Wide Area Network Programming q x q Pn Knowledge Intruder P1 - - PDF document

Non-Functional Aspects of Wide Area Network Programming

Emilio Tuosto

Ph.D. Thesis Dipartimento di Informatica Universit` a di Pisa

←

• ✁

• pen a
• pen a

κ

→ – p. 1/40

Plan of the talk

←

• ✁

• pen a
• pen a

κ

→ – p. 2/40

Plan of the talk

WAN programming: A short overview

←

• ✁

• pen a
• pen a

κ

→ – p. 2/40

Plan of the talk

WAN programming: A short overview Declarative programming model: Hypergraphs Hypergraphs and Ambient calculus

←

• ✁

• pen a
• pen a

κ

→ – p. 2/40

Plan of the talk

WAN programming: A short overview Declarative programming model: Hypergraphs Hypergraphs and Ambient calculus Programming QoS: Qlaim QoS & Hypergraphs: reasoning on optimal routing

←

• ✁

• pen a
• pen a

κ

→ – p. 2/40

Plan of the talk

WAN programming: A short overview Declarative programming model: Hypergraphs Hypergraphs and Ambient calculus Programming QoS: Qlaim QoS & Hypergraphs: reasoning on optimal routing Hypergraphs and UML specifications

←

• ✁

• pen a
• pen a

κ

→ – p. 2/40

Plan of the talk

WAN programming: A short overview Declarative programming model: Hypergraphs Hypergraphs and Ambient calculus Programming QoS: Qlaim QoS & Hypergraphs: reasoning on optimal routing Hypergraphs and UML specifications Cryptographic protocols: cIP and PL

←

• ✁

• pen a
• pen a

κ

→ – p. 2/40

Plan of the talk

WAN programming: A short overview Declarative programming model: Hypergraphs Hypergraphs and Ambient calculus Programming QoS: Qlaim QoS & Hypergraphs: reasoning on optimal routing Hypergraphs and UML specifications Cryptographic protocols: cIP and PL The Mihda environment

←

• ✁

• pen a
• pen a

κ

→ – p. 2/40

Wide Area Network Programming Issues

Absence of centralised control Administrative domains Interoperability “Mobility” (of resources and computation) Network Awareness Service Level Agreement Security ...

←

• ✁

• pen a
• pen a

κ

→ – p. 3/40

Web Services: A programming metaphor

Applications access services that must be

Published Searched Binded

Services are

“Autonomous” Independent (local choices, independently built) Mobile/stationary “Interconnected”

Security issues: hostile environment

←

• ✁

• pen a
• pen a

κ

→ – p. 4/40

WAN Foundations

π-calculus [MPW92] (very basic wrt WAN)

Klaim [DFP98, DFPV00, BLP02] Ambient [CG00] Dπ [HR98, HR00] Djoin [FG96, FGL+96] Seal [VC98] ...

←

• ✁

• pen a
• pen a

κ

→ – p. 5/40

A Model for Declarative WAN Programming

←

• ✁

• pen a
• pen a

κ

→ – p. 6/40

Hypergraphs Programming model

←

• ✁

• pen a
• pen a

κ

→ – p. 7/40

Hypergraphs Programming model

Client-Server metaphor is not enough: P2P

←

• ✁

• pen a
• pen a

κ

→ – p. 7/40

Hypergraphs Programming model

Client-Server metaphor is not enough: P2P Mobility and dynamic linking of components

←

• ✁

• pen a
• pen a

κ

→ – p. 7/40

Hypergraphs Programming model

Client-Server metaphor is not enough: P2P Mobility and dynamic linking of components Adaptability to different devices (e.g. PDA, laptop, mobile phones...)

←

• ✁

• pen a
• pen a

κ

→ – p. 7/40

Hypergraphs Programming model

Client-Server metaphor is not enough: P2P Mobility and dynamic linking of components Adaptability to different devices (e.g. PDA, laptop, mobile phones...) Location awareness

Applications are location dependent Locations have different features and allow multiple (security) policies ←

• ✁

• pen a
• pen a

κ

→ – p. 7/40

Hypergraphs Programming model

Client-Server metaphor is not enough: P2P Mobility and dynamic linking of components Adaptability to different devices (e.g. PDA, laptop, mobile phones...) Location awareness

Applications are location dependent Locations have different features and allow multiple (security) policies

Independently programmed in a distributed environment

←

• ✁

• pen a
• pen a

κ

→ – p. 7/40

Hypergraphs Programming model

Client-Server metaphor is not enough: P2P Mobility and dynamic linking of components Adaptability to different devices (e.g. PDA, laptop, mobile phones...) Location awareness

