PLACES'10: The 3rd Workshop on Programmng Language Approaches to concurrency and Communication-Centric Software

The development of the SJ Framework for session-based distributed programming is part of recent and ongoing research into integrating session types and practical, real-world programming languages. SJ programs featuring session types (protocols) are statically checked by the SJ compiler to verify the key property of communication safety, meaning that parties engaged in a session only communicate messages, including higher-order communications via session delegation, that are compatible with the message types expected by the recipient. This extended abstract presents current work on security aspects of the SJ Framework. Firstly, we discuss our implementation experience from improving the SJ Runtime platform with security measures to protect and augment communication safety at runtime. We implement a transport component for secure session execution that uses a modified TLS connection with authentication based on the Secure Remote Password (SRP) protocol. The key technical point is the delicate treatment of secure session delegation to counter a previous vulnerability. We find that the modular design of the SJ Runtime, based on the notion of an Abstract Transport for session communication, supports rapid extension to utilise additional transports whilst separating this concern from the application-level session programming task. In the second part of this abstract, we formally prove the target security properties by modelling the extended SJ delegation protocols in the π-calculus. 1 Session Programming in SJ It has become increasingly important to understand and specify the behaviour of applications across many domains as sequences of communications and interaction between concurrently executing components, as opposed to independent black boxes that simply return a final output from a given input. Unfortunately, the most common technologies and programming techniques for communication-based programming in use today do not provide the level of support and safety guarantees enjoyed for traditional single-threaded, “localised” programming. For example, low-level network socket APIs provide only the minimal mechanisms for exchanging untyped data in an unstructured manner, and higher-level RPC/RMI libraries are typically coupled to the synchronous call-return pattern and lack the facility to encapsulate a series of such exchanges as one complete unit of interaction. SJ [9, 11] is an extension of Java that uses session types [7] to address the above issues. Programmers use session types, which can be thought of as communication protocols, to specify the abstract communication behaviour of a program. Concrete communication behaviour is implemented using special session primitives; in particular, SJ supports higher-order session types, implemented by session delegation actions, that express the migration of ongoing sessions to new parties. The SJ compiler performs static session type checking, guaranteeing that session implementations conform to their declared types, i.e. a SJ session between compatible peers will never reduce to a communication error other than premature termination due to e.g. network failure. Other works have presented SJ implementations of communications-based applications from widely different domains, such as Internet Web services [9] and parallel algorithms for cluster computing [3], demonstrating competitive performance in both cases. Securing session execution. To enforce the statically verified communication safety property at runtime, the SJ Runtime (SJR) validates peer compatibility at session initiation and provides a session monitoring service that dynamically tracks session progress against the expected type. Nevertheless, the development of the SJ Framework as a research project, until now, had yet to focus on session security