Preliminaries

Several new concepts need to be introduced before the new system may be presented; these are considered in this section.

First of all, there is a small change to the syntax, to allow the programmer to declare the integrity of processes. This is implemented by attaching an annotation to the null process. See Definition 3.6.2 for the syntax in full.

CHAPTER 3. TRUST TYPE SYSTEMS 67

Definition 3.6.2 (Annotated Higher-Order Syntax)

P ::= 0b | X i∈I πi.Pi |!P|P|P|(νx:σb)P|X |Xh − → Ki |Fh−→Ki |x(V :σi)certify? P⊕P F ::= (−→V :−→σb)P A ::= P |F π ::= x(−→V :−→σb)|x[−→V ]

Definition 3.6.3 (Higher-Order Execution Contexts) Write_Cto rep- resent the context created as part of a deduction. It is a partial function from names/variables to annotations (trust expressions; that is _C⊆ V × BA); the

domain of a context is exactly the free variables of the process in the deduction to which it pertains.

1. As usual, _CV represents the context C with the name or variable V removed from its domain.

2. The construct _CT is the total function derived from _C as:

CT(V) =

C(V) , V ∈domC T , otherwise

3. A context is compatible with another, written _{C1 C2}, if and only if for each name or variable V in the domain of both _C1 and _C2 then C1(V) =C2(V).

4. Contexts may be combined using the ‘,’ operator; this creates the union and is defined if and only if the two are compatible:

(_C1,_C2)(x) =

C1(x) , x∈domC1 C2(x) , x∈domC2

The ‘,’ operator is symmetric and transitive. As with environments (see Section 2.3.1) union with a singleton context will frequently be abbreviated to _C, x : b. Given a sequence −→V = V1. . . Vn, define

− →

V : b as V1 :b . . . Vn:b

5. The operator ⊆ is the precise subset operator:

6. Multiplication on contexts is defined as follows: b·_{C ,} {V :b·_C(V)|V ∈dom_C}

This is extended to sequences of contexts in the logical way; that is b·−→_C =b·_C1. . . b·_Cn if

− →

C =C1. . .Cn.

7. Given an annotation b, a ternary operator on a pair of contexts may be defined as follows (the motivation for this will become apparent later on): (_C1hbiC2)(V) =            b·_C1(V) +b·_C2(V) , if V ∈dom_C1∩domC2 b·_C1(V) +b , if V ∈dom_C1 ∧ V /∈dom_C2 b+b·_C2(V) , if V ∈dom_C2 ∧ V /∈dom_C1

Thehioperator is notsymmetric. It binds tighter than ‘,’ so_C1,_C2hbiC3 is equivalent to _C1,(_C2hbi_C3).

Definition 3.6.4 (External Context) Write _C to represent the interface

to the host system that any process is typed under. It is a finite — possibly empty — set of channels (that is, _C⊆ N). A totally empty external context

corresponds to the situation of a total sandbox; the process under investigation has noavenue of communication with the host system and is thus completely isolated. _C is constant throughout a deduction tree.

Definition 3.6.5 (Annotated Type Syntax) The type syntax must also be extended in a higher-order system, due to the need to differentiate between instantiation to a name and instantiation to a process (Vasconcelos 1993). This is achieved by taking the symbol Proc, formerly just used to denote a well-formed judgement, and admitting it as a type for well-formed processes. Because processes now have an integrity level associated, an annotation is also attached. Abstractions are represented in a manner reminiscent of func- tion types using an arrow, preceded by a possibly-empty sequence of the types of the names and variables abstracted on, enclosed in parentheses. As before, σ ranges over base types.

The new type syntax is:

σ ::= (−→σ)b |Procb |(−→σ)→Procb

Multiplication and related definitions are extended logically to handle process types as well. So, b·((−→σc_{) → Proc}d_{) is interpreted as ((}−→_σc_{) → Proc}bd_{. The}

CHAPTER 3. TRUST TYPE SYSTEMS 69 same convention of usually writing the type with the outmost annotation dis- played is also adopted here; note that the annotation displayed refers to the last part of the term, for example the type (()c)→Procb might be referred to in the discussion as σb _{(not σ}c _{for example).}

Definition 3.6.6 (Sub-Typing) The definition of sub-typing is also ex- tended, although in a limited way. For reasons explained later, sub-typing on processes is not admitted into the system, thus the relation below only includes a reflexive relation on process types. Sub-Typing on channel types remains the same (including the restriction that it only considers the outer- most annotation due to a lack of usage information; see Definition 3.4.3 on page 58 for an overview).

c≤B b

(→σ−d₎b _≤(σ−→d₎c Procb ≤Procb ₍−→_σb_)→Procc _≤(−→_σb_)→Procc

Definition 3.6.7 (Higher-Order Judgements) A type judgement in Sys- tem THOπ≤ usually has one of the forms

Γ `C HO≤ K :σb;C Γ `C (HO≤) P :Proc b ;_C

As before, Γ is the typing environment, K the agent being typed, and σb

the resultant type of the (well-formed) agent under the assumptions Γ. For reasons of convenience that will be elaborated later, the definition is relaxed to allow names to appear on the right-hand side. This is purely for convenience, and the majority of the time this form of judgement will refer to an agent. The second form is only used for guarded, null, and summation processes as usual. The new components are

• `C

HO≤, the new ‘turn-style’ operator which also states under what exter-

nal environment (that is, _C) the agent is being typed; and

• _C, the context of each (free) name in the deduction (see Definition 3.6.3). Note that it is a product of that particular deduction, rather than a set of assumptions, so is written on the right-hand side of the deduction. An additional form of judgement is

Γ`C

HO≤ P :Proc

b

which is identical to the first form, but missing the context information. Only one rule in systemTHOπ≤ has a judgement of this form in the consequent (and

it never appears as an antecedent); it represents the very final deduction of a given process in a given environment, with the contextual information utilised (to calculate the overall trustedness under _C) and hence discarded.

A final form

`HO≤ σb

states that the type σb _{is well-formed under the rules of System T}

HOπ≤.

As before, the vector short-hand will be exploited where useful, such as

− → Γ `C HO≤ − → K :−→σb;−→_C to refer to the possibly-empty sequence of judgements

Γ1 `CHO ≤ K1 :σ1b1;C1. . .Γn`CHO ≤Kn :σbnn;Cn

In addition, subscripts will occasionally be used to refer to range over judge- ments in a sequence, for example ∀Γi,Ci. . . meaning that the statement to

follow should apply to each Γi, Ci pair from the sequence of judgements.