Applications are location dependent Locations have different features and allow multiple (security) policies

Independently programmed in a distributed environment Reasoning on space and time

←

• ✁

• pen a
• pen a

κ

→ – p. 7/40

Hypergraphs Programming model2

Graphs for distributed systems [CM83] Edge replacement for graph rewritings [DM87] Edge replacement/distributed constraint solving problem [MR96] Graphs grammars for software architecture styles [HIM00] Synchronised Hyperedge Replacement (SHR) with mobility for name passing calculi [HM01]

←

• ✁

• pen a
• pen a

κ

→ – p. 8/40

Hypergraphs Programming model3

We aim at tackling new non-functional computational phenomena

• f systems using SHR.

The metaphor is

“WAN systems as Hypergraphs” “WAN computations as SHR”

In other words:

Components are represented by hyperedges Systems are bunches of (connected) hyperedges Computing means to rewrite hyperedge... ...according to a synchronisation policy ←

• ✁

• pen a
• pen a

κ

→ – p. 9/40

Hyperedges and Hypergraphs Syntax

A hyperedge generalises edges: It connects more than two nodes L : 3, L(y, z, x),

• y
• x

L

3 1 2

• z

←

• ✁

• pen a
• pen a

κ

→ – p. 10/40

Hyperedges and Hypergraphs Syntax

A hyperedge generalises edges: It connects more than two nodes L : 3, L(y, z, x),

• y
• x

L

3 1 2

• z

G ::= nil

• ν y.G
• L(

x)

• G|G

←

• ✁

• pen a
• pen a

κ

→ – p. 10/40

Hyperedges and Hypergraphs Syntax

A hyperedge generalises edges: It connects more than two nodes L : 3, L(y, z, x),

• y
• x

L

3 1 2

• z

G ::= nil

• ν y.G
• L(

x)

• G|G

Syntactic Judgement

Γ ⊢ G, fn(G) ⊆ Γ ←

• ✁

• pen a
• pen a

κ

→ – p. 10/40

Hyperedges and Hypergraphs Syntax

A hyperedge generalises edges: It connects more than two nodes L : 3, L(y, z, x),

• y
• x

L

3 1 2

• z

G ::= nil

• ν y.G
• L(

x)

• G|G

Syntactic Judgement

Γ ⊢ G, fn(G) ⊆ Γ

An example:

L : 3, M : 2 x, y ⊢ ν z.(L(y, z, x)|M(y, z)) ←

• ✁

• pen a
• pen a

κ

→ – p. 10/40

Hyperedges and Hypergraphs Syntax

A hyperedge generalises edges: It connects more than two nodes L : 3, L(y, z, x),

• y
• x

L

3 1 2

• z

G ::= nil

• ν y.G
• L(

x)

• G|G

Syntactic Judgement

Γ ⊢ G, fn(G) ⊆ Γ

An example:

L : 3, M : 2 x, y ⊢ ν z.(L(y, z, x)|M(y, z))

• y

L

• M
• x
• z

←

• ✁

• pen a
• pen a

κ

→ – p. 10/40

Replacement of Hyperedges

L → G ←

• ✁

• pen a
• pen a

κ

→ – p. 11/40

Replacement of Hyperedges

L → G

• ✁

G1

5 4 2 1

G

L 3

G2’

G2

←

• pen a
• pen a

κ

→ – p. 11/40

Replacement of Hyperedges

L → G

• ✁

G2’ G1 G

L 5 4 2 1 3

←

• pen a
• pen a

κ

→ – p. 11/40

Replacement of Hyperedges

L → G

• ✁

G2’ G1 G

L 5 4 2 1 3

Edge replacement: local Synchronisation as distributed constraint solving New node creation Node fusion: mobility model

←

• pen a
• pen a

κ

→ – p. 11/40

Replacement of Hyperedges

L → G

• ✁

G2’ G1 G

L 5 4 2 1 3

Edge replacement: local Synchronisation as distributed constraint solving New node creation Node fusion: mobility model Benefi ts: Powerful model of system composition (π, π-I, fusion) LTS for Ambient ... ...and for Klaim and path reservation for Qlaim

←

• pen a
• pen a

κ

→ – p. 11/40

Hypergraph Semantics: Productions

x1, . . . , xn

• X

⊢ L(x1, . . . , xn)

Λ

− − → π> Γ ⊢ G, Λ ⊆ X × Act × N ∗ set of constraints π : X → X fusion substitution, i.e. ∀xi, xj ∈ X.π(xi) = xj ⇒ π(xj) = xj Γ = π(X) ∪ (n(Λ) \ X) fn(G) ⊆ Γ ←

