Relational Test Tables: A Practical Specification Language for Evolution and Security
This work addresses a practical problem for software practitioners in verifying relational properties, but it is incremental as it builds on existing generalised test tables.
The paper tackles the lack of accessible specification languages for verifying relational program properties like secure information flow and conditional equivalence, by introducing relational test tables as an extension of generalised test tables, and demonstrates their applicability in specifying and verifying examples from automated product systems.
A wide range of interesting program properties are intrinsically relational, i.e., they relate two or more program traces. Two prominent relational properties are secure information flow and conditional program equivalence. By showing the absence of illegal information flow, confidentiality and integrity properties can be proved. Equivalence proofs allow using an existing (trusted) software release as specification for new revisions. Currently, the verification of relational properties is hardly accessible to practitioners due to the lack of appropriate relational specification languages. In previous work, we introduced the concept of generalised test tables: a table-based specification language for functional (non-relational) properties of reactive systems. In this paper, we present relational test tables -- a canonical extension of generalised test tables for the specification of relational properties, which refer to two or more program runs or traces. Regression test tables support asynchronous program runs via stuttering. We show the applicability of relational test tables, using them for the specification and verification of two examples from the domain of automated product systems.