Privacy by Flexible Parameterization with Erlang Active Objects

International Journal on Advances in Software, vol 3 no 3 & 4, year 2010, http://www.iariajournals.org/software/ 461 Privacy by Flexible Parameterization with Erlang Active Objects Andreas Fleck Florian Kammuller¨ Software Engineering Group Middlesex University, London UK and Technische Universitat¨ Berlin, Germany Technische Universitat¨ Berlin, Germany Email: andreasfl[email protected] Email: [email protected] Abstract—Functional active objects are a new paradigm for • The use of futures as the machinery behind method the implementation of services. They offer safe distributed invocation enables a flexible reply to method requests. evaluation with futures and immutable objects guaranteeing In particular, this reply mechanism supports the privacy efficient implementation of privacy while offering verified quality assurance based on the functional paradigm and a enhancing result acquisition described in the previous development in an interactive theorem prover. In this paper, point. we present a novel and highly performant implementation of • Using Erlang as implementation language we present functional active objects in Erlang. Besides outlining the guid- a novel future implementation concept where each ing principles of the interpreter, we show how secure services future is represented as a process. Thereby, we can can be realized based on the classical service triangle and prove its security based on a formal definition of information flow abstract from different future update strategies; the security for functional active objects. Erlang ASPfun interpreter stays close to the original semantics (see Section II-A): since it is functional it Keywords-Active object, future, Erlang, privacy, service computing is not forced to sacrifice generality for the sake of operationality. • We offer a formal definition of information flow secu- I. INTRODUCTION rity and illustrate its use for the proof of security on the service triangle – our running example. The free lunch is over – as Sutter describes so vividly in his famous paper [24]. In all realms of modern computing, In this paper we first provide the prerequisites of this we need to distribute to keep up performance. Active objects project: brief introductions to the language ASPfun, currying combine the successful concept of object-orientation with in ASPfun, and Erlang (Section II). From there, we develop the necessary concepts of concurrent processes to make them the concepts of our implementation of active objects in fit for this distributed world. Erlang (Section III). We then illustrate how the language can be efficiently used to implement secure services on We present an implementation of the novel language three examples from privacy reflecting our contribution ASP for functional active objects in the programming fun (Section IV). A formal security definition enables the proof language Erlang. ASP is an computation model that can fun of privacy for flexible parameterization (Section V). We be seen as a descendant of the actor model, or more precisely finally offer conclusions, position our work, and give an active objects. Its main specialty is the use of futures to avoid outlook on further plans (Section VI). This paper extends blocking states while invoking asynchronous methods. Since the original conference contribution [13] by further details no data is shared between active objects, concurrent method on the implementation concepts and a formal definition of invocation can be simply used without fear of racing. These security and proof of privacy for the service triangle using features are very similar to the features of services. Hence, flexible parameterization. it is possible to formalize complex services in ASPfun and this fact allows us to transfer ASPfun properties to services. II. PREREQUISITES The Erlang implementation of ASP enables a prompt fun In this section, we present the formal definitions of the transfer from an ASP configuration to executable code fun language ASP and a brief introduction in the concepts and so the ”real behavior” can be tested. Besides the highly fun behind Erlang. performant parallelization of Erlang, this approach supports privacy enhancing implementations for services. The main A. Functional Active Objects contributions presented in this paper are as follows. The language ASPfun [12] is a computation model for • Functional active objects enable a deadlock free evalu- functional active objects. Its local object language is a simple ation that implies service invocation in a higher order &-calculus [1] featuring method call t:l(s), and method fashion. That is, a customer can invoke a service update t:l := &(x; y)b on objects (& is a binder for the without needing to provide his private data. self x and