• ✁

• pen a
• pen a

κ

→ – p. 12/40

Hypergraph Semantics: Transitions Γ1 ⊢ G1

Λ

− → π> Γ2 ⊢ G2

←

• ✁

• pen a
• pen a

κ

→ – p. 13/40

Hypergraph Semantics: Transitions

Γ, y ⊢ G

Λ

−→ π> Γ′ ⊢ G′ Λ(y) ↑ x ≃π y ⇒ y = π(y) ρ = [π(x)/π(y)] Γ ⊢ [x/y]G

ρΛ

− − − − − − → (π; ρ)−y > n(ρΛ) ∪ (π; ρ)−y(Γ) ⊢ ρG′ Γ, y ⊢ G

Λ∪{(x,a, v),(y,a, w)}

− − − − − − − − − − − − − → π > Γ′ ⊢ G′ x ≃π y ⇒ y = π(y) ρ = mgu{[[x/y]

w/[x/y] v], [π(x)/π(y)]}

Γ′′ = n(ρΛ) ∪ (π; ρ)−y(Γ) U = ρ(Γ′) \ Γ′′ Γ ⊢ [x/y]G

(ρΛ∪(x,τ,))

− − − − − − − − − → (π; ρ)−y > Γ′′ ⊢ ν U.ρG′

←

• ✁

• pen a
• pen a

κ

→ – p. 14/40

Hypergraph Semantics: Transitions

Γ, y ⊢ G

Λ

−→ π> Γ′ ⊢ G′ Λ(y) ↑ ∨Λ(y) = (τ, ) x ≃π y ⇒ y = π(y) U = Γ′ \ (n(Λ) ∪ π−y(Γ)) Γ ⊢ ν y.G

Λ\(y,τ,)

− − − − − − − → π−y > n(Λ) ∪ π−y(Γ) ⊢ ν U.G′ Γ1 ⊢ G1

Λ

−→ π> Γ2 ⊢ G2 Γ′

1 ⊢ G′ 1 Λ′

− − → π′> Γ′

2 ⊢ G′ 2

Γ1 ∩ Γ′

1 = ∅

Γ1 ∪ Γ′

1 ⊢ G1 | G′ 1 Λ∪Λ′

− − − − → π ∪ π′ > Γ2 ∪ Γ′

2 ⊢ G2 | G′ 2

←

• ✁

• pen a
• pen a

κ

→ – p. 15/40

Applying the Model

Ambient

a[...]|open a → ... ←

• ✁

• pen a
• pen a

κ

→ – p. 16/40

Applying the Model

Ambient

a[...]|open a → ...

Components

a[· · · ]

• x

a

y ,

• pen a

Lopen a

z ←

• ✁

• pen a
• pen a

κ

→ – p. 16/40

Applying the Model

Ambient

a[...]|open a → ...

Components

a[· · · ]

• x

a

y ,

• pen a

Lopen a

z

Productions

• x

a

y

• pen a

[y/x]

• y = x

Lopen a

• pen a

z

• z

←

• ✁

• pen a
• pen a

κ

→ – p. 16/40

Applying the Model: Node Fusion

G a Lopen a a Lopen a

←

• ✁

• pen a
• pen a

κ

→ – p. 17/40

Applying the Model: Node Fusion

G a Lopen a Lopen a a

• pen a
• pen a

←

• ✁

• pen a
• pen a

κ

→ – p. 17/40

Applying the Model: Node Fusion

G a Lopen a Lopen a a

• pen a
• pen a
• G

u

• y = x

v

• z
• G

v = u ←

• ✁

• pen a
• pen a

κ

→ – p. 17/40

Graphs and Ambient

[ [ nil ] ]x = x ⊢ nil [ [ n[P] ] ]x = x ⊢ ν y.(G | n(y, x)), if y = x ∧ [ [ P ] ]y = y ⊢ G [ [ M.P ] ]x = x ⊢ LM.P(x) [ [ P1|P2 ] ]x = x ⊢ G1 | G2, if [ [ Pi ] ]x = x ⊢ Gi ∧ i = 1, 2 [ [ rec X. P ] ]x = [ [ P[rec X. P/X] ] ]x

Ambient Graphs

                

• n1
• · · ·

nh

• LM1.P1
• · · · LMk.Pk
• · · ·
• G1
• Gh
• Theorem [

[ _ ] ]_ is a bijection on ambient graphs ←

• ✁

• pen a
• pen a

κ

→ – p. 18/40

Coordination Productions for Ambient

(input1) x, y ⊢ b(x, y)

