Obfuscation of Abstract Data-Types - Rowan

CHAPTER 5. SETS AND THE SPLITTING 98
= {Equation (4.16)}
cons asp x (filter (not · member asp ysp) (unsplit asp 〈xr,xl〉 asp ))
= {induction hypothesis}
cons asp x (minus 〈xr,xl〉 asp ysp)
Subcase 2 Suppose that member asp ysp x = True.
split asp (filter (not · member asp ysp) (unsplit asp xsp))
= {definition of xsp}
split asp (filter (not · member asp ysp) (unsplit asp 〈x : xl,xr〉 asp ))
= {definition of unsplit}
split asp (filter (not · member asp ysp) x : (unsplit asp 〈xr,xl〉 asp ))
= {definition of filter with member asp ysp x = False}
split asp (filter (not · member asp ysp) (unsplit asp 〈xr,xl〉 asp ))
= {induction hypothesis}
minus 〈xr,xl〉 asp ysp
Putting all the cases gives the following definition:
minus asp 〈[ ], [ ]〉 asp ysp = 〈[ ], [ ]〉 asp
minus asp 〈x : xl,xr〉 asp ysp = if member asp ysp x
then minus asp 〈xr,xl〉 asp ysp
else cons asp x (minus asp 〈xr,xl〉 asp ysp)
5.3.2 Block Split
Let us now consider how we can obfuscate the set operations using the block
split. As we are now working with ordered lists, we need to strengthen Invariant
(4.18). The representation xs ❀ 〈l,r〉 b(k) satisfies:
((|r| = 0 ∧ |l| < k) ∨ (|l| = k)) ∧ (l ✂ xs) ∧ (r ✂ xs) (5.5)
which ensures that the block split preserves ordering. Using the definition of
split b(k) , we can easily check that this invariant holds and so we can use this
split with ordered lists.
As with the alternating split, we state the operations for ordered lists —
the proofs of correctness can be found in [20]. The member b(k) operation is the
same as usual:
member b(k) 〈l,r〉 b(k) a = member l a ∨ member r a
For insert b(k) , we may have to break the list l into ls + [l ′ ], where l ′ is the
last element of l (assuming that l is not empty). Note that since |l| ≤ k then
breaking l into ls and l ′ is a constant operation.
insert b(k) a 〈l,r〉 b(k)
member b(k) 〈l,r〉 b(k) a = 〈l,r〉 b(k)
|l| < k
= 〈insert a l,r〉 b(k)
l ′ < a
= 〈l, insert a r〉 b(k)
∣ otherwise = 〈insert a ls,l ′ : r〉 b(k)
where ls = init l
l ′ = last l