For compositional linear hybrid automata (CLHA), whose dynamics can be characterized by linear constraints, bounded model checking (BMC) is challenging due to the complexity caused by interactions among member automata. Classical BMC approaches encode CLHA behavior using interleaving semantics, where compositions are handled with Cartesian product; as a result, the encoding is often large and complex, significantly limiting the scalability and efficiency of BMC. To address this problem, we propose three interaction relations to categorize and describe CLHA interactions through shared-label synchronization, discrete-variable read-write, and time-duration read-write. Based on the interaction relations, we devise interaction-oriented synchronization (IOS) semantics for CLHA behavior, which provides for a concise BMC encoding. In BMC, we employ a path-oriented method to check bounded reachability of CLHA, by enumerating candidate paths and checking each path’s feasibility. To prune the search space of candidate paths, we introduce a temporal relation graph (TRG) to quickly rule out infeasible paths via graph-based checking. Our method is implemented into a CLHA bounded reachability checker, BACH . Experiments indicate that it enables significant efficiency improvement over state-of-the-art tools, and performs scalable bounded reachability analysis on practical CLHA cases within seconds.

The confidentiality of tenant's data is confronted with high risk when facing hardware attacks and privileged malicious software. Hardware-based memory encryption is one of the promising means to provide strong guarantees of data security. Recently AMD has proposed its new memory encryption hardware called SME and SEV, which can selectively encrypt memory regions in a fine-grained manner, e.g., by setting the C-bits in the page table entries. More importantly, SEV further supports encrypted virtual machines. This, intuitively, has provided a new opportunity to protect data confidentiality in guest VMs against an untrusted hypervisor in the cloud environment. In this paper, we first provide a security analysis on the (in)security of SEV and uncover a set of security issues of using SEV as a means to defend against an untrusted hypervisor. Based on the study, we then propose a software-based extension to the SEV feature, namely Fidelius, to address those issues while retaining performance efficiency. Fidelius separates the management of critical resources from service provisioning and revokes the permissions of accessing specific resources from the un-trusted hypervisor. By adopting a sibling-based protection mechanism with non-bypassable memory isolation, Fidelius embraces both security and efficiency, as it introduces no new layer of abstraction. Meanwhile, Fidelius reuses the SEV API to provide a full VM life-cycle protection, including two sets of para-virtualized I/O interfaces to encode the I/O data, which is not considered in the SEV hardware design. A detailed and quantitative security analysis shows its effectiveness in protecting tenant's data from a variety of attack surfaces, and the performance evaluation confirms the performance efficiency of Fidelius.