Trace Equivalence and Epistemic Logic to Express Security Properties

TL;DR

This paper explores the use of trace equivalence and epistemic logic within process algebras to accurately formalize and verify security properties, bridging the gap between intuitive security notions and formal methods.

Contribution

It demonstrates that trace equivalence is congruent and aligns with logical equivalence in epistemic logic, providing a formal foundation for security verification.

Findings

Trace equivalence is congruent.

Logical equivalence matches trace equivalence.

Trace equivalence is relevant with non-adaptive attackers.

Abstract

In process algebras, security properties are expressed as equivalences between processes, but which equivalence is suitable is not clear. This means that there is a gap between an intuitive security notion and the formulation. Appropriate formalization is essential for verification, and our purpose is bridging this gap. By chasing scope extrusions, we prove that trace equivalence is congruent. Moreover, we construct an epistemic logic for the applied pi calculus and show that its logical equivalence agrees with the trace equivalence. We use the epistemic logic to show that trace equivalence is pertinent in the presence of a non-adaptive attacker.

Equations

$$S[V_A\{a/v\}|V_B\{b/v\}]{\approx }_{l}S[V_A\{b/v\}|V_B\{a/v\}]$$

$$M,N::=$$

$$|$$

$$P,Q,R,S::=$$

$$|$$

$$A,B,C,D,E::=$$

$$|$$

$$\mathrm{fn}(0)=$$

$$\mathrm{fn}(\overline{M}⟨N⟩.P)=$$

$$\mathrm{fn}(M(x).P)=$$

$$\mathrm{fn}(\nu n.P)=$$

$$\mathrm{fn}(\mathrm{if}M=N\mathrm{then}P\mathrm{else}Q)=$$

$$\mathrm{fn}(P+Q)=$$

$$\mathrm{fn}(P|Q)=$$

$$\mathrm{fn}(!P)=$$

$$\mathrm{fn}(\nu n.A)=$$

$$\mathrm{fn}(\nu x.A)=$$

$$\mathrm{fn}(A|B)=$$

$$\mathrm{fn}(\{M/x\})=$$

$$\mathrm{fv}(0)=$$

$$\mathrm{fv}(\overline{M}⟨N⟩.P)=$$

$$\mathrm{fv}(M(x).P)=$$

$$\mathrm{fv}(\nu n.P)=$$

$$\mathrm{fv}(\mathrm{if}M=N\mathrm{then}P\mathrm{else}Q)=$$

$$\mathrm{fv}(P+Q)=$$

$$\mathrm{fv}(P|Q)=$$

$$\mathrm{fv}(!P)=$$

$$\mathrm{fv}(\nu n.A)=$$

$$\mathrm{fv}(\nu x.A)=$$

$$\mathrm{fv}(A|B)=$$

$$\mathrm{fv}(\{M/x\})=$$

$$\mathrm{bn}(0)=$$

$$\mathrm{bn}(\overline{M}⟨N⟩.P)=$$

$$\mathrm{bn}(M(x).P)=$$

$$\mathrm{bn}(\nu n.P)=$$

$$\mathrm{bn}(\mathrm{if}M=N\mathrm{then}P\mathrm{else}Q)=$$

$$\mathrm{bn}(P+Q)=$$

$$\mathrm{bn}(P|Q)=$$

$$\mathrm{bn}(!P)=$$

$$\mathrm{bn}(\nu n.A)=$$

$$\mathrm{bn}(\nu x.A)=$$

$$\mathrm{bn}(A|B)=$$

$$\mathrm{bn}(\{M/x\})=$$

Full text

Acknowledgements

I am sincerely appreciative of Professor Masahito Hasegawa who provided helpful comments and suggestions. I would also like to convey a sense of gratitude to my family for their moral support and warm encouragements.

Contents

1. Acknowledgements

2. 1 Introduction

3. 1.1 Background

4. 1.2 Contributions

5. 2 The Applied Pi Calculus

6. 2.1 Syntax

7. 2.2 Semantics

8. 2.2.1 Internal Reduction

9. 2.2.2 Labelled Transition

10. 2.3 Equivalence

11. 2.3.1 Labelled Bisimulation

12. 2.3.2 Trace Equivalence

13. 2.4 Examples

14. 3 Congruency of Trace Equivalence

15. 3.1 The Case of Applying a Context without Composition

16. 3.2 The Case of Parallel Composition

17. 3.2.1 A Definition of a Concurrent Normal Trace

18. 3.2.2 A Transformation into a Concurrent Normal Form

19. 3.2.3 Extracting a Trace of a Component Process from Concurrent Normal Form

20. 3.2.4 Composition of Traces

21. 4 An Epistemic Logic for the Applied Pi Calculus

22. 4.1 Syntax

23. 4.2 Semantics

24. 4.3 Correspondence with Trace Equivalence

25. 4.4 Applications

26. 5 Related Work

27. 5.1 Process Algebras

28. 5.2 Logics

29. 5.3 Formal Approaches

30. 6 Conclusion

31. 6.1 Summary

32. 6.2 Future Work

33. A Lemmas for Chapter 3

Chapter 1 Introduction

1.1 Background

In modern society, information and communications technology is indispensable to our daily lives, and a number of communication protocols are proposed to securely transmit information using a network. Verification of safety of these protocols is also essential, but it is not easy.

In the first place, how to define security notions is not clear. As a matter of fact, various different definitions of the same security property have been proposed. In addition, how to model communication is also not clear; many such models have been developed. In this work, we focus on process algebras because it allows us to handle composition easily. In process algebras, typical security properties such as secrecy are represented by an equivalence between processes.

For instance, secrecy of a message $M$ is expressed as equivalence between a process sending $M$ and a process sending $M^{\prime}$.

Many process equivalences exist in the literature, but which is the most suitable for capturing security properties is not always clear. For instance, Delaune, Kremer and Ryan [10] proposed the definition of privacy in electronic voting in terms of the applied pi calculus [1] as follows.

Definition 1.1** ([10, Definition 9]).**

A voting protocol respects vote-privacy (or just privacy) if

[TABLE]

for all possible votes $a$ and $b$.

Intuitively, this definition states that an attacker cannot distinguish two situations where votings are swapped. Note that indistinguishability is expressed by labelled bisimilarity $\approx_{l}$ in this definition. Is it the most suitable? This is a nontrivial question. Chadha, Delaune and Kremer [7] claim that trace equivalence is more suitable regarding privacy.

In fact, an outputted message is not explicitly expressed in the applied pi calculus. It is represented via an alias variable. This feature enables us to handle cryptographic protocols and suggests that trace equivalence means an attacker’s indistinguishability. This is because an attacker can observe only labelled transition. We recall the syntax and semantics of the calculus in Chapter 2.

Bisimilarity and traced equivalences are both well-studied equivalence relations on labelled transition systems. However, trace equivalence in the applied pi calculus (and other variants of the pi calculus [19, 20, 18]) has not drawn much attention. This is probably because trace equivalence is the coarsest among major equivalences. However, security properties sometimes require that actually different processes are regarded as the same. Thereby, a fine equivalence such as bisimilarity does not have to be always adequate.

Epistemic logic is often used to capture security notions (e.g. [7, 15, 22]). It enables us to directly express security properties. For example, when a message $M$ sent by an agent $a$ is anonymous, we can say that an adversary cannot know who sent $M$. In an epistemic logic, we can express it with a formula such like $\lnot K\mathrm{Send}(a,M)$. This logical formulation is close to our intuition. Nevertheless, research about an epistemic logic for the applied pi calculus is few.

1.2 Contributions

We prove that trace equivalence for the applied pi calculus is a congruence in Chapter 3. Secondly, we give an epistemic logic that characterizes trace equivalence in Chapter 4. In addition, we define security properties such as secrecy and role-interchangeability [15, 22] using trace equivalence and our epistemic logic. Moreover, we show that secrecy and openness generally are not preserved by parallel composition. On the other hand, total secrecy is characterized by trace equivalence, so it is preserved by an application of a context. The same partly holds for role-interchangeability. Finally, we prove that the satisfaction problem for the epistemic logic is undecidable.

Our results suggest that trace equivalence is more suitable to express security notions than labelled bisimilarity.

Chapter 2 The Applied Pi Calculus

2.1 Syntax

The applied pi calculus [1] is an extension of the pi calculus [19, 20, 18] and can handle cryptographic protocols.

Let $\Sigma$ be a signature equipped with an equational theory. $\Sigma$ consists of a finite set of function symbols with their arity. Names, variables, and terms are defined on $\Sigma$ by the following grammar:

[TABLE]

The above $f$ is a function symbol with arity $n$ on $\Sigma$. We say that a term is ground when it contains no variables. Meta-variables $u,v$ are used to represent over both names and variables. We describe a sequence of terms $M_{1},...,M_{n}$ as $\widetilde{M}$. We denote by n($M$) and v($M$) the set of names and variables in $M$. The grammar for processes is given below:

[TABLE]

0 cannot do anything. $\overline{M}\langle N\rangle.P$ sends $N$ on a channel $M$ and then behaves as $P$. $M(x).P$ waits for input from a channel $M$ and then behaves as $P$ with the variable $x$ replaced by the received message. In both cases, we omit $P$ if it is 0. The process $\nu n.P$ creates a new restricted name $n$ and then behaves as $P$. A restricted name is often regarded as a nonce, a key and so on. The conditional branch $\mathrm{if}~{}M=N~{}\mathrm{then}~{}P~{}\mathrm{else}~{}Q$ behaves as P when $M=N$ and as $Q$ otherwise. Note that $M=N$ means equality on $\Sigma$. We omit $Q$ if $Q$ is 0. $P+Q$ nondeterministically behaves $P$ or $Q$. $P|Q$ is the parallel composition of $P$ and $Q$; the replication $!P$ behaves as unbounded copies of $P$ running concurrently.

We call processes defined above plain processes. Moreover, we define extended processes:

[TABLE]

We consider that $\{M/x\}$ is floating around processes. If it touches other processes, a substituion happens. We will describe in detail later. If we want to impose reins on this effect, we restrict variables. $\{M/x\}$ often represents messages outputted to an environment. Moreover, it is sometimes interpreted as attacker’s knowledge in view of security because an active substitution $\{M/x\}$ appears when a process sends a message $M$ to an environment. When $\tilde{M}=M_{1},\dots,M_{n}$ and $\tilde{x}=x_{1},\dots,x_{n},\{\tilde{M}/\tilde{x}\}$ expresses $\{M_{1}/x_{1}\}|\dots|\{M_{n}/x_{n}\}$. In particular, if $n=0$, it is a null process 0.

Let $\widetilde{u}=u_{1},...,u_{n}$. Then $\nu\widetilde{u}.A=\nu u_{1}....\nu u_{n}.A$.

Let $\sigma=\{\widetilde{M}/\widetilde{x}\}$, then $M\sigma$ is a term obtained by replacing all $x_{i}$ with $M_{i}$. We denote by fn($A$) and fv($A$) the sets of free names and variables respectively. These are inductively defined below.

[TABLE]

[TABLE]

Furthermore, We denote by bn($A$) and rv($A$) the sets of bound names and restricted variables respectively. Note that $\nu x.$ appears only in an extended process.

[TABLE]

[TABLE]

We also define $\mathrm{n}(A)=\mathrm{fn}(A)\cup\mathrm{bn}(A)$ and $\mathrm{v}(A)=\mathrm{fv}(A)\cup\mathrm{rv}(A)$. The domain dom($A$) of an extended process $A$ is also inductively defined below. If variables in other concurrently running processes are in $\mathrm{dom}(A)$, $A$ affects them.

[TABLE]

We basically identify an extended process with an $\alpha$-equivalent process, but we carefully handle $\alpha$-equivalent processes in Chapter 3, 4. Hereafter, we assume three restrictions. First, suppose that substitutions are cycle-free with respect to variables.

Definition 2.1**.**

An active substitution $\sigma$ is cycle-free $\overset{\mathrm{def}}{\Leftrightarrow}$ $\sigma$ is written as $\{M_{1}/x_{1},...,M_{n}/x_{n}\}$ by reordering so that each $M_{i}$ does not contain $x_{1},...,x_{i}$ by reordering.

Secondly, we can compose $A$ and $B$ in parallel only if $\mathrm{dom}(A)\cap\mathrm{dom}(B)=\emptyset$. Lastly, we can restrict only variables in a domain. We say that $A$ is closed if $\mathrm{fv}(A)=\mathrm{dom}(A)$.

Note the proposition below.

Proposition 2.2**.**

Consider an active substitution $\sigma=\{M_{1}/x_{1},...,M_{n}/x_{n}\}$ where each $M_{i}$ does not contain $x_{1},...,x_{i}$. Then, there exists an active substitution $\rho\equiv\sigma$ such that each $x_{i}\rho$ contains no variables other than ones in $\mathrm{fv}(\sigma)\setminus\mathrm{dom}(\sigma)$.

Proof.

We prove by induction on $n$. The base case is trivial. We consider the induction case.

Let $\sigma^{\prime}=\{M_{n}/x_{n}\}$ and $\sigma^{\prime\prime}=\{M_{1}\sigma^{\prime}/x_{1},...,M_{n-1}\sigma^{\prime}/x_{n-1}\}$. Each $M_{i}\sigma^{\prime}$ does not contain $x_{n}$, so there exists $\rho^{\prime}\equiv\sigma^{\prime\prime}$ such that each $x_{i}\rho^{\prime}$ contains no variables other than ones in $\mathrm{fv}(\sigma^{\prime\prime})\setminus\mathrm{dom}(\sigma^{\prime\prime})$ by induction hypothesis. Then,

[TABLE]

$\rho^{\prime}|\sigma^{\prime}$ meets the condition against $n$. Note that $\mathrm{fv}(\sigma^{\prime\prime})\setminus\mathrm{dom}(\sigma^{\prime\prime})\subseteq\mathrm{fv}(\sigma)\setminus\mathrm{dom}(\sigma)$. ∎

2.2 Semantics

2.2.1 Internal Reduction

Internal communication, conditional branch and nondeterministic choice are unobservable actions.

A context is an expression containing one hole. The hole is represented by [_]. An evaluation context is a context whose hole is neither under a replication, a conditional, nor an action prefix. Structural equivalence $\equiv$ is the smallest equivalence relation between extended processes which is closed under an application of an evaluation context and $\alpha$-conversion, such that:

[TABLE]

That is, $|$ beheves like a commutative monoid, and + behaves like a commutative magma. Restriction is also commutative. Note that $\{M/x\}$ in $A\{M/x\}$ is not an active substitution, it is an ordinal substitution. $A\{M/x\}$ is the same as $A$ expect that all free occurences of $x$ is replaced with $M$, and it is a capture-avoiding substitution. The last rule depends on $\Sigma$. We omit redundant parentheses when distinction between structural equivalent processes is not necessary.

Definition 2.3**.**

Internal reduction $\rightarrow$ is the smallest relation between extended processes closed under structural equivalence and application of evaluation contexts such that:

[TABLE]

The second rule requires that $M$ and $N$ are ground, and it is essential. If this condition is not satisfied, unreasonable reduction happens when an active substituion concurrently exists. For example, consider $\mathrm{if}~{}x=a~{}\mathrm{then}~{}P~{}\mathrm{else}~{}Q|\{a/x\}$.

An internal reduction is often called silent action.

2.2.2 Labelled Transition

Labelled semantics enables us to express unsafe communication.

We denote by $\alpha$ a labelled action. The labelled semantics gives a ternary relation $A\overset{\alpha}{\longrightarrow}A^{\prime}$ on two processes and a label. A label is an input form or an output form. In the former case, $\alpha$ is written as $M(N)$. It means that a message $N$ is received on a channel $M$. In the latter case, $\alpha$ is written as $\nu x.\overline{M}\langle x\rangle$, where $x$ is a variable which is fresh. It means that a message is sent on channel $M$ via an alias variable $x$. It is a notable feature that a sent message does not explicitly appear in a label.

We define n($\alpha$), fv($\alpha$) and rv($\alpha$) as with a process.

[TABLE]

Additionally, we regard that a silent action contains no variables and names.

We recall structural operational semantics for the applied pi calculus.

