or more string variables by increasing a respective bounded length currently assigned to the string variable; Obtaining an updated propositional encoding of the first-order logical formula based on the respective updated bounded length for each string variable of the subset of the one or more string variables; and Calling the SAT solver for the updated propositional encoding of the first-order logical formula. 18. A system according to any of clauses 16 or 17, wherein the automated reasoning solver further includes instructions which, when executed, cause the automated reasoning service to: Determining an alphabet for the statement encoding of each atomic formula within the first-order logical formula, the alphabet including characters that occur in the first-order logical formula and one additional character; and where the generation of the propositional encoding of each atomic formula within the first-order logical formula is performed with respect to the alphabet. 19. The system of any of clauses 16-18, wherein a string variable of the one or more string variables is part of an atomic formula that includes a regular expression restriction, and wherein the automated reasoning solver further includes instructions that, when executed, cause the automated reasoning service to: Translate the atomic formula including the regular expression constraints into a non-deterministic finite automaton. 20. The system of any of clauses 16-19, wherein determining the respective length value for a string variable comprises traversing the string predicates for a string variable and determining the length of the smallest word satisfying the string predicate.

[0102] Furthermore, the terms "may" or "can" are used in a permissive sense (i.e., in the sense of "possible") and not in a mandatory sense (i.e., in the sense of "must"). The terms "include," "including," and "includes" are used to denote open relationships and therefore mean "including," but not limited to. Likewise, the words "comprise," "having," and "comprises" also denote open relationships and thus mean "comprise," but not limited to. The terms "first," "second," "third," etc., as used herein, are used as labels for the nouns they precede and do not represent any kind of ordering (e.g., spatial, temporal, logical, etc.) unless such an ordering is explicitly stated.Likewise, the values ​​of such numerical designations are generally not used to indicate a required amount of a particular noun in the claims recited herein, and therefore a "fifth" element generally does not imply the presence of four additional elements unless those elements are expressly included in the claim or it is otherwise clearly stated that they are present.

[0103] The description and drawings are accordingly to be considered in an illustrative and not restrictive sense. However, it will be apparent that various modifications and changes may be made thereto without departing from the scope of the disclosure as set forth in the claims.

