Secure Implementations for Typed Session Abstractions

Abstract

Distributed applications can be structured as parties that exchange messages according to some pre-arranged communication patterns. These sessions (or contracts, or protocols) simplify distributed programming: when coding a role for a given session, each party just has to follow the intended message flow, under the assumption that the other parties are also compliant.In an adversarial setting, remote parties may not be trusted to play their role. Hence, defensive implementations also have to monitor one another, in order to detect any deviation from the assigned roles of a session. This task involves low-level coding below session abstractions, thus giving up most of their benefits.We explore language-based support for sessions. We extend the ML language with session types that express flows of messages between roles, such that well-typed programs always play their roles. We compile session type declarations to cryptographic communication protocols that can shield programs from any low-level attempt by coalitions of remote peers to deviate from their roles. Our main result is that, when reasoning about programs that use our session implementation, one can safely assume that all session peers comply with their roles-without trusting their remote implementations. Session types for distributed programmingProgramming networked, independent systems is complex, because the programmer has little control over the runtime environment. To simplify his task, programming languages and system libraries offer abstractions for common communication patterns (such as private channels or RPCs), with automated support to help the programmer use these abstractions reliably and to relieve him from their lowlevel implementation details (such as message format and routing). As an example, web services promote declarative types and policies for messaging, with tools that can automatically fetch these declarations and set up proxies with a simple typed programming interface.From a security perspective, when parts of the system and some of the remote parties are not trusted, communication abstractions can be especially effective: relying on cryptographic protocols, implementations of these abstractions can sometimes entirely shield programmers from low-level attacks (such as message interception and rewriting) [1,2]. However, this is seldom the case in practice, as security concerns force the programmer to understand lowlevel protocol issues.Beyond simple abstractions for communications, distributed applications can often be structured as parties that exchange messages according to some fixed, pre-arranged patterns. These sessions (also named contracts, or workflows, or protocols) simplify distributed programming by specifying the behaviour of each network entity, or role. By agreeing on a common session specification, the parties can resolve most of the complexity upfront. Then, when coding a role for a given session, each party just has to follow the message flow for this role, under the assumption that the other parties are al...

Relating Process Languages for Security and Communication Correctness (Extended Abstract)

“…the survey [2]) seems to have proceeded independently from approaches such as those overviewed in [7]. The work in [6] is similar in spirit to ours, but is different in conception and details, as it uses a session graph specification to generate a cryptographic functional implementation that enjoys session integrity. Extensions of session types (e.g., [4,16]) address security issues in various ways, but do not directly support cryptographic operations, global state, nor connections with "applied" languages for (automated) verification, which are all enabled by our approach.…”

On Progress for Structured Communications

“…Since our typing system uses standard types, it can be easily integrated with subtyping [10], bounded session polymorphism [9] and correspondence assertions [2], guaranteeing the progress through the additional information represented by the sets of sent and bound channels and the channel relations. Challenging extensions are progress guarantees for choreographic (global) communication dependencies [5], combining more powerful means such as cryptography [3,7], refinements [20] and logical approach [4], by which more advanced security properties can be ensured.…”

Secrecy and Authenticity Types for Secure Distributed Messaging

“…The analysis of distributed systems built upon secure channel abstractions has been subject of active research in the recent literature, based on various formalisms: model checking [3], CSP-style traces specifications [12], Strand spaces [16], inductive verification [4] and process calculi [2,11].…”