Ambient Calculus Research Articles

The synchronized ambient calculus

We propose a process algebra called “the synchronized ambient calculus (SAC)”, which is an extension of the ambient calculus (AC). The processes of AC have a layered structure of ambients that enable us to describe not only mobile processes but also real entities such as networks, factories and freight systems in which synchronization between objects is crucial. For example, a container must be brought out from a container yard just after the container ship reached the terminal. While such a protocol can be described using the primitives (in, out, open) of AC, the protocol is easily corrupted due to the phenomenon called “grave interference”, which led us to design SAC. The following advantages for using SAC are that we can describe synchronized actions of objects without grave interference and expressions for such synchronized actions can be simpler than using AC. We give an example of SAC processes for stacking containers in constrained shipping order, e.g., in ascending order, the execution sequences of which can be used to improve the efficiency of the reinforcement learning method we are currently developing.

Processes against tests: On defining contextual equivalences

In this paper, we would like to offer and defend a template to study equivalences between programs—in the particular framework of process algebras for concurrent computation. We believe that our layered model of development will clarify the distinction that is too often left implicit between the tasks and duties of the programmer and of the tester. It will also enlighten pre-existing issues that have been running across process algebras such as the calculus of communicating systems, the π-calculus—also in its distributed version—or mobile ambients. Our distinction starts by subdividing the notion of process in three conceptually separated entities, that we call process terms, (completed) processes and tests, and by stressing the importance of formalizing the completion of process terms and the instrumentation that results from placing a (completed) process into a test. While the role of what can be observed and the subtleties in the definitions of congruences have been intensively studied, the fact that not every term can be tested, and that the tester should have access to a different set of tools than the programmer is curiously left out, or at least not often formally discussed–in this respect, the theory of monitor is a counter-example that we discuss and compare to our approach. We argue that this blind spot comes from the under-specification of contexts—environments in which comparisons occur—that play multiple distinct roles but are generally—at least, on the surface of it—given only one definition that fails to capture all of their aspects.

Distributability of mobile ambients

Modern society is dependent on distributed software systems and to verify them different modelling languages such as mobile ambients were developed. They focus on mobility by allowing both a dynamic network topology as well as the movement of code within the network. To analyse the quality of mobile ambients as a good foundational model for distributed computation, we analyse the level of synchronisation between distributed components that they can express. Therefore, we rely on earlier established synchronisation patterns. It turns out that mobile ambients are not fully distributed, because they can express enough synchronisation to express a synchronisation pattern called M. However, they can express strictly less synchronisation than the pi-calculus. For this reason, we can show that there is no good and distributability-preserving encoding from the pi-calculus into mobile ambients and also no such encoding from mobile ambients into the join-calculus, i.e., the expressive power of mobile ambients is in between these languages. Finally, we discuss how these results can be used to obtain a fully distributed variant of mobile ambients and present one example. Such a fully distributed variant of mobile ambients is a good foundation for distributed computation.

Resource Management in a Pervasive Computing Environment

A pervasive computing system provides for the interaction of people, devices and applications in a seamless and transparent manner in a pervasive computing environment. There is a great need for the management of basic resources in this environment. In this paper, we present a resource management architecture that provides for a seamless interaction among pervasive elements using ambient calculus and a publish/subscribe mechanism. Ambient calculus has been used to explore resource interaction and participation in a pervasive computing environment. A resource classifier component is introduced in the architecture that performs resource binding to specific applications. Results show that Ambient calculus offers a convenient and flexible representation of resource availability, usage transparency and management. By incorporating publish subscribe and resource classifier components into the ambient model, our system has shown a high degree of scalability, flexibility, and fault tolerance.

Isolation Modeling and Analysis Based on Mobility

In a mobile system, mobility refers to a change in position of a mobile object with respect to time and its reference point, whereas isolation means the isolation relationship between mobile objects under some scheduling policies. Inspired by event-based formal models and the ambient calculus, we first propose the two types of special events, entering and exiting an ambient, as movement events to model and analyze mobility. Based on mobility, we then introduce the notion of the isolation of mobile objects for ambients. To ensure the isolation, a priority policy needs to be used to schedule the movement of mobile objects. However, traditional scheduling policies focus on task scheduling and depend on the strong hypothesis: The scheduled tasks are independent—that is, the scheduled tasks do not affect each other. In a practical mobile system, mobile objects and ambients interact with each other. It is difficult to separate a mobile system into independent tasks. We finally present an automatic approach for generating a priority scheduling policy without considering the preceding assumption. The approach can guarantee the isolation of the mobile objects for ambients in a mobile system. Experiments demonstrate these results.

