Foundations of Global Computing A Personal Perspective (talk)

(1)

Foundations of Global Computing

A Personal Perspective

Vladimiro Sassone

(2)

Foundations of Global Computing

Resource Control

Programming Languages

Semantic Theories

Models for Concurrency

Global Ubiquitous Computing:

computation over a global network of

mobile, bounded resources shared among mobile entities which move between highly dynamic, largely unknown, untrusted

networks.

Difficulties:

Extreme dynamic reconfigurability; lack of coordination and trust; limited capabilities; partial knowledge . . .

Issues:

(3)

Foundations of Global Computing

Resource Control

Semantic Theories

Petri Nets Based Models and Calculi

A

distributed timed-arc Petri net

(_DTAPN) is a Petri net together with

➤ a _{interval time constraint} on transitions, either _discrete or _continuous;

➤ a _{clock synchronisation equivalence} _Σ on places.

Tokens age, and transitions are enabled accordingly. Time elapses at the same speed on p and p0 if p _Σ p0.

Globally Asynchronous, Locally Synchronous

(4)

Foundations of Global Computing

Resource Control

Semantic Theories

➤ A categorical machinery which allows the

derivation

of

LTS

s from

reduction systems

. ➤

_Bisimulation

on such LTSs is a

congruence

,

provided a general condition is met.

Coinduction Principle Desiderata:

➤ _{Operational Corresp.:} p & q iff p τ I _q

➤ _Correctness: p ≈ q implies p q

➤ _{Completeness:} p q implies p ≈ q

The intuition:

a C I _b _iff C_[_a_] _& _b

Eg:

(5)

Foundations of Global Computing

Resource Control

Semantic Theories

➤ A categorical machinery which allows the

derivation

of

LTS

s from

reduction systems

. ➤

_Bisimulation

on such LTSs is a

congruence

,

provided a general condition is met.

Coinduction Principle Desiderata:

➤ _{Operational Corresp.:} _p & q iff p τ I _q

➤ _Correctness: _p ≈ q implies p q

➤ _{Completeness:} p q implies p ≈ q

The intuition:

a C I _b _iff C_[_a_] _& _b

(6)

Foundations of Global Computing

Resource Control

Semantic Theories

Jeeg:

concurrent OO with _{history-sensitive} access control ➤

_Java

(no _{synchronized()}, _wait(), _notify(), _notifyAll()) for

business code;

➤

_{Linear Time Temporal Logic}

for _{synchronisation} code (method guards).

public class _MyClass {

sync {

m : φ; .... }

...// Standard Java class def }

where m is a method identifier and φ, the

guard

, is an

LTL

formula. When m is invoked, the thread is

kept on

hold

unless φ. When the condition is true, all

waiting

threads are

awaken

. m is implicitly

synchronised

.

(7)

Foundations of Global Computing

Resource Control

Semantic Theories

Resources: Models, Types, Logics, Languages

➤

_{Access Control}

_{(Concur 2002, ESOP 2004)}

➤

_{Access Authorisation}

_{(FST&TCS 2002, Info&Co)}

➤

_{Secrecy for Mobile Agents}

_{(ICALP 2003)}

(8)

Mobile Ambients

Both administrative domains and computational environments

➤

_{Subjective movements}

n[ in m.P | Q ] | m[ R ] −→ m[ n[ P | Q ] | R ]

m[ n[ out m.P | Q ] | R ] −→ n[ P | Q ] | m[ R ]

➤

_{Boundary dissolver}

open n.P | n[ Q ] −→ P | Q.

➤

_{Process interaction}

(9)

Group Types for Mobility

Aim:

Resource Access Control

➤ Detect and prevent _{unwanted access} to resources.

➤ Focus on _static approaches based on enforcing type disciplines.

Groups:

Sets of processes with common access rights.

Constraints like k : _CanEnter(n) are modelled as:

n belongs to group G

k may cross the border of ambients of group G.

For instance, the system:

k[inn | l[outk] ] | n[ ]

is

well-typed

under assumptions of the form:

k : _amb[K,_cross(N)]

(10)

Group Types for Mobility

Aim:

Resource Access Control

➤ Detect and prevent _{unwanted access} to resources.

➤ Focus on _static approaches based on enforcing type disciplines.

Groups:

Sets of processes with common access rights. Constraints like k : _CanEnter(n) are modelled as:

n belongs to group G

k may cross the border of ambients of group G.

