Vicarious trauma: a comparison of clinicians who treat survivors of sexual abuse and sexual offenders.
This study compared vicarious trauma in a random sample of male and female clinicians who treat survivors (n=95) and those who treat offenders (n=252). A national survey was conducted with members of the Association for the Treatment of Sexual Abusers (ATSA) and the American Professional Society on the Abuse of Children (APSAC). These data were used to test the relative contribution of variables theorized to contribute to two vicarious trauma effects (avoidance and intrusions) using the Impact of Event Scale. The sample reported high levels of avoidance and intrusions. Variables associated with vicarious trauma differed based on client population served. Sequential regression analyses were used to examine theoretically derived variables. Implications for practice and further research are discussed.


#include "../asm.h"
#define _LANGUAGE_ASSEMBLY
#include "../../../../reservedarea.h"

.globl VIConfigure480p
VIConfigure480p:
	lhz			%r0, 2 (%r3)
	srwi		%r5, %r0, 2
	cmpwi		%r5, 1
	beq			1f
	cmpwi		%r5, 4
	bne			2f
1:	subi		%r5, %r5, 1
	insrwi		%r0, %r5, 14, 16
2:	lis			%r4, VAR_AREA
	stw			%r5, VAR_TVMODE (%r4)
	insrwi		%r0, %r5, 14, 0
	li			%r8, 0
	li			%r7, 0
	lhz			%r6, 8 (%r3)
	slwi		%r6, %r6, 1
	cmpwi		%r6, 480
	ble			6f
	cmpwi		%r6, 574
	ble			4f
	oris		%r0, %r0, 2
	li			%r8, 1
	lhz			%r6, 8 (%r3)
	lhz			%r5, 6 (%r3)
	cmpw		%r5, %r6
	bgt			6f
	cmpwi		%r5, 264
	ble			6f
	clrrwi		%r5, %r5, 1
	cmpwi		%r5, 480
	ble			3f
	subi		%r5, %r5, 528
	slwi		%r5, %r5, 1
	addi		%r5, %r5, 480
	sth			%r5, 6 (%r3)
3:	sth			%r5, 8 (%r3)
	mr			%r6, %r5
	b			6f
4:	lhz			%r6, 6 (%r3)
	cmpwi		%r6, 240
	ble			5f
	subi		%r6, %r6, 264
	slwi		%r6, %r6, 1
	addi		%r6, %r6, 240
	sth			%r6, 6 (%r3)
5:	sth			%r6, 8 (%r3)
	slwi		%r6, %r6, 1
6:	subfic		%r5, %r6, 480
	srwi		%r5, %r5, 1
	sth			%r5, 12 (%r3)
	sth			%r6, 16 (%r3)
	stb			%r7, 22 (%r3)
	stb			%r8, VAR_VFILTER_ON (%r4)
	stw			%r0, 0 (%r3)

.globl VIConfigure480p_length
VIConfigure480p_length:
.long (VIConfigure480p_length - VIConfigure480p)


Proxy consent and counterfactuals.
When patients are in vegetative states and their lives are maintained by medical devices, their surrogates might offer proxy consents on their behalf in order to terminate the use of the devices. The so-called 'substituted judgment thesis' has been adopted by the courts regularly in order to determine the validity of such proxy consents. The thesis purports to evaluate proxy consents by appealing to putative counterfactual truths about what the patients would choose, were they to be competent. The aim of this paper is to reveal a significant limitation of the thesis, which has hitherto been recognised only vaguely and intuitively. By appealing to the metaphysics of counterfactuals I explain how the thesis fails to determine the validity of proxy consents in a number of actual cases.


Gastric ulceration after fundoplication.
Gastric ulceration after fundoplication for gastroesophageal reflux is relatively uncommon, occurring in 1% to 3% of cases. During the period 1974 to 1979, approximately 100 modified Belsey fundoplications were performed at McMaster University Medical Centre. In four patients gastric ulceration developed after the surgery. In all cases the ulcers were located in the proximal stomach, an unusual site. Published reports of gastric ulceration after fundoplication were reviewed, special attention being given to the cause. The authors conclude that local ischemia and mechanical trauma are important in the development of ulceration, which can occur as early as one week after fundoplication. The detection of ulcers requires awareness of the condition and special attention to the symptoms. Because the gastric anatomy is altered by the fundal wrap, the area can be visualized more easily by double-contrast barium studies than by endoscopy.


London Car Bomb

Found 29th Jun 2007Found 29th Jun 2007

So it didn't detonate today by some off-chance, ok, but why are certain groups getting congratulated? This is luck and nothing more. Some people (the bombers) are obviously feeling too brave and need to be subdued with preemptive strikes. How about bringing back the death penalty? Gordon Brown, stop giving money to Africa and help people who will get killed on your own turf first.

By giving in to certain groups who make threats wether directly or indirectly, the situation will only get worse.

As you say it was complete luck, Thanks goodness they managed to see the smoke before it actually went off and went to check it out.

Just glad nobody was injured and hope the bastârd driver/bomb maker is caught and hung.

29th Jun 2007

Iom-RF

As you say it was complete luck, Thanks goodness they managed to see the … As you say it was complete luck, Thanks goodness they managed to see the smoke before it actually went off and went to check it out.Just glad nobody was injured and hope the bastârd driver/bomb maker is caught and hung.

As far as they're concerened, it misdetinated meaning the smoke was actually the reaction of the detination.

So it detinated, but didnt explode, luckily, reminds me a bit of a bodged attempt on 21/07/05.

They're now investigating another car in Park Lane, London.

29th Jun 2007

Well thank goodness the bomb didn't go off.

I'd be very wary of my car bombs though, More so with streets coming to a stand still in rush hour and with many roads closed off its only going to get busier.

Original Poster29th Jun 2007

Iom-RF

As you say it was complete luck, Thanks goodness they managed to see the … As you say it was complete luck, Thanks goodness they managed to see the smoke before it actually went off and went to check it out.Just glad nobody was injured and hope the bastârd driver/bomb maker is caught and hung.

I just think London has been quite lucky so far to be honest. These people are merciless and generally not afraid to die. Britain needs to wake up and act fast. God knows how many things are not reported on the news. If you recall, 9-11 was said to be known about by the US govt. before it occured. Had people known about potential threats, vigilance levels should have increased. Therefore information hidden from the public (although understandably at times) can sometimes make things so much worse. People power is what it comes down to at the end of the day.

29th Jun 2007

Blanco

I just think London has been quite lucky so far to be honest. These … I just think London has been quite lucky so far to be honest. These people are merciless and generally not afraid to die. Britain needs to wake up and act fast. God knows how many things are not reported on the news. If you recall, 9-11 was said to be known about by the US govt. before it occured. Had people known about potential threats, vigilance levels should have increased. Therefore information hidden from the public (although understandably at times) can sometimes make things so much worse. People power is what it comes down to at the end of the day.

While I can see the logic, I don't think it'll happen because:a) Releasing information will create panic (try to should 'Fire' in cinema and see what happens.b) If offenders would know that authorities are after them, there will be sudden change of plans.c) You can't even look on certain people without being accused for being racist.

..and so on...

29th Jun 2007

Kommunist

a) Releasing information will create panic (try to should 'Fire' in … a) Releasing information will create panic (try to should 'Fire' in cinema and see what happens.

If you start screaming in the street, people ignore you.If you start screaming in a plane, everyone joins in...

Original Poster29th Jun 2007

Kommunist

While I can see the logic, I don't think it'll happen because:a) … While I can see the logic, I don't think it'll happen because:a) Releasing information will create panic (try to should 'Fire' in cinema and see what happens.b) If offenders would know that authorities are after them, there will be sudden change of plans.c) You can't even look on certain people without being accused for being racist. ..and so on...

In answer to:

a) Some will panic, others will take action. It is better to cry wolf than be eaten by the wolf.b) It is probably better that offenders keep changing plans rather than get a chance to execute their plans.c) True, but during pearl harbor, the Japanese were rounded up and given the option of staying at the camp or going back to Japan. No attacks then occured within the US by resident Japanese people. Bear in mind the people doing/planning these attacks are Muslim and mainly of Pakistani descent as far as the UK goes. This ethnic group will have to face up to the problems within their community. That's just the way it is.

29th Jun 2007

In answer to your answers

a) True. But people can't live under constant pressure, they'll give up eventually. Or simply disregard the warnings.b) Well... not sure about this one. If, say, authorities know that Tower is going to be bombed and release this information to public, offenders might simply explode themselves in first shopping mall they see. c) Not possible because of political correctness. Not unless gov't (and self-appointed do-gooders too) realize that the country is at war.

29th Jun 2007

I predict thread locking in the near future and bans for comments. :giggle:

29th Jun 2007

Thankfully no one died

29th Jun 2007

Syzable

I predict thread locking in the near future and bans for comments. … I predict thread locking in the near future and bans for comments. :giggle:

What, do u mena??:thinking:

29th Jun 2007

Dealicous

What, do u mena??:thinking:

Your post has now gone i see. :thumbsup:

29th Jun 2007

I dont think the people in the 'high' places are doing enough to help the 'now' i think most of the operations etc in place by us and america are change things maybe in 5 - 10 years. But how many people are gonna die until then? I can see why some of it (the war etc) has to happen, and why these people are really hard to detain, but surely there must be SOMETHING there not not telling us. and i dont agree with the death penalty, noone has the right to say any person should die. and i think punishment should be given, jail etc death is an easy way out.

Original Poster29th Jun 2007

Kommunist

In answer to your answers :)a) True. But people can't live under constant … In answer to your answers :)a) True. But people can't live under constant pressure, they'll give up eventually. Or simply disregard the warnings.b) Well... not sure about this one. If, say, authorities know that Tower is going to be bombed and release this information to public, offenders might simply explode themselves in first shopping mall they see. c) Not possible because of political correctness. Not unless gov't (and self-appointed do-gooders too) realize that the country is at war.

haha... in answer to your answers to my answers...

a) Also true, but I think time is a great healer and if the British people are persistent enough to take care of their own turf, the attackers may eventually settle down. But just like your theory this is also a theory so I guess one will never know unless it is tried.b) Yeah there could be less subtle attacks made. But then people may be prepared for that. Being on edge is never good nor is panic. Unfortunately Britain doesn't have much choice as far as not being on edge goes... c) viva la revolution? :viking:

29th Jun 2007

Its worrying what the world is coming too, I dont understand how anyone could want to kill innocent people that they dont even know!

29th Jun 2007

i think its insane wanting to kill yourself aswell....

and even more that all these things happen just because of disagreements....i know not all this conflict is religious but the suicide bombers etc are doing it because they think they will be rewarded in the after etc...surely no religion encourages murder??? tho i havent researched all religions so i dunno....

29th Jun 2007

Blanco

haha... in answer to your answers to my answers...a) Also true, but I … haha... in answer to your answers to my answers...a) Also true, but I think time is a great healer and if the British people are persistent enough to take care of their own turf, the attackers may eventually settle down. But just like your theory this is also a theory so I guess one will never know unless it is tried.b) Yeah there could be less subtle attacks made. But then people may be prepared for that. Being on edge is never good nor is panic. Unfortunately Britain doesn't have much choice as far as not being on edge goes... c) viva la revolution? :viking:

a) IMHO, it'll simply become a part of life, like fear of getting parking ticket or being electrocuted in elevator. Not immediately, of course - a first couple of times people will be panicking, then just get used to it.b) You can't be prepared for such event. Say, there will be announcement on radio: there is a terror attack planned in London. So you avoiding London and so does terrorist... And there is a probability you'll meet each other.c) Not a single chance. Here is what will happen now (I'm trying to read the future :))- Police will arrest suspect(s). Of course, their names won't be John, Tom or Leslie. Not even Ivan or Boris.- Advocacy groups will start their campain on whateverphobia directed towards whatever group.- A conspiracy theory will emerge on a web. Its advocates will insist that this plot was organised by:1) Blair - as a middle finger sign to Brown2) Brown - as a sign that he can handle things3) Mossad - well.. just because they can4) KGB (sorry, FSB) - to kill Litvinenko friends5) Martians - they don't like other living forms, don't they?6) etc, etc, etc- A government will call for organising an 'understanding' dialogue between er... whatever group and.. well.. anybody.

And so on. Now tell me I can't read the future

29th Jun 2007

...and I'm in London for the first time in a couple of years on Monday and Tuesday. Nice timing. :-D

29th Jun 2007

duckmagicuk2

...and I'm in London for the first time in a couple of years on Monday … ...and I'm in London for the first time in a couple of years on Monday and Tuesday. Nice timing. :-D

Yup!, It'll probably be the best/safest time to go!!!