On the Distributability of Mobile Ambients

Modern society is dependent on distributed software systems and to verify them different modelling languages such as mobile ambients were developed. To analyse the quality of mobile ambients as a good foundational model for distributed computation, we analyse the level of synchronisation between distributed components that they can express. Therefore, we rely on earlier established synchronisation patterns. It turns out that mobile ambients are not fully distributed, because they can express enough synchronisation to express a synchronisation pattern called M. However, they can express strictly less synchronisation than the standard pi-calculus. For this reason, we can show that there is no good and distributability-preserving encoding from the standard pi-calculus into mobile ambients and also no such encoding from mobile ambients into the join-calculus, i.e., the expressive power of mobile ambients is in between these languages. Finally, we discuss how these results can be used to obtain a fully distributed variant of mobile ambients.

Virtually timed ambients: A calculus of nested virtualization

Nested virtualization enables a virtual machine, which is a software layer representing an execution environment, to be placed inside another virtual machine. Nested virtual machines form a location hierarchy where virtual machines at every level in the hierarchy compete with other processes at that level for processing time. With nested virtualization, the computing power of a virtual machine depends on its position in this hierarchy and may change if the virtual machine moves. This paper introduces the calculus of virtually timed ambients, a formal model of hierarchical locations for execution with explicit resource provisioning, motivated by these effects of nested virtualization. Resource provisioning in this model is based on virtual time slices as a local resource. To reason about timed behavior in this setting, weak timed bisimulation for virtually timed ambients is defined as an extension of bisimulation for mobile ambients. We show that the equivalence of contextual bisimulation and reduction barbed congruence is preserved by weak timed bisimulation. Simulation with time relaxation is defined to express that a system is slower than another system up to a given time bound. The calculus of virtually timed ambients is illustrated by examples.

Automatic security policy enforcement in computer systems

This paper proposes a formal framework for automatic security policy enforcement in computer systems. In this approach, systems and their interactions are formally modeled as process algebra expressions with a new dedicated calculus inspired from the ambient calculus. Security policies are specified with the aid of a dedicated modal logic. We demonstrate how, for a given security policy expressed by a logical formula, our calculus allows to verify whether the specification meets the security policy requirements. If it does not, the optimal enforcement for the system is automatically generated using our enforcement operator. A software prototype has been implemented to show the practical feasibility and the effectiveness of our security policy enforcement framework.

On the expressiveness of π-calculus for encoding mobile ambients

We investigate the expressiveness of two classical distributed paradigms by defining the first encoding of the pure mobile ambient calculus into the synchronous π-calculus. Our encoding, whose correctness has been proved by relying on the notion of operational correspondence, shows how the hierarchical ambient structure can be reformulated within a flat channel interconnection amongst independent processes, without centralised control. To easily handle the computation for simulating a capability, we introduce the notions of simulating trace (representing the computation that a π-calculus process has to execute to mimic a capability) and of aborting trace (representing the computation that a π-calculus process executes when the simulation of a capability cannot succeed). Thus, the encoding may introduce loops, but, as it will be shown, the number of steps of any trace, therefore of any aborting trace, is limited, and the number of states of the transition system of the encoding processes still remains finite. In particular, an aborting trace makes a sort of backtracking, leaving the involved sub-processes in the same starting configurations. We also discuss two run-time support methods to make these loops harmless at execution time. Our work defines a relatively simple, direct, and precise translation that reproduces the ambient structure by means of channel links, and keeps track of the dissolving of an ambient.

A Calculus of Mobility and Communication for Ubiquitous Computing

We propose a Calculus of Mobility and Communication (CMC) for the modelling of mobility, communication and context-awareness in the setting of ubiquitous computing. CMC is an ambient calculus with the in and out capabilities of Cardelli and Gordon's Mobile Ambients. The calculus has a new form of global communication similar to that in Milner's CCS. In CMC an ambient is tagged with a set of ports that agents executing inside the ambient are allowed to communicate on. It also has a new context-awareness feature that allows ambients to query their location. We present reduction semantics and labelled transition system semantics of CMC and prove that the semantics coincide. A new notion of behavioural equivalence is given by defining capability barbed bisimulation and congruence which is proved to coincide with barbed bisimulation congruence. The expressiveness of the calculus is illustrated by two case studies.

