Monitoring Networks through Multiparty Session Types

Abstract

In large-scale distributed infrastructures, applications are realised through communications among distributed components. The need for methods for assuring safe interactions in such environments is recognised, however the existing frameworks, relying on centralised verification or restricted specification methods, have limited applicability. This paper proposes a new theory of monitored π -calculus with dynamic usage of multiparty session types (MPST), offering a rigorous foundation for safety assurance of distributed components which asynchronously communicate through multiparty sessions. Our theory establishes a framework for semantically precise decentralised run-time enforcement and provides reasoning principles over monitored distributed applications, which complement existing static analysis techniques. We introduce asynchrony through the means of explicit routers and global queues, and propose novel equivalences between networks, that capture the notion of interface equivalence, i.e. equating networks offering the same services to a user. We illustrate our static-dynamic analysis system with an ATM protocol as a running example and justify our theory with results: satisfaction equivalence, local/global safety and transparency, and session fidelity.

Verifying Asynchronous Interactions via Communicating Session Automata

“…By (3) and the fact that ∆ Ď ∆ 1 and N Ď N 1 , we must have π ǫ p ppN, s, ∆qq « π ǫ p ppN 1 , s, ∆ 1 qq which is clearly a contradiction with (4) and (5). Corollary 1.…”

“…Communicating automata and asynchronous multiparty session types [29] are closely related: the latter can be seen as a syntactical representation of the former [17] where a sending state corresponds to an internal choice and a receiving state to an external choice. This correspondence between communicating automata and multiparty session types has become the foundation of many tools centred on session types, e.g., for generating communication API from multiparty session (global) types [31,32,48,62], for detecting deadlocks in message-passing programs [51,68], and for monitoring session-enabled programs [5,16,47,49,50]. These tools rely on a property called multiparty compatibility [6,18,40], which guarantees that communicating automata representing session types interact correctly, hence enabling the identification of correct protocols or the detection of errors in endpoint programs.…”

Taming Concurrency for Verification Using Multiparty Session Types

“…The copies of processes in Case 10 increase the size of the resulting SGP-process-in comparison to the original system-only with respect to conditionals that do not implement a choice between different labels of a sender or with respect to actors that are in their next step not influenced by the outcome of this conditional as in the type. However, we observe that in this case the duplication of the behaviour of the actors s [3] and s [4] is already visible in the type. So, if conditionals are used only to guide the choice between labels of an immediately following send-action, then again the corresponding increase of the size of the system in the algorithm is bounded by the size of the global types.…”

“…Rule Get checks whether the process receives if its local type requires this, the roles of the process and the local type match, and each branch P i with the variablesx i :Ũ i behaves as specified by T i . Note that in contrast to e. g. [1,4,3,8,9] we allow that receivers implement unnecessary branches, to allow types to follow the reductions of the system and to deal with branches already ruled out by a former step. However, since the sender is checked as well, the type system ensures that only branches that are specified by the type can happen.…”

Self-Adaptation and Secure Information Flow in Multiparty Structured Communications: A Unified Perspective

“…Our model, like [6]-but unlike other session calculi [9,10,2,7]-uses processes that do not specify their partners in communication actions. It is the associated monitor which determines the partner in a given communication.…”