Putting Strong Linearizability in Context: Preserving Hyperproperties in Programs that Use Concurrent Objects

It has been observed that linearizability, the prevalent consistency condition for implementing concurrent objects, does not preserve some probability distributions. A stronger condition, called strong linearizability has been proposed, but its study has been somewhat ad-hoc. This paper investigates strong linearizability by casting it in the context of observational refinement of objects. We present a strengthening of observational refinement, which generalizes strong linearizability, obtaining several important implications. When a concrete concurrent object refining another, more abstract object - often sequential - the correctness of a program employing the concrete object can be verified by considering its behaviors when using the more abstract object. This means that trace properties of a program using the concrete object can be proved by considering the program with the abstract object. This, however, does not hold for hyperproperties, including many security properties and probability distributions of events. We define strong observational refinement, a strengthening of refinement that preserves hyperproperties, and prove that it is equivalent to the existence of forward simulations. We show that strong observational refinement generalizes strong linearizability. This implies that strong linearizability is also equivalent to forward simulation, and shows that strongly linearizable implementations can be composed both horizontally (i.e., locality) and vertically (i.e., with instantiation). For situations where strongly linearizable implementations do not exist (or are less efficient), we argue that reasoning about hyperproperties of programs can be simplified by strong observational refinement of abstract objects that are not necessarily sequential.

[1]  Michel Raynal,et al.  Unifying Concurrent Objects and Distributed Tasks , 2018, J. ACM.

[2]  Wojciech M. Golab,et al.  Linearizable implementations do not suffice for randomized distributed computation , 2011, STOC '11.

[3]  Maurice Herlihy,et al.  Linearizability: a correctness condition for concurrent objects , 1990, TOPL.

[4]  Yehuda Afek,et al.  Common2 extended to stacks and unbounded concurrency , 2006, PODC '06.

[5]  John McLean,et al.  A general theory of composition for trace sets closed under selective interleaving functions , 1994, Proceedings of 1994 IEEE Computer Society Symposium on Research in Security and Privacy.

[6]  James Aspnes,et al.  Randomized protocols for asynchronous consensus , 2002, Distributed Computing.

[7]  Pavol Cerný,et al.  Preserving Secrecy Under Refinement , 2006, ICALP.

[8]  Philipp Woelfel,et al.  Strongly Linearizable Implementations of Snapshots and Other Types , 2019, PODC.

[9]  Nir Shavit,et al.  Atomic snapshots of shared memory , 1990, JACM.

[10]  Nancy A. Lynch,et al.  Forward and Backward Simulations: I. Untimed Systems , 1995, Inf. Comput..

[11]  Constantin Enea,et al.  Proving Linearizability Using Forward Simulations , 2017, CAV.

[12]  John Derrick,et al.  How to Prove Algorithms Linearisable , 2012, CAV.

[13]  Christoph M. Kirsch,et al.  A Scalable, Correct Time-Stamped Stack , 2015, POPL.

[14]  J. Meseguer,et al.  Security Policies and Security Models , 1982, 1982 IEEE Symposium on Security and Privacy.

[15]  Peter W. O'Hearn,et al.  Abstraction for concurrent objects , 2009, Theor. Comput. Sci..

[16]  Philipp Woelfel,et al.  Wait-Freedom is Harder Than Lock-Freedom Under Strong Linearizability , 2015, DISC.

[17]  Maryam Helmi,et al.  Strongly linearizable implementations: possibilities and impossibilities , 2012, PODC '12.

[18]  Bernd Finkbeiner,et al.  Temporal Logics for Hyperproperties , 2013, POST.

[19]  Constantin Enea,et al.  Tractable Refinement Checking for Concurrent Objects , 2015, POPL.