Once again Police and the general public will be on high alert, Constantly on the look out for anything suspicious! :thumbsup:

29th Jun 2007

nothing more suspicious that a car parked up with smoke streaming out...

29th Jun 2007

i think it was a set up because first they anger muslims with the rushdie knight which also seemed dodgey as they did at this time and again to anger muslims but they did not recieve the outcome they wanted so now they plan this many people are now having doubts about whats happening.

29th Jun 2007

kelly_o_fanatic

Its worrying what the world is coming too, I dont understand how anyone … Its worrying what the world is coming too, I dont understand how anyone could want to kill innocent people that they dont even know!

exactly like the women and children tony blair and bush killed in iraq and afghanistan also children and women dying in palestine how can these 1000s of deaths be allowed and now people allow tony blair to be head of the middle easy commity or whatever it is, i think many of the leader should stand up and disagree but i dont think that will happen as they just speak among themselves.

30th Jun 2007

i think it was a set up because first they anger muslims with the rushdie … i think it was a set up because first they anger muslims with the rushdie knight which also seemed dodgey as they did at this time and again to anger muslims but they did not recieve the outcome they wanted so now they plan this many people are now having doubts about whats happening.

Yeah, right. It seems that modern muslims are offended by just about anything these days. By the very act of our existance it seems.

exactly like the women and children tony blair and bush killed in iraq

Personally?

also children and women dying in palestine

It seems that their own government killed more muslims than anybody else. Just like they did during last two weeks.Oh.. and what about Darfur? No evil westerners there, so no one could be blamed? Or recent developments in Lebanon? It surely must be some westerner's fault?

now people allow tony blair to be head of the middle easy commity or … now people allow tony blair to be head of the middle easy commity or whatever it is, i think many of the leader should stand up and disagree but i dont think that will happen as they just speak among themselves.

I don't get it either, TBH. It was a rare occurance when I was in agreement with Putin who tried to block this.

30th Jun 2007

Kommunist

Yeah, right. It seems that modern muslims are offended by just about … Yeah, right. It seems that modern muslims are offended by just about anything these days. By the very act of our existance it seems. Personally?It seems that their own government killed more muslims than anybody else. Just like they did during last two weeks.Oh.. and what about Darfur? No evil westerners there, so no one could be blamed? Or recent developments in Lebanon? It surely must be some westerner's fault?I don't get it either, TBH. It was a rare occurance when I was in agreement with Putin who tried to block this.

All in favour say "aye"

AYE!!!!

30th Jun 2007

Kommunist

Yeah, right. It seems that modern muslims are offended by just about … Yeah, right. It seems that modern muslims are offended by just about anything these days. By the very act of our existance it seems.

Mdamz

All in favour say "aye"AYE!!!!

Aye!!!!!

30th Jun 2007

Wow, thats some great generalising there, seems like logic and common sense aren't too high on people's lists

More generalising and less self-education will only get this world into more trouble - don't delude yourselves into thinking you know all about the issues at hand, from the comments i have read in this thread and a few others, it seems there are too many people who are happy to comment before they even have a clue about things.IGNORANCE 1HUKD 0

30th Jun 2007

jcampwala

Wow, thats some great generalising there, seems like logic and common … Wow, thats some great generalising there, seems like logic and common sense aren't too high on people's listsMore generalising and less self-education will only get this world into more trouble - don't delude yourselves into thinking you know all about the issues at hand, from the comments i have read in this thread and a few others, it seems there are too many people who are happy to comment before they even have a clue about things.IGNORANCE 1HUKD 0

well if we want to stop terrorism we voted in the wrong political party. there is 1 party which can stop pretty much ALL terrorism in the UK.

30th Jun 2007

jcampwala

it seems there are too many people who are happy to comment before they even have a clue about things.IGNORANCE 1HUKD 0

I really appreciate your self-criticism :whistling:

30th Jun 2007

HU5TLER

exactly like the women and children tony blair and bush killed in iraq … exactly like the women and children tony blair and bush killed in iraq and afghanistan also children and women dying in palestine how can these 1000s of deaths be allowed and now people allow tony blair to be head of the middle easy commity or whatever it is, i think many of the leader should stand up and disagree but i dont think that will happen as they just speak among themselves.

I agree, also the soldiers who have been killed by being sent out there.

30th Jun 2007

^^^ yep also them the corruption of the goverment

30th Jun 2007

And what do you mean by the term 'Modern' muslim? i'm a muslim and i don't quiet understand what you mean by the term 'modern'?

offended by everything? What's that suppose to mean? Offended by the innocent lives lost in Iraq, Afghanistan, Palistine? for the so called 'War on terror'...i'm sorry but i think any humane person would feel something for these lives as would the majority of muslims for the lives lost in 7/7 and 9/11... and yes i use 'majority' and not all because there is obviously a minority of stupid ignorant muslims who beleive that killing innocent lives in the name of Islam is the right thing to do.

30th Jun 2007

Sensible post. ^^^^^^

30th Jun 2007

Just on a side note.......i know this is a thread for debate but please be careful not to start name calling and causing offence as it is pointless and has happened in the past.

Not aimed at anyone.....:thumbsup:

30th Jun 2007

Kopi

And what do you mean by the term 'Modern' muslim? i'm a muslim and i … And what do you mean by the term 'Modern' muslim? i'm a muslim and i don't quiet understand what you mean by the term 'modern'?offended by everything? What's that suppose to mean? Offended by the innocent lives lost in Iraq, Afghanistan, Palistine? for the so called 'War on terror'...i'm sorry but i think any humane person would feel something for these lives as would the majority of muslims for the lives lost in 7/7 and 9/11... and yes i use 'majority' and not all because there is obviously a minority of stupid ignorant muslims who beleive that killing innocent lives in the name of Islam is the right thing to do.

Modern was used as in 'recently' - I am referring to modern days (as I don't remember seeing demostration of such scale even 20 years ago). . Not as in 'modern religion'.As to offended by everything - yes, so it seems. Just about any development of the world affair seems to have some effect on Muslims. Other people might also be outraged by some events, but I don't recall seeing demonstrations with slogans 'Death to England' in Russia because Berezovsky was granted asylum in this country. And believe me, he is seen as one of the worst enemies there.

As to feeling for people... Yes, I feel for innocents, but not for those who is blowing their own (or other) people in the name of whatever. Just like Hamas in last two weeks and Palestinians in Lebanon recently. And, as a Muslim, can you tell me how you feel towards Muslims who kill their fellow Muslims? Not everything in this world is Blair's fault, you know.

30th Jun 2007

Kopi

not all because there is obviously a minority of stupid ignorant muslims … not all because there is obviously a minority of stupid ignorant muslims who beleive that killing innocent lives in the name of Islam is the right thing to do.

Top post! :thumbsup:

I'm not saying every Muslim is an extremist though, But I do think more could be done to stop the ones that are, Surely someone would hear the plans etc.

30th Jun 2007

why do you think "minority" are turning to this , it could all be stopped by pulling troops out and this will help both the killing of soldiers and killing of civilians.

And what do you mean by the term 'Modern' muslim? i'm a muslim and i don't quiet understand what you mean by the term 'modern'?

offended by everything? What's that suppose to mean? Offended by the innocent lives lost in Iraq, Afghanistan, Palistine? for the so called 'War on terror'...i'm sorry but i think any humane person would feel something for these lives as would the majority of muslims for the lives lost in 7/7 and 9/11... and yes i use 'majority' and not all because there is obviously a minority of stupid ignorant muslims who beleive that killing innocent lives in the name of Islam is the right thing to do.

nice

Not everything in this world is Blair's fault, you know.

i know its partly bushes too but they caused all this friction to start

30th Jun 2007

jcampwala

Wow, thats some great generalising there, seems like logic and common … Wow, thats some great generalising there, seems like logic and common sense aren't too high on people's listsMore generalising and less self-education will only get this world into more trouble - don't delude yourselves into thinking you know all about the issues at hand, from the comments i have read in this thread and a few others, it seems there are too many people who are happy to comment before they even have a clue about things.IGNORANCE 1HUKD 0

QFE

Sooo right!

30th Jun 2007

Nice quoting there HU5TLER, Made for difficult reading.

You seem set that its Blair's or Bush's fault, Ok even if it was, How does this warrant the killing of innocent people in London etc?

Just because Blair made the decision to go to war, Doesn't mean the Great Brittish public still support that decision.

30th Jun 2007

yh but im not saying its right there killing innocent people in other countries and these mulims here are killing innocent people here.

if the troops were out it would finish.

i am no way supporting suicide bombings btw.

30th Jun 2007

HU5TLER

if the troops were out it would finish.

Thats just an opinion, certainly not fact.

If troops are pulled out thats one demand fulfilled, they then push for something else.... it's human nature.


<?xml version="1.0" encoding="UTF-8"?>
<doctrine-mapping xmlns="http://doctrine-project.org/schemas/orm/doctrine-mapping"
                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                  xsi:schemaLocation="http://doctrine-project.org/schemas/orm/doctrine-mapping
                          http://raw.github.com/doctrine/doctrine2/master/doctrine-mapping.xsd">

    <entity name="Kreta\TaskManager\Domain\Model\User\User"
            table="user"
            repository-class="Kreta\TaskManager\Infrastructure\Persistence\Doctrine\ORM\User\DoctrineORMUserRepository">
        <id name="id" type="user_id"/>
    </entity>
</doctrine-mapping>


//
//     Generated by class-dump 3.5 (64 bit).
//
//     class-dump is Copyright (C) 1997-1998, 2000-2001, 2004-2015 by Steve Nygard.
//

#import <GameCenterPrivateUI/GKFriendsSplittingDataSource.h>

@class GKChallenge;

@interface GKChallengesPickerDataSource : GKFriendsSplittingDataSource
{
    GKChallenge *_challenge;
}

@property(retain, nonatomic) GKChallenge *challenge; // @synthesize challenge=_challenge;
- (_Bool)canSelectPlayerInfo:(id)arg1;
- (void)configureDataSource;
- (void)dealloc;
- (id)initWithChallenge:(id)arg1;

@end


Daily Archives: January 25, 2012

Famed Greek film director, Theo Angelopoulos died Tuesday from injuries received from being hit by a motorcycle near the set of his latest film. His career spanned four decades. Politics, immigration, and war were common themes of his films. The … Continue reading →


Effective sizes of livestock populations to prevent a decline in fitness.
In livestock populations, fitness may decrease due to inbreeding depression or as a negatively correlated response to artificial selection. On the other hand, fitness may increase due to natural selection. In the absence of a correlated response due to artificial selection, the critical population size at which the increase due to natural selection and the decrease due to inbreeding depression balance each other is approximately D/2σwa (2), where D=the inbreeding depression of fitness with complete inbreeding, and σwa (2)=the additive genetic variance of fitness. This simple expression agrees well with results from transmission probability matrix methods. If fitness declines as a correlated negative response to artificial selection, then a large increase in the critical effective population size is needed. However, if the negative response is larger than the response to natural selection, a reduction in fitness cannot be prevented. From these results it is concluded that a negative correlation between artificial and natural selection should be avoided. Effective sizes to prevent a decline in fitness are usually larger than those which maximize genetic gain of overall efficiency, i.e., the former is a more stringent restriction on effective size. In the examples presented, effective sizes ranged from 31 to 250 animals per generation.