$M(x).P\overset{M(N)}{\longrightarrow}P\{N/x\}$

$x\notin\mathrm{fv}(\overline{M}\langle N\rangle.P)$

$\overline{M}\langle N\rangle.P\overset{\nu x.\overline{M}\langle x\rangle}{\longrightarrow}P|\{N/x\}$

$A\overset{\alpha}{\longrightarrow}A^{\prime}\land u\notin\mathrm{n}(\alpha)\cup\mathrm{v}(\alpha)$

$\nu u.A\overset{\alpha}{\longrightarrow}\nu u.A^{\prime}$

$A\overset{\alpha}{\longrightarrow}A^{\prime}\land\mathrm{rv}(\alpha)\cap\mathrm{fv}(B)=\emptyset$

$A|B\overset{\alpha}{\longrightarrow}A^{\prime}|B$

$A\equiv A^{\prime}\land A^{\prime}\overset{\alpha}{\longrightarrow}B^{\prime}\land B^{\prime}\equiv B$

$A\overset{\alpha}{\longrightarrow}B$

We denote by $\mu$ a silent action and a labelled action. We define $\Longrightarrow$ as the transitive reflective closure of $\longrightarrow$, and $\overset{\alpha}{\Longrightarrow}$ as $\Longrightarrow\overset{\alpha}{\longrightarrow}\Longrightarrow$. $\overset{\mu}{\Longrightarrow}$ is the former when $\mu$ is silent and is the latter when $\mu=\alpha$.

2.3 Equivalence

2.3.1 Labelled Bisimulation

If $\mathrm{fn}(A)\cap\mathrm{bn}(A)=\emptyset$ and any bound name is not restricted twice, we say that $A$ is name-distinct [7]. If $\mathrm{fv}(A)\cap\mathrm{rv}(A)=\emptyset$ and any restricted variable is not restricted twice, we say that $A$ is variable-distinct. When $A$ and $B$ are name-variable-distinct and $\mathrm{fn}(A)\cap\mathrm{bn}(B)=\mathrm{bn}(A)\cap\mathrm{fn}(B)=\mathrm{bn}(A)\cap\mathrm{bn}(B)=\emptyset$, we say that $A$ and $B$ are bind-exclusive.

A frame is an extended process made from 0 and active substitutions by restriction and parallel composition. $\varphi$ and $\psi$ are used to represent frames. We define a map fr from an extended process to a frame below.

[TABLE]

From now, we identify a frame with a structural equivalent frame.

Definition 2.4**.**

$(M=N)\varphi\overset{\mathrm{def}}{\Leftrightarrow}\mathrm{v}(M)\cup\mathrm{v}(N)\subseteq\mathrm{dom}(\varphi)\land M\sigma=N\sigma$* where $\varphi\equiv\nu\widetilde{n}.\sigma\land\widetilde{n}\cap(\mathrm{n}(M)\cup\mathrm{n}(N))=\emptyset$ for some names $\widetilde{n}$ and active substituions $\sigma$.*

It follows from [1, Lemma D.1] that this definition is well-defined.

Definition 2.5**.**

The static equivalence $\approx_{s}$ on closed frames is given by

[TABLE]

for closed frames $\varphi$ and $\psi$.

The static equivalence on closed processes is given by

[TABLE]

for closed processes $A$ and $B$.

We say that $\varphi$ and $\psi$ are statically equivalent when $\varphi\approx_{s}\psi$. In addition, we say that $A$ and $B$ are static equivalent when $A\approx_{s}B$. It is proved in [1, Lemma 4.1] that a static equivalence is closed by an application of an evaluation context.

We recall labelled bisimulation. It intuitively means that two processes operate in the same manner.

Definition 2.6**.**

A binary relation $\mathcal{R}$ between closed extended processes is called a labelled simulation if and only if whenever $A\mathcal{R}B$,

$A\approx_{s}B$** 2. 2.

$A\overset{\mu}{\longrightarrow}A^{\prime}\land A^{\prime}:\mathrm{closed}\land\mathrm{fv}(\mu)\subseteq\mathrm{dom}(A)\Rightarrow\exists B^{\prime}\ \mathrm{s.t.}\ B\overset{\mu}{\Longrightarrow}B^{\prime}\land A\mathcal{R}B$**

If both $\mathcal{R}$ and $\mathcal{R}^{-1}$ are labelled simulations, we say that $\mathcal{R}$ is a labelled bisimulation. We call the largest labelled bisimulation a labelled bisimilarity.

It is proved in [1, Theorem 4.1] the labelled bisimilarity is closed by an application of an evaluation context.

Note that structural equivalence is stronger than labelled bisimilarity.

Lemma 2.7**.**

Let $\sigma$ and $\rho$ be active substitutions. We assume that their images of variables contain no variables in domains. Then, $\sigma\equiv\rho\Rightarrow[\mathrm{dom}(\sigma)=\mathrm{dom}(\rho)\land\forall x\in\mathrm{dom}(\sigma);x\sigma=x\rho]$.

Proof.

We assume that $\sigma\equiv\rho$. It immediately follows that $\mathrm{dom}(\sigma)=\mathrm{dom}(\rho)$. We arbitrarily take $x\in\mathrm{dom}(\sigma)$. Because structural equivalence is preserved by a parallel composition,

[TABLE]

Because $x\sigma$ does not contain variables in $\mathrm{dom}(\sigma)$,

[TABLE]

The left-hand side can act as below:

[TABLE]

Hence, the right-hand side must act as below:

[TABLE]

In other words, it must hold that $x\rho=x\sigma$. ∎

2.3.2 Trace Equivalence

At first, we define a trace. It can be regarded as a history of observable actions.

Definition 2.8**.**

A trace $\mathbf{tr}$ is a finite derivation $\mathbf{tr}=A_{0}\overset{\mu_{1}}{\Longrightarrow}...\overset{\mu_{n}}{\Longrightarrow}A_{n}$ such that every $A_{i}$ is closed and $\mathrm{fv}(\mu_{i})\subseteq\mathrm{dom}(A_{i-1})$ for all $i$. If $A_{n}$ can perform no actions, the trace $\mathbf{tr}$ is said to be complete or maximal. Given a trace $\mathbf{tr}$, let $\mathbf{tr}[i]$ be its $i$-th process $A_{i}$ and $\mathbf{tr}[i,j]$ be the subderivation $A_{i}\overset{\mu_{i+1}}{\Longrightarrow}...\overset{\mu_{j}}{\Longrightarrow}A_{j}$ where $0\leq i\leq j\leq n$. The length of a trace $\mathbf{tr}$ is denoted by $|\mathbf{tr}|=n$. If each $\overset{\mu_{i}}{\Longrightarrow}$ accord with $\overset{\mu_{i}}{\longrightarrow}$, we say that $\mathbf{tr}$ is full.

Definition 2.9**.**

Let $\mathbf{tr}$ be a trace $A_{0}\overset{\mu_{1}}{\Longrightarrow}...\overset{\mu_{n}}{\Longrightarrow}A_{n}$ and $\mathbf{tr}^{\prime}$ be a trace $B_{0}\overset{\mu^{\prime}_{1}}{\Longrightarrow}...\overset{\mu^{\prime}_{m}}{\Longrightarrow}B_{m}$.

$\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}\overset{\mathrm{def}}{\Leftrightarrow}n=m\land\mu_{i}=\mu^{\prime}_{i}\land A_{i}\approx_{s}B_{i}\ for\ all\ i$.

When tr $\sim_{t}$ tr′**, we say that they are statically equivalent.

Definition 2.10**.**

Let $\mathbf{tr}$ be a trace $A_{0}\overset{\mu_{1}}{\Longrightarrow}...\overset{\mu_{n}}{\Longrightarrow}A_{n}$. We arbitrarily take processes $A_{01},...,A_{0m_{0}},...,A_{n-1,1},...,A_{n-1,m_{n-1}}$ such that

[TABLE]

and each transition is derived without $\alpha$-conversion. If $\mu_{i}$ is silent, $m_{i}$ can be 0. The above derivation is denoted by $\mathrm{unfold(\mathbf{tr})}$.

Note that $\mathrm{unfold(\mathbf{tr})}$ is not always unique.

Definition 2.11**.**

A trace $\mathbf{tr}$ is safe with respect to $A$. $\overset{\mathrm{def}}{\Leftrightarrow}$ Every action in $\mathbf{tr}$ contains no elements in $\mathrm{bn}(A)\cup\mathrm{rv}(A)$ and each transition is derived without $\alpha$-conversion.

If $\mathbf{tr}$ is a trace of $A$, we merely say that $\mathbf{tr}$ is safe or $\mathbf{tr}$ is a safe trace.

Definition 2.12**.**

Let A and B be two closed name-variable-distinct extended processes. $A\subseteq_{t}B$ if and only if we can always complete the procedure below.

We $\alpha$-convert $A$ and $B$ such that $A$ and $B$ are bind-exclusive. 2. 2.

We arbitrarily choose a trace $\mathbf{tr}$ of $A$ which is safe with respect to $A$ and $B$. 3. 3.

We take a safe trace of $B$ which is static equivalent to $\mathbf{tr}$.

When $A\subseteq_{t}B\land B\subseteq_{t}A$, we say that they are trace equivalent and denote by $A\approx_{t}B$.

Let A and B be two name-variable-distinct extended processes. We $\alpha$-convert $A$ and $B$ such that $A$ and $B$ are bind-exclusive. Let $\sigma$ be a map that maps a variable in $(\mathrm{fv}(A)\setminus\mathrm{dom}(A))\cup(\mathrm{fv}(B)\setminus\mathrm{dom}(B))$ to a ground term. When $A\sigma\approx_{t}B\sigma$ for all $\sigma$ and capture-avoiding, we also say that they are trace equivalent and denote as $A\approx_{t}B$.

Note that $\sigma$ causes capture-avoiding substitution.

This definition may look strange, but this is equivalent to the standard definition.

Proposition 2.13**.**

Let A and B be two closed name-variable-distinct extended processes.

$A\subseteq_{t}B\Leftrightarrow$* For any trace tr of $A$, there exists a trace $\mathbf{tr}^{\prime}$ of $B$ such that $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$.*

Proof.

$\Rightarrow$) We arbitrarily take a trace tr of $A$.

First, we $\alpha$-convert $A$ and $B$ to $A^{\prime}$ and $B^{\prime}$ respectively such that $A^{\prime}$ and $B^{\prime}$ are bind-exclusive and they bind no names in actions that are in tr. We replace $A$ with $A^{\prime}$ in tr.

Secondly, we convert processes in tr to structural equivalent processes such that

[TABLE]

Thirdly, we $\alpha$-convert processes in tr such that every transition is derived without $\alpha$-conversion.

Now, we got a safe trace $\mathbf{tr}^{\prime\prime}$ of $A^{\prime}$, so we can obtain a safe trace $\mathbf{tr}^{\prime}$ of $B^{\prime}$ such that $\mathbf{tr}^{\prime\prime}\sim_{t}\mathbf{tr}^{\prime}$ because of $A\subseteq_{t}B$.

Then, we $\alpha$-convert $B^{\prime}$ in $\mathbf{tr}^{\prime\prime}$ to $B$ and obtain a trace of $B$ that is statically equivalent to tr.

$\Leftarrow$) We $\alpha$-convert $A$ and $B$ to $A^{\prime}$ and $B^{\prime}$ respectively such that $A^{\prime}$ and $B^{\prime}$ are bind-exclusive.

Next, we arbitrarily choose a trace tr of $A^{\prime}$ which is safe with respect to $A^{\prime}$ and $B^{\prime}$.

We $\alpha$-convert $A^{\prime}$ in $\mathbf{tr}$ to $A$.

By assumption, we obtain a trace $\mathbf{tr}^{\prime}$ of $B$ that is statically equivalent to tr.

We replace $B$ with $B^{\prime}$ in $\mathbf{tr}^{\prime}$.

Moreover, we convert processes in $\mathbf{tr}^{\prime}$ to structural equivalent processes such that

[TABLE]

In addition, we $\alpha$-convert processes in $\mathbf{tr}^{\prime}$ such that every transition is derived without $\alpha$-conversion.

Now, we got a safe trace of $B^{\prime}$ that is statically equivalent to tr. ∎

Definition 2.14**.**

[TABLE]

Derivations are closed under structural equivalence, so structural equivalence is finer than trace equivalence. In addition, labelled bisimilarity is also finer than trace equivalence.

Example 2.15**.**

We consider

[TABLE]

They have the same traces, so they are trace equivalent. However, they are not bisimilar. In fact, $P\longrightarrow\overline{a}\langle s\rangle.\overline{b}\langle s\rangle$ is not simulated by $Q$.

We later show that a non-adaptive active attacker cannot distinguish trace equivalent processes.

Problem 2.16**.**

Input: Closed extended processes $A,B$ and a trace $\mathbf{tr}\in\mathrm{tr}(B)$.

Question: Does there exist a trace $\mathbf{tr}^{\prime}\in\mathrm{tr}(A)$ such that $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$?

Proposition 2.17**.**

There are signatures for which Problem 2.16 is undecidable, even though the input processes are restricted to plain processes.

Proof.

It is proved in [2, Proposition 5] that static equivalence is undecidable in general. We reduce the decision problem for static equivalence to Problem 2.16.

Let $\varphi$ and $\psi$ be traces. We assume that $\mathrm{dom}(\varphi)=\mathrm{dom}(\psi)$.

Let \varphi=\nu\widetilde{n}.\{\raisebox{1.72218pt}{\smallM_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}},...,\raisebox{1.72218pt}{\smallM_{l}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{l}}\},\psi=\nu\widetilde{m}.\{\raisebox{1.72218pt}{\smallN_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}},...,\raisebox{1.72218pt}{\smallN_{l}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{l}}\}.

Let $P=\nu\widetilde{n}.\overline{a}\langle M_{1}\rangle...\overline{a}\langle M_{l}\rangle,Q=\nu\widetilde{m}.\overline{a}\langle N_{1}\rangle...\overline{a}\langle N_{l}\rangle$, where $a\notin\widetilde{n}\cup\widetilde{m}$.

Let tr be P\overset{\nu x_{1}.\overline{a}\langle x_{1}\rangle}{\longrightarrow}\nu\widetilde{n}.(\overline{a}\langle M_{2}\rangle...\overline{a}\langle M_{l}\rangle|\{\raisebox{1.72218pt}{\smallM_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}}\})\overset{\nu x_{2}.\overline{a}\langle x_{2}\rangle}{\longrightarrow}...\overset{\nu x_{l}.\overline{a}\langle x_{l}\rangle}{\longrightarrow}\nu\widetilde{n}.\{\raisebox{1.72218pt}{\smallM_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}},...,\raisebox{1.72218pt}{\smallM_{l}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{l}}\}.

We prove that $\varphi\approx_{s}\psi\Leftrightarrow$ there exists a trace $\mathbf{tr}^{\prime}\in\mathrm{tr}(A)$ such that $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$.

A trace $\mathbf{tr}^{\prime}\in\mathrm{tr}(Q)$ whose actions correspond to tr is the only below:

[TABLE]

We assume that $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$. Then, \nu\widetilde{n}.\{\raisebox{1.72218pt}{\smallM_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}},...,\raisebox{1.72218pt}{\smallM_{l}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{l}}\}\approx_{s}\nu\widetilde{m}.\{\raisebox{1.72218pt}{\smallN_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}},...,\raisebox{1.72218pt}{\smallN_{l}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{l}}\}, so $\Leftarrow$ holds.

Next, we assume that $\varphi\approx_{s}\psi$. Then,

[TABLE]

Therefore, it follows that $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$. Namely, $\Rightarrow$ also holds. ∎

Proposition 2.18**.**

If the static equivalence on a signature $\Sigma$ is decidable, Problem 2.16 is decidable.

Proof.

The number of traces in $\mathrm{tr}(A)$ whose actions correspond to ones in tr is finite because every action yields finite processes.

This is why we only have to check whether each process is statically equivalent to the correspondent process in tr. ∎

Definition 2.19**.**

A convergent subterm theory is an equational theory defined by finite equations whose each right-hand side is a proper subterm of the left-hand side.

For example, if $\Sigma=\{\mathrm{dec},\mathrm{enc}\}$ and an equational theory on $\Sigma$ is defined by

[TABLE]

this theory is convergent subterm.

It is proved in [2, Theorem 1] that static equivalence on a convergent subterm theory is decidable, so the corollary below immediately follows.

Corollary 2.20**.**

If the equational theory on $\Sigma$ is a convergent subterm theory , then Problem 2.16 is decidable.

2.4 Examples

We express Diffie-Hellman key exchange and the man-in-the-middle attack by the applied pi calculus.

The fundamental Diffie-Hellman protocol enables two parties to make a shared secret key by exchanging messages on public channels.

