Search

Register automaton (RA) is an extension of finite automaton for dealing with data values in an infinite domain. In the previous work, we proposed disjunctive mu$^\downarrow$-calculus, which is a subclass of modal mu-calculus with the freeze quantifier, and showed that it has the same expressive power as RA. However, disjunctive mu$^\downarrow$-calculus is defined as a logic on finite words, whereas temporal specifications in model checking are usually given in terms of infinite words. In this paper, we re-define the syntax and semantics of disjunctive mu$^\downarrow$-calculus to be suitable for infinite words and prove that the obtained temporal logic has the same expressive power as Buchi RA., Comment: 6 pages, 1 figure, this is a longer version of a short paper submitted to IEICE Transactions on Information and Systems

The definition of period in finite-state Markov chains can be extended to regular languages by considering the transitions of DFAs accepting them. For example, the language $(\Sigma\Sigma)^*$ has period two because the length of a recursion (cycle) in its DFA must be even. This paper shows that the period of a regular language appears as a cyclic group within its syntactic monoid. Specifically, we show that a regular language has period $P$ if and only if its syntactic monoid is isomorphic to a submonoid of a semidirect product between a specific finite monoid and the cyclic group of order $P$. Moreover, we explore the relation between the structure of Markov chains and our result, and apply this relation to the theory of probabilities of languages. We also discuss the Krohn-Rhodes decomposition of finite semigroups, which is strongly linked to our methods.

Game theory on graphs is a basic tool in computer science. In this paper, we propose a new game-theoretic framework for studying the privacy protection of a user who interactively uses a software service. Our framework is based on the idea that an objective of a user using software services should not be known to an adversary because the objective is often closely related to personal information of the user. We propose two new notions, O-indistinguishable strategy (O-IS) and objective-indistinguishability equilibrium (OIE). For a given game and a subset O of winning objectives (or objectives in short), a strategy of a player is O-indistinguishable if an adversary cannot shrink O by excluding any objective from O as an impossible objective. A strategy profile, which is a tuple of strategies of all players, is an OIE if the profile is locally maximal in the sense that no player can expand her set of objectives indistinguishable from her real objective from the viewpoint of an adversary. We show that for a given multiplayer game with Muller objectives, both of the existence of an O-IS and that of OIE are decidable.

Pushdown systems (PDS) are known as an abstract model of recursive programs, and model checking methods for PDS have been studied. Register PDS (RPDS) are PDS augmented by registers to deal with data values from an infinite domain in a restricted way. A linear temporal logic (LTL) model checking method for RPDS with regular valuations has been proposed; however, the method requires the register automata (RA) used for representing a regular valuation to be backward-deterministic. This paper proposes another approach to the same problem, in which the model checking problem for RPDS is reduced to that problem for PDS by constructing a PDS bisimulation equivalent to a given RPDS. The construction in the proposed method is simpler than the previous model checking method and does not require RAs deterministic or backward-deterministic, and the bisimulation equivalence clearly guarantees the correctness of this reduction. On the other hand, the proposed method requires every RPDS (and RA) to have the freshness property, in which whenever the RPDS updates a register with a data value not stored in any register or the stack top, the value should be fresh. This paper also shows that this model checking problem with regular valuations defined by general RA is undecidable, and thus the freshness constraint is essential in the proposed method., Comment: 9 pages, 2 figures, this is a longer version of a short paper submitted to IEICE Transactions on Information and Systems

Register pushdown automata (RPDA) is an extension of classical pushdown automata to handle data values in a restricted way. RPDA attracts attention as a model of a query language for structured documents with data values. The membership and emptiness problems for RPDA are known to be EXPTIME-complete. This paper shows the membership problem becomes PSPACE-complete and NP-complete for nondecreasing and growing RPDA, respectively, while the emptiness problem remains EXPTIME-complete for these subclasses., Comment: Proceedings of the Third Workshop on Software Foundations for Data Interoperability (SFDI2019+), October 28, 2019, Fukuoka, Japan