The oldest finds from Solothurn city probably date from the Paleolithic era. The remains of a Mesolithic camp were discovered in 1986 during renovations of the former Kino Elite building. From the Neolithic, Bronze and Iron Age, only a few scattered items have been discovered.[3]

The Roman settlement at Solothurn was probably built around AD 15-25 as a road station and bridge head on the road from Aventicum to Augusta Raurica or Vindonissa. A small vicus or settlement quickly developed around the castrum. Solothurn is first mentioned in 219 as vico salod[uro][4] on the so-called Eponastein. The name may indicate either that a Celtic settlement existed on the site before or just be a testimony to the mixed Gallo-Roman culture in the north-west provinces of the Roman Empire.[5] It came to be known as Salodurum. Its strategical importance lay in the position at the approach to the Rhine from southeast. In the 2nd-3rd Century AD, the vicus expanded rapidly to fill almost all of what is now the old city of Solothurn, including a portion of today's suburb south of the Aare.[5]

The Roman bridge was probably somewhat above the current Wengibrücke. The Roman era river bed was 40–80 meters (130–260 ft) north of the present Aare river. The main street of the Vicus was well below the present main street. In addition to the normal government of the settlement, there were two mayors (magistri), and a six member college (seviri Augustales), which was entrusted with supporting the imperial cult. Salodurum was also home to a guard detachment of the XXII Legion, whose high command was stationed in Mainz in Germany. According to inscriptions, there was a temple of Jupiter, a temple of Apollo Augustus and an altar to the goddess of horses Epona, who was popular in the Roman military and of Celtic origin. However, the locations of those three temples is not known. There was bath house on the main street and a pottery district in the northwest of the town which have been documented archaeologically. A cemetery with urns and cremation burials on the eastern end of the Vicus was discovered in 1762-63 during the demolition of the old church of St. Ursus. In addition, two Roman tombs were discovered in the same area.[5]

Around 325-350, the unfortified settlement along the road was transformed into a fortified camp or castrum, which covered only half of the former settlement area. A 2–3 meters (6.6–9.8 ft) thick and 9 m (30 ft) high wall was built around the settlement. The new, fortified town was bell-shaped, and is still visible in the cadastral map of the city. At various points in the city, large and small pieces of the old Roman wall are still visible in the houses of the old town. The location of a gate in the north and a tower in the south-east corner are known and it is likely that there were additional gates and towers. Almost nothing is known about the buildings inside the walls.[6]

In the Early Middle Ages there were two settlement centres, a secular settlement in the former castrum and a religious settlement on the grounds of the late-Roman cemeteries outside the walls. Both the religious histories and archeological discoveries indicate that both areas remained inhabited continuously into the Early Middle Ages. The former chapel of St. Stephen inside the castrum was built on the foundation of an earlier, late-Roman building. A burial memorial in the cemetery of the nearby St. Peter's Chapel dates to around the collapse of the Roman Empire. By the middle of the 5th Century, St. Eucherius of Lyon mentions the martyrdom of St. Ursus and St. Victor and a cult of saints in Solothurn. About 500 AD, the Burgundian Princess Sedeleuba took the bones of St. Victor to Geneva, while the bones of St. Ursus remained in Solothurn. The church dedicated to the veneration of Saint Ursus is first mentioned in 870.[6]

During the Early Middle Ages, Solothurn was part of the Kingdom of Lotharingia (Lorraine). After the collapse of Lotharingia, it became part of the Second Kingdom of Burgundy. In 1033, the Kingdom of Burgundy became part of the Holy Roman Empire and Solothurn gained some independence. In 1038, EmperorConrad II held court at Solothurn and there crowned his son, Henry III King of Burgundy. The royal court resided in Solothurn on several occasions until 1052, however, there is no evidence of a permanent royal palace. In 1127, it was acquired by the dukes of Zähringen. Under the rule of the Zähringens, in 1146, Solothurn's coins are first mentioned. In 1182, causidicus or Zähringen appointed judges first appeared in Solothurn. After the extinction of the Zähringer line in 1218 it became a free imperial city under the Holy Roman Emperor. In 1252, the town council and Schultheiss or mayor became mostly independent and had their own town seals.[7] In 1251 it was mentioned as saluerre and in 1275 as Solotren.[4] Starting around 1200, there was a council of nobles in the town.

In 1252, a group of nobles that could witness and support deeds, known as consuls et cives Solodorenses, first appears in the town. Initially the nobles exercised power over the entire town. However, the guild movement of the 14th Century resulted in a reduction in the power of the nobles and also a restricted guild system in Solothurn. By around 1350, an eleven member Altrat (Council of Elders) and a 22 member Jungrat (Younger Council) existed in the city. Each of the eleven guilds were represented by a member of the Altrat and two members of the Jungrat. These 33 councillors exercised, together with the mayor, the power of government and helped appoint law makers. The members of the two councils were elected each year by the citizens of the city, after which the councils and mayor appointed many of the government officials. The noble families retained some power as the guilds became part of the town council. However in 1459 the last noble family died out and positions on the council fell to wealthy farmers, butchers and millers.[8]

Until the pogrom on 1348 during an outbreak of the plague, there was a small Jewish community in Solothurn.[9]

Over the 13th to 15th centuries, the citizens of the city slowly emancipated themselves from the higher nobility. In 1276 and 1280 Emperor Rudolf I codified the previously poorly defined rights of the city and granted it the privilege de non Evocando or the right that their citizens were protected from trial in foreign courts. In 1344 Solothurn acquired the right to appoint their own Schultheiss from the Count of Buchegg, which was confirmed by Emperor Charles IV in 1360. In 1409, Emperor Ruprecht extended the de non Evocando privilege to include the royal High Court as well.[7]

As the city grew in power, it bound the Monastery of St. Ursus more closely to the city. In 1251 the city defeated claims made by the Monastery on the right to appoint the Schultheiss. Shortly after the acquisition of the right to the Schultheiss office in 1344, the city came into possession of the vogt right over the Monastery by granting citizenship rights to the former vogt (bailiff), Burkhard Senn the Elder. In 1512-20 the city received the right to appoint canons and provosts from the Pope.[7]

After the alliance with Bern in 1295, it became part of the Swiss Confederation. In 1382 the Habsburgs attacked the city, involving Solothurn in the Battle of Sempach. By the treaty of two years later, the Habsburgs renounced all claims to the territory of the city. The latter was expanded by acquisition of neighbouring lands in the 15th century, roughly up to the today's canton area.

Before 1200 there was a Zähringer fortified tower north of the Monastery of St. Ursus. In the first half of the 13th Century, a city wall was built around the area of the former castrum as well as the adjoining industrial area to the east and the churches of St. Peter and St. Urs. Near the Monastery of St. Ursus, a Franciscan monastery was built, and after 1280 it formed the northern city wall on the eastern part of the city. In 1532, the French embassy with a church and stately home was built in the eastern half of the city. In the western part of Solothurn, the town hall was built. First it was along the main street and in 1476 it moved south of the Franciscan monastery. A main market place grew up along the main street, and in the first half of the 17th century it moved to the northern banks of the Aare river. The town hall, market place and clock tower formed the political and economic centre of city life.[10]

The medieval cooperative election of the mayor and councillors led to the creation of a nearly hereditary oligarchy by the 15th Century. By the second half of the 16th Century, the political voice of citizens was nearly totally suppressed. By the second half of the 17th Century, the government was run by a small group of patricians. The oligarchs were weakened in the 18th Century, when in 1718-21 the city council managed to regain some powers. However, in 1682, a new citizenship law prevented wealthy families who had moved into Solothurn from becoming members of the council. While this law reduced the number of people who could be on the city council, the introduction of a secret ballot procedure in 1764 and measures against vote-buying in 1774 allowed more and more non-patrician burghers to join the council.[8]

During the heyday of the patricians in the 17th and 18th Centuries, a number of elegant town houses (Reinert House 1692-93, Palais Besenval 1703-06) and summer residences outside the city (Sommerhaus Vigier 1648-50, Waldegg Castle 1682-86, Steinbrugg Castle 1665-68 and Blumenstein Castle 1725-28) were built. A number of new public buildings were also added including; the Arsenal (1610–19), the town hall with its north staircase tower (1632–34) and its eastern façade (Archive tower 1624, completed 1703-14), the Jesuit church (1680–89), the new Ambassadorenhof (1717–24), the Holy Spirit Hospital in a suburb (1735–1800) and the new classicist Church of St. Ursus (1763–90). In the 16th Century the town walls were reinforced with the Basel gate and three round towers.[10]

Between 1667-1727, following plans by Francesco Polatta, Jacques Le Prestre Tarade and Sébastien de Vauban, the city built fortifications with eleven full and half bastions. The new city wall increased the size of the city by including the eastern suburb of Kreuzacker. Until the 18th Century, prisoners were housed in the towers of the medieval and early modern fortifications store. Between 1753-61 a new prison was built outside the city walls, which remained in use into the 20th Century. A gallows was first mentioned in 1460 and was located northeast of the city near Feldbrunnen. A second gallows was located to the southwest of the city.[10]

The Early Modern Period in Solothurn ended, as in the rest of Switzerland, with the French invasion in 1798.

Following the capitulation of Solothurn on 2 March 1798, the French General Balthazar Alexis Henri Schauenburg set up a provisional government on the following day. The new government met in April to set up the new constitution. The eleven old Vogtei (baillywicks) were replaced by five districts: Solothurn, Biberist, Balsthal, Olten, and Dornach. The municipal Bürgergemeinde laid claim to the assets of the defunct city-state and in 1801 it received the Sönderungsconvention, large estates and extensive forest land outside the city. In 1831 the cantonal parliament withdrew all political power from the eleven city guilds. Over the following years (1831–1842) all the guilds were dissolved. Due to the municipal law of 1859, the enforcement of the Federal Constitution of 1874 and the Cantonal Constitution of 1875, an Einwohnergemeinde was created. The Einwohnergemeinde included all residents of the city, as opposed to the more limited Bürgergemeinde. The division of property between residents and the Bürgergemeinde proved to be lengthy and could not be completed until 1978 and then only with the help of the Executive Council.[11]

Since 1897, the municipal council has been elected by proportional voting and consists of 30 members and 15 alternate members. As the executive body, it elects the council commission (seven members). Mayor and Vice-Mayor are elected by the people. The municipal assembly is the legislative body. The composition of the council remained remarkably stable between 1917-73. The Liberals held an average of 60% of the seats, the Social Democrats and the Conservative People's Party (CVP today), about 20% each. In 1970, the municipality granted voting rights for women. With the emergence of new parties, the Liberals lost its dominant position. 2009, the FDP 30%, SP 23%, CVP 23%, the Greens 17% and 7% of the votes go to the SVP.[11]

Solothurn has an area, as of 2009[update], of 6.28 square kilometers (2.42 sq mi). Of this area, 1.42 km2 (0.55 sq mi) or 22.6% is used for agricultural purposes, while 0.17 km2 (0.066 sq mi) or 2.7% is forested. Of the rest of the land, 4.37 km2 (1.69 sq mi) or 69.6% is settled (buildings or roads), 0.33 km2 (0.13 sq mi) or 5.3% is either rivers or lakes.[12]

Of the built up area, industrial buildings made up 4.1% of the total area while housing and buildings made up 38.5% and transportation infrastructure made up 17.5%. Power and water infrastructure as well as other special developed areas made up 1.9% of the area while parks, green belts and sports fields made up 7.5%. Out of the forested land, 0.5% of the total land area is heavily forested and 2.2% is covered with orchards or small clusters of trees. Of the agricultural land, 14.2% is used for growing crops and 7.0% is pastures, while 1.4% is used for orchards or vine crops. All the water in the municipality is flowing water.[12]

Solothurn is located in the north-west of Switzerland on the banks of the Aare and on the foot of the Weissenstein Jura mountains.

