Authorization is a fundamental problem in modern distributed systems, and the ''policies-as-code'' paradigm has emerged as a promising solution to decouple access control logic from application code. However, most policy languages lack the ability to handle stateful policies directly. This limitation forces developers to manage policy-related state within the application code, reintroducing the very coupling that policies as code aims to eliminate and opening the door to security vulnerabilities. To address this gap, we introduce Strobilus, a language designed to express effects over policy-specific data. Strobilus is built to seamlessly complement and integrate with Amazon's Cedar, allowing developers to write stateful policies without modifying Cedar's core syntax or evaluation engine. Strobilus is distinguished by its formal semantics, a strong typing system, and a guarantee of termination, which facilitates rigorous analysis and verification of policies. We have developed a prototype implementation in Rust, which demonstrates that Strobilus may lead to significant performance improvements over external methods for policy data management. This approach aims to fully realizes the promise of ''policies-as-code'' by providing a comprehensive, safe, and verifiable solution for both stateless and stateful authorization policies.

Abstract Event-driven programming provides a natural fit for the reactive nature of pervasive systems like the Internet of Things (IoT) and Collective Adaptive Systems (CASs). Attribute-based memory Updates (AbU) is a calculus based on Event-Condition-Action (ECA) rules, well-suited for modeling such decentralized systems. This paper introduces a novel extension of AbU by incorporating ECA rule priorities . We show how this extension facilitates the natural expression of prioritized behaviors and enables the implementation of distributed data structures like Conflict-free Replicated Data Types (CRDTs). Furthermore, by leveraging the local invariants of AbU nodes and priorities we address the problem of enforcing global invariants in order to enhance the reliability and predictability of CASs. This is achieved through a syntactic transformation that projects global invariants into local ones and introduces high-priority synchronization rules, so that system-level properties can be guaranteed without relying on a central authority.

Adhesive and quasiadhesive categories provide a general framework for the study of algebraic graph rewriting systems. In a quasiadhesive category any two regular subobjects have a join which is again a regular subobject. Vice versa, if regular monos are adhesive, then the existence of a regular join for any pair of regular subobjects entails quasiadhesivity. It is also known (quasi)adhesive categories can be embedded in a Grothendieck topos via a functor preserving pullbacks and pushouts along (regular) monomorphisms. In this paper we extend these results to $\mathcal{M}, \mathcal{N}$-adhesive categories, a concept recently introduced to generalize the notion of (quasi)adhesivity. We introduce the notion of $\mathcal{N}$-adhesive morphism, which allows us to express $\mathcal{M}, \mathcal{N}$-adhesivity as a condition on the subobjects' posets. Moreover, $\mathcal{N}$-adhesive morphisms allows us to show how an $\mathcal{M},\mathcal{N}$-adhesive category can be embedded into a Grothendieck topos, preserving pullbacks and $\mathcal{M}, \mathcal{N}$-pushouts.

Attribute-based memory Updates (in short) is an interaction mechanism recently introduced for adapting the Event-Condition-Action (ECA) programming paradigm to distributed reactive systems, such as autonomic and smart IoT device ensembles. In this model, an event (e.g., an input from a sensor, or a device state update) can trigger an ECA rule, whose execution can cause the state update of (possibly) many remote devices at once; the latter are selected “on the fly” by means of predicates over their state, without the need of a central coordinating entity. However, the combination of different systems may yield unexpected interactions, e.g., when a new device is added to an existing secure system, potentially hindering the security of the whole ensemble of devices. This can be critical in the IoT, where smart devices are more and more pervasive in our daily life. In this paper, we consider the problem of ensuring security and safety requirements for systems (and, in turn, for IoT devices). The first are a form of noninterference, as they correspond to avoid forbidden information flows (e.g., information flows violating confidentiality); while the second are a form of non-interaction, as they correspond to avoid unintended executions (e.g., leading to erroneous/unsafe states). In order to formally model these requirements, we introduce suitable behavioral equivalences for . These equivalences are generalizations of hiding bisimilarity, i.e., a kind of weak bisimilarity where we can compare systems up-to actions at different levels of security. Leveraging these behavioral equivalences, we propose (syntactic) sufficient conditions guaranteeing the requirements and, then, effective algorithms for statically verifying such conditions.