For instance, the system:

k[inn | l[outk] ] | n[ ]

is

well-typed

under assumptions of the form:

(11)

Indirect Border Crossing

Trojan Horses:

The system

Odysseus[in_Horse.out_Horse.Destroy ] | _Horse[in_Troy ] | _Troy[_Trojans]

is well-typed under assumptions:

Odysseus : _amb[Achaean,_cross(Toy)] Horse : _amb[Toy,_cross(City)]

Troy : _amb[City, ]

However

, the system may evolve to

Troy[ _Trojans | _Horse[ ] | _Odysseus[ _Destroy ] ]

(12)

Indirect Border Crossing

Trojan Horses:

The system

is well-typed under assumptions:

Odysseus : _amb[Achaean,_cross(Toy)] Horse : _amb[Toy,_cross(City)]

Troy : _amb[City, ]

However

, the system may evolve to

Troy[ _Trojans | _Horse[ ] | _Odysseus[ _Destroy ] ]

(13)

Types

Groups:

G,H, . . .

Sets of groups:

P_,S _{, . . .} U _{The universal set of groups}

Ambients types:

A ::₌ _amb[G, M] _{amb of group} G,_{with mobility type} M

Process types:

Π ::₌ _proc[G, M] _{process that can be enclosed in an ambient of group} G,

may drive to ambients whose groups are in M

Capability types:

K ::₌ _cap[G, M] _{capability that can appear in an ambient of group} G,

may drive it to ambients whose groups are in M

Mobility types:

(14)

Access Control Properties

Mobility properties:

➤ If _Γ ` n[inm.P | Q] | m[R] : _Π, then

Γ ` m : _amb[M, ] and _Γ ` n : _amb[ ,_mob[P_]]

with M ∈ P_.

➤ If _Γ ` m[n[outm.P | Q ] | R] : _Π, then

Γ ` m : _amb[M,_mob[P_m_]] _and _Γ _` _n _: _amb_[_N_,_mob_[P_n_]]

(15)

Detecting Odysseus’ intentions

Now, in order to assign a type to

we need assumptions of the form:

Odysseus : _amb[Achaean,_mob[{Ground,Toy,City}]]

Horse : _amb[Toy,_mob[{Ground,City}]]

Troy : _amb[City, ]

representing that _Odysseus is an Achaean intentioned to move into a City! On the other hand, under assumptions of the form

Odysseus : _amb[Achaean,_mob[{Ground,Toy}]]

(16)

Detecting Odysseus’ intentions

Now, in order to assign a type to

we need assumptions of the form:

Odysseus : _amb[Achaean,_mob[{Ground,Toy,City}]]

Horse : _amb[Toy,_mob[{Ground,City}]]

Troy : _amb[City, ]

representing that _Odysseus is an Achaean intentioned to move into a City!

On the other hand, under assumptions of the form

Odysseus : _amb[Achaean,_mob[{Ground,Toy}]]

(17)

Dependent Types for Access Control

Dependent Mobility Types:

(P _and C _{are sets of names, not groups}_.)

A ::₌ _amb[hasFathers(P₎_,_hasChildren₍C_)]

Dependent types

allow personalised services and dynamic access control.

HorseServer , _!(_x₎₍νHorse : amb[ ,hasChildren{x}])Horse[outTroy.inTroy.0 ]

➤ Names have several possible types, depending on the

actual

communications occurred.

(18)

Dependent Types for Access Control

Dependent Mobility Types:

Dependent types

HorseServer , _!(_x₎₍νHorse : amb[ ,hasChildren{x}])Horse[outTroy.inTroy.0 ] ➤ Names have several possible types, depending on the

actual

(19)

Dependent Types for Access Control

Dependent Mobility Types:

Dependent types

HorseServer , _!(_x₎₍νHorse : amb[ ,hasChildren{x}])Horse[outTroy.inTroy.0 ]

➤ Names have several possible types, depending on the

actual

(20)

Secrecy in Mobile Ambients

Names

≈

_Cryptokeys:

Carrying messages inside _private ambients preserves message _integrity and _privacy. Or, does it?

(νn)(a[ n[out a.in b.hMi] ] | b[ open n.(x)P ] ) It actually offers no guarantees for software agents, as n must be revealed along

the move, and servers may peek inside.