Solothurn has a population (as of December 2013[update]) of 16,599.[2] As of 2008[update], 21.1% of the population are resident foreign nationals.[15] Over the last 10 years (1999–2009 ) the population has changed at a rate of 4.4%.[16]

Most of the population (as of 2000[update]) speaks German (13,270 or 85.7%), with Italian being second most common (469 or 3.0%) and Albanian being third (261 or 1.7%). There are 193 people who speak French and 19 people who speak Romansh.[17]

As of 2008[update], the gender distribution of the population was 48.1% male and 51.9% female. The population was made up of 5,891 Swiss men (37.0% of the population) and 1,775 (11.1%) non-Swiss men. There were 6,669 Swiss women (41.8%) and 1,604 (10.1%) non-Swiss women.[18] Of the population in the municipality 3,864 or about 24.9% were born in Solothurn and lived there in 2000. There were 3,630 or 23.4% who were born in the same canton, while 4,135 or 26.7% were born somewhere else in Switzerland, and 3,193 or 20.6% were born outside of Switzerland.[17]

In 2008[update] there were 115 live births to Swiss citizens and 27 births to non-Swiss citizens, and in same time span there were 190 deaths of Swiss citizens and 10 non-Swiss citizen deaths. Ignoring immigration and emigration, the population of Swiss citizens decreased by 75 while the foreign population increased by 17. There were 8 Swiss men and 13 Swiss women who immigrated back to Switzerland. At the same time, there were 91 non-Swiss men and 78 non-Swiss women who immigrated from another country to Switzerland. The total Swiss population change in 2008 (from all sources, including moves across municipal borders) was an increase of 98 and the non-Swiss population increased by 161 people. This represents a population growth rate of 1.7%.[15]

The age distribution, as of 2000[update], in Solothurn is; 913 children or 5.9% of the population are between 0 and 6 years old and 2,013 teenagers or 13.0% are between 7 and 19. Of the adult population, 888 people or 5.7% of the population are between 20 and 24 years old. 4,832 people or 31.2% are between 25 and 44, and 3,678 people or 23.7% are between 45 and 64. The senior population distribution is 2,068 people or 13.4% of the population are between 65 and 79 years old and there are 1,097 people or 7.1% who are over 80.[19]

As of 2000[update], there were 6,784 people who were single and never married in the municipality. There were 6,403 married individuals, 1,144 widows or widowers and 1,158 individuals who are divorced.[17]

As of 2000[update], there were 7,447 private households in the municipality, and an average of 1.9 persons per household.[16] There were 3,468 households that consist of only one person and 303 households with five or more people. Out of a total of 7,625 households that answered this question, 45.5% were households made up of just one person and there were 49 adults who lived with their parents. Of the rest of the households, there are 1,907 married couples without children, 1,455 married couples with children There were 405 single parents with a child or children. There were 163 households that were made up of unrelated people and 178 households that were made up of some sort of institution or another collective housing.[17]

In 2000[update] there were 1,311 single family homes (or 44.3% of the total) out of a total of 2,957 inhabited buildings. There were 838 multi-family buildings (28.3%), along with 441 multi-purpose buildings that were mostly used for housing (14.9%) and 367 other use buildings (commercial or industrial) that also had some housing (12.4%). Of the single family homes 161 were built before 1919, while 62 were built between 1990 and 2000. The greatest number of single family homes (443) were built between 1919 and 1945.[20]

In 2000[update] there were 8,586 apartments in the municipality. The most common apartment size was 3 rooms of which there were 2,954. There were 728 single room apartments and 1,634 apartments with five or more rooms. Of these apartments, a total of 7,272 apartments (84.7% of the total) were permanently occupied, while 794 apartments (9.2%) were seasonally occupied and 520 apartments (6.1%) were empty.[20] As of 2009[update], the construction rate of new housing units was 3.3 new units per 1000 residents.[16] As of 2003[update] the average price to rent an average apartment in Solothurn was 980.18 Swiss francs (CHF) per month (US$780, £440, €630 approx. exchange rate from 2003). The average rate for a one room apartment was 568.85 CHF (US$460, £260, €360), a two room apartment was about 725.13 CHF (US$580, £330, €460), a three room apartment was about 904.51 CHF (US$720, £410, €580) and a six or more room apartment cost an average of 1564.78 CHF (US$1250, £700, €1000). The average apartment price in Solothurn was 87.8% of the national average of 1116 CHF.[21] The vacancy rate for the municipality, in 2010[update], was 0.45%.[16]

The old town was built between 1530 and 1792 and shows an architectural combination of Italian Grandezza, French style and Swiss ideas.

In 1980, Solothurn was awarded the Wakker Prize for the development and preservation of its architectural heritage.

Solothurn is home to 18 structures that are listed as Swiss heritage sites of national significance. The religious buildings on the list are; the Visitation Convent, the Jesuit Church with Kollegium (Lapidarium), the Swiss Reformed Church on Westringstrasse and the St. Ursen Cathedral. There are four civic buildings on the list; the old Armory which is now the Cantonal Museum, the Rathaus (town council house), the State Archives at Bielstrasse 41 and the nearby Central Library at Bielstrasse 39. Two other museums are on the list, the Art Museum and the Naturmuseum. There are two houses and two public objects on the list; the Haller-Haus (former Bishops Palace) at Baselstrasse 61, the Sommerhaus Vigier at Untere Steingrubenstrasse 21, the Mauritius Fountain and the city clock tower. Two castles are listed; the former Blumenstein Castle and Steinbrugg Castle. Finally, the list includes the old city of Salodurum which was a Roman era Vicus and the medieval and early modern city as well as the city walls. The entire old city of Solothurn is part of the Inventory of Swiss Heritage Sites.[22]

Sights include:

Historical Museum of Solothurn

Besenval Palace

Cathedral of St. Ursus (1762–73). It was begun by Gaetano Matteo Pisoni and completed by Paolo Antonio Pisoni. The interior has stuccoes by Francesco Pozzi and canvasses by Domenico Corvi.

In the 2007 federal election the most popular party was the SP which received 24.09% of the vote. The next three most popular parties were the FDP (23.53%), the Green Party (18.56%) and the CVP (17.19%). In the federal election, a total of 5,767 votes were cast, and the voter turnout was 53.8%.[24]

As of 2010[update], Solothurn had an unemployment rate of 4.6%. As of 2008[update], there were 22 people employed in the primary economic sector and about 4 businesses involved in this sector. 2,587 people were employed in the secondary sector and there were 178 businesses in this sector. 14,381 people were employed in the tertiary sector, with 1,226 businesses in this sector.[16] There were 8,023 residents of the municipality who were employed in some capacity, of which females made up 46.9% of the workforce.

In 2008[update] the total number of full-time equivalent jobs was 13,378. The number of jobs in the primary sector was 16, of which 7 were in agriculture and 9 were in forestry or lumber production. The number of jobs in the secondary sector was 2,430 of which 1,398 or (57.5%) were in manufacturing and 813 (33.5%) were in construction. The number of jobs in the tertiary sector was 10,932. In the tertiary sector; 1,537 or 14.1% were in wholesale or retail sales or the repair of motor vehicles, 454 or 4.2% were in the movement and storage of goods, 610 or 5.6% were in a hotel or restaurant, 583 or 5.3% were in the information industry, 975 or 8.9% were the insurance or financial industry, 1,095 or 10.0% were technical professionals or scientists, 614 or 5.6% were in education and 2,612 or 23.9% were in health care.[25]

In 2000[update], there were 13,529 workers who commuted into the municipality and 3,598 workers who commuted away. The municipality is a net importer of workers, with about 3.8 workers entering the municipality for every one leaving.[26] Of the working population, 20.1% used public transportation to get to work, and 40.3% used a private car.[16]

From the 2000 census[update], 5,463 or 35.3% were Roman Catholic, while 4,358 or 28.1% belonged to the Swiss Reformed Church. Of the rest of the population, there were 278 members of an Orthodox church (or about 1.79% of the population), there were 182 individuals (or about 1.18% of the population) who belonged to the Christian Catholic Church, and there were 248 individuals (or about 1.60% of the population) who belonged to another Christian church. There were 27 individuals (or about 0.17% of the population) who were Jewish, and 915 (or about 5.91% of the population) who were Islamic. There were 78 individuals who were Buddhist, 173 individuals who were Hindu and 27 individuals who belonged to another church. 3,139 (or about 20.27% of the population) belonged to no church, are agnostic or atheist, and 601 individuals (or about 3.88% of the population) did not answer the question.[17]

In Solothurn about 5,724 or (37.0%) of the population have completed non-mandatory upper secondary education, and 2,815 or (18.2%) have completed additional higher education (either university or a Fachhochschule). Of the 2,815 who completed tertiary schooling, 58.0% were Swiss men, 28.0% were Swiss women, 8.1% were non-Swiss men and 5.9% were non-Swiss women.[17]

During the 2010-2011 school year there were a total of students in the Solothurn school system. The education system in the Canton of Solothurn allows young children to attend two years of non-obligatory Kindergarten.[27] During that school year, there were Schülerbestand children in kindergarten. The canton's school system requires students to attend six years of primary school, with some of the children attending smaller, specialized classes. In the municipality there were 2010-2011 students in primary school. The secondary school program consists of three lower, obligatory years of schooling, followed by three to five years of optional, advanced schools. All the lower secondary students from Solothurn attend their school in a neighboring municipality.[28] As of 2000[update], there were 2,517 students in Solothurn who came from another municipality, while 188 residents attended schools outside the municipality.[26]

Solothurn is home to 2 libraries. These libraries include; the Zentralbibliothek Solothurn and the Fachhochschule Nordwestschweiz, Pädagogische Hochschule, Standort Solothurn (a library of the Fachhochschule Nordwestschweiz). There was a combined total (as of 2008[update]) of 1,195,394 books or other media in the libraries, and in the same year a total of 522,650 items were loaned out.[29]

The Canton of Solothurn was the eleventh to become part of the Swiss Confederation. There are eleven churches and chapels, as well as eleven historical fountains and eleven towers. The St. Ursus cathedral has eleven altars and eleven bells, and the stairs in front of the cathedral have levels between every eleven steps.

Öufi beer

A local brewery has named itself Öufi, which is Swiss German for eleven, and produces a beer with the same name


---
abstract: 'Security requirements in distributed software systems are inherently dynamic. In the case of authorization policies, resources are meant to be accessed only by authorized parties, but the authorization to access a resource may be dynamically granted/yielded. We describe ongoing work on a model for specifying communication and dynamic authorization handling. We build upon the $\pi$-calculus so as to enrich communication-based systems with authorization specification and delegation; here authorizations regard channel usage and delegation refers to the act of yielding an authorization to another party. Our model includes: (i) a novel scoping construct for authorization, which allows to specify authorization boundaries, and (ii) communication primitives for authorizations, which allow to pass around authorizations to act on a given channel. An authorization error may consist in, e.g., performing an action along a name which is not under an appropriate authorization scope. We introduce a typing discipline that [ensures]{} that processes never reduce to authorization errors, even when authorizations are dynamically delegated.'
author:
- Silvia Ghilezan Svetlana Jakšić Jovanka Pantović
- 'Jorge A. Pérez'
- Hugo Torres Vieira
title: A Typed Model for Dynamic Authorizations
---

Introduction
============

Nowadays, computing systems operate in distributed environments, which may be highly heterogeneous, including at the level of trustworthiness. It is often the case that collaborating systems need to protect themselves from malicious entities by enforcing authorization policies that ensure actions are carried out by properly authorized parties. Such *authorizations* to act upon a resource may be statically prescribed — for instance, a determined party is known to have a determined authorization — but may also be dynamically established — for example, when a server delegates a task to a slave it may be sensible to pass along the appropriate authorization to carry out the delegated task.

[As a motivating example, consider the message sequence chart given in Figure \[fig:bankmsc\] describing a scenario where a client interacts with a bank portal in order to request a credit. After the client submits the request, the bank portal asks a teller to approve the request, allowing him/her to join the ongoing interaction. Apart from some rating that could be automatically calculated by the bank portal, it is the teller who ultimately approves/declines the request. It then seems reasonable that the teller *impersonates* the bank when informing the client about the outcome of the request. At this point we may ask: is the teller authorized to act on behalf of the bank portal in this structured interaction? Even if the teller gained access to the communication medium when joining the interaction, the authorization to act on behalf of the bank portal may not be necessarily granted; in such cases an explicit mechanism that dynamically grants such an authorization is required. To account for this kind of scenarios, in previous work [@DBLP:journals/corr/GhilezanJPPV14] we explored the idea of *role authorizations*. It appears to us that the key notions underlying this idea can be well explored in a more general setting; here we aim at distilling such notions in a simple setting.]{}

![Credit request scenario.[]{data-label="fig:bankmsc"}](bankmsc){width="70mm"}

We distinguish an authorization from the resource itself: a system may already know the identity of the resource (say, an email address or a file name) but may not be authorized to act upon it (e.g., is not able to send an email on behalf of a given address or to write on a file). Also, it might be the case that the system acquires knowledge about the resource (for instance, by receiving an email address or a file) but not necessarily is immediately granted access to act upon it. We focus on communication-centered systems in which authorizations are a first-class notion modeled in a dedicated way, minimally extending the $\pi$-calculus [@DBLP:books/daglib/0004377] to capture dynamic authorization handling. As such, the resources that we consider are communication channels; authorizations concern the ability to communicate on channels.

Authorizations may be associated with a *spatial* connotation, as it seems fairly natural that a determined part of the system has access to a resource while the rest of the system does not. To this end, we introduce a *scoping operator* to specify delimited authorizations: we write ${({a})} {P}$ to specify that process ${P}$ is authorized to act upon the resource ${a}$. For example, by ${({a})} {{a}!{b}}.{Q}$ we specify a process that is authorized on channel ${a}$ and that is willing to use it to send ${b}$ after which it behaves as ${Q}$.

Also, since we are interested in addressing systems in which authorizations are dynamically passed around, we model authorization communication in a distinguished way by means of dedicated communication actions: we write ${{a}\langle{b}\rangle}.{P}$ to specify the action of sending an authorization to act upon ${b}$ (and proceeding as ${P}$) and ${{a}({b})}.{P}$ to specify the action of receiving an authorization to act upon ${b}$ (and proceeding as ${P}$), where in both cases channel ${a}$ is used as the underlying communication medium. We remark that both in the authorization scoping ${({a})} {P}$ and in the authorization reception ${{b}({a})}.{P}$ the name ${a}$ is not bound so as to capture the notion that authorizations are handled at the level of known identities.

