AbstractIn this lecture we present some work we published in [2,3] and hint at some new current lines of research on information flow and security.More precisely, we describe the calculus of Boxed Ambients a variant of Cardelli and Gordon's Mobile Ambients [4] a calculus of mobile and dynamically reconfigurable agents. Boxed Ambients inherit from Mobile Ambients (part of) the mobility primitives but rely on a completely different model of communication. The new communication primitives fit nicely the design principles of Mobile Ambients, and complement the existing constructs for ambient mobility with finer-grained, and more effective, mechanisms for ambient interaction. As a result Boxed Ambients retain the expressive power and the computational flavor of Ambient Calculus, as well as the elegance of its formal presentation. In addition, they enhance the flexibility of typed communications over Mobile Ambients, and provide new insight into the relationship between synchronous and asynchronous input-output

Bugliesi, Michele

Castagna, Giuseppe

Crafa, Silvia

English

Open Access Repository

p ( )URL: http://www.elsevier.nl/locate/entcs/volume62.html 6 pagesAn overview of Boxed Ambients(Abstract)Giuseppe Castagna 1Département d’Informatique, École Normale Supérieure, Paris, FranceLecture on joint work withMichele Bugliesi and Silvia Crafa 2Dipartimento d’Informatica, Università Ca’ Foscari, Venezia, ItalyIn this lecture we present some work we published in [2,3] and hint at somenew current lines of research on information flow and security.More precisely, we describe the calculus of Boxed Ambients a variant ofCardelli and Gordon’s Mobile Ambients [4] a calculus of mobile and dynam-ically reconfigurable agents. Boxed Ambients inherit from Mobile Ambients(part of) the mobility primitives but rely on a completely different modelof communication. The new communication primitives fit nicely the designprinciples of Mobile Ambients, and complement the existing constructs forambient mobility with finer-grained, and more effective, mechanisms for am-bient interaction. As a result Boxed Ambients retain the expressive power andthe computational flavor of Ambient Calculus, as well as the elegance of itsformal presentation. In addition, they enhance the flexibility of typed commu-nications over Mobile Ambients, and provide new insight into the relationshipbetween synchronous and asynchronous input-output.1. Mobile AmbientsAmbients are named process of the form a[ P ] where a is a name and P aprocess. Processes can be composed in parallel, as in P | Q, exercise a capa-bility, as in M.P , declare local names as in (νx)P , or simply do nothing as in0. Ambients may be nested to form a tree structure that can be dynamicallyreconfigured by exercising the capabilities in, out and open. In addition, am-bients and processes may communicate. Communication is anonymous, andhappens inside ambients. The configuration (x)P | 〈M〉 represents the parallelcomposition of two processes, the output process 〈M〉 “dropping” the mes-sage M , and the input process (x)P reading the message M and continuing1 Email: Giuseppe.Castagna@ens.fr2 Email: {michele,silvia}@dsi.unive.itc©2002 Published by Elsevier Science B. V.Castagna et al.as P{x := M}. The open capability has a fundamental interplay with com-munication: in fact, communication results from a combination of mobilityand opening control. To exemplify, consider two ambients running in parallelas in the following configuration a[ (x)P | Q ] | b[ 〈M〉 | R ] . The exchangeof the value M from b to the process P enclosed in a happens as a result of,say, first b moving inside a, and then a opening b. Thus, if Q is the processopen b, and R is in a, communication is the result of the following sequence ofreductions:a[ (x)P | open b ] | b[ 〈M〉 | in a ]➞ a[ (x)P | open b | b[ 〈M〉 ] ] by exercising in a➞ a[ (x)P | 〈M〉 ] by open b, unleashing M➞ a[ P{x := M} ] by local communication2. A case against ambient openingWhile fundamental to the Ambient Calculus for the reasons just illustrated, anunrestricted use of the open capability appears to bring about serious securityconcerns in wide-area distributed applications.Consider a scenario where a client agent c wants to access some infor-mation M in a resource r on a remote host h. This situation can be mod-eled by the configuration c[ in h.P ] | h[ r [ 〈M〉 | Q ] ] . As a result of c ex-ercising the capability in h, the system evolves into the new configurationh[ a[ P ] | r [ 〈M〉 | Q ] ] . Now how can the client access the resource? Afirst solution is that the r enters c and once there it is opened; but it seemsstrange that in order to access a resource an agent must dissolve it. A secondsolution is that the client enters the resource and then it is opened; but it iseven stranger that in order to access a resource an agent has in some sense tocommit a suicide. The only reasonable solution is then that the resource andthe client use some protocol relying on exchanges of some