Typed context awareness Ambient Calculus for pervasive applications

Abstract The idea of pervasive computing is that information processing will become part of everyday life, and will be available everywhere, making computing so natural to the point of being invisible in the ambient. An important concept that arises with pervasive computing is context awareness . Context is any information that can be used to characterize an entity. Based on contextual information, applications can dynamically adapt themselves to the environments in which they operate. The Calculus of Context-aware Ambients (CCA) is an untyped formal language used to describe mobile and context-aware pervasive applications. The CCA extends the Ambient Calculus by providing new features, such as context-guarded action and process abstraction, allowing to model contexts and context-aware computations. In this work, we define a type system for the CCA, called CCA T , with the focus in the communication between processes and in the correct use of process abstraction and contexts, extending previous works on the definition of type systems for mobile computing. Moreover, we prove that the proposed type system has the subject reduction property (or type preservation). We also model a hospital scenario using CCA T to demonstrate the use of the proposed type system.

A General Theory of Barbs, Contexts, and Labels

Barbed bisimilarity is a widely used behavioral equivalence for interactive systems: given a set of predicates (denoted “barbs” and representing basic observations on states) and a set of contexts (representing the possible execution environments), two systems are deemed to be equivalent if they verify the same barbs whenever inserted inside any of the chosen contexts. Despite its flexibility and expressiveness, this definition of equivalence is unsatisfactory because often the quantification is over an infinite set of contexts, thus making barbed bisimilarity very hard to be verified. Should a labeled operational semantics be available, more efficient observational equivalences might be adopted. To this end, a series of techniques has been proposed to derive labeled transition systems (LTSs) from unlabeled ones, the main example being Leifer and Milner’s theory of reactive systems. The underlying intuition is that labels should be the “minimal” contexts that allow for a reduction step to be performed. However, minimality is difficult to asses, whereas the set of “intuitively” correct labels is often easily devised by the ingenuity of the researcher. This article introduces a framework that characterizes (weak) barbed bisimilarity via LTSs whose labels are (not necessarily minimal) contexts. Differently from previous proposals, our theory does not depend on the way the labeled transitions are built but instead relies on a simple set-theoretical presentation for identifying those properties such an LTS should verify to (1) capture the barbed bisimilarities of the underlying system and (2) ensure that such bisimilarities are congruences. Furthermore, we adopt suitable proof techniques to make feasible the verification of such properties. To provide a test-bed for our formalism, we instantiate it by addressing the semantics of the Mobile Ambients calculus, recasting its barbed bisimilarities via label-based behavioral equivalences.

RPO semantics for mobile ambients

In this paper we focus on the synthesis of labelled transition systems (LTSs) for process calculi using Mobile Ambients (MAs) as a testbed. Our proposal is based on a graphical encoding: a process is mapped into a graph equipped with interfaces such that the denotation is fully abstract with respect to the standard structural congruence. Graphs with interfaces are amenable to the synthesis mechanism based on borrowed contexts (BCs), which is an instance of relative pushouts (RPOs). The BC mechanism allows the effective construction of an LTS that has graphs with interfaces as states and labels, and such that the associated bisimilarity is a congruence. We focus here on the analysis of an LTS over processes as graphs with interfaces: we use the LTS on graphs to recover an LTS directly defined over the structure of MA processes and define a set of SOS inference rules capturing the same operational semantics.

Programming distributed computing systems: a foundational approach

Starting from the premise that understanding the foundations of concurrent programming is key to developing distributed computing systems, this book first presents the fundamental theories of concurrent computing and then introduces the programming languages that help develop distributed computing systems at a high level of abstraction. The major theories of concurrent computation -- including the p-calculus, the actor model, the join calculus, and mobile ambients -- are explained with a focus on how they help design and reason about distributed and mobile computing systems. The book then presents programming languages that follow the theoretical models already described, including Pict, SALSA, and JoCaml. The parallel structure of the chapters in both part one (theory) and part two (practice) enable the reader not only to compare the different theories but also to see clearly how a programming language supports a theoretical model. The book is unique in bridging the gap between the theory and the practice of programming distributed computing systems. It can be used as a textbook for graduate and advanced undergraduate students in computer science or as a reference for researchers in the area of programming technology for distributed computing. By presenting theory first, the book allows readers to focus on the essential components of concurrency, distribution, and mobility without getting bogged down in syntactic details of specific programming languages. Once the theory is understood, the practical part of implementing a system in an actual programming language becomes much easier.

Spatiotemporal model checking of location and mobility related security policy specifications

For the formal verification of security in mobile networks, a requirement is that security policies associated with mobility and location constraints are formally specified and verified. For the formal specification and verification of security policies, formal methods ensure that a given network configuration that includes certain network elements satisfies a given security policy. A process calculus based approach is presented, where ambient calculus is used for formal specification of security policies and ambient logic is used for formal representation of mobility and location constraints. A spatiotemporal model checking algorithm is presented for the model checking of formal specifications in ambient calculus with respect to formulas in ambient logic. The presented algorithm allows spatiotemporal model checking of security policy rules and consists of spatial and temporal model checking algorithms. The spatial model checking algorithm is implemented in the Java language and the temporal model checking algorithm is implemented using the NuSMV model checker.