Given the [sensitive]{} nature of an authorization, we believe it is natural to enforce a [*specialized*]{} discipline regarding authorization manipulation. Namely, we consider that the act of passing along an authorization —*authorization delegation*— entails the yielding of the communicated authorization. That is, a party willing to communicate an authorization loses it after synchronization. Consider, for example, a process $$S = {({a})} ( {{a}({b})}.{P}{\;|\;}{({b})} {{a}\langle{b}\rangle}.{Q})$$ while the process on the left-hand side of the parallel composition (${\;|\;}$) is awaiting an authorization to act on ${b}$ (via a synchronization on channel ${a}$), the process on the right-hand side is willing to delegate authorization to act on ${b}$. In one reduction step, process $S$ evolves to ${({a})} ( ({({b})}{P}) {\;|\;}{Q})$, thus capturing the fact that the process on the right (${Q}$) has now lost the authorization to act on ${b}$. Notice that this authorization transfer may have influence on the resources already known to the receiving party (i.e., process ${P}$ may specify communications on channel ${b}$).

[The fact that authorizations are yielded when communicated allows us to model a form of authorization accounting, in the sense that authorizations are viewed as a “countable” resource. As such, in general we would expect ${({a})}{({a})}{P}$ to differ from ${({a})}{P}$. However, since we intuitively interpret ${({a})}{P}$ as “the whole of ${P}$ is authorized to interact on ${a}$”, it does not seem sensible that part of ${P}$ can completely yield the authorization. Consider, e.g., process ${({a})}({{b}\langle{a}\rangle}.{P}{\;|\;}{Q})$ where it does not seem reasonable that the authorization delegation expressed by prefix ${{b}\langle{a}\rangle}$ interferes with the authorization on ${a}$ already held by ${Q}$ which is (concurrently) active in the authorization scope. ]{} [Hence, a]{} [system cannot create/discard valid authorizations (that are scoping active processes); authorizations can only float around.]{} It is also reasonable to [allow that]{} a party that delegates an authorization may get it back via another synchronization step. This way, our model [allows for]{} reasoning about authorization ownership and lending. [Finally, we envisage (in our untyped model) a possibility for sharing a given authorization scope with a specified number of parties. This may be represented by specifying multiple copies of the same authorization scope. For example, process ${({a})}{({a})}{({b})}{{b}\langle{a}\rangle}.{P}$ [(or ${({a})}{({b})}{{b}\langle{a}\rangle}.{({a})}{P}$)]{} will retain authorization scope for ${a}$ and reduce to [${({a})}{({b})}{P},$]{} after communication with ${({b})}{{b}({a})}.{Q}$]{}

Some previous works have explored dedicated scoping operators with security motivations (see, e.g., [@Giunti; @VivasYoshida]). However, to our knowledge, the particular combination of a (non binding) scoping construct with name passing as in the $\pi$-calculus seems to be new. The syntactic elements of our process model, together with the dynamic nature of authorizations, pose challenges at the level of statically identifying processes that act only upon resources for which they are properly authorized. In this paper we start exploring a typing discipline for authorization manipulation that allows to statically [ensure]{} that processes never incur in authorization errors, essentially by accounting process authorization requirements. In the remaining, we formally present the language and type system, and state our results.

Process Model {#s:model}
=============

[@rcl@l@]{} [P]{},[Q]{}& ::= & [0]{}&\
& | & [P]{}[|]{}[Q]{}&\
& | & [a]{}[P]{}&\
& | & [([a]{})]{} [P]{}&\
& | & .[P]{}&

[@rcl@l@]{} & ::= & [a]{}[l]{}[b]{}&\
& | & [a]{}[l]{}[x]{} &\
& | & [a]{}[l]{}[b]{}&\
& | & [a]{}[l]{}[b]{}&\

We introduce our process calculus with authorization scoping and authorization delegation. Let ${{\cal N}}$ be a countable set of [*names*]{}, ranged over by ${a},$ ${b},$ ${c}, \ldots,$ ${x},$ ${y},$ ${z}.$ The syntax of processes is given in Table \[tab:syntax\]. Processes ${0},$ ${P}{\;|\;}{Q},$ ${(\nu {a})}{P},$ ${{a}!{b}}.{P}$ and ${{a}?x}.{P}$ comprise the usual $\pi$-calculus operators for specifying inaction, parallel composition, name restriction, and output and input communication actions, respectively. We introduce three novel operators, motivated earlier:

1.  ${{a}\langle{b}\rangle}.{P}$ sends an authorization for the name ${b}$ on ${a}$ and proceeds as ${P}$;

2.  ${{a}({b})}.{P}$ receives an authorization for the name ${b}$ on ${a}$ and proceeds as ${P}$;

3.  ${({a})} {P}$ authorizes all actions on the channel ${a}$ in ${P}$.

We remark on the novel reasoning regarding scope authorization ${({a})}{P}$ in combination with $\pi$-calculus-like name passing, since all actions on channel ${a}$ in process ${P}$ are authorized, including actions originally specified for received names. For example, consider a process ${P}= {({b})}{({a})} {{b}?x}.{x!{c}}.{0}$ that interacts in a context that sends name ${a}$ on ${b}$. Then ${P}$ may evolve to ${P}' ={({b})} {({a})} {{a}!{c}}.{0}$, which is authorization safe. Still, authorizations may be “revoked” via authorization delegations.

We introduce some auxiliary notions and abbreviations, useful for the remaining formal presentation. [The set of free names of a process ${P}$, denoted ${\mathsf{fn}({P})}$, accounts for authorization constructs in the following way:]{} $$\begin{aligned}
{\mathsf{fn}({({a})} {P})} & \triangleq &  \{a\} \cup {\mathsf{fn}({P})}  \\
 {\mathsf{fn}({{a}\langle{b}\rangle}.{P})} = {\mathsf{fn}({{a}({b})}.{P})} & \triangleq &  \{a,b\} \cup{\mathsf{fn}({P})}\end{aligned}$$ Given a name $a$, we use $\alpha_{a}$ to refer to either ${{a}!{b}}$, ${{a}?x}$, ${{a}\langle{b}\rangle}$, or ${{a}({b})}$. We abbreviate $(\nu a_1)(\nu a_2)\ldots(\nu a_k) P$ by $(\nu \vec{a}) P$ and likewise ${(a_1)}{(a_2)} \ldots {(a_k)} P$ by ${(\vec{a})} P$.

$$\begin{array}{@{}c@{}}
  \inferrule[]{}
  {{P}{\;|\;}{0}\equiv{P}}\qquad\quad
  \inferrule[]{}
  {{P}{\;|\;}{Q}\equiv{Q}{\;|\;}{P}}\qquad\quad
  \inferrule[]{}
  {({P}{\;|\;}{Q}){\;|\;}{R}\equiv{P}{\;|\;}({Q}{\;|\;}{R})}\qquad\quad
  \inferrule[]{}
  {{(\nu {a})}{0}\equiv{0}}
   \vspace{2mm} \\
  \inferrule[]{}
  {{(\nu {a})}{(\nu {b})}{P}\equiv{(\nu {b})}{(\nu {a})}{P}}\qquad\quad
  \inferrule[]{}
  {{P}{\;|\;}{(\nu {a})}{Q}\equiv{(\nu {a})}({P}{\;|\;}{Q})\quad\text{if ${a}\notin{\mathsf{fn}({P})}$}}
    \qquad\quad
  \inferrule[]{}
  {{P}\equiv_{\alpha} {Q}\implies {P}\equiv {Q}}
 \vspace{2mm} \\
  \inferrule[]{}
  {{({a})}{({b})}{P}\equiv {({b})}{({a})}{P}}
    \qquad
  \inferrule[]{}
  {{({a})}{0}\equiv {0}}
  \qquad
    \inferrule[]{}
  {{({a})}({P}{\;|\;}{Q}) \equiv {({a})}{P}{\;|\;}{({a})}{Q}}
\qquad
  \inferrule[]{}
  {{({a})}{(\nu {b})}{P}\equiv {(\nu {b})}{({a})}{P}\quad\text{if ${a}\neq {b}$}
  }
\end{array}$$

*Structural congruence* expresses basic identities on the structure of processes; it is defined as the least equivalence relation between processes that satisfies the rules given in Table \[tab:structural\]. Apart from the usual identities for the static fragment of the $\pi$-calculus (cf. first seven rules in Table \[tab:structural\]), structural congruence gives basic principle for the novel authorization scope: (i) authorizations can be swapped around; (ii) authorizations can be discarded/created only for the inactive process; (iii) authorizations distributes over parallel composition; and (iv) authorizations and name restrictions can be swapped if the corresponding names differ. We remark that, differently from name restrictions, authorization scopes can [neither]{} be extruded/confined: since authorizations are specified for free names (that cannot be $\alpha$-converted), extruding/confining authorizations actually changes the meaning of processes. [For example, processes ${({b})}{{b}?{x}}.{{x}!{b}}.{0}$ and ${({a})}{({b})}{{b}?{x}}.{{x}!{b}}.{0}$ are not considered as structurally congruent, as the latter one authorizes the action on ${a}$ in case it receives ${a}$ through ${b},$ while the former one does not. Another distinctive property comes from the significance of multiplicity of authorization scopes. We do not adopt ${({a})}{P}\equiv {({a})}{({a})}{P}$ for ${P}\neq{0}$]{}, [for the sake of authorization accounting]{}. Before presenting the operational semantics of the language, we ensure that the rewriting supported by structural congruence is enough to isolate [top level]{} communication actions [together with their respective authorization scopes.]{}

\[pro:normalform\] For any process ${Q}$ we have that there are ${P}_1, \ldots,$ ${P}_k,$ ${\alpha}_1, \ldots,$ ${\alpha}_k,$ $\vec{c}$, and $\vec{a}_1$, …, $\vec{a}_k$, where $(\nu \vec{c})$ and ${(\vec{a}_i)}$ for $i \in 1,\ldots,k$ can be empty sequences, such that $$\label{normal_form}
{Q}\equiv (\nu \vec{c}) ({(\vec{a}_1)}{\alpha}_1.P_1 {\;|\;}{(\vec{a}_2)}{\alpha}_2.P_2  {\;|\;}\ldots {\;|\;}{(\vec{a}_k)}{\alpha}_k.P_k)$$

(by induction on the structure of ${Q}$)\
${Q}\equiv {0}:$ It is in the form (\[normal\_form\]).\
${Q}\equiv {Q}' {\;|\;}{Q}'':$ By induction hypothesis, we have that $${Q}'  \equiv  (\nu\vec{c})({(\vec{a}_1)}{\alpha}_1.P_1 {\;|\;}\ldots{\;|\;}{(\vec{a}_k)}{\alpha}_k.P_k) \qquad
{Q}'' \equiv  (\nu\vec{d})({(\vec{b}_1)}\beta_1.Q_1    {\;|\;}\ldots {\;|\;}{(\vec{b}_l)}\beta_l.Q_l)$$ and we can assume, by application of $\alpha$-conversion, that $\vec{d} \cap {\mathsf{fn}({Q}')} =\emptyset.$ Therefore, $${Q}\equiv (\nu\vec{c})(\nu\vec{d})
(
 {(\vec{a}_1)}{\alpha}_1.P_1{\;|\;}\ldots{\;|\;}{(\vec{a}_k)}{\alpha}_k.P_k {\;|\;}{(\vec{b}_1)}\beta_1.Q_1 {\;|\;}\ldots {\;|\;}{(\vec{b}_l)} \beta_l.Q_l
).$$

${Q}\equiv {(\nu {a})} {P}:$ Applying the induction hypothesis on ${P}$, we have that $${Q}\equiv {(\nu {a})} (\nu \vec{c}) ({(\vec{a_1})}{\alpha}_1.P_1 {\;|\;}{(\vec{a_2})}{\alpha}_2.P_2
{\;|\;}\ldots {\;|\;}{(\vec{a_k})}{\alpha}_k.P_k).$$

${Q}\equiv {({a})} {P}:$ By induction hypothesis and $\alpha$-conversion, we have that $${Q}\equiv {({a})} (\nu \vec{c}) ({(\vec{a}_1)}{\alpha}_1.P_1 {\;|\;}{(\vec{a}_2)}{\alpha}_2.P_2
{\;|\;}\ldots {\;|\;}{(\vec{a}_k)}{\alpha}_k.P_k),$$ where ${a}\not \in \{c_1,\ldots,c_k\}.$ Hence, $${Q}\equiv (\nu \vec{c})({({a})}{(\vec{a}_1)}{\alpha}_1.P_1 {\;|\;}\ldots {\;|\;}{({a})}{(\vec{a}_k)}{\alpha}_k.P_k).$$ ${Q}\equiv {\alpha}.{P}:$ It is in the form (\[normal\_form\]).