We consider the binary function symbol $f$ and the unary function symbol $g$. They satisfy $f(x,g(y))=f(y,g(x))$. We intend that $f(x,y)=y^{x}\ \mathrm{mod}\ p$ and $g(x)=\alpha^{x}\ \mathrm{mod}\ p$ where $p$ is a prime, $\alpha$ is a generator of $(\mathbb{Z}/p\mathbb{Z})^{*}$, and $x$ and $y$ are elements in $(\mathbb{Z}/p\mathbb{Z})^{*}$. However, such a specific definition is not necessary for the discussion below.

Diffie-Hellman protocol is expressed in the applied pi calculus as below. Note that $k_{A}$ and $k_{B}$ are variables. Alice behaves as $\nu a,k_{A}.\overline{c}\langle g(a)\rangle.d(x).(P_{A}|\{f(a,x)/k_{A}\})$ and Bob behaves as $\nu b,k_{B}.c(y).\overline{d}\langle g(b)\rangle.(P_{B}|\{f(b,y)/k_{B}\})$. We suppose that $P_{A}$ does not contain $x$ for simplicity. $P_{B}$ is similar.

[TABLE]

In the first transition, Alice sent $g(a)$ on a channel $c$, and Bob received it. In the second transition, Bob sent $g(b)$ on a channel $d$, and Alice received it. Then, $Alice$ makes a shared key using $g(b)$. That is, she calculates $f(a,g(b))$. Similarly, $Bob$ calculates $f(b,g(a))$. They coincide by the equation above. The transitions above represent a good case. If someone eavesdrops, it is expressed as below.

[TABLE]

Unlike the first example, sending and receiving are observable. Note that the domain of the last process contains $z$ and $w$. The environment —now it is an eavesdropper— can use them freely. In other words, the eavesdropper gets the value of $g(a)$ and $g(b)$. On the other hand, she cannot directly use $a$ and $b$ because they are restricted. Moreover, she cannot calculate $a$ and $b$ from $g(a)$ and $g(b)$ because such equations do not exist. This corresponds to the complexity of discrete logarithm problems.

If an active attacker exists, this protocol is no longer safe.

[TABLE]

The attacker sent $g(r)$ to Bob and sent $g(s)$ to Alice. Then, $Alice$ calculates $f(a,g(s))$ and use it as a secret key. The value is same with $f(s,z)$ in this situation, so the attacker can read secret messages encrypted by the key. Bob is similar. This man-in-the-middle attack is well known. This is why Diffie-Hellman protocol needs authentication.

Chapter 3 Congruency of Trace Equivalence

This chapter proves the theorem below by case analysis, and this is our main result.

Theorem 3.1**.**

$\approx_{t}$* is a congruence.*

In this chapter and the next chapter, we assume that every process is bind-exclusive. Otherwise, we $\alpha$-convert so that it is satisfied. This chapter and the appendix use many results in [1]

At first, we summarize lemmas for this chapter. We omit all proofs here. See Appendix. We will define the notion of normal processes later (Definition 3.12, 3.13 and the remark before them).

Lemma 3.2**.**

$P\overset{\alpha\sigma}{\longrightarrow}A\Rightarrow\sigma|P\overset{\alpha}{\longrightarrow}\sigma|A$.

Lemma 3.3**.**

$\nu u.A\overset{\mu}{\longrightarrow}B\land A:\mathrm{closed}\land\mathrm{fv}(\mu)\subseteq\mathrm{dom}(\nu u.A)\land\mathrm{n}(\mu)\cap\mathrm{bn}(\nu u.A)=\emptyset$**

$\Rightarrow\exists B^{\prime}\ s.t.\ A\overset{\mu}{\longrightarrow}B^{\prime}\land B\equiv\nu u.B^{\prime}$**

Lemma 3.4**.**

Let $\nu\widetilde{n}.(\sigma|P)$ be a closed normal process.

$\nu\widetilde{n}.(\sigma|P)\overset{\alpha}{\longrightarrow}A\land\alpha\sigma=\beta\sigma\land\mathrm{fv}(\alpha)\subseteq\mathrm{dom}(\sigma)\land\widetilde{n}\cap(\mathrm{n}(\alpha)\cup\mathrm{n}(\beta))=\emptyset$**

$\Rightarrow\nu\widetilde{n}.(\sigma|P)\overset{\beta}{\longrightarrow}A$.

Lemma 3.5**.**

$\sigma|A\overset{\mu}{\longrightarrow}\sigma|B\land\mathrm{dom}(\sigma)\cap\mathrm{fv}(\mu)=\emptyset\land x\in\mathrm{dom}(\sigma)\Rightarrow x\sigma$: closed

$\Rightarrow A\sigma\overset{\mu}{\longrightarrow}B\sigma$.

Lemma 3.6**.**

$\sigma|P\overset{\mu}{\longrightarrow}B\land\sigma|P$: closed normal $\land\mathrm{fv}(\mu)\subseteq\mathrm{dom}(\sigma)$

$\Rightarrow\exists B^{\prime}\ \mathrm{s.t.}\ P\sigma\overset{\mu\sigma}{\longrightarrow}B^{\prime}\land B\equiv\sigma|B^{\prime}$.

3.1 The Case of Applying a Context without Composition

This case is straightforward, and the proof is simple, but some propositions rely on Proposition 3.19.

Proposition 3.7**.**

$P\approx_{t}Q\Rightarrow\overline{M}\langle N\rangle.P\approx_{t}\overline{M}\langle N\rangle.Q$**

Proof.

Assume that $P\approx_{t}Q$.

For all assignments $\sigma$, it is sufficient to prove that $\overline{M\sigma}\langle N\sigma\rangle.P\sigma\approx_{t}\overline{M\sigma}\langle N\sigma\rangle.Q\sigma$. Thus, we can suppose that $P,Q,M$ and $N$ are closed without loss of generality. We arbitrarily take a safe trace tr of $\overline{M}\langle N\rangle.P$. Here, unfold(tr) is $\overline{M}\langle N\rangle.P\overset{\nu x.\overline{M}\langle x\rangle}{\longrightarrow}A\overset{\mu}{\longrightarrow}$ … and $A\equiv P|\{N/x\}$ for some $x$.

By Proposition 3.19, $P|\{N/x\}\approx_{t}Q|\{N/x\}$, so there exists a trace of $Q|\{N/x\}$ which is statically equivalent to the part $A\overset{\mu}{\longrightarrow}$ … of unfold(tr). We add $\overline{M}\langle N\rangle.Q\overset{\nu x.\overline{M}\langle x\rangle}{\longrightarrow}$ to it and we get a trace of $\overline{M}\langle N\rangle.Q$ that is statically equivalent to unfold(tr). We omit some silent actions and get the desired trace. Hence, $\overline{M}\langle N\rangle.P\subseteq_{t}\overline{M}\langle N\rangle.Q$ and vice versa. ∎

Proposition 3.8**.**

$P\approx_{t}Q\Rightarrow M(x).P\approx_{t}M(x).Q$**

Proof.

Assume that $P\approx_{t}Q$.

For all assignments $\sigma$, it is sufficient to prove that $M\sigma(x).P\sigma\approx_{t}M\sigma(x).Q\sigma$. Thus, we can suppose that $M$ is closed and $\mathrm{fv}(P)\cup\mathrm{fv}(Q)\subseteq\{x\}$ without loss of generality. Note that $x$ is not mapped by $\sigma$ because it is not free in $M(x).P$ and $M(x).Q$. We arbitrarily take a safe trace tr of $M(x).P$. Here, unfold(tr) is $M(x).P\overset{M(N)}{\longrightarrow}P^{\prime}\overset{\mu}{\longrightarrow}$ … and $P^{\prime}\equiv P\{N/x\}$ for some ground $N$. By $P\approx_{s}Q$, there exists a trace of $Q\{N/x\}$ which is statically equivalent to the part $P^{\prime}\overset{\mu}{\longrightarrow}$ … of unfold(tr). We add $M(x).Q\overset{M(N)}{\longrightarrow}$ to it and we get the desired trace of $M(x).Q$ that is statically equivalent to unfold(tr). We omit some silent actions and get the desired trace. Hence, $M(x).P\subseteq_{t}M(x).Q$ and vice versa. ∎

Proposition 3.9**.**

$A\approx_{t}B\Rightarrow\nu u.A\approx_{t}\nu u.B$* (When $u$ is a variable, $u\in\mathrm{dom}(A)$.)*

Proof.

Assume that $A\approx_{t}B$.

For all assignments $\sigma$, it is sufficient to prove that $(\nu u.A)\sigma\approx_{t}(\nu u.B)\sigma$. Thus, we can suppose that $A$ and $B$ are closed without loss of generality. We arbitrarily take a safe trace tr of $\nu u.A$. Here, unfold(tr) is $\nu u.A\overset{\mu_{1}}{\longrightarrow}C_{1}\overset{\mu_{2}}{\longrightarrow}...$. By Lemma 3.3, there exists $C_{1}^{\prime}$ such that $A\overset{\mu_{1}}{\longrightarrow}C_{1}^{\prime}\land C_{1}\equiv\nu u.C_{1}^{\prime}$. Moreover, we use Lemma 3.3 repeatedly, and we get

[TABLE]

We take a trace of $B$ which is statically equivalent to the second line and add $\nu u.$ to each process. This is possible because tr is safe. Recall that every action in a safe trace contains no bound names and restricted variables. Hence, $\mu_{i}$ does not contain $u$.

[TABLE]

The last line is statically equivalent to unfold(tr). Note that restriction preserves static equivalence. We omit some internal reductions and get the desired trace. Hence, $\nu u.A\subseteq_{t}\nu u.B$ and vice versa. ∎

Proposition 3.10**.**

$P\approx_{t}Q\Rightarrow\mathrm{if}~{}M=N~{}\mathrm{then}~{}P~{}\mathrm{else}~{}R\approx_{t}\mathrm{if}~{}M=N~{}\mathrm{then}~{}Q~{}\mathrm{else}~{}R$.

Proof.

Assume that $P\approx_{t}Q$. For all assignments $\sigma$, it is sufficient to prove that

[TABLE]

Thus, we can suppose that $P,Q,R,M$ and $N$ are closed without loss of generality. We arbitrarily take a safe trace tr of $\mathrm{if}~{}M=N~{}\mathrm{then}~{}P~{}\mathrm{else}~{}R$. Here, unfold(tr) is

[TABLE]

We know that $A\equiv P\lor A\equiv R$, so we can regard $A\overset{\mu}{\longrightarrow}...$ as a trace of $P$ or $R$. In the former case, there exists a trace of $Q$ which is statically equivalent to it. We add $\mathrm{if}~{}M=N~{}\mathrm{then}~{}Q~{}\mathrm{else}~{}R\longrightarrow$ to it and get a trace of $\mathrm{if}~{}M=N~{}\mathrm{then}~{}Q~{}\mathrm{else}~{}R$ which is statically equivalent to unfold(tr). In the latter case, we add $\mathrm{if}~{}M=N~{}\mathrm{then}~{}Q~{}\mathrm{else}~{}R\longrightarrow$ to $A\overset{\mu}{\longrightarrow}...$ and get a trace of $\mathrm{if}~{}M=N~{}\mathrm{then}~{}Q~{}\mathrm{else}~{}R$ which is statically equivalent to unfold(tr). We omit some internal reductions and get the desired trace. Hence,

[TABLE]

and vice versa. ∎

Proposition 3.11**.**

$P\approx_{t}Q\Rightarrow P+R\approx_{t}Q+R$.

Proof.

Assume that $P\approx_{t}Q$. For all assignments $\sigma$, it is sufficient to prove that

[TABLE]

Thus, we can suppose that $P,Q$ and $R$ are closed without loss of generality. We arbitrarily take a safe trace tr of $P+R$. Here, unfold(tr) is $P+R\longrightarrow A\overset{\mu}{\longrightarrow}...$. We know that $A\equiv P\lor A\equiv R$, so we can regard $A\overset{\mu}{\longrightarrow}...$ as a trace of $P$ or $R$. In the former case, there exists a trace of $Q$ which is statically equivalent to it. We add $Q+R\longrightarrow$ to it and get a trace of $Q+R$ which is statically equivalent to unfold(tr). In the latter case, we add $Q+R\longrightarrow$ to $A\overset{\mu}{\longrightarrow}...$ and get a trace of $Q+R$ which is statically equivalent to unfold(tr). We omit some internal reductions and get the desired trace. Hence, $P+R\subseteq_{t}Q+R$ and vice versa. ∎

Hereafter, we often use partial normal forms [1]. $\mathrm{pnf}(A)$ is the partial normal form of $A$. We call a process which is partial normal form a normal process.

Definition 3.12**.**

Let $\sigma$ and $\rho$ be active substitutions.

We assume that $\sigma|\rho\equiv\{M_{1}/x_{1},...,M_{n}/x_{n}\}$ where each $M_{i}$ does not contain $x_{1},...,x_{i}$ by reordering. We define $\sigma_{0}=0$ and $\sigma_{i+1}=\sigma_{i}\{M_{i+1}/x_{i+1}\}|\{M_{i+1}/x_{i+1}\}$. Then, we also define $\sigma\uplus\rho=\sigma_{n}$.

Definition 3.13**.**

We suppose that $\mathrm{pnf}(A)=\nu\widetilde{n}.(\sigma|P)$ and $\mathrm{pnf}(B)=\nu\widetilde{m}.(\rho|Q)$.

[TABLE]

Note that $A\equiv\mathrm{pnf}(A)$.

Lemma 3.14**.**

If $A$ and $P$ are closed and $A|!P\longrightarrow B$, it holds one of the following:

$\exists A^{\prime}\ \mathrm{s.t.}\ A\longrightarrow A^{\prime}\land B\equiv A^{\prime}|!P$. 2. 2.

$\exists P^{\prime\prime}\ \mathrm{s.t.}\ P|P\longrightarrow P^{\prime\prime}\land B\equiv A|P^{\prime\prime}|!P$. 3. 3.

$\exists E\ \mathrm{s.t.}\ A|P\longrightarrow E\land B\equiv E|!P$.

Proof.

Let $\mathrm{pnf}(A)=\nu\widetilde{n}.(\sigma|Q)$.

Then, $\mathrm{pnf}(A|!P)=\nu\widetilde{n}.(\sigma|Q|!P)$. Note that $\mathrm{n}(P)\cap\widetilde{n}=\emptyset$.

By [1, Lemma B.23], $Q|!P\longrightarrow R\land B\equiv\nu\widetilde{n}.(\sigma|R)$ for some closed $R$.

By [1, Lemma B.24], we consider the following four cases:

$Q\longrightarrow Q^{\prime}\land R\equiv Q^{\prime}|!P$ for some closed $Q^{\prime}$.

$A\equiv\nu\widetilde{n}.(\sigma|Q)\longrightarrow\nu\widetilde{n}.(\sigma|Q^{\prime})$ and $\nu\widetilde{n}.(\sigma|Q^{\prime})|!P\equiv\nu\widetilde{n}.(\sigma|Q^{\prime}|!P)\equiv B$.

Then, $A^{\prime}=\nu\widetilde{n}.(\sigma|Q^{\prime})$ satisfies case 1 of this lemma. 2. 2.

$!P\longrightarrow P^{\prime}\land R\equiv Q|P^{\prime}$ for some closed $P^{\prime}$.

By [1, Lemma B.24], $P|P\longrightarrow P^{\prime\prime}\land P^{\prime}\equiv P^{\prime\prime}|!P$ for some closed $P^{\prime\prime}$.

$B\equiv\nu\widetilde{n}.(\sigma|R)\equiv\nu\widetilde{n}.(\sigma|Q)|P^{\prime\prime}|!P\equiv A|P^{\prime\prime}|!P$, so case 1 of this lemma is satisfied. 3. 3.

$Q\overset{N(x)}{\longrightarrow}B^{\prime}\land!P\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}C\land R\equiv\nu x.(B^{\prime}|C)$ for some $B^{\prime},C,x$ and ground $N$.

By [1, Lemma B.18], $P\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}D\land C\equiv D|!P$ for some $D$.

Then,

[TABLE]

Thus, $E=\nu\widetilde{n}.(\sigma|\nu x.(B^{\prime}|D))$ satisfies case 3 of this lemma. 4. 4.

$!P\overset{N(x)}{\longrightarrow}B^{\prime}\land Q\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}C\land R\equiv\nu x.(B^{\prime}|C)$ for some $B^{\prime},C,x$ and ground $N$.

By [1, Lemma B.18], $P\overset{N(x)}{\longrightarrow}D\land B^{\prime}\equiv D|!P$ for some $D$.

Then,

[TABLE]

Thus, $E=\nu\widetilde{n}.(\sigma|\nu x.(D|C))$ satisfies case 3 of this lemma.