{(x,in a,),(y,input a,z)}

− − − − − − − − − − − − − − − − → > x, y, z ⊢ b(x, z)

• y
• x

in a

b

y

input a,z

• x

b

• z

(input2) x, y ⊢ a(x, y)

{(y,input a,x)}

− − − − − − − − − − → > x, y ⊢ a(x, y)

• x

a

y

input a,x

• x

a

y ←

• ✁

• pen a
• pen a

κ

→ – p. 19/40

Semantic Correspondence

Theorem If P → Q then [

[ P ] ]x

Λ

− → id > [ [ Q ] ]x and either Λ = ∅

• r Λ = {(x, τ, )}

←

• ✁

• pen a
• pen a

κ

→ – p. 20/40

Semantic Correspondence

Theorem If P → Q then [

[ P ] ]x

Λ

− → id > [ [ Q ] ]x and either Λ = ∅

• r Λ = {(x, τ, )}

Theorem If [

[ P ] ]x

Λ

− → π> Γ ⊢ G is a basic transition, then either [ [ P ] ]x = Γ ⊢ G

• r ∃Q ∈ Proc :

P → Q ∧ Γ ⊢ G = [ [ Q ] ]x ←

• ✁

• pen a
• pen a

κ

→ – p. 20/40

Klaim [DFP98]

←

• ✁

• pen a
• pen a

κ

→ – p. 21/40

Klaim [DFP98]

Multiple TS

←

• ✁

• pen a
• pen a

κ

→ – p. 21/40

Klaim [DFP98]

Multiple TS Localities: first class citizens

←

• ✁

• pen a
• pen a

κ

→ – p. 21/40

Klaim [DFP98]

Multiple TS Localities: first class citizens Process migration

←

• ✁

• pen a
• pen a

κ

→ – p. 21/40

Klaim [DFP98]

Multiple TS Localities: first class citizens Process migration

site s’ site s a(t)@s’ eval(P’)@s’ P’ R P Q Q’ R’

←

• ✁

• pen a
• pen a

κ

→ – p. 21/40

Klaim [DFP98]

Multiple TS Localities: first class citizens Process migration

site s’ site s eval(P’)@s’ P’ R’ P R Q Q’ a(t)@s’

←

• ✁

• pen a
• pen a

κ

→ – p. 21/40

Klaim [DFP98]

Multiple TS Localities: first class citizens Process migration

site s’ site s eval(P’)@s’ R’ Q R Q’ a(t)@s’ P’ P

P ::= nil | α.P | P1 | P2 α ::= a@s a ::=

... // Klaim actions

| eval(P)

←

• ✁

• pen a
• pen a

κ

→ – p. 21/40

Qlaim: Gateways

In [BLP02]

←

• ✁

• pen a
• pen a

κ

→ – p. 22/40

Qlaim: Gateways

In [BLP02] Coordinators (super processes)

←

• ✁

• pen a
• pen a

κ

→ – p. 22/40

Qlaim: Gateways

In [BLP02] Coordinators (super processes) Dynamic creation of sites

←

• ✁

• pen a
• pen a

κ

→ – p. 22/40

Qlaim: Gateways

In [BLP02] Coordinators (super processes) Dynamic creation of sites Gateway connection management

←

• ✁

• pen a
• pen a

κ

→ – p. 22/40

Qlaim: Gateways

In [BLP02] Coordinators (super processes) Dynamic creation of sites Gateway connection management

Q’ R’ |P’ site s’ site s R Q P |P

←

• ✁

• pen a
• pen a

κ

→ – p. 22/40

Qlaim: Gateways

In [BLP02] Coordinators (super processes) Dynamic creation of sites Gateway connection management

site s’ site s R’ |P’ Q’ |P Q P R new(s’,|P’)

←

• ✁

• pen a
• pen a

κ

→ – p. 22/40

Qlaim: Gateways

In [BLP02] Coordinators (super processes) Dynamic creation of sites Gateway connection management

site s’ site s R’ R Q |P P |P’ Q’

←

• ✁

• pen a
• pen a

κ

→ – p. 22/40

Qlaim: Gateways

In [BLP02] Coordinators (super processes) Dynamic creation of sites Gateway connection management

site s’ site s R’ |P’ Q’ Q |P P R κ

P ::= γ.P | P1 | P2 γ ::= α | new(s, P) | login(s, κ) | accept(s, κ) | logout(s, κ) | disconnect(s, κ)

←

• ✁

• pen a
• pen a

κ

→ – p. 22/40

Connection costs

Cost κ abstracts characteristics of connections (bandwidth, latency, distance, access rights ...)

