CONCUR 2004 – Concurrency Theory- P9: The purpose of the CONCUR conferences is to bring together researchers, developers and students in order to advance the theory of concurrency and promote its applications. Interest in this topic is continually growing, as a consequence of the importance and ubiquity of concurrent systems and their applications, and of the scientific relevance of their foundations. | 226 M. Bugliesi et al. The types T v with v e r w rw indicate the types of channels carrying values of type T with the associated capabilities for reading writing or both. By delivering the channel s at different types we can thus enforce an access control policy stating that only the spooler can read jobs. Notice however that the ability of that type system to control the behavior of the system is still rather limited. Indeed if we want to prevent clientjobs from being read by any process other than the spooler 5 we need to disallow situations like the following where the spooler forwards each of the jobs it receives to process SPY. The capabilitybased access control from 13 is of little help here unless one resorts to a more complex encoding of the system or imposes overly restrictive conditions . prevent the server from writing on all public channels . A similar problem arises in the following variation of the protocol in which clients request an ack message to be notified that their jobs have been printed. S vprint s x .print x print x . P acklx C 5 7 1 .ac x .5 7 2 .ac y As in the previous case the capability-based type system will fail to detect violations of the intended protocol due to malicious or erroneous servers that discard jobs by say running the process s x .ack x . To counter these problems we propose a novel typing discipline in which we complement the capability-based control system of 13 with a richer class of types that convey information needed to describe and prescribe the ways that values may be exchanged within the different system components. The new types have the form G T A where G identifies the authority in control of the values of that type T describes the structure of those values and A is a delivery policy governing the circulation of such values along the channels of the system. To illustrate the typing construes j as a file descriptor to be first delivered to the spooler then passed on to the printer and only then re-transmitted