∎

Corollary 3.15**.**

If $A$ and $P$ are closed and $A|!P\longrightarrow B$, then $A|P|P\longrightarrow C\land B\equiv C|!P$ for some $C$.

Lemma 3.16**.**

If $A$ and $P$ are closed and $A|!P\overset{\alpha}{\longrightarrow}B$ and $\mathrm{fv}(\alpha)\subseteq\mathrm{dom}(A)$ and $\mathrm{n}(\alpha)\cap\mathrm{bn}(A|!P)=\emptyset$, it holds one of the following:

$\exists E\ \mathrm{s.t.}\ A\overset{\alpha}{\longrightarrow}E\land B\equiv E|!P$. 2. 2.

$\exists F\ \mathrm{s.t.}\ A|P\overset{\alpha}{\longrightarrow}F\land B\equiv F|!P$.

Proof.

Let $\mathrm{pnf}(A)=\nu\widetilde{n}.(\sigma|Q)$.

Then, $\mathrm{pnf}(A|!P)=\nu\widetilde{n}.(\sigma|Q|!P)$.

By [1, Lemma B.19], $Q|!P\overset{\alpha\sigma}{\longrightarrow}C\land B\equiv\nu\widetilde{n}.(\sigma|C)$ for some $C$.

By [1, Lemma B.18], we consider the following two cases:

$Q\overset{\alpha\sigma}{\longrightarrow}D\land C\equiv D|!P$ for some $D$.

By Lemma 3.2, $\sigma|Q\overset{\alpha}{\longrightarrow}\sigma|D$.

Thus, $A\equiv\nu\widetilde{n}.(\sigma|Q)\overset{\alpha}{\longrightarrow}\nu\widetilde{n}.(\sigma|D)$.

In addition, $\nu\widetilde{n}.(\sigma|D)|!P\equiv\nu\widetilde{n}.(\sigma|D|!P)\equiv B$, so $E=\nu\widetilde{n}.(\sigma|D)$ satisfies case 1 of this lemma. 2. 2.

$!P\overset{\alpha\sigma}{\longrightarrow}D\land C\equiv Q|D$ for some $D$.

By [1, Lemma B.18], $P\overset{\alpha\sigma}{\longrightarrow}E\land D\equiv E|!P$ for some $E$.

By Lemma 3.2, $\sigma|P\overset{\alpha}{\longrightarrow}\sigma|E$.

Thus, $A|P\equiv\nu\widetilde{n}.(\sigma|Q)|P\overset{\alpha}{\longrightarrow}\nu\widetilde{n}.(\sigma|Q|E)$.

In addition, $\nu\widetilde{n}.(\sigma|Q|E)|!P\equiv\nu\widetilde{n}.(\sigma|Q|E|!P)\equiv B$, so $F=\nu\widetilde{n}.(\sigma|Q|E)$ satisfies case 2 of this lemma.

∎

Corollary 3.17**.**

If $A$ and $P$ are closed and $A|!P\overset{\alpha}{\longrightarrow}B$ and $\mathrm{fv}(\alpha)\subseteq\mathrm{dom}(A)$ and $\mathrm{n}(\alpha)\cap\mathrm{bn}(A|!P)=\emptyset$, then $A|P\overset{\alpha}{\longrightarrow}C\land B\equiv C|!P$ for some $C$.

Proposition 3.18**.**

$P\approx_{t}Q\Rightarrow!P\approx_{t}!Q$.

Proof.

Assume that $P\approx_{t}Q$.

For all assignments $\sigma$, it is sufficient to prove that $!P\sigma\approx_{t}!Q\sigma$. Thus, we can suppose that $P$ and $Q$ are closed without loss of generality.

We arbitrarily take a safe trace tr of $!P$. By corollary 3.15, 3.17, we obtain a trace which is of the form $P^{n}|!P\overset{\mu_{1}}{\longrightarrow}A_{1}|!P\overset{\mu_{2}}{\longrightarrow}A_{2}|!P\overset{\mu_{3}}{\longrightarrow}...$ and statically equivalent to unfold(tr). We also obtain $P^{n}\overset{\mu_{1}}{\longrightarrow}A_{1}\overset{\mu_{2}}{\longrightarrow}A_{2}\overset{\mu_{3}}{\longrightarrow}...$ to convert each process in unfold(tr). Here, $n$ depends on tr and $P^{n}$ is $n$ concurrent processes. Strictly speaking, processes in $P^{n}$ are not same when $\mathrm{bn}(P)\neq\emptyset$. In this case, we $\alpha$-convert $P$ and make processes in $P^{n}$ bind-exclusive.

By Proposition 3.19, $P^{n}\approx_{t}Q^{n}$, so there exists a trace of $Q^{n}$ which is statically equivalent to $P^{n}\overset{\mu_{1}}{\longrightarrow}A_{1}\overset{\mu_{2}}{\longrightarrow}A_{2}\overset{\mu_{3}}{\longrightarrow}...$.

We add $|!Q$ to each process in the trace, omit some internal reductions and get the desired trace. Hence, $!P\subseteq_{t}!Q$ and vice versa. ∎

3.2 The Case of Parallel Composition

Proposition 3.19**.**

$A\approx_{t}B\Rightarrow A|C\approx_{t}B|C$.

This proof is very long and complex, so we present an outline at first. We suppose that $A,B$ and $C$ are closed as before.

First, we define a concurrent normal form. This is a special form of a trace of a process which is of the form $A|C$. A concurrent normal trace completely captures the change of scope of bound names.

Secondly, we prove that every safe trace of $A|C$ can be transformed into a concurrent normal form. This proof is constructive.

Thirdly, we constitute a correspondent trace from the concurrent normal trace by division into cases.

Finally, we convert the extracted traces, combine them and prove that the result is statically equivalent to the given trace.

In this section, we always assume that structural equivalent processes are constructed without $\alpha$-conversion.

3.2.1 A Definition of a Concurrent Normal Trace

Definition 3.20**.**

$[\sigma\rho]=(\sigma\uplus\rho)_{|\mathrm{dom}(\sigma)}$.

Lemma 3.21**.**

$\sigma\rho\equiv[\sigma\rho]$.

Proof.

See Appendix. ∎

Lemma 3.22**.**

$\rho\sigma\equiv\rho[\sigma\rho]$.

Proof.

See Appendix. ∎

Lemma 3.23**.**

$(\sigma|P)\rho\equiv[\sigma\rho]|P[\rho\sigma]$.

Proof.

See Appendix. ∎

Concurrent normal form completely records communication.

Definition 3.24**.**

A concurrent normal trace $\mathbf{tr}$ of $A|C$ is a trace which satisfies the following conditions.

$\mathbf{tr}$* is full and safe.* 2. 2.

Each process in $\mathbf{tr}$ is of the form $\nu\widetilde{r_{m}}\widetilde{s_{m}}.(\nu\widetilde{x_{m}}.A_{m}\rho_{m}|\nu\widetilde{y_{m}}.C_{m}\sigma_{m})$.

In addition, The conditions below are satisfied.

• •

$\mathrm{fv}(A_{m})\setminus\mathrm{dom}(A_{m})\subseteq\mathrm{dom}(\rho_{m})\land\mathrm{fv}(C_{m})\setminus\mathrm{dom}(C_{m})\subseteq\mathrm{dom}(\sigma_{m})$.

• •

$\mathrm{n}(\rho_{m})\cap\widetilde{s_{m}}=\emptyset\land\mathrm{n}(\sigma_{m})\cap\widetilde{r_{m}}=\emptyset$.

• •

$A_{m}=\sigma_{m}|P_{m}\land C_{m}=\rho_{m}|Q_{m}$* and they are normal for some $P_{m}$ and $Q_{m}$, and $\mathrm{n}(Q_{m})\cap\widetilde{s_{m}}=\emptyset\land\mathrm{n}(P_{m})\cap\widetilde{r_{m}}=\emptyset$.*

Let $D_{m}=\nu\widetilde{r_{m}}\widetilde{s_{m}}.(\nu\widetilde{x_{m}}.A_{m}\rho_{m}|\nu\widetilde{y_{m}}.C_{m}\sigma_{m})$. 3. 3.

For every $D_{m}\longrightarrow D_{m+1}$ in $\mathbf{tr}$, it holds one of the following:

1. (a)

$A_{m}\rho_{m}\longrightarrow A_{m+1}\rho_{m}$* and elements in $D_{m+1}$ except for $A_{m+1}$ are same as counterparts in $D_{m}$.* 2. (b)

$C_{m}\sigma_{m}\longrightarrow C_{m+1}\sigma_{m}$* and elements in $D_{m+1}$ except for $C_{m+1}$ are same as counterparts in $D_{m}$.* 3. (c)

• •

$A_{m}\rho_{m}\overset{N_{1}(x)}{\longrightarrow}A_{m+1}\rho_{m}\land C_{m}\sigma_{m}\overset{\nu x.\overline{N_{2}}\langle x\rangle}{\longrightarrow}\nu\widetilde{m}.C_{m+1}\sigma_{m}$,

• •

$\widetilde{r_{m+1}}=\widetilde{r_{m}}\widetilde{m}$,

• •

$\rho_{m+1}=\rho_{m}\uplus\{M/x\}$,

• •

$\widetilde{m}=\mathrm{n}(M)\cap\mathrm{bn}(C_{m})$,

• •

$N_{1}[\sigma_{m}\rho_{m}]=N_{2}[\rho_{m}\sigma_{m}]$: ground,

• •

$\widetilde{r_{m}}\cap\mathrm{n}(N_{1})=\emptyset\land\widetilde{s_{m}}\cap\mathrm{n}(N_{2})=\emptyset$,

• •

$M[\sigma_{m}\rho_{m}]$: ground,

• •

$\widetilde{y_{m+1}}=\widetilde{y_{m}}x$,

• •

$\mathrm{n}(M)\cap\widetilde{s_{m}}=\emptyset$,

for some $N_{1},N_{2},M$ and $x$, and the other parts of $D_{m+1}$ are same as counterparts in $D_{m}$. 4. (d)

• •

$C_{m}\sigma_{m}\overset{N_{2}(x)}{\longrightarrow}C_{m+1}\sigma_{m}$,

• •

$A_{m}\rho_{m}\overset{\nu x.\overline{N_{1}}\langle x\rangle}{\longrightarrow}\nu\widetilde{m}.A_{m+1}\rho_{m}$,

• •

$\widetilde{s_{m+1}}=\widetilde{s_{m}}\widetilde{m}$,

• •

$\sigma_{m+1}=\sigma_{m}\uplus\{M/x\}$,

• •

$\widetilde{m}=\mathrm{n}(M)\cap\mathrm{bn}(A_{m})$,

• •

$N_{1}[\sigma_{m}\rho_{m}]=N_{2}[\rho_{m}\sigma_{m}]$: ground,

• •

$\widetilde{s_{m}}\cap\mathrm{n}(N_{2})=\emptyset$,

• •

$\widetilde{r_{m}}\cap\mathrm{n}(N_{1})=\emptyset$.,

• •

$M[\rho_{m}\sigma_{m}]$: ground,

• •

$\widetilde{x_{m+1}}=\widetilde{x_{m}}x$,

• •

$\mathrm{n}(M)\cap\widetilde{r_{m}}=\emptyset$,

for some $N_{1},N_{2},M$ and $x$, and the other parts of $D_{m+1}$ are same as counterparts in $D_{m}$. 4. 4.

For every $D_{m}\overset{N(M)}{\longrightarrow}D_{m+1}$ in $\mathbf{tr}$, it holds one of the following:

1. (a)

$A_{m}\rho_{m}\overset{N(M)[\rho_{m}\sigma_{m}]}{\longrightarrow}A_{m+1}\rho_{m}$* and elements in $D_{m+1}$ except for $A_{m+1}$ are same as counterparts in $D_{m}$.* 2. (b)

$C_{m}\sigma_{m}\overset{N(M)[\sigma_{m}\rho_{m}]}{\longrightarrow}C_{m+1}\sigma_{m}$* and elements in $D_{m+1}$ except for $C_{m+1}$ are same as counterparts in $D_{m}$.* 5. 5.

For every $D_{m}\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}D_{m+1}$ in $\mathbf{tr}$, it holds one of the following:

1. (a)

• •

$A_{m}\rho_{m}\overset{\nu x.\overline{N}\langle x\rangle[\rho_{m}\sigma_{m}]}{\longrightarrow}\nu\widetilde{m}.A_{m+1}\rho_{m}$,

• •

$\sigma_{m+1}=\sigma_{m}\uplus\{M/x\}$,

• •

$\widetilde{s_{m+1}}=\widetilde{s_{m}}\widetilde{m}$,

• •

$\widetilde{m}=\mathrm{n}(M)\cap\mathrm{bn}(A_{m})$**

• •

$M[\rho_{m}\sigma_{m}]$: ground,

• •

$\mathrm{n}(M)\cap\widetilde{r_{m}}=\emptyset$,

and the other parts of $D_{m+1}$ are same as counterparts in $D_{m}$. 2. (b)

• •

$C_{m}\sigma_{m}\overset{\nu x.\overline{N}\langle x\rangle[\sigma_{m}\rho_{m}]}{\longrightarrow}\nu\widetilde{m}.C_{m+1}\sigma_{m}$,

• •

$\rho_{m+1}=\rho_{m}\uplus\{M/x\}$,

• •

$\widetilde{r_{m+1}}=\widetilde{r_{m}}\widetilde{m}$,

• •

$\widetilde{m}=\mathrm{n}(M)\cap\mathrm{bn}(C_{m})$,

• •

$M[\sigma_{m}\rho_{m}]$: ground,

• •

$\mathrm{n}(M)\cap\widetilde{s_{m}}=\emptyset$,

and the other parts of $D_{m+1}$ are same as counterparts in $D_{m}$. 6. 6.

1. (a)

At 3a, let $A_{m}^{\prime}$ be a process obtained by applying $\rho_{m}$ to only for the part related to the transition from $A_{m}$. Then, $A_{m}^{\prime}\longrightarrow A_{m+1}$, and 3b is similar. 2. (b)

At 3c, let $A_{m}^{\prime}$ be a process obtained by substituting only for the part related to the transition from $A_{m}$. Then, $A_{m}^{\prime}\overset{N_{1}[\sigma_{m}\rho_{m}](x)}{\longrightarrow}A_{m+1}$. $C_{m}$ is similar, and 3d is similar. 3. (c)

At 4a, let $A_{m}^{\prime}$ be a process obtained by substituting only for the part related to the transition from $A_{m}$. Then, $A_{m}^{\prime}\overset{N(\rho_{m}\uplus\sigma_{m})(M)}{\longrightarrow}A_{m+1}$, and 4b is similar. 4. (d)

At 5a, let $A_{m}^{\prime}$ be a process obtained by substituting only for the part related to the transition from $A_{m}$. Then, $A_{m}^{\prime}\overset{\nu x.\overline{N(\rho_{m}\uplus\sigma_{m})}\langle x\rangle}{\longrightarrow}A_{m+1}$, and 5b is similar.

3.2.2 A Transformation into a Concurrent Normal Form

We can transform all full safe traces of a parallel composed process into a concurrent normal form.

Lemma 3.25**.**

For any full safe trace of $A|C$, there exists a concurrent normal trace of $A|C$ such that they are statically equivalent.

Proof.

We transform the given trace in order from the top. Assuming that we transformed the first $m$-th process.

We suppose that $\nu\widetilde{r}\widetilde{s}.(\nu\widetilde{x}.A_{m}\rho|\nu\widetilde{y}.C_{m}\sigma)\overset{\mu}{\longrightarrow}D$.

By Lemma 3.3, $\nu\widetilde{x}.A_{m}\rho|\nu\widetilde{y}.C_{m}\sigma\overset{\mu}{\longrightarrow}D^{\prime}\land D\equiv\nu\widetilde{r}\widetilde{s}.D^{\prime}$.

Let $A_{m}=\sigma|P\land C_{m}=\rho|Q$. Note that $A_{m}\rho\equiv[\sigma\rho]|P[\rho\sigma]$ and $C_{m}\sigma\equiv[\rho\sigma]|Q[\sigma\rho]$.

Then, $\nu\widetilde{x}\widetilde{y}.\sigma\uplus\rho|P[\rho\sigma]|Q[\sigma\rho]\overset{\mu}{\longrightarrow}D^{\prime}$. That is, $(\sigma\uplus\rho)_{|dom(\sigma\uplus\rho)\setminus\widetilde{x}\widetilde{y}}|P[\rho\sigma]|Q[\sigma\rho]\overset{\mu}{\longrightarrow}D^{\prime}$.