←

• ✁

• pen a
• pen a

κ

→ – p. 23/40

Connection costs

Cost κ abstracts characteristics of connections (bandwidth, latency, distance, access rights ...) Algebra on costs: c-semiring. For instance

c1, π1 ⊕ c2, π2 = c1 + c2, π1 ∪ π2 c1, π1 ⊗ c2, π2 =

• c1 + c2, π1 ∩ π2

if c2 < c1 and π2 ⊂ π1

⊥

• therwise

←

• ✁

• pen a
• pen a

κ

→ – p. 23/40

Qlaim & Hypergraphs

[ [ s ::L, P ] ] = Γ ⊢ (ν x, p)([ [ P ] ]p | Ss

m,n(

u, x, p) |

n

• j=1

G

κj tj (xj, vj)) ζ ζ ζ G G ..... ..... ..... ..... ..... ..... G G P

←

• ✁

• pen a
• pen a

κ

→ – p. 24/40

Qlaim & Hypergraphs

[ [ s ::L, P ] ] = Γ ⊢ (ν x, p)([ [ P ] ]p | Ss

m,n(

u, x, p) |

n

• j=1

G

κj tj (xj, vj)) ζ ζ ζ G G ..... ..... ..... ..... ..... ..... G G P

[ [ nil ] ]p = nil [ [ outt ] ]p = Loutt(p) [ [ γ.P ] ]p = Lγ.P (p) [ [ eval(P)@s ] ]p = (ν u)(evalT (P )

s

(u, p) | SP (u)) [ [ P1 | P2 ] ]p = [ [ P1 ] ]p | [ [ P2 ] ]p [ [ rec X. P ] ]p = [ [ P[rec X. P /X] ] ]p.

←

• ✁

• pen a
• pen a

κ

→ – p. 24/40

Qlaim’s Graph semantics: pros & cons

←

• ✁

• pen a
• pen a

κ

→ – p. 25/40

Qlaim’s Graph semantics: pros & cons

– Many productions (recently reduced :-)

←

• ✁

• pen a
• pen a

κ

→ – p. 25/40

Qlaim’s Graph semantics: pros & cons

– Many productions (recently reduced :-) + Determines the “optimal” path (also Qlaim)

←

• ✁

• pen a
• pen a

κ

→ – p. 25/40

Qlaim’s Graph semantics: pros & cons

– Many productions (recently reduced :-) + Determines the “optimal” path (also Qlaim) + Path reservation

←

• ✁

• pen a
• pen a

κ

→ – p. 25/40

Qlaim’s Graph semantics: pros & cons

– Many productions (recently reduced :-) + Determines the “optimal” path (also Qlaim) + Path reservation + Path routing

←

• ✁

• pen a
• pen a

κ

→ – p. 25/40

Qlaim’s Graph semantics: pros & cons

– Many productions (recently reduced :-) + Determines the “optimal” path (also Qlaim) + Path reservation + Path routing

Theorem Qlaim remote actions are routed on paths with minimal cost

(wrt the c-semiring operations) ←

• ✁

• pen a
• pen a

κ

→ – p. 25/40

Hypergraph & Software Design

In [KGKK02] graph transformation is used for modelling dynamic behaviour of UML specifications. + Formal semantics of computations – No local rewritings – Distribution is not considered SHR has been applied as a further refinement step in the software design process.

←

• ✁

• pen a
• pen a

κ

→ – p. 26/40

Security

←

• ✁

• pen a
• pen a

κ

→ – p. 27/40

The Dolev-Yao Model

Intruder Knowledge

P1 Pn

←

• ✁

• pen a
• pen a

κ

→ – p. 28/40

The Dolev-Yao Model

Intruder Knowledge

P1 Pn

Receive and store any transmitted message Hinder a message Decompose messages into parts Forge messages using known data Perfect Encryption Hypothesis

←

• ✁

• pen a
• pen a

κ

→ – p. 28/40

The Dolev-Yao Model

Intruder Knowledge

P1 Pn

Receive and store any transmitted message Hinder a message Decompose messages into parts Forge messages using known data Perfect Encryption Hypothesis Names

n, m, ..., A, B, S, ...

Keys

k, k′, ..., A+, A−, ...

