In joint work with Peter O'Hearn and others, based on early ideas of Burstall, we have developed an extension of Hoare logic that permits reasoning about low-level imperative programs that use shared mutable data structure. The simple imperative programming language is extended with commands (not expressions) for accessing and modifying shared structures, and for explicit allocation and deallocation of storage. Assertions are extended by introducing a "separating conjunction" that asserts that its subformulas hold for disjoint parts of the heap, and a closely related "separating implication". Coupled with the inductive definition of predicates on abstract data structures, this extension permits the concise and flexible description of structures with controlled sharing. In this paper, we survey the current development of this program logic, including extensions that permit unrestricted address arithmetic, dynamically allocated arrays, and recursive procedures. We also discuss promising future directions.

/pdf/separation-logic-a-logic-for-shared-mutable-data-structures-1oyj7ddi1a.pdf

Separation logic: a logic for shared mutable data structures

[서평]「Component Software」 - Beyond Object-Oriented Programming -

コンピュータ・サイエンス : ACM computing surveys

Microservices is an architectural style inspired by service-oriented computing that has recently started gaining popularity. Before presenting the current state of the art in the field, this chapter reviews the history of software architecture, the reasons that led to the diffusion of objects and services first, and microservices later. Finally, open problems and future challenges are introduced. This survey primarily addresses newcomers to the discipline, while offering an academic viewpoint on the topic. In addition, we investigate some practical issues and point out a few potential solutions.

/pdf/microservices-yesterday-today-and-tomorrow-30wvjeeix0.pdf

Microservices: Yesterday, Today, and Tomorrow

The Art of Multiprocessor Programming

Reasoning about security properties involves reasoning about where the information of a system is located, and how it evolves over time. While most security analysis techniques need to cope with some notions of information locality and knowledge propagation, usually they do not provide a general language for expressing arbitrary properties involving local knowledge and knowledge transfer. Building on this observation, we introduce a framework for security protocol analysis based on dynamic spatial logic specifications. Our computational model is a variant of existing pi-calculi, while specifications are expressed in a dynamic spatial logic extended with an epistemic operator. We present the syntax and semantics of the model and logic, and discuss the expressiveness of the approach, showing it complete for passive attackers. We also prove that generic Dolev-Yao attackers may be mechanically determined for any deterministic finite protocol, and discuss how this result may be used to reason about security properties of open systems. We also present a model-checking algorithm for our logic, which has been implemented as an extension to the SLMC system.

A Spatial-Epistemic Logic for Reasoning about Security Protocols

The undisciplined use of shared mutable state can be a source of program errors when aliases unsafely interfere with each other.
While protocol-based techniques to reason about interference abound, they do not address two practical concerns: the decidability of protocol composition and its integration with protocol abstraction.
We show that our composition procedure is decidable and that it ensures safe interference even when composing abstract protocols.
To evaluate the expressiveness of our protocol framework for safe shared memory interference, we show how this same protocol framework can be used to model safe, typeful message-passing concurrency idioms.

https://drops.dagstuhl.de/opus/volltexte/2016/6110/pdf/LIPIcs-ECOOP-2016-16.pdf/

Composing Interfering Abstract Protocols

An integrated model-driven application development and execution environment enables declaration of a data-role in an application model. The data-role is based on a property of a data entity in the application model. The data-role provides for the enforcement of domain-specific security policies with respect to data elements corresponding to the data entity.

Systems, methods, and apparatus for model-based security control

Relating the specification of the global communication behavior of a distributed system and the specifications of the local communication behavior of each of its nodes/peers (e.g., to check if the former is realizable by the latter under some safety and/or liveness conditions) is a challenging problem addressed in many relevant scenarios. In the context of networked software services, a widespread programming language-based approach relies on global specifications defined by session types or behavioral contracts. Static type checking can then be used to ensure that components follow the prescribed interaction protocols. In the case of session types, developments have been mostly framed within quite different type theories for either binary (two-party) or multiparty (n-party) protocols. Unfortunately, the precise relationship between analysis techniques for multiparty and binary protocols is yet to be understood. 
In this work, we bridge this previously open gap in a principled way: we show that the analysis of multiparty protocols can also be developed within a much simpler type theory for binary protocols, ensuring protocol fidelity and deadlock-freedom. We present characterization theorems which provide new insights on the relation between two existing, yet very differently motivated, session type systems---one based on linear logic, the other based on automata theory---and suggest useful type-based verification techniques for multiparty systems relying on reductions to the binary case.

Luís Caires

Papers

A Spatial-Epistemic Logic for Reasoning about Security Protocols

Composing Interfering Abstract Protocols

Systems, methods, and apparatus for model-based security control

A Typeful Characterization of Multiparty Structured Conversations Based on Binary Sessions.

The spatial logic model checker user's manual: version 0.9