How to provide stronger protection?

A new crypto-primitive:

subjective access control using co-capabilities + data encryption to preserve secrecy of data while agents move autonomously

n[ seal k.P | Q] −→ n{| P | Q |}_k sealed under k

crypto-key

Effects:

➤

_blocks

message exchanges and

encrypts

their contents;

(21)

Secrecy in Mobile Ambients

Names

≈

_Cryptokeys:

(νn)(a[ n[out a.in b.hMi] ] | b[ open n.(x)P ] )

It actually offers no guarantees for software agents, as n must be revealed along the move, and servers may peek inside.

How to provide stronger protection?

A new crypto-primitive:

subjective access control using co-capabilities + data

encryption to preserve secrecy of data while agents move autonomously

crypto-key

Effects:

➤

_blocks

encrypts

their contents;

(22)

Secrecy in Mobile Ambients

Names

≈

_Cryptokeys:

(νn)(a[ n[out a.in b.hMi] ] | b[ open n.(x)P ] )

It actually offers no guarantees for software agents, as n must be revealed along the move, and servers may peek inside.

How to provide stronger protection?

A new crypto-primitive:

subjective access control using co-capabilities + data encryption to preserve secrecy of data while agents move autonomously

crypto-key

Effects:

➤

_blocks

encrypts

their contents;

(23)

Sealed Ambients

➤ The mechanism to resume to a fully operational state is associated to movements and co-capabilities containing keys

n{|in m.P | Q |}_k | m{in {x}_k.R | R0 } −→ m{ n[ P | Q ] | R{x :₌ n} | R0 }

Example:

(νk)a[ n[seal k.out a.in b.hMiˆˆ] ] | b[in {x}_k.(y)x.P]

−→ (νk)a[ n{|out a.in b.hMiˆˆ|}_k ] | b[ in {x}_k.(y)x.P]

−→ (νk)a[ ] | n{|in b.hMiˆˆ|}_k | b[in {x}_k.(y)x.P ]

(24)

Sealed Ambients

Example:

(25)

Sealed Ambients

Example:

(26)

Sealed Ambients

Example:

(27)

Sealed Ambients

Example:

(28)

Sealed Ambients

Example:

−→ (νk)a[ ] | b[ n[ hMiˆˆ] | (y)n.P{x := n} ]

Example:

(29)

Sealed Ambients

Example:

(30)

Secrecy and Adversaries

Intuitively:

A process preserves the secrecy of a piece of data M _{if it does not publish} M_{, or}

anything that would permit the computation of M_.

S-Adversary:

A context _A(−) which initially knows names and capabilities in S.

Revealing Names:

P _{may reveal} n to S if there exists an S-adversary A(−) and a name c ∈ S such that:

A(P) ₌⇒ C(c[ hniˆˆ | Q]) (c free )

Typing System:

Secrecy is captured by a type system ` which may classify processes as

untrusted

_Γ ` P : Un, and data as

public

a : Public if it can be exchanged with untrusted process.

Secrecy Theorem:

Well-typed processes do not reveal their secrets publicly. Formally, if Γ ` P : Un and _Γ 0 _s _: _{Public, then} _P _{preserves the secrecy of} _s _{from all public}

(31)

Secrecy and Adversaries

Intuitively:

S-Adversary:

Revealing Names:

Typing System:

Secrecy is captured by a type system ` which may classify

processes as

untrusted

public

Secrecy Theorem:

(32)

Secrecy and Adversaries

Intuitively:

S-Adversary:

Revealing Names:

Typing System:

Secrecy is captured by a type system ` which may classify processes as

untrusted

public

Secrecy Theorem:

(33)

Between Theory and Practice

That’s all good, but . . .

. . . one cannot type the Internet

The gap between theory and practice matters in practice.

All this only works as long as you trust the certified types, or are willing to

typecheck migrating code yourself (

bytecode verification

,

PCC

,. . . ), . . .

➤

_Verification

(relates to type checking/inference)

➤

_Certificates

(groups as certified roles)

➤

_Trust

: In UbiComp,

security

must work be coupled with

trust management

.

(34)

Between Theory and Practice

That’s all good, but . . .

. . . one cannot type the Internet

The gap between theory and practice matters in practice.

bytecode verification

,

PCC

,. . . ), . . . ➤

_Verification

➤

_Certificates

➤

_Trust

: In UbiComp,

security

must work be coupled with

trust management

.