Messages

M ::= N | K | M, M | {M}M ←

• ✁

• pen a
• pen a

κ

→ – p. 28/40

Intruder capabilities: ⋊ ⋉

m ∈ κ (∈) κ ⋊ ⋉ m κ ⋊ ⋉ m κ ⋊ ⋉ n (, ) κ ⋊ ⋉ m, n κ ⋊ ⋉ m κ ⋊ ⋉ λ ({}) κ ⋊ ⋉ {m}λ κ ⋊ ⋉ m, n (+1) κ ⋊ ⋉ m κ ⋊ ⋉ m, n (+2) κ ⋊ ⋉ n κ ⋊ ⋉ {m}λ κ ⋊ ⋉ λ− (}{) κ ⋊ ⋉ m

Generalising [CJM98] to asymmetric key cryptography

Theorem ⋊

⋉ is decidable

←

• ✁

• pen a
• pen a

κ

→ – p. 29/40

A Calculus of Principals

Some design choices:

Cryptography & communication (pattern-matching) Key-sharing via “name fusion” Rôle based calculus Multi-session facilities

←

• ✁

• pen a
• pen a

κ

→ – p. 30/40

Syntax of cIP

Extension of IP [BBT01]

E, F ::= nil | α.E | E + E | E|E α, β ::= in(d) | out(d) d ::= N | K | d, d | {d}d | x | ?x

1.A → B : {na, A}B+ 2.B → A : {na, nb}A+ 3.A → B : {nb}B+ A

△

=(y)[

• ut({na, A}y+).

in({na, ?u}A−).

• ut({u}y+)]

B

△

=()[ in({?x, ?z}B−).

• ut({x, nb}z+).

in({nb}B−)]

←

• ✁

• pen a
• pen a

κ

→ – p. 31/40

cIP Semantics

α.E

α

− → E E

α

− → E′ E + F

α

− → E′ E

α

− → E′ bn(α) ∩ fn(F) = ∅ E | | F

α

− → E′ | | F Ei

in(d)

− − → E′

i

∂(κ) ⊲ m : ∃σ ground s.t. dσ ∼ m ( ˜ Xi)[Ei] ∪ C, χ, κ → ( ˜ Xi)[E′

iσ] ∪ C, χσ, κ

Ei

• ut(m)

− − − → E′

i

( ˜ Xi)[Ei] ∪ C, χ, κ → ( ˜ Xi)[E′

i] ∪ C, χ, κ ∪ m

C′ = join(Ai, γ, C) A

△

=( ˜ X)[E] i new C, χ, κ → C′, χγ, κ ∪ {Ai}

←

• ✁

• pen a
• pen a

κ

→ – p. 32/40

PL: Formalising Security Properties

φ, ψ ::= δ ∈ K | ∀α : A.φ | x@α = δ | α = β | | ¬φ | φ ∧ ψ δ ::= d | α | x@α

κ | =χ φ

“If B completes a protocol session and thinks that he has been talking to A, then A had started a protocol session thinking that she has been talking to B”

∀β : B.∃α : A.(z@β = α → y@α = β) ←

• ✁

• pen a
• pen a

κ

→ – p. 33/40

Mihda: Co-Algebraic Minimisation of Automata

←

• ✁

• pen a
• pen a

κ

→ – p. 34/40

Mihda

Minimizing History Dependent Automata: HD-automata for history dependent calculi Co-algebraic specification Partition Refinement Algorithm based on co-algebraic specification [FMP02]

Mihda: Ocaml implementation

• Comp. Time

States Trans.

• Min. Time

States Trans. GSM small 0m 0.931s 211 398 0m 4.193s 105 197 GSM full 0m 8.186s 964 1778 0m 54.690s 137 253

←

• ✁

• pen a
• pen a

κ

→ – p. 35/40

Mihda Architecture

Bundle Block States Labels Transitions Automaton Domination

Adherent to specs Highly modular Easily extendible

←

• ✁

• pen a
• pen a

κ

→ – p. 36/40

The main step

x

q

q θ

x q q BIN x q2;s [*/y] x y s IN q BIN x s [*/y] q3;s3 Tau q3 q2 Tau s3 x

←

• ✁

• pen a
• pen a

κ

→ – p. 37/40

The main step

x

q1 q2 q3 q1 q2 q3 q x y I N σ x BIN σ [*/y] Tau σ3 BIN x q2;s [*/y] qq Tau q3;s3 q2 q3 x x x

let bundle hd q = List.sort compare (List.fi lter ( fun h → (Arrow.source h) = q) (arrows hd)) ←

• ✁

• pen a
• pen a

κ

→ – p. 37/40

The main step

x

q1 q2 q3 q1 q2 q3

x

q x y I N σ x BIN σ [*/y] Tau σ3

x

qq Tau q3;s3 BIN q2;s [*/y] q2 q3 x x

List.map hn bundle ←

• ✁

• pen a
• pen a

κ

→ – p. 37/40

The main step

x

x

q1 q2 q3 q1 q2 q3 Tau σ3

x x

q x y I N σ x BIN x BIN σ [*/y] Tau θ3;σ3 θ2 θ3 θ2;σ [*/y]

hn+1 = normstates, {ℓ, π, hn(q′), σ′; σ|q

ℓ π σ

− → q′ ∧ σ′ ∈ Σn(q′)} let red bl = ...... let bl_in = List.fi lter covered_in bl in list_diff bl bl_in ←

