1. ICFP 19991 Principals in Programming Languages: A Syntactic Proof Technique Steve Zdancewic Dan Grossman and Greg Morrisett Cornell University

2. ICFP 19992 Type Abstraction Long history of study –Strachey 1967, Reynolds 1974, 1983, Mitchell & Plotkin 1988,... Reasoning about Programs –Type safety –System Design –Extensible Systems

3. ICFP 19993 Principals One way to characterize principals is by their "view" of the environment. Resources Available –Memory –Security Privileges –Type Information(this talk)

4. ICFP 19994 Types and Principals (* File handle *) abstype fh open : string fh read : fh char Host Client type fh = int fun open s =... val h = open"file"... API

5. ICFP 19995 Safety Properties Client cant create file handles: –Must call open to obtain file handles File handles are abstract: –No client ever performs [ handle + 3 ] –Host can return any integer as handle The read function is applied only to host- provided values

6. ICFP 19996 Polymorphic Encoding fh. host: { open: string fh, read: fh char }. )

7. ICFP 19997 Operational Models Needed Parametric Polymorphism Recursive Types References & State Control Operators Threads Objects...

8. ICFP 19998 The Goal Track and enforce type abstractions in an operational semantics. (Proofs in style of Wright & Felleisen 1992)

9. ICFP 19999 Linking Host and Client fh. host: { open: string fh, read: fh char }. ) int

10. ICFP 199910 Evaluation fh. host: { open: string fh, read: fh char }. ) int host: { open: string int, read: int char }. { int / fh })

11. ICFP 199911 Evaluation host: { open: string int, read: int char }. [ int / fh ]) { int / fh }{ / host }

12. ICFP 199912 An Observation No mention of fh No distinction between client and host { int / fh }{ / host }

13. ICFP 199913 Our Solution Make principals explicit in the syntax: Color client code blue Color host code red Typecheck with different rules: – Host knows fh = int Track colors during evaluation

14. ICFP 199914 Syntax fh | int | |... C x | n | x C | (C C) | [H] H x | n | x H | (H H) | [C] Ø | [x: ] | [x: ]

15. ICFP 199915 Client Operational Semantics [ x H] x H x x [n] int n [n] fh

16. ICFP 199916 Host Operational Semantics [ n fh ] int n e e' [e] [e']

17. ICFP 199917 handle int hr(handle) fh char [3] fh

18. ICFP 199918 handle int hr(handle) fh char [3] fh handle fh hr( handle int ) char [3] fh

19. ICFP 199919 handle int hr(handle) fh char [3] fh handle fh hr( handle int ) char [3] fh hr( [3] fh int ) char

20. ICFP 199920 handle int hr(handle) fh char [3] fh handle fh hr( handle int ) char [3] fh hr( [3] fh int ) char hr( 3 ) char

21. ICFP 199921 handle int hr(handle) fh char [3] fh handle fh hr( handle int ) char [3] fh hr( [3] fh int ) char hr( 3 ) char A char

22. ICFP 199922 handle int hr(handle) fh char [3] fh handle fh hr( handle int ) char [3] fh hr( [3] fh int ) char hr( 3 ) char A char A

23. ICFP 199923 Static Semantics C] int / fh C H int / fh H]

24. ICFP 199924 Theorems Soundness proved by standard Subject Reduction and Progress lemmas. Erasure property: Embeddings and colors dont affect evaluation.

25. ICFP 199925 Independence of Evaluation If C is host-free and h fh C is of type fh int then: ( h fh C) [n] fh m iff ( h fh C) [n'] fh m

26. ICFP 199926 File Handles Come From Open Suppose ( open string fh C) is well-typed and C is host-free. If ( open string fh C) [ s string ho(s) ] string fh steps to C' containing [n] fh as a subterm, then n was derived from a sequence of the form: ho ( s ) n

27. ICFP 199927 The General Setting Multiple principals Many abstract types Products, Sums, Recursive Types, and References Proofs follow standard techniques

28. ICFP 199928 Related Work Language Based Security (Smith & Volpano '97, Heintze & Riecke '98, Myers '99) Principals (Nielson & Nielson '92, Leroy & Rouaix '98) Other Parametricity Results (Abadi, Cardelli & Curien '93, Crary '99, Pierce & Sangiorgi '99)

29. ICFP 199929 Summary Principals are a useful conceptual framework. Operational approach to proving type abstraction properties

30. ICFP 199930 Host Operational Semantics [ n fh ] int n [ x C] x int / fh C x x