(35)

Between Theory and Practice

That’s all good, but . . .

. . . one cannot type the Internet

The gap between theory and practice matters in practice.

bytecode verification

,

PCC

,. . . ), . . .

➤

_Verification

➤

_Certificates

(36)

Trust Management

Focus on Trust Evolution and Delegation in Dynamic Networks

a{ A }_π

Focus on Trust Evolution and Delegation in Dynamic Networks

a{ A }_π

principal P

agent/behaviour

trust policy: expressions on lattice (D,≤)

Trust Based Services:

a{ b.`hvi. A } | b{ `(x) .Σ_tB_t }_π −→ a{ A } | b{ B_π_(a){x := v} }_π

Trust Evolution:

a{ ζ .A | B }_π −→ a{ A | B }_ζ_(π)

Policies and Expressions:

π ::₌ _pp_q _delegation τ ::₌ t ∈ D _value/var

λx : _P.τ _abstraction π(p) _{policy value}

op(π1, . . . , πn) lattice op e 7→ τ;τ choice

p ::₌ a ∈ P, x : _P _{principal/vars} e ::₌ τ _cmp τ , p _eq p _comparisons

(37)

Trust Management

Focus on Trust Evolution and Delegation in Dynamic Networks

a{ A }_π

principal P

agent/behaviour

Trust Based Services:

Trust Evolution:

a{ ζ .A | B }_π −→ a{ A | B }_ζ_(π)

Policies and Expressions:

op(π₁, . . . , π_n) _{lattice op} e 7→ τ;τ _choice

(38)

Trust Management

Focus on Trust Evolution and Delegation in Dynamic Networks

a{ A }_π

principal P

agent/behaviour

Trust Based Services:

Trust Evolution:

a{ ζ .A | B }_π −→ a{ A | B }_ζ_(π)

Policies and Expressions:

op(π₁, . . . , π_n) _{lattice op} e 7→ τ;τ _choice

(39)

Trust Management

Focus on Trust Evolution and Delegation in Dynamic Networks

a{ A }_π

principal P

agent/behaviour

Trust Based Services:

Trust Evolution:

a{ ζ .A | B }_π −→ a{ A | B }_ζ_(π)

Policies and Expressions:

(40)

Understanding Delegation

Example:

a : p 7→ _trusted; b : p 7→ _pa_q(p);

q 7→ _pb_q(q); q 7→ _untrusted;

z 7→ _pp_q(z); z 7→ _pa_q(z);

Delegation, formally:

Global trust as a _fixpoint.

π : (P → P → D) → (P → D) _{Local Policy}

Ξ : (P → P → D) → (P → P → D) _{Collected Policies}

Global Trust:

fix(_Ξ) : P → P → D. But, is this good enough?

p : _trusted q : _untrusted z : _???

Cannot confuse

don’t trust

with

don’t know

: the value of _pp_q(z) could become available later.

(41)

Understanding Delegation

Example:

z 7→ _pp_q(z); z 7→ _pa_q(z);

Delegation, formally:

Global Trust:

Cannot confuse

don’t trust

with

don’t know

(42)

Understanding Delegation

Example:

z 7→ _pp_q(z); z 7→ _pa_q(z);

Delegation, formally:

Global Trust:

Cannot confuse

don’t trust

with

don’t know

(43)

Trust Structures

(D,≤,v), _where _ _is v _-continous

trust lattice approximation cpo

Thm.

(D,≤,v) yields an _adequate semantics [[−]] : _Policies → _Env → (P → P → D). The trust structure is _derived canonically from (D,≤). The fixpoint is computed with respect to v.

[[π_p₁, . . . , π_p_n]]_σ ₌ fixv(λm.λp.([ πp ])σm)

Ongoing work:

➤ Approximate the fixpoint in the presence of

partial information

.

➤ Use

Kripke

style semantics to capture

trust evolution

in time.

(44)

Dimensions, Capacities, Mobility

Central Notion:

Resource Usage

Focus:

Capacity Bounds Awareness

.

➤ Bounded Capacity Ambients

➤ Fine control of capacity.