• ✁

• pen a
• pen a

κ

→ – p. 37/40

The main step

x

x

q1 q2 q3 q1 q2 q3 Tau σ3

x x

q

θ q x y I N σ x BIN x BIN σ [*/y] Tau θ3;σ3 θ2 θ3 θ2;σ [*/y]

let an = active_names_bundle (red bundle) in let remove_in ar = match ar with | Arrow(_,_,In(_,_)) → not (List.mem (obj ar) an) | _ → false in list_diff bundle (List.filter remove_in bundle)

←

• ✁

• pen a
• pen a

κ

→ – p. 37/40

The main step

x

x

q1 q2 q3 q1 q2 q3 Tau σ3

x x

q

θ q x y I N σ x BIN x BIN σ [*/y] Tau θ3;σ3 θ2 θ3 θ2;σ [*/y]

Σn+1(q) = (compute_group (norm bundle)) ; θ−1

q

←

• ✁

• pen a
• pen a

κ

→ – p. 37/40

The main step

x

x

q1 q2 q3 q1 q2 q3 Tau σ3

x x

q

θ q x y I N σ x BIN x BIN σ [*/y] Tau θ3;σ3 θ2 θ3 θ2;σ [*/y]

Σn+1(q) = (compute_group (norm bundle)) ; θ−1

q

Theorem At the end of each iteration i blocks corresponds to hHi

←

• ✁

• pen a
• pen a

κ

→ – p. 37/40

Mihda Web Interface

http://jordie.di.unipi.it:8080/pweb ←

• ✁

• pen a
• pen a

κ

→ – p. 38/40

Summing up...

Initial steps toward: Declarative approach to WAN programming Foundational aspects QoS at application level Software Architectures (to be developed) Web Services Secure composition of components Coordination mechanism Tool development Distributed infrastructure Proof strategies as programmable coordinators

←

• ✁

• pen a
• pen a

κ

→ – p. 39/40

Published papers

Ferrari, G., Pugliese, R., Tuosto, E. Calculi for Network Aware Programming. Workshop on agents 2000: Dagli oggetti agli agenti Ferrari, G., Montanari, U., Tuosto, E. LTS Semantics of Ambients via Graph Synchronization with Mobility. In 7th Italian Conference on Theoretical Computer Science – ICTCS’01, volume 2202 of LNCS. Springer, 2001 Bracciali, A., Brogi, A., Ferrari, G., Tuosto, E.. Security Issues in Component Based Design, In ConCoord Workshop 2001, Lipari - Italy Bracciali, A., Brogi, A., Ferrari, G., Tuosto, E., Security and Dynamic Compositions of Open Systems. In International conference of Parallel and Distributed Processing Techniques and Applications, F . Arbarb et al. Editors, PDPTA 2002 Ferrari, G., Montanari, U., Tuosto, E. Graph-based Models of Internetworking

• Systems. In Formal Methods at the Crossroads: from Panaces to Foundational

Support, A. Haeberer editor, LNCS. Springer, 2003

←

• ✁

• pen a
• pen a

κ

→ – p. 40/40

References

[BBT01] Andrea Bracciali, Antonio Brogi, and Franco Turini. Coordinating interaction patterns. In Proceedings

• f the ACM Symposium on Applied Computing, Las

Vegas, USA. ACM, 2001. [BC99] Boumediene Bal, Henri E. Belkhouche and Luca Cardelli, editors. Workshop on Internet Program- ming Languages, volume 1686 of LNCS. Springer, 1999. [BLP02] Lorenzo Bettini, Michele Loreti, and Rosario Pugliese. Infrastructure language for open nets. In Proc. of the 2002 ACM Symposium on Applied Computing (SAC’02), Special Track on Coordina- tion Models, Languages and Applications. ACM Press, 2002. Special Track on Coordination Mod- els, Languages and Applications. [CG00] Luca Cardelli and Andrew D. Gordon. Mobile am-

• bients. TCS: Theoretical Computer Science, 240,

2000. [CJM98] Edmund M. Clarke, Somesh Jha, and Wilfredo R.