First, we consider when $\mu$ is silent.

By [1, Lemma B.23], $P[\rho\sigma]|Q[\sigma\rho]\longrightarrow R\land D^{\prime}\equiv(\sigma\uplus\rho)_{|dom(\sigma\uplus\rho)\setminus\widetilde{x}\widetilde{y}}|R$ for some closed $R$.

We consider four cases.

$P[\rho\sigma]\longrightarrow P^{\prime}[\rho\sigma]\land R\equiv P^{\prime}[\rho\sigma]|Q[\sigma\rho]$ for some $P^{\prime}$ where $\mathrm{fv}(P^{\prime})\subseteq\mathrm{dom}(\rho)$. Furthermore, let $P^{\prime\prime}$ be a process obtained by applying $[\rho\sigma]$ to only for the part related to the transition from $P$. Then, $P^{\prime\prime}\longrightarrow P^{\prime}$.

$A_{m}\rho\longrightarrow[\sigma\rho]|P^{\prime}[\rho\sigma]\equiv(\sigma|P^{\prime})\rho$.

Hence,

[TABLE]

This is the desired form. 2. 2.

$Q[\sigma\rho]\longrightarrow Q^{\prime}[\sigma\rho]\land R\equiv P[\rho\sigma]|Q^{\prime}[\sigma\rho]$ for some $Q^{\prime}$ where $\mathrm{fv}(Q^{\prime})\subseteq\mathrm{dom}(\sigma)$. Furthermore, let $Q^{\prime\prime}$ be a process obtained by applying $[\sigma\rho]$ to only for the part related to the transition from $Q$. Then, $Q^{\prime\prime}\longrightarrow Q^{\prime}$.

This case is similar to case 1. 3. 3.

$P[\rho\sigma]\overset{N(x)}{\longrightarrow}E\land Q[\sigma\rho]\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}F\land R\equiv\nu x.(E|F)$ for some $E,F,x$ and ground $N$.

In this case, $A_{m}\rho\overset{N_{1}(x)}{\longrightarrow}[\sigma\rho]|E\land C_{m}\sigma\overset{\nu x.\overline{N_{2}}\langle x\rangle}{\longrightarrow}[\rho\sigma]|F$ for some $N_{1}$ and $N_{2}$ where $N_{1}[\sigma\rho]=N\land\widetilde{r}\cap\mathrm{n}(N_{1})=\emptyset\land N_{2}[\rho\sigma]=N\land\widetilde{s}\cap\mathrm{n}(N_{2})=\emptyset$.

By [1, Lemma B.10], there exist $\widetilde{l},P^{\prime}$ and $P_{2}$ such that

[TABLE]

Hence $A_{m}\rho\overset{N_{1}(x)}{\longrightarrow}(\sigma|\nu\widetilde{l}.(P^{\prime}|P_{2}))\rho$.

We use again [1, Lemma B.10].

There exists $\widetilde{m},\widetilde{t},M,Q^{\prime}$ and $Q_{2}$ such that $Q[\sigma\rho]\equiv(\nu\widetilde{m}\widetilde{t}.(\overline{N_{1}}\langle M\rangle.Q^{\prime}|Q_{2}))[\sigma\rho]$ and $F\equiv(\nu\widetilde{m}.(\{M/x\}|\nu\widetilde{t}.(Q^{\prime}|Q_{2})))[\rho\sigma]$ where $\widetilde{m}\subseteq\mathrm{n}(M)\land\widetilde{t}\cap\mathrm{n}(M)=\emptyset\land\mathrm{n}(M)\cap\widetilde{s}=\emptyset$ and $M[\sigma\rho]$ is ground.

Hence $C_{m}\sigma\overset{\nu x.\overline{N_{2}}\langle x\rangle}{\longrightarrow}(\rho|\nu\widetilde{m}.(\{M/x\}|\nu\widetilde{t}.(Q^{\prime}|Q_{2})))\sigma\equiv\nu\widetilde{m}.(\rho\uplus\{M/x\}|\nu\widetilde{t}.(Q^{\prime}|Q_{2}))\sigma$.

Therefore,

[TABLE]

This is a desired form. 4. 4.

$P[\rho\sigma]\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}E\land Q[\sigma\rho]\overset{N(x)}{\longrightarrow}F\land R\equiv\nu x.(E|F)$ for some $E,F,x$ and ground $N$.

This case is similar to case 3.

Second, we consider when $\mu$ is a labelled action $\alpha$. Note that $\widetilde{r}\widetilde{s}\cap\mathrm{n}(\alpha)=\emptyset$.

By [1, Lemma B.19], $P[\rho\sigma]|Q[\sigma\rho]\overset{\alpha(\sigma\uplus\rho)}{\longrightarrow}E\land D^{\prime}\equiv(\sigma\uplus\rho)_{|dom(\sigma\uplus\rho)\setminus\widetilde{x}\widetilde{y}}|E$ for some $E$.

We consider two cases.

$P[\rho\sigma]\overset{\alpha(\sigma\uplus\rho)}{\longrightarrow}F\land E\equiv F|Q[\sigma\rho]$ for some $F$.

Then, $A_{m}\rho\overset{\alpha[\rho\sigma]}{\longrightarrow}[\sigma\rho]|F$ because of $\sigma\uplus\rho=[\sigma\rho]|[\rho\sigma]$ and Lemma 3.2.

In addition, we consider two cases.

1. (a)

$\alpha=N(M)$

There exists $\widetilde{l},P^{\prime}$ and $P_{2}$ such that $P[\rho\sigma]\equiv(\nu\widetilde{l}.(N[\sigma\rho](x).P^{\prime}|P_{2}))[\rho\sigma]$ and $F\equiv(\nu\widetilde{l}.(P^{\prime}\{M[\sigma\rho]/x\}|P_{2}))[\rho\sigma]$.

Hence, $A_{m}\rho\overset{N(M)[\rho\sigma]}{\longrightarrow}(\sigma|\nu\widetilde{l}.(P^{\prime}\{M[\sigma\rho]/x\}|P_{2}))\rho$.

$\nu\widetilde{x}.A_{m}\rho\overset{N(M)[\rho\sigma]}{\longrightarrow}\nu\widetilde{x}.(\sigma|\nu\widetilde{l}.(P^{\prime}\{M[\sigma\rho]/x\}|P_{2}))\rho$.

By Lemma 3.2, $\nu\widetilde{x}.A_{m}\rho|[\rho\sigma]\overset{N(M)}{\longrightarrow}\nu\widetilde{x}.(\sigma|\nu\widetilde{l}.(P^{\prime}\{M[\sigma\rho]/x\}|P_{2}))\rho|[\rho\sigma]$.

$\nu\widetilde{x}.A_{m}\rho|[\rho\sigma]|Q[\sigma\rho]\overset{N(M)}{\longrightarrow}\nu\widetilde{x}.(\sigma|\nu\widetilde{l}.(P^{\prime}\{M[\sigma\rho]/x\}|P_{2}))\rho|[\rho\sigma]|Q[\sigma\rho]$.

By Lemma 3.23,

$\nu\widetilde{x}.A_{m}\rho|\nu\widetilde{y}.(\rho|Q)\sigma\overset{N(M)}{\longrightarrow}\nu\widetilde{x}.(\sigma|\nu\widetilde{l}.(P^{\prime}\{M[\sigma\rho]/x\}|P_{2}))\rho|\nu\widetilde{y}.(\rho|Q)\sigma$.

Therefore,

$\nu\widetilde{r}\widetilde{s}.(\nu\widetilde{x}.A_{m}\rho|\nu\widetilde{y}.C_{m}\sigma)\overset{N(M)}{\longrightarrow}\nu\widetilde{r}\widetilde{s}.(\nu\widetilde{x}.(\sigma|\nu\widetilde{l}.(P^{\prime}\{M[\sigma\rho]/x\}|P_{2}))\rho|\nu\widetilde{y}.C_{m}\sigma)$.

This is the desired form. 2. (b)

$\alpha=\nu x.\overline{N}\langle x\rangle$

There exists $\widetilde{m},\widetilde{t},M,P^{\prime}$ and $P_{2}$ such that

[TABLE]

where $\widetilde{m}\subseteq\mathrm{n}(M)\land\widetilde{t}\cap\mathrm{n}(M)=\emptyset$ and $M[\rho\sigma]$ is ground.

$[\sigma\rho]|F\equiv(\sigma|(\nu\widetilde{m}.(\{M/x\}|\nu\widetilde{t}.(P^{\prime}|P_{2})))\rho\equiv\nu\widetilde{m}.(\sigma\uplus\{M/x\}|\nu\widetilde{t}.(P^{\prime}|P_{2}))\rho$.

Hence, $A_{m}\rho\overset{(\nu x.\overline{N}\langle x\rangle)[\rho\sigma]}{\longrightarrow}\nu\widetilde{m}.(\sigma\uplus\{M/x\}|\nu\widetilde{t}.(P^{\prime}|P_{2}))\rho$.

$\nu\widetilde{x}.A_{m}\rho\overset{(\nu x.\overline{N}\langle x\rangle)[\rho\sigma]}{\longrightarrow}\nu\widetilde{x}.\nu\widetilde{m}.(\sigma\uplus\{M/x\}|\nu\widetilde{t}.(P^{\prime}|P_{2}))\rho$.

By Lemma 3.2, $\nu\widetilde{x}.A_{m}\rho|[\rho\sigma]\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}\nu\widetilde{x}.\nu\widetilde{m}.(\sigma\uplus\{M/x\}|\nu\widetilde{t}.(P^{\prime}|P_{2}))\rho|[\rho\sigma]$.

$\nu\widetilde{x}.A_{m}\rho|[\rho\sigma]|Q[\sigma\rho]\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}\nu\widetilde{x}.\nu\widetilde{m}.(\sigma\uplus\{M/x\}|\nu\widetilde{t}.(P^{\prime}|P_{2}))\rho|[\rho\sigma]|Q[\sigma\rho]$.

By Lemma 3.23,

$\nu\widetilde{x}.A_{m}\rho|\nu\widetilde{y}.(\rho|Q)\sigma\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}\nu\widetilde{x}.\nu\widetilde{m}.(\sigma\uplus\{M/x\}|\nu\widetilde{t}.(P^{\prime}|P_{2}))\rho|\nu\widetilde{y}.(\rho|Q)\sigma$.

Therefore,

$\nu\widetilde{r}\widetilde{s}.(\nu\widetilde{x}.A_{m}\rho|\nu\widetilde{y}.C_{m}\sigma)\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}\nu\widetilde{r}\widetilde{s}.(\nu\widetilde{x}.\nu\widetilde{m}.(\sigma\uplus\{M/x\}|\nu\widetilde{t}.(P^{\prime}|P_{2}))\rho|\nu\widetilde{y}.C_{m}\sigma)$.

This is the desired form. 2. 2.

$Q[\sigma\rho]\overset{\alpha(\sigma\uplus\rho)}{\longrightarrow}F\land E\equiv P[\sigma\rho]|F$ for some $F$.

This case is similar to case 1.

∎

3.2.3 Extracting a Trace of a Component Process from Concurrent Normal Form

Given a concurrent normal trace of $A|C$, we construct traces of $A$ and $C$ which are each process in them is of the form $\nu\widetilde{s_{m}}.A_{m}\rho_{m}$ or $\nu\widetilde{r_{m}}.C_{m}\sigma_{m}$. Assuming that we transformed the first $m$-th process.

We omit many subscripts and symmetric cases.

In case 3a in Definition 3.24, we get $\nu\widetilde{s_{m}}.A_{m}\rho_{m}\longrightarrow\nu\widetilde{s_{m+1}}.A_{m+1}\rho_{m+1}$.

In case 3c,

[TABLE]

The left-hand side is normal, so by Lemma 3.4 and 3.22,

$[\rho\sigma]|[\sigma\rho]|P_{m}[\rho\sigma]\overset{N_{2}\rho(M)}{\longrightarrow}[\rho\sigma]|[\sigma\rho]|P_{m+1}[(\rho\uplus\{M/x\})\sigma]$.

Note that $N_{1}[\sigma\rho]=N_{2}[\rho\sigma]$ and $M[\sigma\rho]$ is ground.

By Lemma 3.5, $[\sigma\rho]|P_{m}[\rho\sigma]\overset{N_{2}\rho(M)}{\longrightarrow}[\sigma\rho]|P_{m+1}[(\rho\uplus\{M/x\})\sigma]$.

$A_{m}\rho\overset{N_{2}\rho(M)}{\longrightarrow}A_{m+1}(\rho\uplus\{M/x\})$.

We get $\nu\widetilde{s_{m}}.A_{m}\rho_{m}\overset{N_{2}\rho_{m}(M\rho_{m})}{\longrightarrow}\nu\widetilde{s_{m+1}}.A_{m+1}\rho_{m+1}$.

$C_{m}\sigma\overset{\nu x.\overline{N_{2}}\langle x\rangle}{\longrightarrow}\nu\widetilde{m}.C_{m+1}\sigma$.

$[\rho\sigma]|Q_{m}[\sigma\rho]\overset{\nu x.\overline{N_{2}}\langle x\rangle}{\longrightarrow}\nu\widetilde{m}.([(\rho\uplus\{M/x\})\sigma]|Q_{m+1}[\sigma\rho])$.

$[\sigma\rho]|[\rho\sigma]|Q_{m}[\sigma\rho]\overset{\nu x.\overline{N_{2}}\langle x\rangle}{\longrightarrow}[\sigma\rho]|\nu\widetilde{m}.([(\rho\uplus\{M/x\})\sigma]|Q_{m+1}[\sigma\rho])$.

The left-hand side is normal, so by Lemma 3.4 and 3.22,

$[\sigma\rho]|[\rho\sigma]|Q_{m}[\sigma\rho]\overset{\nu x.\overline{N_{1}\sigma}\langle x\rangle}{\longrightarrow}[\sigma\rho]|\nu\widetilde{m}.([(\rho\uplus\{M/x\})\sigma]|Q_{m+1}[\sigma\rho])$.

By Lemma 3.5, $[\rho\sigma]|Q_{m}[\sigma\rho]\overset{\nu x.\overline{N_{1}\sigma}\langle x\rangle}{\longrightarrow}\nu\widetilde{m}.([(\rho\uplus\{M/x\})\sigma]|Q_{m+1}[\sigma\rho])$.

$C_{m}\sigma\overset{\nu x.\overline{N_{1}\sigma}\langle x\rangle}{\longrightarrow}\nu\widetilde{m}.C_{m+1}\sigma$.

We get $\nu\widetilde{r_{m}}.C_{m}\sigma_{m}\overset{\nu x.\overline{N_{1}\sigma_{m}}\langle x\rangle}{\longrightarrow}\nu\widetilde{r_{m+1}}.C_{m+1}\sigma_{m+1}$.

In case 4a, $A_{m}\rho\overset{N(M)[\rho\sigma]}{\longrightarrow}A_{m+1}\rho$.

$[\sigma\rho]|P[\rho\sigma]\overset{N(M)[\rho\sigma]}{\longrightarrow}A_{m+1}\rho$.

By Lemma 3.4, $[\sigma\rho]|P[\rho\sigma]\overset{N(M)\rho}{\longrightarrow}A_{m+1}\rho$. Note that $(N(M)[\rho\sigma])[\sigma\rho]=(N(M)\rho)[\sigma\rho]$.

$A_{m}\rho\overset{N(M)\rho}{\longrightarrow}A_{m+1}\rho$.

We get $\nu\widetilde{s_{m}}.A_{m}\rho_{m}\overset{N(M)\rho_{m}}{\longrightarrow}\nu\widetilde{s_{m+1}}.A_{m+1}\rho_{m+1}$.

Case 5a is similar to case 4a. We get $\nu\widetilde{s_{m}}.A_{m}\rho_{m}\overset{\nu x.\overline{N}\langle x\rangle\rho_{m}}{\longrightarrow}\nu\widetilde{s_{m+1}}.A_{m+1}\rho_{m+1}$.

