Abstraction Preservation and Secure Sessions in Distributed - PowerPoint PPT Presentation

Abstraction Preservation and Secure Sessions in Distributed Languages PhD defense of Pierre-Malo Deniélou MOSCOVA Project (INRIA) MSR-INRIA Joint Centre Advisors: Jean-Jacques Lévy and James Leifer 25/01/2009 Pierre-Malo.Denielou@inria.fr http://moscova.inria.fr/~denielou/these/ Pierre-Malo Deniélou (PhD Defense) 1 / 23

Distributed systems Alice Bob A distributed system Independent programs that realise a global task through network interactions Charlie Pierre-Malo Deniélou (PhD Defense) 2 / 23

Distributed systems Alice Bob A distributed system Independent programs that realise a global task through network interactions They need to agree on data semantics Misunderstanding on protocols Miscommunication Charlie Pierre-Malo Deniélou (PhD Defense) 2 / 23

Distributed systems Alice Bob A distributed system Independent programs that realise a global task through network interactions They need to agree on data semantics Misunderstanding on protocols Miscommunication Charlie Pierre-Malo Deniélou (PhD Defense) 2 / 23

Distributed systems Al... Capone Bob A distributed system Independent programs that realise a global task through network interactions There is little trust They need to agree Errors (Safety) on data semantics Typing system Misunderstanding Corruption (Security) on protocols Cryptographic protocol Miscommunication Charlie Pierre-Malo Deniélou (PhD Defense) 2 / 23

Distributed systems Alice Bob A distributed system Independent programs that realise a global task through network interactions There is little trust They need to agree Errors (Safety) on data semantics Typing system Misunderstanding Corruption (Security) on protocols Cryptographic protocol Miscommunication Charlie Pierre-Malo Deniélou (PhD Defense) 2 / 23

Distributed systems Alice Bob A distributed system Independent programs that realise a global task through network interactions There is little trust They need to agree Errors (Safety) on data semantics Typing system Misunderstanding Corruption (Security) on protocols Cryptographic protocol Miscommunication Charlie Pierre-Malo Deniélou (PhD Defense) 2 / 23

Improving Distributed Programming Different from sequential programming Independent programs need to cooperate: safety . Complicated interactive software: easier to generate/prove than to program/debug. No control over the execution environment (peers, network): security . Pierre-Malo Deniélou (PhD Defense) 3 / 23

Improving Distributed Programming Different from sequential programming Independent programs need to cooperate: safety . Complicated interactive software: easier to generate/prove than to program/debug. No control over the execution environment (peers, network): security . Most existing tools are not well-suited Compilers and type systems are local. Security and networking libraries are low-level, binary. Pierre-Malo Deniélou (PhD Defense) 3 / 23

Improving Distributed Programming Different from sequential programming Independent programs need to cooperate: safety . Complicated interactive software: easier to generate/prove than to program/debug. No control over the execution environment (peers, network): security . Most existing tools are not well-suited Compilers and type systems are local. Security and networking libraries are low-level, binary. Contribution I: Abstract Type Safety How to enforce local semantics in a distributed environment Pierre-Malo Deniélou (PhD Defense) 3 / 23

Improving Distributed Programming Different from sequential programming Independent programs need to cooperate: safety . Complicated interactive software: easier to generate/prove than to program/debug. No control over the execution environment (peers, network): security . Most existing tools are not well-suited Compilers and type systems are local. Security and networking libraries are low-level, binary. Contribution I: Abstract Type Safety Contribution II: Session Security How to secure a distributed execution How to enforce local semantics in despite compromised parties a distributed environment Pierre-Malo Deniélou (PhD Defense) 3 / 23

Improving Distributed Programming Different from sequential programming Independent programs need to cooperate: safety . Complicated interactive software: easier to generate/prove than to program/debug. No control over the execution environment (peers, network): security . Most existing tools are not well-suited Compilers and type systems are local. Security and networking libraries are low-level, binary. Contribution I: Abstract Type Safety Contribution II: Session Security How to secure a distributed execution How to enforce local semantics in despite compromised parties a distributed environment Computer science = Engineering ∩ Mathematics industrial objects: prototyping logical objects: mathematical definition experiments and measures: theorems and proofs: experimental method formal method Pierre-Malo Deniélou (PhD Defense) 3 / 23

