Types for Access Control

KLAIM is an experimental programming language that supports a programming paradigm where both processes and data can be moved across different computing environments. This paper presents the mathematical foundations of the KLAIM type system; this system permits checking access rights violations of mobile agents. Types are used to describe the intentions (read, write, execute, ...) of processes relative to the different localities with which they are willing to interact, or to which they want to migrate. Type checking then determines whether processes comply with the declared intentions, and whether they have been assigned the necessary rights to perform the intended operations at the specified localities. The KLAIM type system encompasses both subtyping and recursively defined types. The former occurs naturally when considering hierarchies of access rights, while the latter is needed to model migration of recursive processes.