temporary agents;but in that case it becomes difficult to determine whether it is c that accessesr or vice-versa.Static or dynamic analysis of incoming code are often advocated as solu-tions to the above problem but these solutions may not be always possible,or feasible, in practice. This is not meant to dismiss the role of static anal-ysis. To the contrary, it should be taken as a motivation to seek new designprinciples enabling a more effective use of static analysis. One such principlefor Mobile Ambients, which leaded to the definition of Boxed Ambients isthat resource access should not rely on some kind of protocol but instead bealready accounted for at the level of communication primitives.3. Boxed Ambients: overview and main resultsBoxed Ambients result from Cardelli and Gordon’s Mobile Ambients essen-tially by dropping the open capability while retaining the in and out capabili-2Castagna et al.ties for mobility. Disallowing open represents a rather drastic departure fromthe Ambient Calculus, and requires new primitives for process communication.As in the Ambient Calculus, processes in the new calculus communicatevia anonymous channels, inside ambients. This is a formal parsimony thatsimplifies the definition of the new calculus while not involving any loss ofexpressive power: in fact, named communication channels can be coded infaithful ways using the existing primitives. In addition, to compensate for theabsence of open, Boxed Ambients are equipped with primitives for communi-cation across ambient boundaries, between parent and children. Syntactically,this is obtained by means of tags specifying the location where the commu-nication has to take place: for instance, (x)nP indicates an input from childambient n, while 〈M〉↑ is an output to the parent ambient.The choice of these primitives, and the resulting model of communica-tion is inspired to Castagna and Vitek’s Seal Calculus [7], from which BoxedAmbients also inherit the two principles of mediation and locality. Media-tion implies that remote communication, i.e., between sibling ambients, is notpossible: it either requires mobility, or intervention by the ambients’ parent.Locality means that communication resources are local to ambients, and mes-sage exchanges result from explicit read and write requests on those resources.To exemplify, consider the following nested configuration:n[ (x)pP | p[ 〈M〉 | (x)Q | q[ 〈N〉↑ ] ] ]Ambient n makes a downward request to read p’s local value M , while am-bient q makes an upward write request to communicate its value N to itsparent. The downward input request (x)pP may only synchronize with theoutput 〈M〉 local to p. Instead, (x)Q may non-deterministically synchronizewith either output: of course, type safety requires that M and N be of thesame type. Interestingly, however, exchanges of different types may take placewithin the same ambient without type confusion:n[ (x)pP | (x)qQ | p[ 〈M〉 ] | q[ 〈N〉 ] ]The two values M and N are local to p and q, respectively, and may very wellhave different types: there is no risk of type confusion, as (x)pP requests aread from p, while (x)qQ requests a read from q.The ressource access case of previous section can thus be handled by thedefinition in the host h of a monitor process R that manages the accesses tothe ressource (for example h[ a[ P ] | !((x)r〈x〉a) | r [ Q ] ] where !((x)r〈x〉a)is the monitor process).This flexibility of communication results from the combination of two de-sign choices: directed input/output operations, and resource locality. In fact,these choices have other interesting consequences.• They provide the calculus with fine-grained primitives for ambient interac-tion, and with clear notions of resource ownership and access request. Basedon that, Boxed Ambients enable a rather direct formalization of classicalsecurity policies for resource protection and access control: this is not easy(if at all possible) with Mobile Ambients (see [3]).3Castagna et al.• They ease the design of type systems providing precise accounts of ambientbehavior. As we show in [2], a rather simple structure of types suffices forthat purpose. Ambient and process types are defined simply as two-placeconstructors describing the types of exchanges that may take place locally,and with the enclosing context. Interestingly, this simple type structureis all that is needed to give a full account of ambient interaction. Thisis a consequence of (i) there being no way for ambients to communicatedirectly across more than one boundary, and (ii) communication being theonly means for ambient to interact. Based on that, the typing of BoxedAmbients provides for more flexibility of communication and mobility thanexisting type systems for Mobile Ambients.