3.2.4 Composition of Traces

Given trace-equivalent processes $A,B$, an arbitrary process $C$, and a trace of $A|C$, we construct a statically equivalent trace of $B|C$. By subsection 3.2.2, we can suppose that a given trace tr of $A|C$ is a concurrent normal form without loss of generality. We extract traces $\mathbf{tr}^{\prime}$ and $\mathbf{tr}^{\prime\prime\prime}$ of $A$ and $C$ as mentioned in subsection 3.2.3. There exists a safe trace $\mathbf{tr}^{\prime\prime}$ of $B$ such that it satisfies the conditions below:

Each transition $\nu\widetilde{s_{m}}.A_{m}\rho_{m}\overset{\mu}{\longrightarrow}\nu\widetilde{s_{m+1}}.A_{m+1}\rho_{m+1}$ in $\mathbf{tr}^{\prime}$ corresponds to the transition $\nu\widetilde{s_{m}^{\prime}}.B_{m}\overset{\mu}{\Longrightarrow}\nu\widetilde{s_{m+1}^{\prime}}.B_{m+1}$ in $\mathbf{tr}^{\prime\prime}$. Moreover, $B_{m}$ is of the form $\zeta_{m}|S_{m}$, it is normal and $\mathrm{dom}(\zeta_{m})=\mathrm{dom}(\sigma_{m})$. Especially, $S_{m}$ is closed.

Each process in a constructed trace is of the form $\nu\widetilde{r_{m}}\widetilde{s_{m}^{\prime}}.(\nu\widetilde{x_{m}}.B_{m}|\nu\widetilde{y_{m}}.C_{m}\zeta_{m})$.

We again omit many subscripts. Note that an internal reduction and a receive action do not change a frame. In addition, $\widetilde{s_{m}^{\prime}}$ contains no names in other processes because of bind-exclusiveness. Let $\widetilde{z}=\mathrm{dom}(\sigma)$.

Case 3a in Definition 3.24.

[TABLE]

(3.2) is in $\mathbf{tr}^{\prime}$ and corrsponds to (3.1). (3.3) is in $\mathbf{tr}^{\prime\prime}$ and corresponds to (3.2).

By Lemma 3.3, we can suppose that $B_{m}\Longrightarrow B_{m+1}$. We get a desired transition

$\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)\Longrightarrow\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m+1}|\nu\widetilde{y}.C_{m}\zeta)$. 2. 2.

Case 3b.

[TABLE]

(3.5) is in $\mathbf{tr}^{\prime\prime\prime}$ and corresponds to (3.4).

By Lemma 3.3, we can suppose that $C_{m}\sigma\longrightarrow C_{m+1}\sigma$.

$C_{m}\sigma\equiv\nu\widetilde{z}.(C_{m}|\sigma)\equiv\nu\widetilde{z}.(\rho|Q|\sigma)\equiv\nu\widetilde{z}.(\rho\uplus\sigma|Q)\equiv\nu\widetilde{z}.(\rho\uplus\sigma|Q^{\prime})$.

$Q^{\prime}$ is a process obtained from $Q$ to substitute only for the part related to the transition.

$\rho|Q^{\prime}\longrightarrow C_{m+1}$.

Similarly, $C_{m}\zeta\equiv\nu\widetilde{z}.(\rho\uplus\zeta|Q^{\prime\prime})$.

$Q^{\prime\prime}$ is a process obtained from $Q$ to substitute similarly using $\rho\uplus\zeta$.

$\nu\widetilde{s}.[\sigma\rho]\approx_{s}\nu\widetilde{s^{\prime}}.\zeta$. Recall that $\nu\widetilde{s}.A_{m}\rho\approx_{s}\nu\widetilde{s}^{\prime}.B_{n}$

$\nu\widetilde{s}.\rho\uplus\sigma\approx_{s}\nu\widetilde{s^{\prime}}.\rho\uplus\zeta$. Note that $\mathrm{n}(\rho)\cap\widetilde{s}=\emptyset$.

Thus, two terms affected by $\rho\uplus\sigma$ at $C_{m}\sigma\longrightarrow C_{m+1}\sigma$ are also equal in $Q^{\prime\prime}$.

$\rho|Q^{\prime\prime}\longrightarrow C_{m+1}$.

$C_{m}\zeta\longrightarrow C_{m+1}\zeta$.

We get a desired transition

$\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)\longrightarrow\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m+1}\zeta)$. 3. 3.

Case 3c.

[TABLE]

(3.7) is in $\mathbf{tr}^{\prime}$. (3.8) is in $\mathbf{tr}^{\prime\prime\prime}$. Both correspond to (3.6). (3.9) is in $\mathbf{tr}^{\prime\prime}$ and corresponds to (3.7).

By Lemma 3.3, we can suppose that $C_{m}\sigma\overset{\nu x.\overline{N_{2}}\langle x\rangle}{\longrightarrow}\nu\widetilde{m}.C_{m+1}\sigma$.

$C_{m}\sigma\equiv\nu\widetilde{z}.(\rho\uplus\sigma|Q^{\prime})$.

$Q^{\prime}$ is a process obtained from $Q$ to substitute only for the part related to transition.

$\rho|Q^{\prime}\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}\nu\widetilde{m}.C_{m+1}$, where $N=N_{1}[\sigma\rho]=N_{2}[\rho\sigma]$.

Similarly, $C_{m}\zeta\equiv\nu\widetilde{z}.(\rho\uplus\zeta|Q^{\prime\prime})$.

$Q^{\prime\prime}$ is a process obtained from $Q$ to substitute similarly using $\rho\uplus\zeta$.

$\nu\widetilde{s}.[\sigma\rho]\approx_{s}\nu\widetilde{s^{\prime}}.\zeta$.

$\nu\widetilde{s}.\rho\uplus\sigma\approx_{s}\nu\widetilde{s^{\prime}}.\rho\uplus\zeta$.

Some channel in $Q$ becomes equal to $N=N_{2}[\rho\sigma]=N_{2}(\rho\uplus\sigma)$ by $\rho\uplus\sigma$, so this channel becomes equal to $N_{2}(\rho\uplus\zeta)$ by $\rho\uplus\zeta$. Note that $\widetilde{s}\cap\mathrm{n}(N_{2})=\emptyset$.

Thus, $\rho|Q^{\prime\prime}\overset{\nu x.\overline{N_{2}\rho\zeta}\langle x\rangle}{\longrightarrow}\nu\widetilde{m}.C_{m+1}$. Note that $[\rho\zeta]=\rho\zeta$.

[TABLE]

$\nu\widetilde{s^{\prime}}.B\Longrightarrow\nu\widetilde{s^{\prime}}.B^{\prime}\overset{N_{2}\rho(M)}{\longrightarrow}\nu\widetilde{s^{\prime}}.B^{\prime\prime}\Longrightarrow\nu\widetilde{s^{\prime}}.B_{m+1}$ for some $B^{\prime}$ and $B^{\prime\prime}$ because $\nu\widetilde{s^{\prime}}.B_{m}\Longrightarrow\nu\widetilde{s^{\prime}}.B_{m+1}$.

We suppose that

• •

$B^{\prime}\equiv\zeta|\hat{S}$,

• •

$\hat{S}\equiv\nu\widetilde{p}.(N_{2}\rho(x).S^{\prime}|S_{2})$,

• •

$S\Longrightarrow\hat{S}\overset{N_{2}\rho(M\rho)}{\longrightarrow}D^{\prime}\Longrightarrow D$,

• •

$B_{m+1}=\zeta|D$,

• •

$Q\zeta\overset{\nu x.\overline{N_{2}\rho\zeta}\langle x\rangle}{\longrightarrow}E$, and

• •

$\nu\widetilde{m}.C_{m+1}\zeta\equiv\rho\zeta|E$.

Let $Q\zeta\equiv(\nu\widetilde{m}\widetilde{q}.(\overline{N_{2}\rho}\langle M\rangle.Q^{\prime}|Q_{2}))\zeta$. This is possible because of $Q\zeta\overset{\nu x.\overline{N_{2}\rho\zeta}\langle x\rangle}{\longrightarrow}E$.

By $\nu\widetilde{s^{\prime}}.B\Longrightarrow\nu\widetilde{s^{\prime}}.B^{\prime}$ and $\hat{S}\overset{N_{2}\rho(M)}{\Longrightarrow}D$,

[TABLE]

We get the desired transition

$\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)\Longrightarrow\nu\widetilde{r}\widetilde{m}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m+1}|\nu\widetilde{y}x.C_{m+1}\zeta)$. 4. 4.

Case 3d.

[TABLE]

(3.11) is in $\mathbf{tr}^{\prime}$. (3.12) is in $\mathbf{tr}^{\prime\prime\prime}$. Both correspond to (3.10). (3.13) is in $\mathbf{tr}^{\prime\prime}$ and corresponds to (3.11).

$C_{m}\sigma\overset{N_{2}(x)}{\longrightarrow}C_{m+1}\sigma$.

$C_{m}\sigma\equiv\nu\widetilde{z}.(\rho\uplus\sigma|Q^{\prime})$, where $Q^{\prime}$ is a process obtained from $Q$ to substitute only for the input channel.

$\rho|Q^{\prime}\overset{N(x)}{\longrightarrow}C_{m+1}$, where $N=N_{1}[\sigma\rho]=N_{2}[\rho\sigma]$.

Similarly, $C_{m}\zeta\equiv\nu\widetilde{z}.(\rho\uplus\zeta|Q^{\prime\prime})$.

$Q^{\prime\prime}$ is a process obtained from $Q$ to substitute similarly using $\rho\uplus\zeta$.

$\nu\widetilde{s}.(\rho\uplus\sigma)\approx_{s}\nu\widetilde{s^{\prime}}.(\rho\uplus\zeta)$.

Some channel in $Q$ is equal to $N=N_{2}[\rho\sigma]=N_{2}(\rho\uplus\sigma)$ by $\rho\uplus\sigma$, so this channel becomes equal to $N_{2}(\rho\uplus\zeta)$ by $\rho\uplus\zeta$. Note that $\widetilde{s}\cap\mathrm{n}(N_{2})=\emptyset$.

Thus, $\rho|Q^{\prime\prime}\overset{N_{2}\rho\zeta(x)}{\longrightarrow}C_{m+1}$. Note that $[\rho\zeta]=\rho\zeta$.

$\nu\widetilde{s^{\prime}}.B\Longrightarrow\nu\widetilde{s^{\prime}}.B^{\prime}\overset{\nu x.\overline{N_{2}\rho}\langle x\rangle}{\longrightarrow}\nu\widetilde{s^{\prime\prime}}.B^{\prime\prime}\Longrightarrow\nu\widetilde{s^{\prime}}.B_{m+1}$ for some $B^{\prime}$ and $B^{\prime\prime}$.

We suppose that

• •

$B^{\prime}\equiv\zeta|\hat{S}$,

• •

$\hat{S}\equiv\nu\widetilde{m^{\prime}}\widetilde{p}.(\overline{N_{2}\rho}\langle M\rangle.S^{\prime}|S_{2})$,

• •

$S\Longrightarrow\hat{S}\overset{\nu x.\overline{N_{2}\rho}\langle x\rangle}{\longrightarrow}D^{\prime}\Longrightarrow D$,

• •

$B_{m+1}=\zeta|D$,

• •

$Q\zeta\overset{N_{2}\rho\zeta(x)}{\longrightarrow}E$, and

• •

$C_{m+1}\zeta\equiv\rho\zeta|E$.

Let $Q\zeta\equiv(\nu\widetilde{q}.(N_{2}\rho(x).Q^{\prime}|Q_{2}))\zeta$.

By $S\Longrightarrow\hat{S}$,

[TABLE]

We get a desired transition

$\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)\Longrightarrow\nu\widetilde{r}\widetilde{s^{\prime}}\widetilde{m^{\prime}}.(\nu\widetilde{x}x.B_{m+1}|\nu\widetilde{y}.C_{m+1}(\zeta\uplus\{M/x\}))$. 5. 5.

Case 4a.

[TABLE]

(3.15) is in $\mathbf{tr}^{\prime}$ and corresponds to (3.14). Recall subsection 3.2.3. (3.16) is in $\mathbf{tr}^{\prime}$ and corresponds to (3.15).

By Lemma 3.3, we can suppose that $B_{m}\overset{N(M)\rho}{\Longrightarrow}B_{m+1}$.

By Lemma 3.2, $\rho|B_{m}\overset{N(M)}{\Longrightarrow}\rho|B_{m+1}$.

We get a desired transition

$\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)\overset{N(M)}{\Longrightarrow}\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m+1}|\nu\widetilde{y}.C_{m}\zeta)$. 6. 6.

Case 4b.

[TABLE]

(3.18) is in $\mathbf{tr}^{\prime\prime\prime}$ and corresponds to (3.17).

$C_{m}\sigma\overset{N(M)\sigma}{\longrightarrow}C_{m+1}\sigma$.

$C_{m}\sigma\equiv\nu\widetilde{z}.(\rho\uplus\sigma|Q^{\prime})$ where $Q^{\prime}$ is a process obtained from $Q$ to substitute only for the input channel.

$\rho|Q^{\prime}\overset{N(\rho\uplus\sigma)(M)}{\longrightarrow}C_{m+1}$.

Similarly, $C_{m}\zeta\equiv\nu\widetilde{z}.(\rho\uplus\zeta|Q^{\prime\prime})$.

$Q^{\prime\prime}$ is a process obtained from $Q$ to substitute similarly using $\rho\uplus\zeta$.

Some channel in $Q$ is equal to $N(\rho\uplus\zeta)$ by $\rho\uplus\zeta$ because $\nu\widetilde{s}.(\rho\uplus\sigma)\approx_{s}\nu\widetilde{s^{\prime}}.(\rho\uplus\zeta)$. Note that $\widetilde{s}\cap\mathrm{n}(N_{2})=\emptyset$.

Thus, $\rho|Q^{\prime\prime}\overset{N(\rho\uplus\zeta)(M)}{\longrightarrow}C_{m+1}$.

$\rho\uplus\zeta|Q^{\prime\prime}\overset{N(\rho\uplus\zeta)(M)}{\longrightarrow}\zeta|C_{m+1}$.

By Lemma 3.4, $\rho\uplus\zeta|Q^{\prime\prime}\overset{N(M)\zeta}{\longrightarrow}\zeta|C_{m+1}$.

$C_{m}\zeta\overset{N(M)\zeta}{\longrightarrow}C_{m+1}\zeta$.

By Lemma 3.2, $\zeta|C_{m}\zeta\overset{N(M)}{\longrightarrow}\zeta|C_{m+1}\zeta$. We get a desired transition

$\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)\overset{N(M)}{\longrightarrow}\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m+1}\zeta)$. 7. 7.

Case 5a.

[TABLE]

(3.20) is in $\mathbf{tr}^{\prime}$ and corresponds to (3.19). Recall subsection 3.2.3. (3.21) is in $\mathbf{tr}^{\prime\prime}$ and corresponds to (3.20). (3.22) is deriverd from (3.21). Note that $x$ does not appear in $C_{m}$.

(3.22) contains an output, so it changes a frame. We have to check that static equivalence is preserved.

$\nu\widetilde{s}.[\sigma\rho]\approx_{s}\nu\widetilde{s^{\prime}}.\zeta$ because $\nu\widetilde{s}.A_{m}\rho\approx_{s}\nu\widetilde{s^{\prime}}.B_{m}$.

$\nu\widetilde{s}\widetilde{m}.[(\sigma\uplus\{M/x\})\rho]\approx_{s}\nu\widetilde{s^{\prime}}\widetilde{m^{\prime}}.(\zeta\uplus\{M^{\prime}/x\})$ because $\nu\widetilde{s}\widetilde{m}.A_{m+1}\rho\approx_{s}\nu\widetilde{s^{\prime}}\widetilde{m^{\prime}}.B_{m+1}$.

In addition, $\nu\widetilde{r}\widetilde{s}.(\nu\widetilde{x}.[\sigma\rho]|\nu\widetilde{y}.[\rho\sigma])\approx_{s}\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.\zeta|\nu\widetilde{y}.\rho\zeta)$.

This is because $\nu\widetilde{r}\widetilde{s}.(\nu\widetilde{x}.A_{m}\rho|\nu\widetilde{y}.C_{m}\sigma)\approx_{s}\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)$.

$P[\rho\sigma]\overset{\nu x.\overline{(N\rho)[\sigma\rho]}\langle x\rangle}{\longrightarrow}D\land\nu\widetilde{m}.A_{m+1}\rho\equiv[\sigma\rho]|D$ for some $D$. By Lemma 3.6. Recall Definition 3.24.

Let $P[\rho\sigma]\equiv(\nu\widetilde{m}\widetilde{l}.(\overline{N}\langle M\rangle.P^{\prime}|P_{2}))[\rho\sigma]\land D\equiv(\nu\widetilde{m}.(\{M/x\}|\nu\widetilde{l}.(P^{\prime}|P_{2})))[\rho\sigma]$.