$$\begin{array}[t]{@{}c@{\qquad}c@{\qquad}c@{\qquad}c@{}}
\inferrule[(stru)]
{{P}\equiv {P}' {\rightarrow}{Q}' \equiv {Q}}
{{P}{\rightarrow}{Q}}
&
\inferrule[(parc)]
{{P}{\rightarrow}{Q}}
{{P}{\;|\;}{R}{\rightarrow}{Q}{\;|\;}{R}}
&
\inferrule[(newc)]
{{P}{\rightarrow}{Q}}
{{(\nu {a})} {P}{\rightarrow}{(\nu {a})} {Q}}
&
\inferrule[(autc)]
{{P}{\rightarrow}{Q}}
{{({a})} {P}{\rightarrow}{({a})} {Q}}
\\\\
\multicolumn{4}{c}
{\inferrule[(comm)]{}
{{(\vec{{a}}_1)}{({b})} {{b}!{c}}.{P}{\;|\;}{(\vec{{a}}_2)}{({b})}{{b}?x}.{Q}{\rightarrow}{(\vec{{a}}_1)}{({b})} {P}{\;|\;}{(\vec{{a}}_2)}{({b})}{Q}{\{{c}/x\}}
}}
\\\\
\multicolumn{4}{c}
{\inferrule[(auth)]{}
{{(\vec{{a}}_1)}{({b})}{({c})} {{b}\langle{c}\rangle}.{P}{\;|\;}{(\vec{{a}}_2)}{({b})}{{b}({c})}.{Q}{\rightarrow}{(\vec{{a}}_1)}{({b})} {P}{\;|\;}{(\vec{{a}}_2)}{({b})}{({c})}{Q}}}
\end{array}$$

We may then characterize the evolution of systems via a reduction relation, denoted by ${\rightarrow}$, defined as the least relation that satisfies the rules given in Table \[tab:red\], focusing on the representative cases for synchronization and closing the relation under structural congruence ${\text{\small \textsc{(stru)}}}$ and static contexts ${\text{\small \textsc{(parc)}}}$, ${\text{\small \textsc{(newc)}}}$, and ${\text{\small \textsc{(autc)}}}$. Rule ${\text{\small \textsc{(comm)}}}$ formalizes communication of names, stating that it can be performed only via authorized channel names — notice we single out authorization scopes on channel ${b}$ both for output and input. Authorization delegation is formalized by rule ${\text{\small \textsc{(auth)}}}$. It meets the following requirements: synchronization is realized via an authorized channel and the emitting process must have the authorization in order to delegate it away (names ${b}$ and ${c}$ in the rule, respectively); after sending an authorization for a name the emitting process proceeds (${P}$) falling outside of authorization scope of that name (losing authorization), and after receiving an authorization for a name the receiving process proceeds (${Q}$) under the scope of the received authorization (acquiring authorization). Notice rules ${\text{\small \textsc{(comm)}}}$ and ${\text{\small \textsc{(auth)}}}$ address action prefixes up to the relevant authorizations (cf. Proposition \[pro:normalform\]). We denote by ${\rightarrow}^{\star}$ the reflexive and transitive closure of ${\rightarrow}.$ We introduce some auxiliary notions in order to syntactically characterize *authorization errors* in our setting. First of all, we define the usual notion of *active contexts* for our calculus:

[@rcl@l@]{} \[\] ::= | [P]{}[|]{}\[\] | [a]{}\[\] | [([a]{})]{} \[\]

Active contexts allow us to talk about any active communication prefixes of a process. Also, we may introduce a predicate that states that an active context authorizes actions on a given channel. More precisely, for a given context and a channel, when the hole of the context is filled with an action on the channel, it is authorised for that action.

For an active context ${\mathcal{C}}[\cdot]$ and a channel ${a},$ the context authorization predicate, denoted ${\mathit{auth}({\mathcal{C}}[\cdot],{a})}$, is defined inductively on the structure of ${\mathcal{C}}[\cdot]$ as $${\mathit{auth}({\mathcal{C}}[\cdot],{a})}
\triangleq
\ \left\{\begin{array}{@{}l@{\quad}l@{}}
\mathit{false} & \text{if } {\mathcal{C}}[\cdot] = \cdot\\
\mathit{true} & \text{if } {\mathcal{C}}[\cdot] = {({a})}{\mathcal{C}}'[\cdot] \\
{\mathit{auth}({\mathcal{C}}'[\cdot],{a})} & \text{if } {\mathcal{C}}[\cdot] = {({b})}{\mathcal{C}}'[\cdot] \text{ and } {a}\neq {b}\\
{\mathit{auth}({\mathcal{C}}'[\cdot],{a})} & \text{if } {\mathcal{C}}[\cdot] = {P}{\;|\;}{\mathcal{C}}'[\cdot] \\
{\mathit{auth}({\mathcal{C}}'[\cdot],{a})} & \text{if } {\mathcal{C}}[\cdot] = {(\nu {b})}{\mathcal{C}}'[\cdot]
\end{array}\right.$$

We may then use active contexts and context authorization to precisely characterize errors in our model, since active contexts allow us to talk about any communication prefix in the process and the context authorization predicate allows to account for the authorizations granted by the context: processes that have active communication prefixes which are not authorized are errors.

\[d:error\] We say process ${P}$ is an error if $P \equiv {\mathcal{C}}[\alpha_{a}.{Q}]$ where

1.  $ {\mathit{auth}({\mathcal{C}}[\cdot],{a})}=\mathit{false}$ or

2.  $\alpha_{{a}} = {{a}\langle{b}\rangle}$ and ${\mathit{auth}({\mathcal{C}}[\cdot],{b})}=\mathit{false}$.

Notice that by $\alpha_{a}$ we refer to any communication action on channel ${a}$, so [intuitively communication actions that may cause stuck configurations according to our semantics (where synchronizations only occur when processes hold the proper authorizations) are seen as errors.]{}

Type System {#s:types}
===========

In order to statically single out the processes that can never evolve into authorization errors, we introduce a suitable type system that accounts for the authorizations required by the processes.

#### Typing Judgment and Typing Rules.

Let $\rho$ denote a set of names. The typing judgment $\rho \vdash {P}$ states that process ${P}$ is typed if the context provides authorizations for names $\rho$; hence the process performs actions in the (unauthorized) names $\rho$ (i.e., actions along names not under respective authorization scopes). Thus, $\emptyset \vdash {P}$ says that all communication actions prescribed by process ${P}$ are authorized, i.e., occur within the scope of the appropriate authorizations. We say that process ${P}$ is [*well typed*]{} if $\emptyset \vdash {P}$.

Typing rules are given in Table \[tab:typing\]. The inactive process contains no actions along unauthorized channel names $({\text{\small \textsc{tstop}}}).$ If two processes act along unauthorized channel names $\rho_1$ and $\rho_2,$ their parallel composition performs actions along the union $\rho_1\cup\rho_2$ of unauthorized names $({\text{\small \textsc{tpar}}}).$ If a typed process ${P}$ does not perform actions along a channel ${a},$ the process where name ${a}$ is restricted is typed under the same set of names as ${P}$ $({\text{\small \textsc{tnew}}}).$ If ${P}$ acts under a set of unauthorized names $\rho,$ then ${({a})}{P}$ authorizes ${a}$ in ${P}$ and thus performs actions under the set of unauthorized names $\rho\setminus\{{a}\}$ $({\text{\small \textsc{tauth}}}).$ Sending a name along a channel ${a}$ extends the set of unauthorized names with the name ${a}$ $({\text{\small \textsc{tsend}}}).$ Receiving a name ${x}$ along a channel ${a}$ extends the set of unauthorized names with the name ${a}$ and it is typed only if there is no unauthorized actions along ${x}$ within ${P}$ $({\text{\small \textsc{trecv}}}).$ Sending authorization for a name ${b}$ along a channel ${a}$ extends the set of unauthorized names with both names ${a}$ and ${b}$ $({\text{\small \textsc{tdeleg}}}).$ Receiving authorization for a name ${b}$ along a name ${a}$ is typed under the set of unauthorized names that is extended with ${a}$ and does not contain ${b}$ (since the reception authorizes ${b}$ in ${P}$).

$$\begin{array}[t]{@{}c@{\qquad}c@{\qquad}c@{\qquad}c@{}}
\inferrule[(tstop)]
{}{\emptyset \vdash {0}}
&
\inferrule[(tpar)]
{\rho_1 \vdash {P}\quad \rho_2 \vdash {Q}}
{\rho_1 \cup \rho_2 \vdash {P}{\;|\;}{Q}}
&
\inferrule[(tnew)]
{\rho \vdash {P}\quad {a}\not \in \rho}
{\rho \vdash {(\nu {a})} {P}}
&
\inferrule[(tauth)]
{\rho \vdash {P}}
{\rho \setminus \{{a}\} \vdash {({a})}{P}}
\\\\
\inferrule[(tsend)]
{\rho \vdash {P}}
{\rho \cup \{{a}\} \vdash {{a}!{b}}. {P}}
&
\inferrule[(trecv)]
{\rho \vdash {P}\quad x \not \in \rho}
{\rho \cup \{{a}\} \vdash {{a}?x}. {P}}
& \inferrule[(tdeleg)]
{\rho \vdash {P}\quad {b}\not \in \rho}
{\rho \cup \{{a},{b}\} \vdash {{a}\langle{b}\rangle}. {P}}
&
\inferrule[(trecp)]
{\rho \vdash {P}}
{(\rho \setminus \{{b}\})\cup \{{a}\} \vdash {{a}({b})}. {P}}
\end{array}$$

#### Main Results.

Our main result is *type safety*: well-typed processes never evolve into an (authorization) error, in the sense of Definition \[d:error\]. This is stated as Corollary \[cor:safety\]; before giving the main statement we show its supporting results. We first state a basic property of typing derivations: unauthorized names must be included in the free names of the process.

\[pro:freenames\] If $\rho \vdash {P}$ then $\rho \subseteq {\mathsf{fn}({P})}$.

(by induction on the depth of the derivation of $\rho \vdash {P}$)\
If $\emptyset\vdash{0}$ then ${\mathsf{fn}({0})}=\emptyset.$\
The following cases follow by definition of free names and the induction hypothesis.\
Case $\rho_1\cup\rho_2\vdash {P}{\;|\;}{Q}$ is derived from $\rho_1\vdash{P}$ and $\rho_2\vdash{Q}:$ ${\mathsf{fn}({P}{\;|\;}{Q})}={\mathsf{fn}({P})}\cup{\mathsf{fn}({Q})} \supseteq \rho_1\cup\rho_2.$\
Case $\rho\vdash{(\nu {a})}{P}$ is derived from $\rho\vdash{P}$ and ${a}\not\in\rho:$ ${\mathsf{fn}({(\nu {a})}{P})}={\mathsf{fn}({P})}\setminus\{{a}\}\supseteq \rho\setminus\{{a}\}=\rho.$\
Case $\rho\setminus\{{a}\}\vdash{({a})}{P}$ is derived from $\rho\vdash{P}:$ ${\mathsf{fn}({({a})}{P})}={\mathsf{fn}({P})}\cup\{{a}\}\supseteq \rho\cup\{{a}\}\supseteq \rho\setminus\{{a}\}.$\
Case $\rho\cup\{{a}\}\vdash{{a}!{b}}. {P}$ is derived from $\rho\vdash{P}:$ ${\mathsf{fn}({{a}!{b}}. {P})}={\mathsf{fn}({P})}\cup\{{a}\}\supseteq \rho\cup\{{a}\}.$\
Case $\rho \cup \{{a}\} \vdash {{a}?x}. {P}$ is derived from $\rho\vdash{P}$ and ${x}\not\in \rho:$ ${\mathsf{fn}({{a}?x}. {P})}=({\mathsf{fn}({P})}\setminus\{{x}\})\cup\{{a}\} \supseteq (\rho \setminus\{{x}\})\cup\{{a}\} =\rho\cup\{{a}\}.$\
Case $\rho \cup \{{a},{b}\} \vdash {{a}\langle{b}\rangle}. {P}$ is derived from $\rho\vdash{P}$ and ${b}\not\in \rho:$ ${\mathsf{fn}({{a}\langle{b}\rangle}. {P})}={\mathsf{fn}({P})}\cup\{{a},{b}\} \supseteq \rho\cup\{{a},{b}\}.$\
Case $(\rho \setminus \{{b}\})\cup \{{a}\} \vdash {{a}({b})}. {P}$ is derived from $\rho\vdash{P}:$ ${\mathsf{fn}({{a}({b})}. {P})}={\mathsf{fn}({P})}\cup\{{a},{b}\}\supseteq \rho\cup\{{a},{b}\} \supseteq (\rho \setminus \{{b}\})\cup \{{a}\}.$

