Modelling interfaces in distributed systems: some first steps. David Pym UCL and Alan Turing London

Transcription

1 Modelling interfaces in distributed systems: some first steps David Pym UCL and Alan Turing London

2 Modelling distributed systems: basic concepts Basic concepts of distributed systems the basic architecture Resource: created, consumed, moved by the processes Process: the services that the system provides Situated in Environment: structure not modelled, just events These may be composed of other models of interest, so need seek to employ minimal viable structure Concerned here with prac)cal modelling, with from security policy

3 Modelling distributed systems: basic set- up Topological structure: e.g., directed graphs Resource Combinatorial structure: e.g., monoids, possibly ordered (cf. the logic BI s resource seman@cs, which gives rise to Separa@on Logic) Process Synchronous structure (for modelling purposes): e.g., SCCS + integra@on with resources Environment Stochas@c representa@on: events are incident upon a model system from outside

4 Modelling distributed systems: basic set- up Basic judgement: L, R, E a! L 0,R 0,E 0 Some rules (omipng loca@ons for brevity): µ(a, R) =R 0 R, a : E a! R 0,E R i,e i R, E a! R 0,E 0 S, F b! S 0,F 0 R S, E F ab! R 0 S 0,E 0 F 0 a! R 0 i,e 0 i R 1 R 2,E 1 + E 2 a! R 0 i,e 0 i i =1, 2 A bunch of laws for µ,, and Resource- process equivalence is bisimula@on, wriren ~ Cf. Concurrent Separa@on Logic

5 A (bunched) modal logic ::= p? > _ ^! hai [a] I hai [a] In a given model, a truth- func@onal judgement: R, E = R, E = 1 ^ 2 i R, E = 1 and R, E = 2 R, E = hai i for some R, E a! R 0,E 0, R 0,E 0 = R, E = 1 2 i for some R 1 R 2 = R and E 1 E 2 E, R 1,E 1 = 1 and R 2,E 2 = 2 R, E = hai i for some S, S 0 s.t. R S, E a! R 0 S 0,E 0, R 0 S 0,E 0 = Other similar things, some choices for the last one

6 Basic meta- theory Logical equivalence: R 1,E 1 R 2,E 2 i for all, R 1,E 1 = i R 2,E 2 = Bisimula@on (opera@onal) equivalence: R 1,E 1 R 2,E 2 Soundness and completeness (Hennessy- Milner- van Bentham equivalence): for all R 1,E 1, R 1,E 1 R 2,E 2 i R 1,E 1 R 2,E 2

7 Basic meta- theory Hennessy- Milner completeness is not as straighvorward as might perhaps be imagined In basic resource based on ordered monoids of resource elements, it holds only for fragments of the modal logic and Need the combinatorial structure of and to track of + and x Several papers (MSCS, TCS, JLC, others): hrp://

8 Building models Classical modelling approach using these tools in! observa-ons! induc-on! models! out!! valida-on! deduc-on! real3world! consequences! interpreta-on! consequences! Early versions deployed with HewleR- Packard and its customers, and more recently in projects in the GCHQ RISCS Currently aiming for policy modelling apps in the Turing lots of big industry partners Several papers at hrp:// julia code at hrps://github.com/tristanc/sysmodels

9 Aside: building models Approach is scale- free level therefore chosen to fit problem explored using Model checking also possible (though much less developed at this point) The map is not the territory (Alfred Korzybski) Time- value of models

10 Example: security modelling

11 Interfaces: basic concepts Mediate of models Build on the structure of distributed systems models, quite In must reflect the involved, the resources involved, and crossing the boundaries Note that models are being for environment

12 Interfaces: sketch of basic set- up Interface) Implement the distributed systems model: graph labelled with resources Explicitly with associated in interfaces Each model comes with a specified set of interfaces, specifying input/output loca@ons, with associated ac@ons Decent basic algebraic proper@es: commuta@ve, associa@ve composi@on of models with compa@ble interfaces

13 Interfaces: sketch of basic set- up Implement models as tuples Here Graph with resource- labelled Sets of processes, and located ac)ons A set of interfaces to hav I 2 I ut verti to support com (In,Out,L) and V, An interface on a model is a tuple of (disjoint) input and output loca@ons and located ac@ons

14 Example: security modelling

15 Interfaces: the frame property Supports reasoning: The Frame Rule (think of Hoare s program logic and CSL): { } (M a! M 0 ) { } { } (M N a! M 0 N) { } N =,wheren 6 Side- condi@on restricts evolu@on to part of model not in the interface Correctness reasoning can then be restricted to the interfaces themselves This gives local reasoning about models in their global context; that is, composi@onality a!

16 Example: security modelling

17 Next steps Refine of interface, useful Some underpinning logical theory The Frame Rule in theory and cf. (Concurrent) Logic s theory and implementa@on of local reasoning: abduc)on important here? Applica@ons to big- scale systems Networking Distributed databases and their consistency Supply chains Deliver tools for reasoning about big- scale systems Small- scale systems: weak memory

18 Thank you

19 Modelling distributed systems: basic set- up Other key combinators Hiding Generalizes (build a term model for resources; par@al monoid of ac@ons) Sequen@al composi@on Fixed points

20 A (bunched) modal logic Other logical operators and (over logical treatment in recent joint work with Galmiche, Courtault, and Kimmel in access control Roles: Corresponding (via says modality:

21 References G. Anderson and D. Pym. A Calculus and Logic of Bunched Resources and Processes. Theore)cal Computer Science 614:63-96, D. Galmiche, J.- R. Courtault, D. Pym. A Logic of Separa@ng Modali@es. Theore)cal Computer Science 637, 30-58, M. Collinson and D. Pym. Algebra and Logic for Resource- based Systems Modelling. Mathema)cal Structures in Computer Science 19: , doi: / S M. Collinson, B. Monahan, D. Pym. A Discipline of Mathema)cal Systems Modelling. College Publica@ons, 2012.

22 More references T. Caulfield and D. Pym. Modelling and Systems Security Policy. Proc. SIMUTools 2015, ACM Digital Library, SIMUtools doi: /eai T. Caulfield and D. Pym. Improving Security Policy Decisions with Models. IEEE Security and Privacy, 13(5), 34-41, September/October The julia package used for system models may be obtained from GitHub: hrps:// github.com/tristanc/sysmodels