➤ Space as a linear co-capability.

a[ inb. P | Q ] | b[ | R ] & | b[ a[ P | Q ] | R ]

move capability

space co-capability

(45)

A Calculus of Bounded Capacities: Movement

Fundamentals: Space Conscious Movement

a[ inb. P | Q ] | b[ | R ] & | b[ a[ P | Q ] | R ]

| b[ a[ outb . P | Q ] | R ] & a[ P | Q ] | b[ | R ]

Example: Travelling needs but consumes no space

.

a[ inb .inc.outc.outb.0 ] | b[ | c[ ] ]

&& | b[ | c[ a[ outc.outb .0 ] ] ]

(46)

A Calculus of Bounded Capacities: Movement

Fundamentals: Space Conscious Movement

a[ inb. P | Q ] | b[ | R ] & | b[ a[ P | Q ] | R ]

| b[ a[ outb . P | Q ] | R ] & a[ P | Q ] | b[ | R ]

Example: Travelling needs but consumes no space

.

a[ inb .inc.outc.outb.0 ] | b[ | c[ ] ]

&& | b[ | c[ a[ outc.outb .0 ] ] ]

(47)

A Calculus of Bounded Capacities: Sizes

Fundamentals: Space Conscious Movement

➤ But the

size

of travellers matters!

ak[ inb . P | Q ] | b[

k times

z }| {

| . . . | | R ] &

ktimes

z }| {

| . . . | | b[ ak[ P | Q ] | R ]

| . . . |

| {z } k times

| b[ ak[ outb . P | Q ] | R ] & ak[ P | Q ] | b[ | . . . |

| {z } k times

| R ]

What is the

a

k

_?

A _{type annotation} measuring the size of P.

Notation.

We use k as a shorthand for

k times z }| {

(48)

A Calculus of Bounded Capacities: Sizes

Fundamentals: Space Conscious Movement

➤ But the

size

of travellers matters!

ak[ inb . P | Q ] | b[

k times

z }| {

| . . . | | R ] &

ktimes

z }| {

| . . . | | b[ ak[ P | Q ] | R ]

| . . . |

| {z } k times

| b[ ak[ outb . P | Q ] | R ] & ak[ P | Q ] | b[ | . . . |

| {z } k times

| R ]

What is the

a

k

_?

A _{type annotation} measuring the size of P.

Notation.

We use k as a shorthand for

k times z }| {

(49)

A Calculus of Bounded Capacities: Spawning

Fundamentals: Space Conscious Process Activation

.kP | k & P

Fundamentals: Space Conscious Process Activation

.kP | k & P

passive process: weighs 0

P _weighs k

Example: Replication

: !k, _!.k

!.kP | k & !.kP | P

(50)

A Calculus of Bounded Capacities: Spawning

Fundamentals: Space Conscious Process Activation

.kP | k & P

P _weighs k

Example: Replication

: !k, _!.k

!.kP | k & !.kP | P

(51)

A Calculus of Bounded Capacities: Spawning

Fundamentals: Space Conscious Process Activation

.kP | k & P

P _weighs k

Example: Replication

: !k, _!.k

!.kP | k & !.kP | P

(52)

A Calculus of Bounded Capacities: Transfer

Fundamentals: Space Acquisition and Release

putˇˇa . P | | ak[ getˆˆ.Q | R ] & P | ak+1[ Q | | R ]

ak+1[ put.P | | S ] | bh[ geta .Q | R ] & ak[ P | S ] | bh+1[ Q | | R ]

Example: A Memory Module

memMod , _mem[ 256MB | !put | !get_free ]

malloc , _m[ !get_mem.free[ outm .getm.put ] | !put ]

memMod | _malloc &256MB _mem[ !put | !get_free ] | _m[ 256MB | . . . ] &2×256MB

(53)

A Calculus of Bounded Capacities: Transfer

Fundamentals: Space Acquisition and Release

Example: A Memory Module

(54)

A Calculus of Bounded Capacities: Transfer

Fundamentals: Space Acquisition and Release

Example: A Memory Module

malloc , _m[ !get_mem.free[ outm .getm.put ] | !put ]

memMod | _malloc &256MB _mem[ !put | !get_free ] | _m[ 256MB | . . . ] &2×256MB

(55)

A System of Capacity Types

Capacity Types:

φ, . . . are pairs of nats [n,N], with n ≤ N.

Effect Types

E, . . . are pairs of nats (d,i), representing _decs and _incs.