We now state results used to prove that typing is preserved under system evolution, namely that (i) typing is preserved under structural congruence, as reduction is closed under structural congruence, and that (ii) typing is preserved under name substitution, since channel passing involves name substitution.

\[lem:inversion\]

1.  If $\rho \vdash {0}$ then $\rho=\emptyset.$

2.  If $\rho \vdash {P}{\;|\;}{Q}$ then there are $\rho_1$ and $\rho_2$ such that $\rho=\rho_1\cup\rho_2$ and $\rho_1\vdash{P}$ and $\rho_2\vdash{Q}.$

3.  If $\rho \vdash {(\nu {a})} {P}$ then $\rho \vdash {P}$ and ${a}\not \in \rho.$

4.  If $\rho \vdash {({a})}{P}$ then there is $\rho'$ such that $\rho=\rho'\setminus\{a\}$ and $\rho' \vdash {P}.$

5.  If $\rho  \vdash {{a}!{b}}. {P}$ then there is $\rho'$ such that $\rho=\rho'\cup\{a\}$ and $\rho' \vdash {P}.$

6.  If $\rho \vdash {{a}?x}. {P}$ then there is $\rho'$ such that $\rho=\rho'\cup\{{a}\}$ and ${x}\not\in\rho'$ and $\rho' \vdash {P}.$

7.  If $\rho \vdash {{a}\langle{b}\rangle}. {P}$ then there is $\rho'$ such that $\rho=\rho'\cup\{{a},{b}\}$ and ${b}\not\in \rho'$ and $\rho' \vdash {P}.$

8.  If $\rho  \vdash {{a}({b})}. {P}$ then there is $\rho'$ such that $\rho=(\rho'\setminus \{{b}\})\cup\{{a}\}$ and $\rho' \vdash {P}.$

\[lem:subcong\] If $\rho \vdash {P}$ and ${P}\equiv {Q}$ then $\rho \vdash {Q}$.

(by induction on the depth of the derivation of ${P}\equiv {Q}$)\
\
We only write the following two interesting cases, and other cases can be obtained by similar reasoning.\
\
Case ${P}{\;|\;}{(\nu {a})}{Q}\equiv{(\nu {a})}({P}{\;|\;}{Q})$ and ${a}\notin{\mathsf{fn}({P})}:$\
\
From $\rho \vdash {P}{\;|\;}{(\nu {a})}{Q},$ by Lemma \[lem:inversion\]. 2, there are $\rho_1$ and $\rho_2$ such that $\rho_1 \vdash {P}$ and $\rho_2 \vdash {(\nu {a})}{Q}.$ Therefore, by Lemma \[lem:inversion\]. 3, $\rho_2\vdash{Q}$ and ${a}\not\in\rho_2.$ Since ${a}\notin {\mathsf{fn}({P})}$ we conclude by Proposition \[pro:freenames\] that ${a}\notin\rho_1.$ By the rule ${\text{\small \textsc{(tpar)}}}$ we get that $\rho_1\cup\rho_2\vdash {P}{\;|\;}{Q},$ and from ${a}\not\in \rho_1\cup\rho_2,$ by ${\text{\small \textsc{(tnew)}}}$ we derive $\rho\vdash{(\nu {a})}({P}{\;|\;}{Q}).$\
\
Case ${({a})}{(\nu {b})}{P}\equiv {(\nu {b})}{({a})}{P}$ and ${a}\neq {b}:$\
\
If $\rho\vdash{({a})}{(\nu {b})}{P}$ then by Lemma \[lem:inversion\]. 4 there is $\rho'$ such that $\rho'\vdash {(\nu {b})}{P}$ and $\rho=\rho'\setminus\{{a}\}.$ By Lemma \[lem:inversion\]. 3, $\rho'\vdash{P}$ and ${b}\not\in\rho'$ (and so ${b}\not\in\rho'\setminus\{{a}\}$). Hence, by ${\text{\small \textsc{(tauth)}}}$ and ${\text{\small \textsc{(tnew)}}},$ we get $\rho \vdash {(\nu {b})}{({a})}{P}.$

\[lem:subst\] If $\rho \vdash {P}$ then $\rho {\{a/b\}}Ê\vdash {P}{\{a/b\}}$.

(by induction on the depth of the derivation of $\rho \vdash {P}$)\
\
We give only one interesting case. If $\rho\cup\{{b},{c}\}\vdash{{c}\langle{b}\rangle}. {P}$ is derived from $\rho\vdash{P}$ and ${b}\not\in\rho.$ It holds that $(\rho\cup\{{b},{c}\}){\{{a}/{b}\}}=\rho\cup\{{a},{c}\}$ and $({{c}\langle{b}\rangle}.{P}){\{{a}/{b}\}}={{c}\langle{a}\rangle}.{P}{\{{a}/{b}\}}.$ By induction hypothesis, $\rho{\{{a}/{b}\}}\vdash{P}{\{{a}/{b}\}},$ and by the rule $({\text{\small \textsc{tdeleg}}}),$ $\rho \cup\{{a},{c}\}\vdash {{c}\langle{a}\rangle}.{P}{\{{a}/{b}\}}.$

We may now state our soundness result which ensures typing is preserved under reduction.

\[the:subred\] If $\rho \vdash {P}$ and ${P}{\rightarrow}{Q}$ then $\rho \vdash {Q}$.

(by induction on the depth of the derivation of ${P}{\rightarrow}{Q}$)\
\
Assume that $\rho\vdash  {(\vec{{a}}_1)}{({b})} {{b}!{c}}.{P}{\;|\;}{(\vec{{a}}_2)}{({b})}{{b}?x}.{Q}$ and $${\text{\small \textsc{(comm)}}}
\qquad
{(\vec{{a}}_1)}{({b})} {{b}!{c}}.{P}{\;|\;}{(\vec{{a}}_2)}{({b})}{{b}?x}.{Q}{\rightarrow}{(\vec{{a}}_1)}{({b})} {P}{\;|\;}{(\vec{{a}}_2)}{({b})}{Q}{\{{c}/x\}}.$$ By Lemma \[lem:inversion\]. 2, there are $\rho_1$ and $\rho_2$ such that $\rho=\rho_1\cup\rho_2$ and $$\rho_1 \vdash  {(\vec{{a}}_1)}{({b})} {{b}!{c}}.{P}\quad \mbox{ and } \quad  \rho_2\vdash{(\vec{{a}}_2)}{({b})}{{b}?x}.{Q}.$$ By consecutive application of Lemma \[lem:inversion\]. 4, there are $\rho_1'$ and $\rho_2'$ such that $\rho_1=\rho_1'\setminus \{\vec{a_1}, {b}\}$ and $\rho_2=\rho_2'\setminus \{\vec{a_2}, {b}\}$ and $$\rho_1' \vdash {{b}!{c}}.{P}\quad \mbox{ and } \quad  \rho_2' \vdash {{b}?x}.{Q}.$$ By Lemma \[lem:inversion\]. 5-6, there are $\rho_1''$ and $\rho_2''$ such that $\rho_1'=\rho_1''\cup\{{b}\}$ and $\rho_2'=\rho_2''\cup\{{b}\}$ and ${x}\not\in\rho_2''$ and $$\rho_1'' \vdash {P}\quad \mbox{ and } \quad  \rho_2'' \vdash {Q}.$$ One should notice that $\rho_1=(\rho_1''\cup\{{b}\})\setminus\{\vec{a_1},{b}\}=\rho_1''\setminus\{\vec{a_1},{b}\}$ and $\rho_2=(\rho_2''\cup\{{b}\})\setminus\{\vec{a_2},{b}\}=\rho_2''\setminus\{\vec{a_2},{b}\}$ and $\rho_2''{\{c/x\}}=\rho_2''$ (since ${x}\not\in\rho_2'').$ By Lemma \[lem:subst\] and consecutive application of the typing rules ${\text{\small \textsc{(tauth)}}}$ we get $$\rho_1 \vdash  {(\vec{{a}}_1)}{({b})} {P}\quad \mbox{ and } \quad  \rho_2\vdash{(\vec{{a}}_2)}{({b})}.{Q}{\{{c}/{x}\}}.$$ and finally, by ${\text{\small \textsc{(tpar)}}},$ we have $\rho \vdash  {(\vec{{a}}_1)}{({b})} {P}{\;|\;}{(\vec{{a}}_2)}{({b})}.{Q}{\{{c}/{x}\}}.$\
\
Assume that $\rho\vdash  {(\vec{{a}}_1)}{({b})}{({c})} {{b}\langle{c}\rangle}.{P}{\;|\;}{(\vec{{a}}_2)}{({b})}{{b}({c})}.{Q}$ and $${\text{\small \textsc{(auth)}}}
\qquad
{(\vec{{a}}_1)}{({b})}{({c})} {{b}\langle{c}\rangle}.{P}{\;|\;}{(\vec{{a}}_2)}{({b})}{{b}({c})}.{Q}{\rightarrow}{(\vec{{a}}_1)}{({b})} {P}{\;|\;}{(\vec{{a}}_2)}{({b})}{({c})}{Q}$$ By Lemma \[lem:inversion\]. 2, there are $\rho_1$ and $\rho_2$ such that $\rho=\rho_1\cup\rho_2$ and $$\rho_1 \vdash {(\vec{{a}}_1)}{({b})}{({c})} {{b}\langle{c}\rangle}.{P}\quad\mbox{ and }\quad
  \rho_2 \vdash {(\vec{{a}}_2)}{({b})}{{b}({c})}.{Q}$$ By consecutive application of Lemma \[lem:inversion\]. 4, there are $\rho_1'$ and $\rho_2'$ such that $\rho_1=\rho_1'\setminus \{\vec{a_1}, {b}, {c}\}$ and $\rho_2=\rho_2'\setminus \{\vec{a_2}, {b}\}$ and $$\rho_1' \vdash {{b}\langle{c}\rangle}.{P}\quad\mbox{ and }\quad
  \rho_2' \vdash {{b}({c})}.{Q}$$ By Lemma \[lem:inversion\]. 7-8, there are $\rho_1''$ and $\rho_2''$ such that $\rho_1'=\rho_1''\cup\{{b}, {c}\}$ and ${c}\not\in\rho_1''$ and $\rho_2'=(\rho_2''\setminus \{{c}\}) \cup\{{b}\}$ and $$\rho_1'' \vdash {P}\quad\mbox{ and }\quad
  \rho_2'' \vdash {Q}.$$ We conclude that $\rho_1=(\rho_1''\cup\{{b},{c}\}) \setminus\{\vec{a_1},{b},{c}\}=\rho_1''\setminus \{\vec{a_1},{b}\}$ (since ${c}\not\in \rho_1''$) and $\rho_2=\rho_2''\setminus \{\vec{a_2},{b},{c}\}.$ By consecutive application of the typing rule ${\text{\small \textsc{(tauth)}}},$ we get $$\rho_1 \vdash {(\vec{{a}}_1)}{({b})} {P}\quad \mbox{ and }\quad
  \rho_2 \vdash {(\vec{{a}}_2)}{({b})}{({c})}{Q}$$ and by ${\text{\small \textsc{(tpar)}}}$ $$\rho \vdash {(\vec{{a}}_1)}{({b})} {P}{\;|\;}{(\vec{{a}}_2)}{({b})}{({c})}{Q}.$$\
\
Assume that $\rho \vdash {P}{\;|\;}{R}$ and ${P}{\;|\;}{R}{\rightarrow}{Q}{\;|\;}{R}$ is derived from ${P}{\rightarrow}{Q}.$ By Lemma \[lem:inversion\]. 2, there are $\rho_1$ and $\rho_2$ such that $\rho=\rho_1\cup\rho_2$ and $$\rho_1 \vdash {P}\quad \mbox{ and } \quad \rho_2 \vdash {R}.$$ By induction hypothesis, it holds that $\rho_1\vdash {Q}$ and therefore we have, by ${\text{\small \textsc{(tpar)}}},$ that $\rho \vdash {Q}{\;|\;}{R}.$\
\
Assume that $\rho \vdash {(\nu {a})} {P}$ and ${(\nu {a})} {P}{\rightarrow}{(\nu {a})} {Q}$ is derived from ${P}{\rightarrow}{Q}.$ By Lemma \[lem:inversion\]. 3, it holds that ${a}\not\in\rho$ and $\rho \vdash {P}.$ By induction hypothesis, it holds that $\rho\vdash {Q}$ and therefore, by ${\text{\small \textsc{(tnew)}}},$ we get $\rho \vdash {(\nu {a})}{Q}.$\
\
Assume that $\rho \vdash {({a})} {P}$ and ${({a})} {P}{\rightarrow}{({a})} {Q}$ is derived from ${P}{\rightarrow}{Q}.$ By Lemma \[lem:inversion\]. 4, it holds that there is $\rho'$ such that $\rho=\rho'\setminus\{{a}\}$ and $\rho' \vdash {P}.$ By induction hypothesis, it holds that $\rho'\vdash {Q}$ and therefore, by ${\text{\small \textsc{(tauth)}}},$ we get $\rho \vdash {({a})}{Q}.$\
\
Assume that $\rho\vdash{P}$ and ${P}{\rightarrow}{Q}$ is derived from ${P}' {\rightarrow}{Q}',$ where ${P}\equiv {P}'$ and $ {Q}' \equiv {Q}.$ We conclude by Lemma \[lem:subcong\] that $\rho\vdash {P}'.$ Than, by induction hypothesis, we get $\rho\vdash {Q}',$ and applying again Lemma \[lem:subcong\], we have that $\rho\vdash{Q}.$