Abstract Session types are a well-established framework for the specification of interactions between components of a distributed systems. An important issue is how to determine the type for an open system, i.e., obtained by assembling subcomponents, some of which could be missing. To this end, we introduce partial sessions and partial (multiparty) session types. Partial sessions can be composed, and the type of the resulting system is derived from those of its components without knowing any suitable global type nor the types of missing parts. To deal with this incomplete information, partial session types represent the subjective views of the interactions from participants’ perspectives; when sessions are composed, different partial views can be merged if compatible, yielding a unified view of the session. Incompatible types, due to, e.g., miscommunications or deadlocks, are detected at the merging phase. In fact, in this theory the distinction between global and local types vanishes. We apply these types to a process calculus for which we prove subject reduction and progress, so that well-typed systems never violate the prescribed constraints. In particular, we introduce a generalization of the progress property, in order to accommodate the case when a partial session cannot progress not due to a deadlock, but because some participants are still missing. Therefore, partial session types support the development of systems by incremental assembling of components.

In recent years, event-driven programming languages, in particular those based on Event Condition Action (ECA) rules, have emerged as a promising paradigm for implementing ubiquitous and pervasive systems. These implementations are mostly centralized, where a single server (often in the cloud) collects and processes all the inputs from the environment. In fact, placing the computation on the nodes interacting with the environment requires suitable abstractions for effective communication and coordination of (possibly large) ensembles of these distributed components — abstractions that current ECA languages are still missing. To this end, in this paper we present AbU, a calculus for modeling and reasoning about ECA-based systems with attribute-based communication. The latter is an interaction model recently introduced for the coordination of (possibly large) families of nodes: communication is similar to broadcast but the actual receivers are selected on the spot, by means of predicates over nodes properties. Thus, the programmer can specify interactions between nodes in a declarative way, abstracting from details such as nodes identity, number, or even their existence, without the need for a central server: the computation is moved on the “edge”, thus improving reliability, scalability, privacy and security. After having defined syntax and formal semantics of AbU, we showcase its expressiveness by providing some example applications and the encoding of AbC, the archetypal calculus with attribute-based communication. Then, we focus on two key properties of reactive systems: stabilization (i.e., termination of internal steps) and confluence. For both these properties we provide formal semantic definition, sufficient syntactic conditions on AbU systems, and algorithms to statically check such conditions. Hence, AbU is both a basis for the formal analysis of event-driven architectures with attributed-based interaction, and a reference model for a full-fledged language for IoT and edge computing.

In this work we propose a formal system for fuzzy algebraic reasoning. The sequent calculus we define is based on two kinds of propositions, capturing equality and existence of terms as members of a fuzzy set. We provide a sound semantics for this calculus and show that there is a notion of free model for any theory in this system, allowing us (with some restrictions) to recover models as Eilenberg-Moore algebras for some monad. We will also prove a completeness result: a formula is derivable from a given theory if and only if it is satisfied by all models of the theory. Finally, leveraging results by Milius and Urbat, we give HSP-like characterizations of subcategories of algebras which are categories of models of particular kinds of theories.

Abstract Adhesive categoriesprovide an abstract framework for the algebraic approach to rewriting theory, where many general results can be recast and uniformly proved. However, checking that a model satisfies the adhesivity properties is sometimes far from immediate. In this paper we present a new criterion giving a sufficient condition for $$\mathcal {M},\mathcal {N}$$ M,N -adhesivity, a generalisation of the original notion of adhesivity. We apply it to several existing categories, and in particular tohierarchical graphs, a formalism that is notoriously difficult to fit in the mould of algebraic approaches to rewriting and for which various alternative definitions float around.

