Typing access control and secure information flow in sessions

Abstract

We consider a calculus for multiparty sessions with delegation, enriched with security levels for session participants and data. We propose a type system that guarantees both session safety and a form of access control. Moreover, this type system ensures secure information flow, including controlled forms of declassification. In particular, it prevents information leaks due to the specific control constructs of the calculus, such as session opening, selection, branching and delegation. We illustrate the use of our type system with a number of examples, which reveal an interesting interplay between the constraints of security type systems and those used in session types to ensure properties like communication safety and session fidelity.

Relating Process Languages for Security and Communication Correctness (Extended Abstract)

“…The work in [6] is similar in spirit to ours, but is different in conception and details, as it uses a session graph specification to generate a cryptographic functional implementation that enjoys session integrity. Extensions of session types (e.g., [4,16]) address security issues in various ways, but do not directly support cryptographic operations, global state, nor connections with "applied" languages for (automated) verification, which are all enabled by our approach.…”

“…We also plan to connect our approach with existing type systems for secure information flow and access control in multiparty sessions [4].…”

Discretionary Information Flow Control for Interaction-Oriented Specifications

“…A first work worth mentioning is [7], which presents an approach for dealing with non-interference properties in distributed systems where components interact within multiparty sessions. Systems are described with a session calculus featuring, among others, session creation, inter-session interaction, and session delegation.…”

“…A second difference lies in the specification languages used; our choreography description language differs from the calculi used in the above mentioned works. It would not be trivial, for instance, to integrate our type system with the type system of [7] as both focus on related but significantly different languages and properties. We would also like to remark that our work is still in a preliminary phase and does not yet consider aspects of choreography realizability, local projections and systems with multiple-sessions.…”

Self-Adaptation and Secure Information Flow in Multiparty Structured Communications: A Unified Perspective

“…It uses a rather natural structural equivalence ≡ which erases monitored processes with end monitor and commutes independent messages (with different senders or different receivers) in queues [4]. Table 4: LTS of processes.…”