Theorem \[the:subred\] ensures, considering $\rho= \emptyset$, that well-typed processes always reduce to well-typed processes. We now express the basic property for well-typed systems, namely that they do not expose any authorization errors up to the ones granted by pending authorizations $\rho$.

\[pro:errorfree\] If $\rho \vdash {\mathcal{C}}[\alpha_{a}.{Q}]$ and ${a}\not \in \rho$ then ${\mathit{auth}({\mathcal{C}}[\cdot],{a})}$.

(by induction on the structure of ${\mathcal{C}}[\cdot]$)\
\
Case ${\mathcal{C}}[\cdot]=[\cdot]:$ If $\rho \vdash \alpha_{a}.{Q}$ we conclude that ${a}\in\rho,$ by Lemma \[lem:inversion\].\
Case ${\mathcal{C}}[\cdot]={P}{\;|\;}{\mathcal{C}}'[\cdot]:$ If $\rho\vdash{P}{\;|\;}{\mathcal{C}}'[\alpha_{a}.{Q}],$ by Lemma \[lem:inversion\]. 2, there are $\rho_1$ and $\rho_2$ such that $\rho=\rho_1\cup\rho_2$ and $\rho_1\vdash {P}$ and $\rho_2 \vdash {\mathcal{C}}'[\alpha_{a}.{Q}].$ By induction hypothesis, ${\mathit{auth}({\mathcal{C}}'[\cdot],{a})},$ while by definition ${\mathit{auth}({P}{\;|\;}{\mathcal{C}}'[\cdot],{a})}={\mathit{auth}({\mathcal{C}}'[\cdot],{a})}.$\
Case ${\mathcal{C}}[\cdot]={(\nu {b})}{\mathcal{C}}'[\cdot]:$ If ${a}\not\in\rho$ and $\rho\vdash {(\nu {b})}{\mathcal{C}}'[\alpha_{a}.{Q}],$ by Lemma \[lem:inversion\]. 3, $\rho\vdash{\mathcal{C}}'[\alpha_{a}.{Q}]$ and ${b}\not\in\rho.$ By induction hypothesis, ${\mathit{auth}({\mathcal{C}}'[\cdot],{a})}.$ By definition, ${\mathit{auth}({(\nu {b})}{\mathcal{C}}'[\cdot],{a})}={\mathit{auth}({\mathcal{C}}'[\cdot],{a})}.$\
Case ${\mathcal{C}}[\cdot]={({b})}{\mathcal{C}}'[\cdot]$ and ${a}\neq{b}:$ If ${a}\not\in\rho$ and $\rho\vdash {({b})}{\mathcal{C}}'[\alpha_{a}.{Q}],$ by Lemma \[lem:inversion\]. 4, there is $\rho'$ such that $\rho=\rho'\setminus\{{b}\}$ and $\rho'\vdash{\mathcal{C}}'[\alpha_{a}.{Q}].$ If ${a}\neq{b}$ and ${a}\not\in\rho$ then ${a}\not\in\rho'.$ By induction hypothesis, ${\mathit{auth}({\mathcal{C}}'[\cdot],{a})}.$ By definition, ${\mathit{auth}({({b})}{\mathcal{C}}'[\cdot],{a})}={\mathit{auth}({\mathcal{C}}'[\cdot],{a})}.$\
Case ${\mathcal{C}}[\cdot]={({a})}{\mathcal{C}}'[\cdot]:$ By definition ${\mathit{auth}({({a})}{\mathcal{C}}'[\cdot],{a})}=\mathit{true}.$

Proposition \[pro:errorfree\] thus ensures that active communication prefixes that do not involve a pending authorization (outside of $\rho$) are not errors. Considering $\rho = \emptyset$ we thus have that well-typed processes do not have any unauthorized prefixes and thus are not errors. Along with Theorem \[the:subred\] we may then state our safety result which says well-typed processes never evolve into an error.

\[cor:safety\] If $\;\emptyset \vdash {P}$ and ${P}{\rightarrow}^{\star} {Q}$ then ${Q}$ is not an error.

Immediate from Theorem \[the:subred\] and Proposition \[pro:errorfree\].

Corollary \[cor:safety\] attests that well-typed systems never reduce to authorization errors, including when authorizations are dynamically delegated. The presented type system allows for a streamlined analysis on process authorization requirements, which we intend to exploit as the building block for richer analysis.

Concluding Remarks
==================

The work presented here builds on our previous work [@DBLP:journals/corr/GhilezanJPPV14], in which we explored authorization passing in the context of communication-centered systems. In [@DBLP:journals/corr/GhilezanJPPV14], the analysis addressed not only authorization passing but also role-based protocol specification, building on the conversation type analysis presented in [@DBLP:conf/tgc/BaltazarCVV12]. Here we focussed exclusively on the authorization problem, obtaining a simple model which paves the way for further investigation, since the challenges involved may now be highlighted in a crisper way. [As usual,]{} [there are non typable processes that are authorized for all the actions and reduce to ${0}$. This is unsurprising, given the simplicity of the analysis. An example is $${({a})}{({b})}({{b}?{x}}.{{x}!{b}}.{0}{\;|\;}{{b}!{a}}.{{a}?{x}}.{0}).$$ For the same reason, even [though]{} our untyped model enables to keep existing copies of delegated authorization scopes, the type system restricts the usage of their scopes. For example, the current discipline can not type the process $$Ê{({b})}{({a})}{({a})}{{b}\langle{a}\rangle}{{a}!{b}}.{0}{\;|\;}{({b})}{{b}({a})}{{a}?{x}}.{0}$$ even [though]{} it safely reduces to ${0}.$ ]{} We believe it would be interesting to enrich the typing analysis so that it encompasses the contextual information (authorizations already held by the process) so as to address name reception [and authorization delegation]{} in a different way. We also believe it would be interesting to discipline authorization usage so as to ensure absence of double authorizations [for the sake of authorization accountability, so as to ensure only the strictly necessary authorizations are specified.]{} Naturally, it would also be interesting to integrate the analysis presented here in richer settings, for instance (i) considering the need to ensure protocol fidelity using session types [@DBLP:conf/esop/HondaVK98], or (ii) ensuring liveness properties so that security critical events are guaranteed to take place, or (iii) exploring an ontology on names so that authorizations to act upon higher ranked names automatically yield authorization for lower-level ones. While relevant, these extensions appear as orthogonal developments to the analysis presented here and therefore should be studied in depth in a dedicated way.

We briefly review some related works. Scoping operators have been widely used for the purpose of modeling security aspects (e.g., [@Giunti]) but typically they use bound names (e.g., to model secrets). With the aim of representing secrecy and confidentiality requirements in process specifications, an alternative scoping operator called *hide* is investigated in [@Giunti]. The hide operator is embedded in the so-called secrecy $\pi$-calculus, tailored to program secrecy in communications. The expressiveness of the hide operator is investigated in the context of a behavioral theory, by means of an Spy agent. In contrast, our (free name) scoping operator focuses on authorization, a different security concern. In [@VivasYoshida], a scoping operator (called *filter*) is proposed for dynamic channel screening. In a different setting (higher-order communication) and with similar properties, the filter operator blocks all the actions that are not contained in the corresponding filter (which contains polarised channel names). Contrary to the authorization scope, filters are statically assigned to processes, while the authorization scope assigned to a process may be dynamically changed. To the best of our knowledge, the authorization scoping proposed here has not been explored before for the specification of communication-centered systems.

One key idea explored here is the separation between resource and the respective authorization which in particular allows us to distinguish the communication of the resource handler from the resource authorization. Consider, e.g., process $
 {{a}?{x}}. {{b}!{x}}. {0}$, where a forwarding process receives a channel and forwards it without necessarily being authorized to interact in it. This allows to model scenarios where resource handlers may be passed around in unverified contexts, since their unauthorized use is excluded. This example in particular distinguishes the type-based authorization handling presented in [@DBLP:journals/jlp/GorlaP09], since authorizations directly flow in the communications (via the types) and cannot be received afterwards — we leave to future work a comparison with more *refined* typing notions such as [@DBLP:conf/sefm/FrancoV13; @DBLP:conf/esop/SwamyCC10] where we conceive that dependencies between received values can address such a separation, albeit in a more indirect way.

To further remark on the particularities of our linguistic constructors consider process $${{a}?{x}}. {({x})} {P}$$ where ${P}$ is authorized to act on channel ${x}$, regardless of the identity of the channel actually received, which somewhat hints on the particular combination between the (non-binding) scoping operator and name passing. While we do not claim that our constructs cannot be encoded in other models, we do believe they provide an adequate abstraction level to reason on authorization handling. Still, it would be interesting to see how to express authorization scopes and authorization communication (including delegation) using $\pi$-calculus like models (such as, e.g., [@appliedpi; @polipi; @pigroups]).

There are high-level similarities between our work and the concept of *ownership types*, as well studied for object-oriented languages [@DBLP:conf/oopsla/ClarkePN98]. Although in principle ownership types focus on static ownership structures, assessing their use for disciplining dynamic authorizations is interesting future work.

#### **Acknowledgments.**

We thank the anonymous referees for their insightful and useful remarks. This work was supported by COST Action IC1201: Behavioural Types for Reliable Large-Scale Software Systems (BETTY) via Short-Term Scientific Mission grants (to Pantović and Vieira). Pérez is also affiliated to the NOVA Laboratory for Computer Science and Informatics (NOVA LINCS), Universidade Nova de Lisboa, Portugal.

[10]{} \[2\] \[1\][`#1`]{} \[2\][`#2`]{} \[2\][[\#2](#1)]{} \[1\][doi:]{} \[2\][\#2]{}

& (): **. In: [**]{}, , pp. , .

, , & (): **. In: [**]{}, [ ** ]{} , , pp. , .

& (): **. (), pp. , .

, & (): **. In: [**]{}, , pp. , .

& (): **. (), pp. , .

& (): **. In: [**]{}, [**]{} , , pp. , .

, , , & (): **. In: [**]{}, [**]{} , pp. , .

, & (): **. In: [**]{}, [ ** ]{} , pp. , .

& (): **. (), pp. , .

, & (): **. In: [**]{}, [ ** ]{} , , pp. , .

& (): **. .

, & (): **. In: [**]{}, [ ** ]{} , , pp. , .

& (): **. (), pp. , .


Address

Contact

We are pet friendly. 2 pets allowed per apartment. Weight restrictions 50 lbs at full grown. Non-Refundable Pet fee is $300.00.Pet rent is $20.00 per month. Pet rent and non-refundable pet fee will cover 2 pets.Resident shall keep all pets vaccinated and registered with appropriate local/state officials in accordance with applicable law. All pets must be 6 months in age or older.
No dog breeds will be allowed who are known to exhibit aggressive or vicious behavior, including but not limited to the following: Rottweiler, Husky, Pit Bull, Great Dane, German Shepherd, Chow Chow, Doberman Pincer, Wolf Hybrid. (Source: Insurance Information Institute)