• Finally, resource locality and directed input/output provide new insight intothe relation between the synchronous and asynchronous models of commu-nication. Specifically, the classic π-calculus relations between synchronousand asynchronous output, as stated by Boudol in [1], no longer hold as aresult of combining remote communications, resource locality and mobility.More precisely asynchronous output may no longer be viewed as a specialcase of synchronous output with null continuation, neither can it be en-coded by structural equivalence, by stipulating that 〈M〉P ≡ 〈M〉 | P . Aswe show in [2] these two solutions, which are equivalent in the π-calculus,have rather different consequences in Boxed Ambients.4. Boxed Ambients and Information FlowIn [3] we describe in detail how it is possible to modify the Boxed Ambienttype system in order to use for enforcing classic mandatory access control(MAC) security policies. However it is well know that such policies are notenough to ensure the absence of insecure information flows. They can ensurethat a subject will never be allowed to access (either directly or indirectly)the resources it has not the right to access, but they cannot ensure that thesubject will not get hold of the information stored in these resources. Aclassical example ish[ . . . | (x:bool)(if x then t [ ] else f [ ] ) | c[ . . . ] ]Even though c does not perform an access to the local channel of h it candetermine its value by testing (e.g., by exercising an in capability) the presenceof the t or f ambient: the value of x flowed from h to c.In order to determine the presence of such flows one relies on some notionof process equivalence to state a non-interference property. The rough idea isto partition agents (and resources) into top-secret and low-secret classes, anddefine as secure every system in which the behavior of top-secret processesdoes not “interfere” with the behavior of low secret ones, in the sense that thebehavior of the latter does not depend on that of the former.This needs the definition of some behavioral equivalence on processes.While the presence of the full-fledged communication primitives of [2] is in-4Castagna et al.teresting in dealing with MAC policies (as it naturally renders the completepalette of access modes), the definition of behavioral equivalences is greatlysimplified by a reduced number of possible interaction. Moreover a tightercontrol on parent-child communication offers better guarantees of the absenceof implicit information flows. Therefore we modify the semantics of BoxedAmbients on the lines of the shared channel semantics of [5] and allow onlytwo (instead of four) non-local basic interactions, described by the followingreduction rules:(input n) (x)nP | n[ 〈M〉↑Q | R ] ➞ P{x := M} | n[ Q | R ](output n) 〈M〉nP | n[ (x)↑Q | R ] ➞ P | n[ Q{x := M} | R ]We then establish the convention to consider the former as a read access ton and the latter as a write access to n. This corresponds to the the view ofan ambient as having two channels: a private channel which is only availablefor local exchanges, and an “upward channel” which the ambient offers to itsenclosing context for read and write access.Based on this intuition, one then may try to adapt to our framework thedefinition of non-interference first introduced in Goguen and Meseguer’s sem-inal paper [6]. In that paper non-interference was defined as the property thatthe output of low-secret subjects did not depend on the input of top-secretsubjects. In our framework subjects are ambients and their output is easilyidentifiable with upward communications (being the calculus synchronous thesole observation of the output actions may not suffice). So to study non-interference it is reasonable to use as barbs the actions of upward commu-nication, to define equivalence in terms of weak barbed congruence (weak,as it does not matter “how long” to produce the ouput takes) and define as“interference free” any process whose behavior is insensitive to operations ontop-secret names.References[1] G. Boudol. Asynchrony and the π-calculus. Research Report 1702, INRIA,http://www-sop.inria.fr/mimosa/personnel/Gerard.Boudol.html, 1992.[2] M. Bugliesi, G. Castagna, and S. Crafa. Boxed ambients. In TACS 2001, number2215 in LNCS, pages 38–63, Sendai, Japan, 2001. Springer.[3] M. Bugliesi, G. Castagna, and S. Crafa. Reasoning about security in mobileambients. In CONCUR 2001 , number 2154 in LNCS, pages 102–120, 2001.Springer.[4] L. Cardelli and A. Gordon. Mobile ambients. In Proceedings of POPL ’98. ACMPress, 1998.[5] G. Castagna, G. Ghelli, and F. Zappa. Typing mobility in the Seal Calculus. InCONCUR 2001 , number 2154 in LNCS, pages 82–101, 2001. Springer.5Castagna et al.[6] J.A. Goguen and J. Meseguer. Security policy and security models. InProceedings of Symposium on Secrecy and Privacy, pages 11–20. IEEE ComputerSociety, 1982.[7] J. Vitek and G. Castagna. Seal: A framework for secure mobile computations. InInternet Programming Languages, number 1686 in LNCS, pages 47–77. Springer,1999.6

An overview of Boxed Ambients (Abstract)

https://www.openaccessrepository.it/record/41676/files/fulltext.pdf

An overview of Boxed Ambients (Abstract)

Abstract

Similar works

Full text

Available Versions

Open Access Repository