Part I Abstraction preservation and subtyping Pierre-Malo Deniélou (PhD Defense) 4 / 23

Abstract type preservation Alice’s counter Bob’s counter module Counter = module Counter = struct sig struct sig type t = int type t type t = int type t let init = 0 : val init : t let init = 0 : val init : t let incr x = x+1 val incr : t → t let incr x = x+1 val incr : t → t let decr x = x-1 val decr : t → t let value x = x val value : t → int let value x = x val value : t → int end end end end Alice ↔ Bob 0 : Counter.t 1. Alice sends Counter.init Bob − − − − − − − − → Pierre-Malo Deniélou (PhD Defense) 5 / 23

Abstract type preservation Alice’s counter Bob’s counter module Counter = module Counter = struct sig struct sig type t = int type t type t = int type t let init = 0 : val init : t let init = 0 : val init : t let incr x = x+1 val incr : t → t let incr x = x+1 val incr : t → t let decr x = x-1 val decr : t → t let value x = x val value : t → int let value x = x val value : t → int end end end end Alice ↔ Bob 0 : Counter.t 1. Alice sends Counter.init Bob − − − − − − − − → Pierre-Malo Deniélou (PhD Defense) 5 / 23

Abstract type preservation Alice’s counter Bob’s counter module Counter = module Counter = struct sig struct sig type t = int type t type t = int type t let init = 0 : val init : t let init = 0 : val init : t let incr x = x+1 val incr : t → t let incr x = x+1 val incr : t → t let decr x = x-1 val decr : t → t let value x = x val value : t → int let value x = x val value : t → int end end end end Alice ↔ Bob 0 : Counter.t 1. Alice sends Counter.init Bob − − − − − − − − → 2. Bob applies Counter.decr Pierre-Malo Deniélou (PhD Defense) 5 / 23

Abstract type preservation Alice’s counter Bob’s counter module Counter = module Counter = struct sig struct sig type t = int type t type t = int type t let init = 0 : val init : t let init = 0 : val init : t let incr x = x+1 val incr : t → t let incr x = x+1 val incr : t → t let decr x = x-1 val decr : t → t let value x = x val value : t → int let value x = x val value : t → int end end end end Alice ↔ Bob 0 : Counter.t 1. Alice sends Counter.init Bob − − − − − − − − → 2. Bob applies Counter.decr − 1 : Counter.t 3. Alice Bob sends the result ← − − − − − − − − − Pierre-Malo Deniélou (PhD Defense) 5 / 23

Abstract type preservation Alice’s counter Bob’s counter module Counter = module Counter = struct sig struct sig type t = int type t type t = int type t let init = 0 : val init : t let init = 0 : val init : t let incr x = x+1 val incr : t → t let incr x = x+1 val incr : t → t let decr x = x-1 val decr : t → t let value x = x val value : t → int let value x = x val value : t → int end end end end Alice ↔ Bob 0 : Counter.t 1. Alice sends Counter.init Bob − − − − − − − − → 2. Bob applies Counter.decr − 1 : Counter.t 3. Alice Bob sends the result ← − − − − − − − − − 4. Alice applies Counter.value Pierre-Malo Deniélou (PhD Defense) 5 / 23

Abstract type preservation Alice’s counter Bob’s counter module Counter = module Counter = struct sig struct sig type t = int type t type t = int type t let init = 0 : val init : t let init = 0 : val init : t let incr x = x+1 val incr : t → t let incr x = x+1 val incr : t → t let decr x = x-1 val decr : t → t let value x = x val value : t → int let value x = x val value : t → int end end end end Alice ↔ Bob 0 : Counter.t 1. Alice sends Counter.init Bob − − − − − − − − → 2. Bob applies Counter.decr − 1 : Counter.t 3. Alice Bob sends the result ← − − − − − − − − − 4. Alice applies Counter.value 5. Alice fails! (broken invariant) Pierre-Malo Deniélou (PhD Defense) 5 / 23