Exchange Types

: χ ::₌ _Shh | _Ambhσ, χi | _CaphE, χi

Process

and

Ambient

and

Capability Types

:

a : _Ambhφ, χi a has no less than φ_m and no more than φ_M spaces

P : _Prochk,E, χi P weighs k and produces the effect E on ambients

C : _CaphE, χi C transforms processes adding E to their effects

Thm: Subject Reduction

: _{Well-typed processes preserve space}.

(56)

A System of Capacity Types

Capacity Types:

φ, . . . are pairs of nats [n,N], with n ≤ N.

Effect Types

E, . . . are pairs of nats (d,i), representing _decs and _incs.

Exchange Types

: χ ::₌ _Shh | _Ambhσ, χi | _CaphE, χi

Process

and

Ambient

and

Capability Types

:

a : _Ambhφ, χi a has no less than φ_m and no more than φ_M spaces

P : _Prochk,E, χi P weighs k and produces the effect E on ambients

C : _CaphE, χi C transforms processes adding E to their effects

Thm: Subject Reduction

: _{Well-typed processes preserve space}.

(57)

Future Work

➤

_What:

_{Third-Party Resources: Models, Languages and Techniques}

➤

_{Resource-Aware Computation:}

_{resource bounds negotiation & enforcement} ➤

_{Resource Usage:}

_{calculi & logics for quantitative analysis}

➤

_{Resource Safety:}

_{languages for security & trust policies; general resource logics} ➤

_{Resource Trust:}

_{history-based: theory and infrastructures}

➤

_How:

Integrated approach:

Behavioural

,

Execution

,

Abstract Models

.

➤

_Who:

Communities involved:

➤ _{EU FET Global Computing}

(58)

Future Work

➤

_What:

_{Third-Party Resources: Models, Languages and Techniques}

➤

_{Resource-Aware Computation:}

_{Resource Usage:}

➤

_{Resource Safety:}

_{Resource Trust:}

➤

_How:

Behavioural

,

Execution

,

Abstract Models

. ➤

_Who:

(59)

Future Work

➤

_What:

_{Third-Party Resources: Models, Languages and Techniques}

➤

_{Resource-Aware Computation:}

_{Resource Usage:}

➤

_{Resource Safety:}

_{Resource Trust:}

➤

_How:

Behavioural

,

Execution

,

Abstract Models

.

➤

_Who:

(60)

Contexts as Labels

The intuition:

a C I _b _iff C_[_a_] _& _b

For instance:

a −|a¯ I ₀ _M (λx.−)N I _M_{_N_/_x_} _K_M −N I _M

Yep, but not quite:

➤ _{Too many labels not desirable:}

➤ _{Useless combinatorial explosion:} λx.xx −MN I _MMN

➤ _{Messes up the bisimulation (too coarse):} _l D I D_[_r_] _{for all rules} _l _& _r_.

Choose only ‘minimal’ redex-enabling contexts

➤ _{Case analysis of basic situations:} _Sewell. _{Abstract approach:} _{Leifer-Milner}

(61)

Contexts as Labels

The intuition:

a C I _b _iff C_[_a_] _& _b

For instance:

a −|a¯ I ₀ _M (λx.−)N I _M_{_N_/_x_} _K_M −N I _M

Yep, but not quite:

➤ _{Too many labels not desirable:}

➤ _{Useless combinatorial explosion:} λx.xx −MN I _MMN

➤ _{Messes up the bisimulation (too coarse):} _l D I D_[_r_] _{for all rules} _l _& _r_.

Choose only ‘minimal’ redex-enabling contexts

(62)

A Categorical Approach

Lawvere theory

on _Σ

➤ the natural numbers for objects

➤ a morphism t: m → n, for t a n-tuple of m-holed terms.

➤ Composition is substitution of terms into holes.

E.G.

for _Σ the signature for arithmetics:

➤ term (−₁ × x) ₊ −₂ is an arrow 2 → 1 (two holes yielding one term)

➤ h3,2 × yi is an arrow 0 → 2 (a pair of terms with no holes).

➤ Their composition is the term (3 × x) ₊ (2 × y), an arrow of type 0 → 1. A generalisation from term rewriting systems to categories.

➤ A category C _{with distinguished object} _0.

➤ A set of

reaction rules

R ⊆ S_C∈C C(0,C) × C(0,C).

➤ A set D _{of arrows of} C _{called the}

reactive contexts

_.