A formal role-based access control model for security policies in multi-domain mobile networks

Mobile users present challenges for security in multi-domain mobile networks. The actions of mobile users moving across security domains need to be specified and checked against domain and inter-domain policies. We propose a new formal security policy model for multi-domain mobile networks, called FPM-RBAC, Formal Policy Model for Mobility with Role Based Access Control. FPM-RBAC supports the specification of mobility and location constraints, role hierarchy mapping, inter-domain services, inter-domain access rights and separation of duty. Associated with FPM-RBAC, we also present a formal security policy constraint specification language for domain and inter-domain security policies. Formal policy constraint specifications are based on ambient logic and predicate logic. We also use ambient calculus to specify the current state of a mobile network and actions within security policies for evaluation of access requests according to security policies. A novel aspect of the proposed policy model is the support for formal and automated analysis of security policies related to mobility within multiple security domains.

How faithfully can π be interpreted in SA?

The π calculus and the safe ambient calculus are two of the widely studied variants of process calculi in the field of concurrency theory. The former is the most classic model for mobile processes and the latter is well known for its nested structure. However, the relationship between these two models deserves further investigation. In this paper, we reinvestigate this problem thoroughly. We first give the strengthened encoding criteria. Then we propose the encoding of the synchronous π-calculus into the safe ambients calculus. The encoding scheme is a generalization and improvement of Levi and Sangiorgi’s work when moving from the asynchronous π-calculus to the synchronous π-calculus. We show the merits of the encoding by checking the mentioned criteria.

Multiset rewriting for the verification of depth-bounded processes with name binding

We combine two of the existing approaches to the study of concurrency by means of multiset rewriting: multiset rewriting with existential quantification (MSR) and constrained multiset rewriting. We obtain ν-MSR, where we rewrite multisets of atomic formulae, in which terms can only be pure names, where some names can be restricted. We consider the subclass of depth-bounded ν-MSR, for which the interdependence of names is bounded. We prove that they are strictly Well Structured Transition Systems, so that coverability, termination and boundedness are all decidable for depth-bounded ν-MSR. This allows us to obtain new verification results for several formalisms with name binding that can be encoded within ν-MSR, namely polyadic ν-PN (Petri nets with tuples of names as tokens), the π-calculus, MSR or Mobile Ambients.

XFPM‐RBAC: XML‐based specification language for security policies in multidomain mobile networks

ABSTRACTWe present XFPM‐RBAC (XML‐based formal policy language for mobility with role‐based access control), an XML‐based specification language for specification of domain and interdomain security policies with location and mobility constraints based on role‐based access control. XFPM‐RBAC supports specification of locations, mobility, interdomain access rights, role mapping, and separation of duty (SOD) aspects of security policies. XFPM‐RBAC builds upon the FPM‐RBAC security policy model that we have recently proposed. XFPM‐RBAC consists of XML schemas, which define domain security policy, interdomain security policy, locations, mobility, and SOD constructs. A Security Policy Management Interface application is also developed for specification and administration of security policies as a prototype implementation of XFPM‐RBAC. XFPM‐RBAC supports extraction of formal specifications from security policies for the purpose of automated verification of security policies. Automated extraction of formal specifications is based on XSLT (Extensible Stylesheet Language Transformations). Formal specification of security policies together with location and mobility constraints within security policy rules are based on ambient calculus and ambient logic. Copyright © 2012 John Wiley & Sons, Ltd.

Reachability problems in BioAmbients

BioAmbients (BA) is a powerful model for representing various aspects of living cells. The model provides a rich set of operations for the movement and interaction of molecules. The richness of the language motivates the study of fragments of the full model and comparison with other computational models. In this paper, we investigate the impact of the merge capability, used for fusing the contents of two sibling ambients, on the decidability of two reachability problems called Target and Spatial Reachability. By enhancing techniques–based on the theory of Petri nets–already used in the context of Mobile Ambients, we prove that both Target and Spatial Reachability are decidable for a Turing-complete fragment of BA without merge. Then we extend this fragment with a limited form of merge, that does not reduce the total number of ambients: in this fragment Target Reachability is no longer decidable, but by resorting to the theory of Petri nets with transfer arcs we prove that at least Spatial Reachability is decidable. Finally, we show that if we consider the standard merge capability then both reachability problems turn out to be undecidable. Besides characterizing the power of merge, the proof techniques that we use also establish an interesting connection between BA and other computational models like standard Petri nets, their extension with transfer arcs, and Two Counter Machines.