Quantitative information flow (QIF) is traditionally defined as the expected value of information leakage over all feasible program runs and it fails to identify vulnerable programs where only limited number of runs leak large amount of information. As discussed in Bielova (2016), a good notion for dynamic leakage and an efficient way of computing the leakage are needed. To address this problem, the authors have already proposed two notions for dynamic leakage and a method of quantifying dynamic leakage based on model counting. Inspired by the work of Kawamoto et. al. (2017), this paper proposes two efficient methods for computing dynamic leakage, a compositional method along with the sequential structure of a program and a parallel computation based on the value domain decomposition. For the former, we also investigate both exact and approximated calculations. From the perspective of implementation, we utilize binary decision diagrams (BDDs) and deterministic decomposable negation normal forms (d-DNNFs) to represent Boolean formulas in model counting. Finally, we show experimental results on several examples., Comment: preprint

A program is non-interferent if it leaks no secret information to an observable output. However, non-interference is too strict in many practical cases and quantitative information flow (QIF) has been proposed and studied in depth. Originally, QIF is defined as the average of leakage amount of secret information over all executions of a program. However, a vulnerable program that has executions leaking the whole secret but has the small average leakage could be considered as secure. This counter-intuition raises a need for a new definition of information leakage of a particular run, i.e., dynamic leakage. As discussed in [5], entropy-based definitions do not work well for quantifying information leakage dynamically; Belief-based definition on the other hand is appropriate for deterministic programs, however, it is not appropriate for probabilistic ones. In this paper, we propose new simple notions of dynamic leakage based on entropy which are compatible with existing QIF definitions for deterministic programs, and yet reasonable for probabilistic programs in the sense of [5]. We also investigated the complexity of computing the proposed dynamic leakage for three classes of Boolean programs. We also implemented a tool for QIF calculation using model counting tools for Boolean formulae. Experimental results on popular benchmarks of QIF research show the flexibility of our framework. Finally, we discuss the improvement of performance and scalability of the proposed method as well as an extension to more general cases., Comment: will be revised to submit to IEICE Transaction on Information and Systems in near future

A parameterised Boolean equation system (PBES) is a set of equations that defines sets as the least and/or greatest fixed-points that satisfy the equations. This system is regarded as a declarative program defining functions that take a datum and returns a Boolean value. The membership problem of PBESs is a problem to decide whether a given element is in the defined set or not, which corresponds to an execution of the program. This paper introduces reduced proof graphs, and studies a technique to solve the membership problem of PBESs, which is undecidable in general, by transforming it into a reduced proof graph. A vertex X(v) in a proof graph represents that the data v is in the set X, if the graph satisfies conditions induced from a given PBES. Proof graphs are, however, infinite in general. Thus we introduce vertices each of which stands for a set of vertices of the original ones, which possibly results in a finite graph. For a subclass of disjunctive PBESs, we clarify some conditions which reduced proof graphs should satisfy. We also show some examples having no finite proof graph except for reduced one. We further propose a reduced dependency space, which contains reduced proof graphs as sub-graphs if a proof graph exists. We provide a procedure to construct finite reduced dependency spaces, and show the soundness and completeness of the procedure., Comment: In Proceedings WPTE 2016, arXiv:1701.00233

This paper discusses the decidability of node query preservation problems for XML document transformations. We assume a transformation given by a deterministic linear top-down data tree transducer (abbreviated as DLT^V) and an n-ary query based on runs of a tree automaton. We say that a DLT^V Tr strongly preserves a query Q if there is a query Q' such that for every document t, the answer set of Q' for Tr(t) is equal to the answer set of Q for t. Also we say that Tr weakly preserves Q if there is a query Q' such that for every t_d in the range of Tr, the answer set of Q' for t_d is equal to the union of the answer set of Q for t such that t_d = Tr(t). We show that the weak preservation problem is coNP-complete and the strong preservation problem is in 2-EXPTIME., Comment: In Proceedings TTATT 2013, arXiv:1311.5058