Then, $A_{m+1}\rho\equiv(\sigma\uplus\{M/x\}|\nu\widetilde{l}.(P^{\prime}|P_{2}))\rho$.

[TABLE]

Note that $\nu\widetilde{s}\widetilde{m}.[(\sigma\uplus\{M/x\})\rho]\approx_{s}\nu\widetilde{s^{\prime}}\widetilde{m^{\prime}}.(\zeta\uplus\{M^{\prime}/x\})$.

Therefore,

$\nu\widetilde{r}\widetilde{s}\widetilde{m}.(\nu\widetilde{x}.A_{m+1}\rho|\nu\widetilde{y}.C_{m}(\sigma\uplus\{M/x\}))\approx_{s}\nu\widetilde{r}\widetilde{s^{\prime}}\widetilde{m^{\prime}}.(\nu\widetilde{x}.B_{m+1}\rho|\nu\widetilde{y}.C_{m}(\zeta\uplus\{M^{\prime}/x\}))$.

Hence, the transition below is a desired one.

$\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)\overset{\nu x.\overline{N}\langle x\rangle}{\Longrightarrow}\nu\widetilde{r}\widetilde{s^{\prime}}\widetilde{m^{\prime}}.(\nu\widetilde{x}.B_{m+1}\rho|\nu\widetilde{y}.C_{m}(\zeta\uplus\{M/x\}))$. 8. 8.

Case 5b.

[TABLE]

(3.24) is in $\mathbf{tr}^{\prime\prime\prime}$ and corresponds to (3.23).

In the same way with Case 4b, $C_{m}\zeta\overset{\nu x.\overline{N\zeta}\langle x\rangle}{\longrightarrow}C_{m+1}\zeta$.

$\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}\nu\widetilde{r}\widetilde{m}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m+1}\zeta)$.

We have to check that static equivalence is preserved.

Now, $\nu\widetilde{r}\widetilde{s}.(\nu\widetilde{x}.[\sigma\rho]|\nu\widetilde{y}.[\rho\sigma])\approx_{s}\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.\zeta|\nu\widetilde{y}.\rho\zeta)$.

This is because $\nu\widetilde{r}\widetilde{s}.(\nu\widetilde{x}.A_{m}\rho|\nu\widetilde{y}.C_{m}\sigma)\approx_{s}\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)$.

$\nu\widetilde{s}.[\sigma\rho]\approx_{s}\nu\widetilde{s^{\prime}}.\zeta$ because $\nu\widetilde{s}.A_{m}\rho\approx_{s}\nu\widetilde{s^{\prime}}.B_{m}$.

$\nu\widetilde{s}.[\sigma\rho]|\nu\widetilde{y}.(\rho\uplus\{M/x\})\approx_{s}\nu\widetilde{s^{\prime}}.\zeta|\nu\widetilde{y}.(\rho\uplus\{M/x\})$.

Thus, $\nu\widetilde{r}\widetilde{m}\widetilde{s}.(\nu\widetilde{x}.[\sigma\rho]|\nu\widetilde{y}.(\rho\uplus\{M/x\}))\approx_{s}\nu\widetilde{r}\widetilde{m}\widetilde{s^{\prime}}.(\nu\widetilde{x}.\zeta|\nu\widetilde{y}.(\sigma\uplus\{M/x\}))$.

Hence, the transition below is a desired one.

$\nu\widetilde{r}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m}\zeta)\overset{\nu x.\overline{N}\langle x\rangle}{\longrightarrow}\nu\widetilde{r}\widetilde{m}\widetilde{s^{\prime}}.(\nu\widetilde{x}.B_{m}|\nu\widetilde{y}.C_{m+1}\zeta)$.

Thus we have finished the proof of Lemma 3.19 and Theorem 3.1.

Chapter 4 An Epistemic Logic for the Applied Pi Calculus

From now, we suppose that all processes are name-variable-distinct. We redefine trace equivalence as below.

Definition 4.1**.**

[TABLE]

Definition 4.2**.**

Let $A$ and $B$ be closed processes.

[TABLE]

Let A and B be two processes. Let $\sigma$ be a map that maps a variable in $(\mathrm{fv}(A)\setminus\mathrm{dom}(A))\cup(\mathrm{fv}(B)\setminus\mathrm{dom}(B))$ to a ground term. When $A\sigma\approx_{t}B\sigma$ for all $\sigma$ and capture-avoidings, we also denote as $A\approx_{t}B$.

Please note that this definition is equivalent to the previous definition because of Proposition 2.13.

4.1 Syntax

We adopt equality of terms as a primitive proposition. We give syntax of formulas.

[TABLE]

where $M_{1},M_{2}$ and $M$ are terms, and $\mu$ is an action.

4.2 Semantics

Our logic is an LTL-like logic with an epistemic operator. Let $A$ be a name-variable-distinct extended process that $\mathrm{fv}(A)\setminus\mathrm{dom}(A)=\widetilde{x}$, $\rho$ be an assignment from $\widetilde{x}$ to ground terms, tr be a trace of $A\rho$ and $0\leq i\leq|\mathbf{tr}|,M_{1}$ and $M_{2}$ be terms.

We suppose that $\delta$ and $\varphi$ contain no variables other than $\widetilde{x}\cup\mathrm{dom}(\mathbf{tr}[i])$.

[TABLE]

We also define validity of formulas containing free variables.

Let $\mathrm{dom}(\mathbf{tr}[i])=\widetilde{y}$. We suppose that $\varphi$ contains no variables other than $\widetilde{x},\widetilde{y}$ and $\widetilde{z}$.

[TABLE]

Definition 4.3**.**

$A\models\varphi$* if and only if $\forall\rho\ \forall\mathbf{tr}\in\mathrm{tr}(A\rho);A,\rho,\mathbf{tr},0\models\varphi$.*

Definition 4.4**.**

$A\sqsubseteq_{s}B$* if and only if $\forall\delta\ \forall\rho;A,\rho,A\rho,0\models\delta\Rightarrow B,\rho,B\rho,0\models\delta$.*

$A\equiv_{s}B$* if and only if $A\sqsubseteq_{s}B\land B\sqsubseteq_{s}A$.*

Definition 4.5**.**

$A\sqsubseteq_{L}B\overset{\mathrm{def}}{\Leftrightarrow}\forall\rho\forall\mathbf{tr}\in\mathrm{tr}(A\rho)\exists\mathbf{tr}^{\prime}\in\mathrm{tr}(B\rho)$**

$\mathrm{s.t.}\ \forall i\forall\varphi;[A,\rho,\mathbf{tr},i\models\varphi\Leftrightarrow B,\rho,\mathbf{tr}^{\prime},i\models\varphi]$.

$A\equiv_{L}B$* if and only if $A\sqsubseteq_{L}B\land B\sqsubseteq_{L}A$. *

Proposition 4.6**.**

We assume that $A\sqsubseteq_{L}B$. Then $B\models\varphi\Rightarrow A\models\varphi$.

Proof.

Assuming that $B\models\varphi$, we arbitrarily take $\rho$ and $\mathbf{tr}\in\mathrm{tr}(A\rho)$.

By assumption, there exists $\mathbf{tr}^{\prime}\in\mathrm{tr}(B\rho)$ such that

[TABLE]

Then, $B,\rho,\mathbf{tr}^{\prime},0\models\varphi$ because of $B\models\varphi$.

By (4.1), $A,\rho,\mathbf{tr},0\models\varphi$.

By arbitrariness of $\rho$ and $\mathbf{tr}$, it holds that $A\models\varphi$. ∎

4.3 Correspondence with Trace Equivalence

We prove that trace equivalent processes satisfy the same formulas and vice versa.

Lemma 4.7**.**

$\mathrm{[}\forall\rho;A\rho\approx_{s}B\rho\mathrm{]}$* $\Leftrightarrow A\equiv_{s}B$*

Proof.

$\Rightarrow$) We prove $A\sqsubseteq_{s}B$ by induction on the syntax of static formulas.

Let $\widetilde{x}=(\mathrm{fv}(A)\setminus\mathrm{dom}(A))\cup(\mathrm{fv}(B)\setminus\mathrm{dom}(B))$.

We arbitrarily take an assignment $\rho$ from $\widetilde{x}$ to terms. We suppose $A,\rho,A\rho,0\models\delta$ and $\delta$ contains no variables other than free variables of $A$. Here, we omitted restriction of a domain.

$\top$.

Trivially, $B,\rho,B\rho,0\models\top$. 2. 2.

$M_{1}=M_{2}$.

By assumption, $(M_{1}\rho=M_{2}\rho)\mathrm{fr}(A\rho)$.

By $A\rho\approx_{s}B\rho$, $(M_{1}\rho=M_{2}\rho)\mathrm{fr}(B\rho)$.

This means that $B,\rho,B\rho,0\models M_{1}=M_{2}$. 3. 3.

$M\in\mathrm{dom}$.

$M$ must be a variable $x$.

By definition, $x\in\mathrm{dom}(A\rho)$.

By $A\rho\approx_{s}B\rho$, $x\in\mathrm{dom}(B\rho)$.

This means that $B,\rho,B\rho,0\models x\in\mathrm{dom}$. 4. 4.

$\delta_{1}\lor\delta_{2}$

By assumption, $A,\rho,A\rho,0\models\delta_{1}\lor\delta_{2}$.

By definition, $A,\rho,A\rho,0\models\delta_{1}$ or $A,\rho,A\rho,0\models\delta_{2}$.

By induction hypothesis, $B,\rho,B\rho,0\models\delta_{1}$ or $B,\rho,B\rho,0\models\delta_{2}$.

This means that $B,\rho,B\rho,0\models\delta_{1}\lor\delta_{2}$. 5. 5.

$\lnot\delta$.

By assumption, $A,\rho,A\rho,0\not\models\delta$.

By induction hypothesis, $B,\rho,B\rho,0\not\models\delta$.

This means that $B,\rho,B\rho,0\models\lnot\delta$.

Thus, $A\sqsubseteq_{s}B$ and vice versa.

$\Leftarrow$) We arbitrarily take an assignment $\rho$ from $\widetilde{x}$ to terms.

We arbitrarily take $x\in\mathrm{dom}(A\rho)$. Then, $A,\rho,A\rho,0\models x\in\mathrm{dom}$.

By assumption, $B,\rho,B\rho,0\models x\in\mathrm{dom}$. That is, $x\in\mathrm{dom}(B\rho)$.

Thus, $\mathrm{dom}(A\rho)\subseteq\mathrm{dom}(B\rho)$. The converse is similar.

We suppose that $(M=N)\mathrm{fr}(A\rho)$. This means that $A,\rho,A\rho,0\models M=N$. By assumption, $B,\rho,B\rho,0\models M=N$. In other words, $(M=N)\mathrm{fr}(B\rho)$. Similarly, $(M=N)\mathrm{fr}(B\rho)\Rightarrow(M=N)\mathrm{fr}(A\rho)$. Therefore, $A\rho\approx_{s}B\rho$. ∎

Theorem 4.8**.**

$A\approx_{t}B\Rightarrow A\sqsubseteq_{L}B$. 2. 2.

$A\sqsubseteq_{L}B\Rightarrow A\subseteq_{t}B$.

Proof.

Let $\widetilde{x}=(\mathrm{fv}(A)\setminus\mathrm{dom}(A))\cup(\mathrm{fv}(B)\setminus\mathrm{dom}(B))$.

1) We prove

[TABLE]

by induction on the syntax of modal formulas. Here, we omitted restriction of a domain.

We take arbitrarily an assignment $\rho$ from $\widetilde{x}$ to terms. We also arbitrarily take traces tr and $\mathbf{tr}^{\prime}$ of $A\rho$ and $B\rho$. We arbitrarily take $i$.

$\delta$.

We suppose that $A,\rho,\mathbf{tr},i\models\delta$.

This means that $\mathbf{tr}[i],0,\mathbf{tr}[i],0\models\delta$. Here, the first 0 expresses an empty map.

By $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$, $\mathbf{tr}[i]\approx_{s}\mathbf{tr}^{\prime}[i]$. By Lemma 4.7, $\mathbf{tr}[i]\equiv_{s}\mathbf{tr}^{\prime}[i]$.

Thus, $\mathbf{tr}^{\prime}[i],0,\mathbf{tr}^{\prime}[i],0\models\delta$. This implies that $B,\rho,\mathbf{tr}^{\prime},i\models\delta$

The converse is similar. 2. 2.

$\varphi_{1}\lor\varphi_{2}$.

By induction hypothesis,

$A,\rho,\mathbf{tr},i\models\varphi_{1}\Leftrightarrow B,\rho,\mathbf{tr}^{\prime},i\models\varphi_{1}$, and $A,\rho,\mathbf{tr},i\models\varphi_{2}\Leftrightarrow B,\rho,\mathbf{tr}^{\prime},i\models\varphi_{2}$

Thus, $A,\rho,\mathbf{tr},i\models\varphi_{1}\lor\varphi_{2}\Leftrightarrow B,\rho,\mathbf{tr}^{\prime},i\models\varphi_{1}\lor\varphi_{2}$. 3. 3.

$\lnot\varphi$.

By induction hypothesis, $A,\rho,\mathbf{tr},i\not\models\varphi\Leftrightarrow B,\rho,\mathbf{tr}^{\prime},i\not\models\varphi$.

Thus, $A,\rho,\mathbf{tr},i\models\lnot\varphi\Leftrightarrow B,\rho,\mathbf{tr}^{\prime},i\models\lnot\varphi$. 4. 4.

$\langle\mu\rangle_{-}\varphi$.

We suppose that $A,\rho,\mathbf{tr},i\models\langle\mu\rangle_{-}\varphi$.

By definition, $\mathbf{tr}[i-1]\overset{\mu}{\Longrightarrow}\mathbf{tr}[i]\ \mathrm{in}\ \mathbf{tr}\ \land A,\rho,\mathbf{tr},i-1\models\varphi$.

$\mathbf{tr}^{\prime}[i-1]\overset{\mu}{\Longrightarrow}\mathbf{tr}^{\prime}[i]\ \mathrm{in}\ \mathbf{tr}^{\prime}$ because $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$.

By induction hypothesis, $B,\rho,\mathbf{tr},i-1\models\varphi$.

Thus, $B,\rho,\mathbf{tr}^{\prime},i\models\langle\mu\rangle_{-}\varphi$.

The converse is similar. 5. 5.

$F\varphi$.

We suppose that $A,\rho,\mathbf{tr},i\models F\varphi$.

By definition, $\exists j\geq i\ \mathrm{s.t.}\ A,\rho,\mathbf{tr},j\models\varphi$.

By induction hypothesis, $B,\rho,\mathbf{tr}^{\prime},j\models\varphi$.

Thus, $B,\rho,\mathbf{tr}^{\prime},i\models F\varphi$.

The converse is similar. 6. 6.

$K\varphi$.

We suppose that $A,\rho,\mathbf{tr},i\models K\varphi$.

By definition, $\forall\rho^{\prime}\ \forall\mathbf{tr}^{\prime\prime}\in\mathrm{tr}(A\rho^{\prime});\mathbf{tr}[0,i]\sim_{t}\mathbf{tr}^{\prime\prime}[0,i]\Rightarrow A,\rho^{\prime},\mathbf{tr}^{\prime\prime},i\models\varphi$.

We arbitrarily take $\rho^{\prime}$ and $\mathbf{tr}^{\prime\prime\prime}\in\mathrm{tr}(B\rho^{\prime})$ such as $\mathbf{tr}^{\prime}[0,i]\sim_{t}\mathbf{tr}^{\prime\prime\prime}[0,i]$

By assumption, there exists a trace $\mathbf{tr}^{\prime\prime}$ of $A\rho^{\prime}$ such as $\mathbf{tr}^{\prime\prime\prime}\sim_{t}\mathbf{tr}^{\prime\prime}$.

Now, $\mathbf{tr}[0,i]\sim_{t}\mathbf{tr}^{\prime}[0,i]\sim_{t}\mathbf{tr}^{\prime\prime\prime}[0,i]\sim_{t}\mathbf{tr}^{\prime\prime}[0,i]$, so $A,\rho^{\prime},\mathbf{tr}^{\prime\prime},i\models\varphi$.

By induction hypothesis, $B,\rho^{\prime},\mathbf{tr}^{\prime\prime\prime},i\models\varphi$.

By arbitrariness of $\rho^{\prime}$ and $\mathbf{tr}^{\prime\prime\prime}$, it follows that $B,\rho,\mathbf{tr}^{\prime},i\models K\varphi$.

The converse is similar.

