On the Computational Complexity of Satisfiability Solving for String Theories

Susmit Jha, Sanjit A. Seshia, and Rhishikesh Limaye. On the Computational Complexity of Satisfiability Solving for String Theories. Technical Report UCB/EECS-2009-41, EECS Department, UC Berkeley, 2009.

Download

[HTML] 

Abstract

Satisfiability solvers are increasingly playing a key role in software verification, with particularly effective use in the analysis of security vulnerabilities. String processing is a key part of many software applications, such as browsers and web servers. These applications are susceptible to attacks through malicious data received over network. Automated tools for analyzing the security of such applications, thus need to reason about strings. For efficiency reasons, it is desirable to have a solver that treats strings as first-class types. In this paper, we present some theories of strings that are useful in a software security context and analyze the computational complexity of the presented theories. We use this complexity analysis to motivate a byte-blast approach which employs a Boolean encoding of the string constraints to a corresponding Boolean satisfiability problem.

BibTeX

@TechReport{jha-tr09,
  author =       {Susmit Jha and Sanjit A. Seshia and Rhishikesh Limaye},
  title =        "On the Computational Complexity of Satisfiability Solving for String Theories",
  institution =  {EECS Department, UC Berkeley},
  year =         {2009},
  month = {March},
  number =       {UCB/EECS-2009-41},
  abstract = {Satisfiability solvers are increasingly playing a key role in software verification, with particularly effective use in the analysis of security vulnerabilities. String processing is a key part of many software applications, such as browsers and web servers. These applications are susceptible to attacks through malicious data received over network. Automated tools for analyzing the security of such applications, thus need to reason about strings. For efficiency reasons, it is desirable to have a solver that treats strings as first-class types. In this paper, we present some theories of strings that are useful in a software security context and analyze the computational complexity of the presented theories. We use this complexity analysis to motivate a byte-blast approach which employs a Boolean encoding of the string constraints to a corresponding Boolean satisfiability problem.}
}