[Paper Review] Logical Relations for Session-Typed Concurrency

Stephanie Balzer, Farzaneh Derakhshan+1 more|arXiv (Cornell University)|Sep 1, 2023

Security and Verification in Computing1 citations

TL;DR

This paper introduces a recursive session logical relation (RSLR) for intuitionistic linear logic session types (ILLST) that supports general recursion, nontermination, and concurrency. By indexing the relation with intuitionistic linear sequents and using step-indexing with observation levels, it achieves sound and complete equivalence checking via biorthogonality, validating progress-sensitive noninterference and closure under parallel composition.

ABSTRACT

Noninterference guarantees that an attacker cannot infer secrets by interacting with a program. Information flow control (IFC) type systems assert noninterference by tracking the level of information learned (pc) and disallowing communication to entities of lesser or unrelated level than the pc. Control flow constructs such as loops are at odds with this pattern because they necessitate downgrading the pc upon recursion to be practical. In a concurrent setting, however, downgrading is not generally safe. This paper utilizes session types to track the flow of information and contributes an IFC type system for message-passing concurrent processes that allows downgrading the pc upon recursion. To make downgrading safe, the paper introduces regrading policies. Regrading policies are expressed in terms of integrity labels, which are also key to safe composition of entities with different regrading policies. The paper develops the type system and proves progress-sensitive noninterference for well-typed processes, ruling out timing attacks that exploit the relative order of messages. The type system has been implemented in a type checker, which supports security-polymorphic processes.

Motivation & Objective

• Address the lack of logical relations for session types in the presence of general recursion and nontermination.
• Enable reasoning about program equivalence in concurrent, session-typed processes with higher-order channels and dynamic topology.
• Develop a logical relation that is both sound and complete with respect to weak bisimilarity under parallel composition.
• Support noninterference proofs in session-typed systems by ensuring equivalence respects confidentiality levels.
• Overcome limitations of prior Kripke-style logical relations in handling recursion and concurrency in session types.

Proposed method

• Propose a recursive session logical relation (RSLR) indexed by intuitionistic linear sequents Δ ⊩ A, capturing free channel types in process configurations.
• Introduce an observation index m to stratify the logical relation, enabling step-indexing for handling recursive and nonterminating processes.
• Use biorthogonal closure to validate the logical relation, ensuring it is sound and complete with respect to weak bisimilarity under parallel composition.
• Define equivalence via a symmetric, step-indexed relation that equates processes only if they behave identically under all observers up to a secrecy level.
• Leverage cut reduction and sequent-based typing to maintain structural integrity and support compositionality across process components.
• Prove soundness and completeness using a novel biorthogonality argument, showing that the logical equivalence coincides with weak bisimilarity in the presence of recursion.

Experimental results

Research questions

• RQ1 Can logical relations be extended to session-typed processes with general recursion and nontermination?
• RQ2 How can a logical relation be designed to be both sound and complete for progress-sensitive equivalence in concurrent systems?
• RQ3 What structural and indexing mechanisms are necessary to support noninterference and biorthogonality in session types?
• RQ4 How can step-indexing and sequent-based indexing be combined to handle recursive session types with dynamic channel topology?
• RQ5 Does the proposed logical relation correctly capture weak bisimilarity under parallel composition in session-typed processes?

Key findings

• The proposed RSLR is sound and complete with respect to weak bisimilarity under parallel composition, ensuring maximal discriminatory power and permissiveness.
• The logical relation correctly equates diverging processes only with other diverging ones, preserving progress-sensitivity in equivalence checking.
• Biorthogonal closure is proven to validate the logical relation, ensuring that the induced equivalence is closed under parallel composition.
• The use of sequent indexing (Δ ⊩ A) instead of type indexing enables compositional reasoning across recursive and higher-order session processes.
• The logical relation supports noninterference proofs by ensuring that processes are equivalent up to a confidentiality level, as demonstrated via the ⊤⊤-closure theorem.
• The completeness result (Corollary K.6) confirms that the logical equivalence relation coincides with weak bisimilarity, validating its adequacy for program verification.