Access control types for agents Rohit Chadha and Matthew Hennessy - - PowerPoint PPT Presentation

Access control types for agents

Rohit Chadha and Matthew Hennessy University of Sussex

Access control types for agents – p.1/20

Overview: an agent calculus

We consider an extension of

• calculus

It has two named entities

Channels used for communication Agents use channels to communicate

Channels are the resources in this calculus Types are used to control access to the channels

The type of a channel names the agents that can access the channel

Access control types for agents – p.2/20

Syntax

A system has a two-level structure

At the lower level, there are extended

• processes

At the higher level, there are agents running

threads

At the level of processes, we add a primitive for sender authentication

The process

inputs

along the channel

and

is bound to the name of the sender The details of the authentication are abstracted away

A typical system looks like

and

are agents which share the name

is executing the thread

and

is executing the thread

Access control types for agents – p.3/20

Communication

There are no sites and communication occurs globally There are two types of communication

Standard communication:

Authenticated input:

learns the identity of the sender.

Access control types for agents – p.4/20

Overview: types

Channels are typed as list of input and output capabilities

An input capability

means

can read on the channel An output capability

means

can write on the channel

There is subtyping relation

• n channel

types

A channel type,

is a subtype of

if

is less restrictive than

The type

classifies a name as an agent

Access control types for agents – p.5/20

Capability Types

In capability types,

• r

• ■

,

may be

A normal transmission type

means

can read values of at least type

means

can read values of at most type

An authenticated transmission type

means

can read authenticated values Values read must have at least type

, if

is the sender

means

can write authenticated values Values written must have at most

Access control types for agents – p.6/20

The wild card *

In place of an identifier

, a capability type may also have a special symbol

means anybody can read on the channel

means anybody can write on the channel

Access control types for agents – p.7/20

Type judgements

A type judgement for a system in the agent calculus takes the form

, the type environment, is a list of identifiers

, meaning that

is an agent

, meaning that

is a channel that has capability list

if in the execution of , an agent

in

accesses a channel

in

, only when allowed by

Access control types for agents – p.8/20

Typing values and processes

The typing judgement uses two other judgements A judgement for typing values,

Keeps track of access For example, if

then

is allowed to input values of type

• n

A judgement for typing process threads,

is allowed by

to perform the possible input/output while executing

Access control types for agents – p.9/20

Type inference for communication

Output on a channel

Input from a channel

Access control types for agents – p.10/20

Authenticated communication

Output on an authenticated channel

Input from an authenticated channel

Access control types for agents – p.11/20

Simple examples

Consider the system

if

is

if

is

Access control types for agents – p.12/20

Simple examples continued...

Consider the system

if

is

If a channel type

lists more elements than

, then it is less restrictive

Access control types for agents – p.13/20

Simple examples continued...

Consider the system

if

is

• r,

is less restrictive than

and

is less restrictive than

Access control types for agents – p.14/20

Handover of capabilities

Consider the system

Let

be

if

is

hands over the capability of writing on b to d

Access control types for agents – p.15/20

Handover of capabilities continued..

In particular,

may be a channel that only

knows at

Consider the system,

Let

be

if

is

Access control types for agents – p.16/20

Handover of capabilities continued..

can demand payment for the capability

gets payment from

, who also sends a return channel

sends back the name

• n

In order for this to work, we can choose

as

;

returns

• n

, allowing only the paying agent to write on the channel

contains

Access control types for agents – p.17/20

Handover of capabilities continued..

The above system can be thought of as a repository of papers

a channel on which a paying agent could request papers For example, in order to get the write permission on

, an agent

can execute the following code

where

is

Access control types for agents – p.18/20

Conclusions

An agent calculus with two named entities, channels and agents The calculus allows for sender authentication A type system that controls of access to channels

The type of a channel explicitly names the agents allowed to access A special type to allow everybody to access the channel A dependent type to model sender authentication

Access control types for agents – p.19/20

Ongoing and future work

A typed modal logic that allows us to specify the desired properties A modal

• calculus with a past operator

Proof techniques to show that systems satisfy these properties Investigate relationship between the logic and types Extensions with sites, delegation, etc..

Access control types for agents – p.20/20