Assume that d0 .d1 ∈ D implies d0 and d1 ∈ D.

The

reaction relation

is defined as

a I _b _iff _a ₌ _d _._l_, _b ₌ _d _._r_, _d _∈ D _and _h_l_,_r_{i ∈ R}_.

(63)

A Categorical Approach

Lawvere theory

on _Σ

➤ the natural numbers for objects

➤ a morphism t: m → n, for t a n-tuple of m-holed terms.

➤ Composition is substitution of terms into holes.

A generalisation from term rewriting systems to categories.

➤ A category C _{with distinguished object} _0.

➤ A set of

reaction rules

R ⊆ S_C∈C C(0,C) × C(0,C).

➤ A set D _{of arrows of} C _{called the}

reactive contexts

_.

Assume that d0 .d1 ∈ D implies d0 and d1 ∈ D.

(64)

(G)RPOs

Suppose that C _{is a (bi)category and consider a redex square}

• • c • d • a _l • • c c _• p m •

c00 d00 p0 • d d • a _l

➤ a _{relative pushout} (_RPO) is a tuple hc,d, pi which satisfies the universal property that:

(65)

(G)RPOs

• • c c _• p • d d • a _l

➤ a _{relative pushout} (_RPO) is a tuple hc,d, pi which satisfies the universal property that: • • c c _• p m •

c00 d00 p0 • d d • a _l

(66)

(G)RPOs

•

c

c _•

p

m •

c00 d00 p0

•

d

•

a _l

(67)

Deriving LTS

The LTS

derived

from the reactive system has:

➤

_Nodes:

a : O → N

➤

_Transitions:

a f I _dr _{iff for} _h_l_,_r_{i ∈ R} _and _d _∈ D_, _h_f_,_d_,_id_i _{is a relative}

pushout of the square

•

• f

• d

•

a _l

➤

_Thm.

If all

redex squares

like the above have

(G)RPOs

then the bisimulation on the derived LTS is a

congruence

.

(68)

Deriving LTS

The LTS

derived

from the reactive system has:

➤

_Nodes:

a : O → N

➤

_Transitions:

a f I _dr _{iff for} _h_l_,_r_{i ∈ R} _and _d _∈ D_, _h_f_,_d_,_id_i _{is a relative}

pushout of the square

•

• f

• d

•

a _l

➤

_Thm.

If all

redex squares

like the above have

(G)RPOs

then the bisimulation on the derived LTS is a

congruence

.

(69)

Applying (G)RPOs

➤ _{Milner (2001)} worked out

RPOs

for a graphical formalism called

bigraphs

.

➤ _{Sassone and Sobocinski (2002)} introduced

GRPOs

to handle calculi with

non-trivial structural congruences.

➤ _{Jensen and Milner (2003)} derived (essentially) the usual π labelled bisimulation on asynchronous π using

RPOs

.

➤ _{Sassone and Sobocinski (2003)} worked out an easy encoding of Milner’s

pre-category approach into the

G

-world.

➤ _{Jensen and Milner (2004)} found

(G)RPOs

for

ambient-calculus

and for

weak

bisimulations

.

➤ _{Sassone and Sobocinski (2004)} derived

GRPOs

for generic

graph structures

and

graph rewrite systems

. So far, the price of the initial 2-categorical investment seems

worth

paying. . .

Future Work

➤ Extend to more complicated

process calculi

with complex structural

(70)

Applying (G)RPOs

➤ _{Milner (2001)} worked out

RPOs

for a graphical formalism called

bigraphs

.

➤ _{Sassone and Sobocinski (2002)} introduced

GRPOs

to handle calculi with

non-trivial structural congruences.

➤ _{Jensen and Milner (2003)} derived (essentially) the usual π labelled bisimulation on asynchronous π using

RPOs

.

➤ _{Sassone and Sobocinski (2003)} worked out an easy encoding of Milner’s

pre-category approach into the

G

-world.

➤ _{Jensen and Milner (2004)} found

(G)RPOs

for

ambient-calculus

and for

weak

bisimulations

.

➤ _{Sassone and Sobocinski (2004)} derived

GRPOs

for generic

graph structures

and

graph rewrite systems

.

So far, the price of the initial 2-categorical investment seems

worth

paying. . .

Future Work

➤ Extend to more complicated

process calculi

with complex structural