• Marrero. Using state space exploration and a nat-

ural deduction style message derivation engine to 40-1

verify security protocols. In IFIP Working Con- ference on Programming Concepts and Methods (PROCOMET), 1998. [CM83] Ilaria Castellani and Ugo Montanari. Graph Gram- mars for Distributed Systems. In Hartmut Ehrig, Manfred Nagl, and Grzegorz Rozenberg, editors,

• Proc. 2nd Int. Workshop on Graph-Grammars and

Their Application to Computer Science, volume 153

• f Lecture Notes in Computer Science, pages 20–
• 38. Springer-Verlag, 1983.

[DFP98] Rocco De Nicola, Gianluigi Ferrari, and Rosario

• Pugliese. KLAIM: A kernel language for agents in-

teraction and mobility. IEEE Transactions on Soft- ware Engineering, 24(5):315–330, 1998. [DFPV00] Rocco De Nicola, Gianluigi Ferrari, Rosario Pugliese, and Betti Venneri. Types for access con- trol. Theoretical Computer Science, 240(1):215– 254, June 2000. [DM87] Pierpaolo Degano and Ugo Montanari. A model of distributed systems based of graph rewriting. Jour- nal of the ACM, 34:411–449, 1987. 40-2

[FG96] Cedric Fournet and George Gonthier. The reflex- ive CHAM and the join-calculus. In Conference Record of POPL ’96: The 23rd ACM SIGPLAN- SIGACT Symposium on Principles of Programming Languages, pages 372–385, St. Petersburg Beach, Florida, January 1996. [FGL+96] Cedric Fournet, Georges Gonthier, Jean-Jacques L´ evy, Luc Maranget, and Didier R´

• emy. A calculus of

mobile processes. In Ugo Montanari and Vladimiro Sassone, editors, CONCUR ’96: Concurrency The-

• ry, 7th International Conference, volume 1119 of

Lecture Notes in Computer Science, pages 406– 421, Pisa, Italy, August 1996. Springer-Verlag. [FMP02] Gianluigi Ferrari, Ugo Montanari, and Marco Pis-

• tore. Minimizing transition systems for name pass-

ing calculi: A co-algebraic formulation. In Mo- gens Nielsen and Uffe Engberg, editors, FOS- SACS 2002, volume LNCS 2303, pages 129–143. Springer Verlag, 2002. [HIM00] Dan Hirsch, Paola Inverardi, and Ugo Montanari. Reconfi guration of Software Architecture Styles with Name Mobility. In Antonio Porto and Gruia- Catalin Roman, editors, Coordination 2000, volume 40-3

1906 of LNCS, pages 148–163. Springer Verlag, 2000. [HM01] Dan Hirsch and Ugo Montanari. Synchronized hy- peredge replacement with name mobility: A graph- ical calculus for name mobility. In 12th Interna- tional Conference in Concurrency Theory (CON- CUR 2001), volume 2154 of LNCS, pages 121– 136, Aalborg, Denmark, 2001. Springer Verlag. [HR98] Mattew Hennessy and James Riely. Resource access control in systems of mobile agents. In Uwe Nestmann and Benjamin C. Pierce, editors, HLCL ’98: High-Level Concurrent Languages (Nice, France, September 12, 1998), volume 16.3 of entcs, pages 3–17. Elsevier Science Publishers,

• 1998. Full version as CogSci Report 2/98, Univer-

sity of Sussex, Brighton. [HR00] Matthew Hennessy and James Riely. Informa- tion flow vs. resource access in the asynchronous pi-calculus. In 27th International Colloquium on Automata, Languages and Programming (ICALP ’2000), July 2000. A longer version appeared as Computer Science Technical Report 2000:03, 40-4

School of Cognitive and Computing Sciences, Uni- versity of Sussex. [KGKK02] Sabine Kuske, Martin Gogolla, Ralf Kollmann, and Hans-J¨

• rg Kreowski. An Integrated Semantics for

UML Class, Object, and State Diagrams based on Graph Transformation. In Michael Butler and Kaisa Sere, editors, 3rd Int. Conf. Integrated Formal Meth-

• ds (IFM’02), LNCS. Springer, Berlin, 2002.

[MPW92] Robin Milner, Joachim Parrow, and David Walker. A calculus of mobile processes, I and II. Information and Computation, 100(1):1–40,41–77, September 1992. [MR96] Ugo Montanari and Francesca Rossi. Graph rewrit- ing and constraint solving for modelling distributed systems with synchronization. In P . Ciancarini and

• C. Hankin, editors, Proceedings of the First Inter-

national Conference COORDINATION ’96, Cesena, Italy, volume 1061 of LNCS. Springer Verlag, April 1996. [VC98] Jan Vitek and Giuseppe Castagna. Towards a cal- culus of secure mobile computations. In [BC99], Chicago, Illinois, May 1998. 40-5