Claims

[1] Computer-implemented method comprising: Obtaining, by a solver used by an automated reasoning service of a cloud provider network, a formula involving one or more string variables, wherein the formula relates to a question about a desired condition of a policy managed by an identity and access management service of a cloud provider network; Determining a respective length value for at least one string variable of the one or more string variables that indicates a limited length of possible assignments to the string variable; Generating a statement encoding of the formula with respect to the respective length value for at least one string variable of the one or more string variables; calling a SAT solver for the propositional encoding of the formula to obtain a result value indicating whether the formula is satisfiable or unsatisfiable with respect to the respective length value for the at least one string variable of the one or more string variables; and Providing the result value to another component of the automatic reasoning service. [2] The computer-implemented method of claim 2, wherein the result value indicates that the formula is unsatisfiable, and wherein the method further comprises: Obtaining an unsatisfiable kernel of the formula from the SAT solver, wherein the unsatisfiable kernel of the formula includes a subset of atomic formulas of the formula; identifying a subset of the one or more string variables in the formula within the unsatisfiable kernel; determining an updated bounded length for each string variable of the subset of the one or more string variables by increasing a respective bounded length currently assigned to the string variable; Obtaining an updated propositional encoding of the formula based on the respective updated bounded length for each string variable of the subset of the one or more string variables; and Call the SAT solver for the updated propositional encoding of the formula. [3] A computer-implemented method according to any one of claims 1 or 2, further comprising: Determining an alphabet for the statement encoding of each atomic formula within the formula, the alphabet including characters that occur in the formula and one additional character; and where the generation of the propositional encoding of each atomic formula within the formula is performed with respect to the alphabet. [4] A computer-implemented method according to any one of claims 1-3, wherein a string variable of the one or more string variables is part of an atomic formula including a regular expression constraint, and wherein the method further comprises translating the atomic formula including the regular expression constraint into a non-deterministic finite state machine. [5] A computer-implemented method according to any one of claims 1-4, wherein determining the respective length value for a string variable includes traversing the string predicates for a string variable and determining the length of the smallest word satisfying the string predicate. [6] The computer-implemented method of claim 2, wherein calling the SAT solver on the updated propositional encoding of the formula includes using the incremental solving functionality of the SAT solver. [7] A computer-implemented method according to any one of claims 1-6, wherein the result value indicates that the formula is unsatisfiable, and wherein the method further comprises: Obtaining an unsatisfiable kernel of the formula from the SAT solver, wherein the unsatisfiable kernel of the formula includes a subset of atomic formulas of the formula; identifying a subset of the one or more string variables in the formula within the unsatisfiable kernel; Determining, for each string variable of the subset, that an upper bound for each string variable of the subset has been reached; and Determine that the formula is unsatisfiable. [8] A computer-implemented method according to any one of claims 1-7, wherein the question about the desired condition of the policy includes at least one of the following: Determine whether public write access to a compute resource is allowed, determine whether unencrypted write operations to a compute resource are allowed, determine whether public read access to a compute resource is allowed, or determine whether Secure Socket Layer (SSL) requirements are required to access a compute resource, or compare the permissibility of two policies relative to each other. [9] A computer-implemented method according to any one of claims 1-8, further comprising causing a display of information indicating whether the policy conforms to the desired condition of the policy. [10] A computer-implemented method according to any one of claims 1-9, further comprising: Generating a recommendation regarding policy based on the recommendation value, wherein the recommendation identifies a potential change to the policy; and Initiate the display of the recommendation. [11] System comprising: a first one or more electronic devices for automatically To implement a reasoning service in a multi-tenant provider network, wherein the automatic reasoning service includes instructions that, when executed, cause the automatic reasoning service to: Generating a first-order logical formula, wherein the first-order logical formula is generated based on a policy managed by an identity and access management service of a cloud provider network and a rule, wherein the rule expresses a desired condition of the policy, and wherein the first-order logical formula includes one or more string variables; and a second one or more electronic devices for implementing an automatic reasoning solver in the multi-tenant provider network, the automatic reasoning solver including instructions that, when executed, cause the automatic reasoning service to: Generating a Boolean abstraction of the first-order logical formula, wherein the Boolean abstraction of the first-order logical formula includes one or more Boolean variables each representing an atomic formula of the first-order logical formula; Determining a respective length value for each string variable of the one or more string variables that indicates a bounded length of possible string assignments to the string variable; Generating a propositional encoding of each atomic formula within the first-order logical formula based on the respective length value for each string variable; Invoking a SAT solver for the Boolean abstraction of the first-order logical formula and the propositional encoding of each atomic formula in the first-order logical formula to obtain a result value indicating whether the first-order logical formula is satisfiable or unsatisfiable with respect to the respective length value for each string variable; Determine, based on the result value, whether the policy matches the desired policy restriction expressed by the rule; and Display information indicating whether the policy matches the desired condition of the policy. [12] The system of claim 11, wherein the result value indicates that the first-order logical formula is unsatisfiable with respect to the respective length value for each string variable, and wherein the automated reasoning solver further includes instructions that, when executed, cause the automated reasoning service to: Obtaining an unsatisfiable kernel of the first-order logical formula from the SAT solver, wherein the unsatisfiable kernel of the first-order logical formula includes a subset of atomic formulas of the first-order logical formula; identifying a subset of the one or more string variables in the first-order logical formula within the unsatisfiable kernel; determining an updated bounded length for each string variable of the subset of the one or more string variables by increasing a respective bounded length currently assigned to the string variable; Obtaining an updated propositional encoding of the first-order logical formula based on the respective updated bounded length for each string variable of the subset of the one or more string variables; and Calling the SAT solver for the updated propositional encoding of the first-order logical formula. [13] The system of any of claims 11 or 12, wherein the automated reasoning solver further includes instructions that, when executed, cause the automated reasoning service to: Determining an alphabet for the statement encoding of each atomic formula within the first-order logical formula, the alphabet including characters that occur in the first-order logical formula and one additional character; and where the generation of the propositional encoding of each atomic formula within the first-order logical formula is performed with respect to the alphabet. [14] The system of any of claims 11-13, wherein a string variable of the one or more string variables is part of an atomic formula that includes a regular expression constraint, and wherein the automated reasoning solver further includes instructions that, when executed, cause the automated reasoning service to: Translate the atomic formula including the restriction by regular expressions into a non-deterministic finite automaton. [15] The system of any of claims 11-14, wherein determining the respective length value for a string variable includes traversing the string predicates for a string variable and determining the length of the smallest word satisfying the string predicate.

Images