method parameter y). Objects consist of a set 2010, © Copyright by authors, Published under agreement with IARIA - www.iaria.org International Journal on Advances in Software, vol 3 no 3 & 4, year 2010, http://www.iariajournals.org/software/ 462 configuration C. Formal ASPfun semantics activity α β We use a concise contextual description with contexts E active object t t' defined as usual. Classically we define contexts as expres- request queue request queue sions with a single hole (•). E [fk] t'.l(s) j2(1::n)−{ig E ::= • j [li = &(x; y)E; lj = &(xj; yj)tj ] j E:li(t) j ... ... s:li(E) j E:li := &(x; y)s j s:li := &(x; y)Ej Active(E) ... ... E[s] denotes the term obtained by replacing the single hole ... ... by s. The semantics of the &-calculus for (local) objects is simply given by the following two reduction rules for calling and updating a method (or field) of an object. CALL j21::n li 2 fljg Figure 1. ASPfun: a configuration j21::n (1) E [lj = &(xj; yj)bj] :li(b) !& i21::n j21::n of labeled methods [li = &(x; y)b] (attributes are E bifxi [lj = &(xj; yj)bj] ; yj bg considered as methods with no parameters). ASPfun now UPDATE j21::n simply extends this basic object language by a command li 2 fljg Active(t) for creating an activity for an object t. A simple j21::n (2) E [lj = &(xj; yj)bj] :li := &(x; y)b !& configuration containing just activities α and β within which h i E [l = &(x; y)b; l = &(x ; y )bj2(1::n)−{ig] are so-called active objects t and t0 is depicted in Figure i j j j j 1. This figure also illustrates futures, a concept enabling The semantics of ASPfun is built over the local semantics asynchronous communication. Futures are promises for the of the &-calculus as a reduction relation !k that we call the results of remote method calls, for example in Figure 1, parallel semantics (see Table I). fk points to the location in activity β where at some point the result of the method evaluation t0:l(s) can be retrieved D. A Running Example from Service Computing from. Futures are first class citizen but they are not part In the following example (an extension of the motivating of the static syntax of ASPfun, that is, they cannot be example of [11]), a customer uses a hotel reservation service used by a programmer. Similarly, activity references, e.g. provided by a broker. This simple example is representative α, β, in Figure 1, are references and not part of the static for service oriented architectures; we refer to it also as syntax. Instead, futures and activity references constitute the service triangle. In this triangle, the three activities the machinery for the computation of configurations of hotel, broker, and customer are composed by k into a active objects. Syntactically, we write configurations as configuration. To simplify this example the broker’s search α[Rα; tα] k β[Rβ; tβ] k ::: . For example, the configuration for a hotel is omitted and we always consider the same hotel of Figure 1 would be syntactically expressed as α[f0 7! and in addition we abstract from the computation in hotel 0 0 E[fk] :: Rα; t] k β[fk 7! t :l(s) :: Rβ; t ]. that produces the booking reference for the customer. We concentrate on the message passing implemented in futures B. Informal Semantics of ASPfun to highlight the actual flows of information in the following Local (&-calculus) and parallel (configuration) semantics evaluation sequence. are given by a set of reduction rules informally described as follows. customer[f0 7! broker:book(date); t] k [ ; [ = &(x; (date)) : (date);:::]] • LOCAL: the local reduction relation !& is based on the broker ? book hotel room &-calculus. k hotel[?; [room = &(x,date)bookingref;:::]] • ACTIVE: Active(t) creates a new activity α[ ; t] for ∗ ? The following step of the semantic reduction relation !k new name α, empty request queue, and with t as active creates the new future f1 in broker following rule REQUEST. object. According to LOCAL, this call is reduced and the original • REQUEST: method call β:l creates new future f in k call in the customer becomes f1. future-list of activity β (see Figure 1). customer[f0 7! f1; t] • REPLY: returns result, i.e. replaces future fk by the referenced result term s (possibly not fully evaluated). k broker[f1 7! hotel:room(date);:::] k [ ; [ = &(x,date) ;:::]] • UPNAME-AO: activity upname creates a copy of the hotel ? room bookingref activity and upnames the active object of the copy – The parameter x representing the self is not used but the call the original remains the same (functional active objects to hotel’s method room with parameter date creates again are immutable). by rule REQUEST a new future in the request queue of the 2010, © Copyright by authors, Published under agreement with IARIA - www.iaria.org International Journal on Advances in Software, vol 3 no 3 & 4, year 2010,

Load more