Abstract
Java bytecode verification is traditionally performed by using dataflow analysis. We investigate an alternative based on reducing bytecode verification to model checking. First, we analyze the complexity and scalability of this approach. We show experimentally that, despite an exponential worst-case time complexity, model checking type-correct bytecode using an explicit-state on-the-fly model checker is feasible in practice, and we give a theoretical account why this is the case. Second, we formalize our approach using Isabelle/HOL and prove its correctness. In doing so we build on the formalization of the Java Virtual Machine and dataflow analysis framework of Pusch and Nipkow and extend it to a more general framework for reasoning about model-checking-based analysis. Overall, our work constitutes the first comprehensive investigation of the theory and practice of bytecode verification by model checking.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
References
Basin, D., Friedrich, S. and Gawkowski, M.: Verified bytecode model checkers, in V. A. Carreño, C. A. Muñoz and S. Tahar (eds.), Theorem Proving in Higher Order Logics (TPHOLs'02), Lecture Notes in Comput. Sci. 2410, 2002, pp. 47-66.
Basin, D., Friedrich, S., Gawkowski, M. and Posegga, J.: Bytecode model checking: An experimental analysis, in D. Bosnacki and S. Leue (eds.), Model Checking Software, 9th International SPIN Workshop, Lecture Notes in Comput. Sci. 2318, 2002, pp. 42-59.
Basin, D., Friedrich, S., Posegga, J. and Vogt, H.: Java byte code verification by model checking, in N. Halbwachs and D. Peled (eds.), 11th International Conference on Computer-Aided Verification (CAV' 99), 1999, pp. 491-494.
Bertot, Y.: A Coq formalization of a type checker for object initialization in the Java virtual machine, Research Report RR-4047, INRIA, 2000.
Biere, A., Cimatti, A., Clarke, E. and Zhu, Y.: Symbolic model checking without BDDs, in W. R. Cleaveland (ed.), Tools and Algorithms for the Construction and Analysis of Systems, TACAS' 99, Lecture Notes in Comput. Sci. 1579, 1999, pp. 193-207.
Coglio, A.: Simple verification technique for complex Java bytecode subroutines, in Proc. 4th ECOOP Workshop on Formal Techniques for Java-like Programs, 2002.
Cohen, R.: The defensive Java Virtual Machine specification, Technical Report, Computational Logic Inc., 1997.
Freund, S. N. and Mitchell, J. C.: A formal framework for the Java bytecode language and verifier, ACM SIGPLAN Notices 34(10) (1999), 147-166.
Freund, S. N. and Mitchell, J. C.: The type system for object initialization in the Java bytecode language, ACM Transactions on Programming Languages and Systems 21(6) (1999), 1196-1250.
Holzmann, G. J.: The SPIN model checker, IEEE Transactions on Software Engineering 23(5) (1997), 279-295.
Kfoury, A. J., Tiuryn, J. and Urzyczyn, P.: An analysis of ML typability, J. ACM 41(2) (1994), 368-398.
Klein, G. and Nipkow, T.: Verified bytecode verifiers, Theoret. Comput. Sci. (2002), to appear.
Klein, G. and Wildmoser, M.: Verified bytecode subroutines, J. Automated Reasoning (2003), in this issue.
Leroy, X.: Java bytecode verification: An overview, in G. Berry, H. Comon and A. Finkel (eds.), Computer Aided Verification, 13th International Conference, CAV 2001, Lecture Notes in Comput. Sci. 2102, 2001, pp. 265-285.
Lindholm, T. and Yellin, F.: The Java Virtual Machine Specification, The Java Series 1102, Addison-Wesley, 1997.
McMillan, K.: Symbolic model checking: An approach to the state explosion problem, Ph.D. thesis, School of Computer Science, Carnegie Mellon University, Pittsburgh, PA, 1992. CMUCS-92-131.
Nipkow, T.: Verified bytecode verifiers, in F. Honsell and M. Miculan (eds.), Foundations of Software Science and Computation Structures, 4th International Conference, FOSSACS 2001, Lecture Notes in Comput. Sci. 2030, 2001, pp. 347-363.
Nipkow, T., v. Oheimb, D. and Pusch, C.: µJava: Embedding a programming language in a theorem prover, in F. Bauer and R. Steinbrüggen (eds.), Foundations of Secure Computation. Proc. Int. Summer School Marktoberdorf 1999, 2000, pp. 117-144.
Nipkow, T., Paulson, L. C. and Wenzel, M.: Isabelle/HOL, A Proof Assistant for Higher-Order Logic, Lecture Notes in Comput. Sci. 2283, Springer, 2002.
Paulson, L. C.: Isabelle: A Generic Theorem Prover; With Contributions by Tobias Nipkow, Lecture Notes in Comput. Sci. 828, Springer, 1994.
Posegga, J. and Vogt, H.: Byte code verification for Java smart cards based on model checking, in J.-J. Quisquater, Y. Deswarte, C. Meadows, and D. Gollmann (eds.), Computer Security - ESORICS 98, 5th European Symposium on Research in Computer Security, Lecture Notes in Comput. Sci. 1485, 1998, pp. 175-190.
Pusch, C.: Formalizing the Java virtual machine in Isabelle/HOL, Technical Report TUMI9816, Institut für Informatik, Technische Universität München, 1998.
Pusch, C.: Proving the soundness of a Java bytecode verifier specification in Isabelle/HOL, in W. R. Cleaveland (ed.), Tools and Algorithms for the Construction and Analysis of Systems, TACAS' 99, Lecture Notes in Comput. Sci. 1579, 1999, pp. 89-103.
Qian, Z.: A formal specification of Java Virtual Machine instructions for objects, methods and subroutines, in J. Alves-Foss (ed.), Formal Syntax and Semantics of Java, Lecture Notes in Comput. Sci. 1528, Springer, 1999, pp. 271-311.
Qian, Z.: Standard fixpoint iteration for Java bytecode verification, ACM Transactions on Programming Languages and Systems 22(4) (2000), 638-672.
Ruys, T. C.: Towards effective model checking, Ph.D. thesis, University of Twente, Department of Computer Science, 2001.
Schmidt, D.: Data flow analysis is model checking of abstract interpretations, in Proceedings of the 25th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL' 98), 1998, pp. 38-48.
Schmidt, D. and Steffen, B.: Program analysis as model checking of abstract interpretations, in G. Levi (ed.), Static Analysis, 5th International Symposium, SAS' 98, Lecture Notes in Comput. Sci. 1503, 1998, pp. 351-380.
Stärk, R. F. and Schmid, J.: Java bytecode verification is not possible, in R. Moreno-Díaz and A. Quesada-Arencibia (eds.), Formal Methods and Tools for Computer Science, Eurocast, Extended Abstract, 2001.
Stata, R. and Abadi, M.: A type system for Java bytecode subroutines, ACM Transactions on Programming Languages and Systems 21(1) (1999), 90-137.
Yellin, F.: Low level security in Java, in World Wide Web Journal: The Fourth International WWW Conference Proceedings, Cambridge, MA, 1995, pp. 369-380.
Author information
Authors and Affiliations
Rights and permissions
About this article
Cite this article
Basin, D., Friedrich, S. & Gawkowski, M. Bytecode Verification by Model Checking. Journal of Automated Reasoning 30, 399–444 (2003). https://doi.org/10.1023/A:1025059508087
Issue Date:
DOI: https://doi.org/10.1023/A:1025059508087