Bigraphs and bigraphical reactive systems are a well-known meta-model successfully used for formalizing a wide range of models and situations, such as process calculi, service oriented architectures , multi-agent systems, biological systems, etc. A key problem in the theory and the implementations of bigraphs is how to compute embeddings , i.e., structure-preserving mappings of a given bigraph (the pattern or guest ) inside another (the target or host ). In this paper, we present an algorithm for computing embeddings for directed bigraphs, an extension of Milner's bigraphs which take into account the request directions between controls and names. This algorithm solves the embedding problem by means of a reduction to a constraint satisfaction problem . We first prove soundness and completeness of this algorithm; then we present an implementation in jLibBig , a general Java library for manipulating bigraphical reactive systems. The effectiveness of this implementation is shown by several experimental results. Finally, we show that this algorithm can be readily adapted to find the optimal embeddings in a weighted variant of the embedding problem.

(Pre)closure spaces are a generalization of topological spaces covering also the notion of neighbourhood in discrete structures, widely used to model and reason about spatial aspects of distributed systems. In this paper we present an abstract theoretical framework for the systematic investigation of the logical aspects of closure spaces. To this end, we introduce the notion of closure (hyper)doctrines, i.e. doctrines endowed with inflationary operators (and subject to suitable conditions). The generality and effectiveness of this concept is witnessed by many examples arising naturally from topological spaces, fuzzy sets, algebraic structures, coalgebras, and covering at once also known cases such as Kripke frames and probabilistic frames (i.e., Markov chains). By leveraging general categorical constructions, we provide axiomatisations and sound and complete semantics for various fragments of logics for closure operators. Hence, closure hyperdoctrines are useful both for refining and improving the theory of existing spatial logics, and for the definition of new spatial logics for new applications.

MTProto 2.0 is a suite of cryptographic protocols for instant messaging at the core of the popular Telegram messenger application. In this paper we analyse MTProto 2.0 using the symbolic verifier ProVerif. We provide fully automated proofs of the soundness of MTProto 2.0's authentication, normal chat, end-to-end encrypted chat, and rekeying mechanisms with respect to several security properties, including authentication, integrity, secrecy and perfect forward secrecy; at the same time, we discover that the rekeying protocol is vulnerable to an unknown key-share (UKS) attack. We proceed in an incremental way: each protocol is examined in isolation, relying only on the guarantees provided by the previous ones and the robustness of the basic cryptographic primitives. Our research proves the formal correctness of MTProto 2.0 w.r.t. most relevant security properties, and it can serve as a reference for implementation and analysis of clients and servers.

The Theory of Contexts is a type-theoretic axiomatization aiming to give a metalogical account of the fundamental notions of variable and context as they appear in Higher Order Abstract Syntax. In this paper, we prove that this theory is consistent by building a model based on functor categories . By means of a suitable notion of forcing , we prove that this model validates Classical Higher Order Logic, the Theory of Contexts, and also (parametrised) structural induction and recursion principles over contexts. Our approach, which we present in full detail, should also be useful for reasoning on other models based on functor categories. Moreover, the construction could also be adopted, and possibly generalized, for validating other theories of names and binders.

We investigate a framework for representing and reasoning about syntactic and semantic aspects of typed languages with variable binders.First, we introduce typed binding signatures and develop a theory of typed abstract syntax with binders. Each signature is associated to a category of "presentation" models, where the language of the typed signature is the initial model.At the semantic level, types can be given also a computational meaning in a (possibly different) semantic category. We observe that in general, semantic aspects of terms and variables can be reflected in the presentation category by means of an adjunction. Therefore, the category of presentation models is expressive enough to represent both the syntactic and the semantic aspects of languages.We introduce then a metalogical system, inspired by the internal languages of the presentation category, which can be used for reasoning on both the syntax and the semantics of languages. This system is composed by a core equational logic tailored for reasoning on the syntactic aspects; when a specific semantics is chosen, the system can be modularly extended with further "semantic" notions, as needed.

Introduces a new paradigm for concurrency, called behaviours-as-types. In this paradigm, types are used to convey information about the behaviour of processes: while terms correspond to processes, types correspond to behaviours. We apply this paradigm to Winskel's (1994) process algebra. Its types are similar to Kozen's (1983) modal /spl mu/-calculus; hence, they are called modal /spl mu/-types. We prove that two terms having the same type denote two processes which behave in the some way, that is, they are bisimilar. We give a sound and complete compositional typing system for this language. Such a system naturally also recovers the notion of bisimulation on open terms, allowing us to deal with processes with undefined parts in a compositional manner.