We complete to prove (4.2), and it immediately follows that $A\approx_{t}B\Rightarrow A\sqsubseteq_{L}B$.

2) We take arbitrarily an assignment $\rho$ from $\widetilde{x}$ to terms. We also take arbitrarily a trace tr of $A\rho$.

By assumption, $\exists\mathbf{tr}^{\prime}\in\mathrm{tr}(B\rho)\mathrm{s.t.}\forall i\forall\varphi;[A,\rho,\mathbf{tr},i\models\varphi\Leftrightarrow B,\rho,\mathbf{tr}^{\prime},i\models\varphi]$.

We prove $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$.

Let $\mathbf{tr}=A_{0}\coloneqq A\rho\overset{\mu_{1}}{\Longrightarrow}A_{1}\overset{\mu_{2}}{\Longrightarrow},...,\overset{\mu_{n}}{\Longrightarrow}A_{n}$. It holds that $A,\rho,\mathbf{tr},0\models F\langle\mu_{n}\rangle...\langle\mu_{1}\rangle\top$, so it also holds that $B,\rho,\mathbf{tr}^{\prime},0\models F\langle\mu_{n}\rangle...\langle\mu_{1}\rangle\top$.

Moreover, $\forall\mu;A,\rho,\mathbf{tr},0\not\models F\langle\mu\rangle\langle\mu_{n}\rangle...\langle\mu_{1}\rangle\top$ and $\forall\mu;A,\rho,\mathbf{tr},0\not\models F\langle\mu_{n}\rangle...\langle\mu_{1}\rangle\langle\mu\rangle\top$. Thus, $\forall\mu;B,\rho,\mathbf{tr}^{\prime},0\not\models F\langle\mu\rangle\langle\mu_{n}\rangle...\langle\mu_{1}\rangle\top$ and $\forall\mu;B,\rho,\mathbf{tr}^{\prime},0\not\models F\langle\mu_{n}\rangle...\langle\mu_{1}\rangle\langle\mu\rangle\top$.

Therefore, $\mathbf{tr}^{\prime}$ is of the form $B_{0}\coloneqq B\rho\overset{\mu_{1}}{\Longrightarrow}B_{1}\overset{\mu_{2}}{\Longrightarrow},...,\overset{\mu_{n}}{\Longrightarrow}B_{n}$.

We arbitrarily take $i$. We suppose that $(M=N)\mathrm{fr}(A_{i})$.

Now, $A,\rho,\mathbf{tr},i\models M=N$. Hence, $B,\rho,\mathbf{tr}^{\prime},i\models M=N$.

That is, $(M=N)\mathrm{fr}(B_{i})$. Thus $(M=N)\mathrm{fr}(A_{i})\Rightarrow(M=N)\mathrm{fr}(B_{i})$ and the converse similarly holds.

It follows that $A_{i}\approx_{s}B_{i}$. Therefore, $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$.

By arbitrariness of tr, it immediately follows that $A\sqsubseteq_{L}B\Rightarrow A\subseteq_{t}B$. ∎

We can immediately conclude that the next theorem holds.

Theorem 4.9**.**

$A\approx_{t}B\Leftrightarrow A\equiv_{L}B$.

4.4 Applications

In this section, we abbreviate $\lnot F\lnot\varphi$ to $G\varphi$ ,$\lnot K\lnot\varphi$ to $P\varphi$, $\lnot(\lnot\varphi_{1}\lor\lnot\varphi_{2})$ to $\varphi_{1}\land\varphi_{2}$, $\lnot\varphi_{1}\lor\varphi_{2}$ to $\varphi_{1}\rightarrow\varphi_{2}$ and $\lnot(M_{1}=M_{2})$ to $M_{1}\neq M_{2}$.

At first, we define minimal secrecy. This can be regarded as a generalization of minimal anonymity [15, Definition 2.3].

Definition 4.10**.**

$x$* is minimally secret with respect to $\delta$ in $A$ iff $A\models G(\delta(x)\rightarrow P(\lnot\delta(x)))$.*

As a matter of fact, this is a very weak property. For instance, although $A$ and $B$ satisfy it, $A|B$ does not always satisfy. In addition, although $x$ is minimally secret with respect to nontrivial $\delta$, $x$ is not always minimally secret with respect to $\lnot\delta$.

Example 4.11**.**

Let $\delta(z):z\neq a\land z\neq b$. Let

[TABLE]

Then

[TABLE]

In fact, when $\rho=[x\mapsto a]$, we can take the trace below:

[TABLE]

However, when $x$ is assigned to a term other than $a$ and $b$, there exist no traces whose actions correspond to the above.

When $\rho=[x\mapsto c]$, we can take the trace below:

[TABLE]

However, when $x$ is assigned to $a$ or $b$, there exist no traces whose actions correspond to the above.

Besides, although $x$ is minimally secret with respect to $\delta$ in $A$, $x$ is not always secret in $A^{2}$.

Example 4.12**.**

Let $\delta(z):z=a$. Let

[TABLE]

Then

[TABLE]

In fact, when $\rho=[x\mapsto a]$, we can take the trace below:

[TABLE]

However, when $x$ is assigned to a term other than $a$, there exist no traces whose actions correspond to the above.

What is more, minimal secrecy is not preserved by restriction. Even though $\delta$ does not contain the restricted name, preservation does not hold in general.

Example 4.13**.**

Let $\delta(z):z=a$. Let

[TABLE]

Then

[TABLE]

In fact, when $\rho=[x\mapsto a]$, we can take the trace below:

[TABLE]

However, when $x$ is assigned to a term other than $a$, there exist no traces whose actions correspond to the above. Note that $(\nu n.Q)\sigma$ can do nothing for any assignment $\sigma$ because of capture-avoiding.

Moreover, although $x$ is minimally secret with respect to $\delta_{1}$ and $\delta_{2}$ in $A$, $x$ is not always minimally secret with respect to $\delta_{1}\lor\delta_{2}$. $\delta_{2}=\lnot\delta_{1}$ is a counterexample.

On the other hand, $\land$ preserves minimal secrecy.

Proposition 4.14**.**

If $x$ is minimally secret with respect to $\delta_{1}$ and $\delta_{2}$ in $A$, then $x$ is minimally secret with respect to $\delta_{1}\land\delta_{2}$ in $A$.

Proof.

We arbitrarily take $\rho$, $\mathbf{tr}\in\mathrm{tr}(A\rho)$ and $i$. We suppose that $A,\rho,\mathbf{tr},i\models\delta_{1}\land\delta_{2}$.

By definition, $A,\rho,\mathbf{tr},i\models\delta_{1}$.

By assumption, $A,\rho,\mathbf{tr},i\models P(\lnot\delta_{1})$.

It immediately follows that $A,\rho,\mathbf{tr},i\models P(\lnot\delta_{1}\lor\lnot\delta_{2})$.

By arbitrariness of $\rho,\mathbf{tr}$ and $i$, we conclude that $A\models G(\delta_{1}\land\delta_{2}\rightarrow P(\lnot\delta_{1}\lor\lnot\delta_{2}))$. ∎

We define total secrecy. This can also be regarded as a generalization of total anonimity [15, Definition 2.4].

Definition 4.15**.**

$x$* is totally secret in $A(x,\widetilde{y})$ iff*

[TABLE]

where $\delta$ contains no variables other than ones in $\{z\}\cup\widetilde{z}\cup\widetilde{w}$ and satisfies that $\forall\widetilde{N}\forall\psi\exists M:ground\ \mathrm{s.t.}\ \psi\models\lnot\delta(M,\widetilde{N},\widetilde{w})$. Besieds, $|\widetilde{y}|=|\widetilde{z}|$ and $\widetilde{w}\cap(\{x\}\cup\widetilde{y})=\emptyset$.

Proposition 4.16**.**

$x$* is totally secret in $A(x,\widetilde{y})\Leftrightarrow A(x,\widetilde{y})\approx_{t}A(x^{\prime},\widetilde{y})$.*

Proof.

$\Rightarrow$) We suppose for the sake of contradiction that $A(x,\widetilde{y})\not\approx_{t}A(x^{\prime},\widetilde{y})$

Then, there exist $M_{1},M_{2}$ and $\widetilde{N}$ which are closed and whose every name is not in bn($A$) such that $A(M_{1},\widetilde{N})\not\approx_{t}A(M_{2},\widetilde{N})$.

We suppose that $A(M_{1},\widetilde{N})\not\subseteq_{t}A(M_{2},\widetilde{N})$ without loss of generality. That is, there exists $\mathbf{tr}\in\mathrm{tr}(A(M_{1},\widetilde{N}))$ such that any trace of $A(M_{2},\widetilde{N})$ is not statically equivalent to tr.

Let $\delta(z,\widetilde{z})$ be $z\neq M_{2}\lor\widetilde{z}\neq\widetilde{N}$.

[TABLE]

The below follows because of how to take $\mathbf{tr}$.

[TABLE]

This contradicts total secrecy.

$\Leftarrow$) We arbitrarily take $\delta,\rho,\mathbf{tr}$ and i, where $\delta$ meets the demand of Definition 4.15.

We suppose that $A(x,\widetilde{y}),\rho,\mathbf{tr},i\models\delta(x,\widetilde{y},\widetilde{w})$.

We take $M$ such that $\mathrm{fr}(\mathbf{tr}[i])\models\lnot\delta(M,\rho(\widetilde{y}),\widetilde{w})$. Let $\rho^{\prime}$ be

[TABLE]

By assumption, $A(\rho(x),\rho(\widetilde{y}))\approx_{t}A(M,\rho(\widetilde{y}))$.

Hence, there exists $\mathbf{tr}^{\prime}\in\mathrm{tr}(A(M,\rho(\widetilde{y})))$ such that $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$.

By Lemma 4.7, $\mathbf{tr}[i]\equiv_{s}\mathbf{tr}^{\prime}[i]$ and $\mathbf{tr}^{\prime}[i],0,\mathbf{tr}^{\prime}[i],0\models\lnot\delta(M,\rho(\widetilde{y}),\widetilde{w})$.

Thus, $A(x,\widetilde{y}),\rho^{\prime},\mathbf{tr}^{\prime},i\models\lnot\delta(M,\rho(\widetilde{y}),\widetilde{w})$.

Therefore, $A(x,\widetilde{y}),\rho,\mathbf{tr},i\models P(\lnot\delta(x,\rho(\widetilde{y}),\widetilde{w}))$.

That is, $A(x,\widetilde{y})\models G(\delta(x,\widetilde{y},\widetilde{w})\rightarrow P(\lnot\delta(x,\rho(\widetilde{y}),\widetilde{w})))$. ∎

Theorem 4.17**.**

If $x$ is totally secret in $A(x,\widetilde{y})$, then $x$ is also totally secret in $E[A(x,\widetilde{y})]$ for all contexts $E[\_]$.

Proof.

It immediately follows from Proposition 4.16 and Theorem 3.1. ∎

Our framework can also introduce role interchangeability [22, Subsection 2.2.3] to the applied pi calculus.

Definition 4.18**.**

Let $\mathrm{fv}(A)\setminus\mathrm{dom}(A)\subseteq\{x_{1},...,x_{p}\}$, $J$ be a finite set and $I=\{1,...,p\}$.

$(x_{i},\delta_{k})$* is role interchangeable with respect to $\{\delta_{j}(z_{j},\widetilde{y_{j}})\}_{j\in J}$ in $A$ iff*

[TABLE]

where $\widetilde{y_{j}}\cap\{x_{1},...,x_{p}\}=\emptyset$.

Proposition 4.19**.**

$\forall\widetilde{M}\forall i\forall\mathrm{\mathbf{tr}\in tr}(A(M_{1},...,M_{p}))$**

$\exists\widetilde{N}\exists\mathrm{\mathbf{tr}^{\prime}\in tr}(A(M_{i},N_{2},...,N_{i-1},M_{1},N_{i+1},...,N_{p}))\mathrm{s.t.}\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$**

$\Leftrightarrow(x_{1},\delta_{k})$* is role interchangeable with respect to $\{\delta_{j}\}_{j\in J}$ in $A$ for all $\{\delta_{j}\}_{j\in J}$ and $k$.*

Proof.

$\Rightarrow$) We arbitrarily take $\widetilde{M}$ and $i$.

Let $\rho=[x_{1}\mapsto M_{1},...,x_{p}\mapsto M_{p}]$.

We arbitrarily take $\mathbf{tr}\in\mathrm{tr}(A\rho)$ and $t$.

We suppose that $A,\rho,\mathbf{tr},t\models\delta_{k}(x_{1},\widetilde{y_{k}})\land\delta_{j}(x_{i},\widetilde{y_{j}})$.

By assumption, $\exists\widetilde{N}\exists\mathrm{\mathbf{tr}^{\prime}\in tr}(A(M_{i},N_{2},...,N_{i-1},M_{1},N_{i+1},...,N_{p}))\mathrm{s.t.}\ \mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$.

Let $\rho^{\prime}=[x_{1}\mapsto M_{i},x_{2}\mapsto N_{2},...,x_{i-1}\mapsto N_{i-1},x_{i}\mapsto M_{i},x_{i+1}\mapsto M_{i+1},...,x_{P}\mapsto N_{p}]$.

By Lemma 4.7, $\mathbf{tr}[t]\equiv_{s}\mathbf{tr}^{\prime}[t]$ and $\mathbf{tr}^{\prime}[t],0,\mathbf{tr}^{\prime}[t],0\models\delta_{k}(\rho(x_{1}),\widetilde{y_{k}})\land\delta_{j}(\rho(x_{i}),\widetilde{y_{j}})$.

Thus, $A,\rho^{\prime},\mathbf{tr}^{\prime},t\models\delta_{k}(x_{i},\widetilde{y_{k}})\land\delta_{j}(x_{1},\widetilde{y_{j}})$.

Hence, $A,\rho,\mathbf{tr},t\models P(\delta_{k}(x_{i},\widetilde{y_{k}})\land\delta_{j}(x_{1},\widetilde{y_{j}}))$.

That is, $A\models G(\delta_{k}(x_{1},\widetilde{y_{k}})\rightarrow\bigwedge_{i\in I}\bigwedge_{j\in J}(\delta_{j}(x_{i},\widetilde{y_{j}})\rightarrow P(\delta_{k}(x_{i},\widetilde{y_{k}})\land\delta_{j}(x_{1},\widetilde{y_{j}}))))$.

$\Leftarrow$) We arbitrarily take $\widetilde{M}$ and $i$.

Let $\rho=[x_{1}\mapsto M_{1},...,x_{p}\mapsto M_{p}]$.

We arbitrarily take $\mathbf{tr}\in\mathrm{tr}(A\rho)$.

Let $\delta_{1}(z):z=M_{1}$ and $\delta_{i}(z):z=M_{i}$.

By assumption, $(x_{1},\delta_{1})$ is role interchangeable with respect to $\{\delta_{1},\delta_{i}\}$.

Hence, $A\models G(\delta_{1}(x_{1})\rightarrow(\delta_{i}(x_{i})\rightarrow P(\delta_{1}(x_{i})\land\delta_{i}(x_{1}))))$.

Therefore, $A,\rho,\mathbf{tr},|\mathbf{tr}|\models\delta_{1}(x_{1})\rightarrow(\delta_{i}(x_{i})\rightarrow P(\delta_{1}(x_{i})\land\delta_{i}(x_{1})))$.

Because $A,\rho,\mathbf{tr},|\mathbf{tr}|\models\delta_{1}(x_{1})\land\delta_{i}(x_{i})$, it holds that $A,\rho,\mathbf{tr},t\models P(\delta_{1}(x_{i})\land\delta_{i}(x_{1}))$.

That is, $\exists\rho^{\prime}\exists\mathbf{tr}^{\prime}\in\mathrm{tr}(A\rho^{\prime})\mathrm{s.t.}\ \mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}\land A,\rho^{\prime},\mathbf{tr}^{\prime},|\mathbf{tr}^{\prime}|\models\delta_{1}(x_{i})\land\delta_{i}(x_{1})$.

This means that $\rho^{\prime}(x_{1})=M_{i}\land\rho^{\prime}(x_{i})=M_{1}$.

Let $N_{j}=\rho^{\prime}(x_{j})(j\neq 1,i)$.

Then, $\exists\mathrm{\mathbf{tr}^{\prime}\in tr}(A(M_{i},N_{2},...,N_{i-1},M_{1},N_{i+1},...,N_{p}))\mathrm{s.t.}\ \mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$ holds. ∎

Corollary 4.20**.**

$\forall l\in I\setminus\{i\};A(x_{1},...,x_{i},...,x_{l},...,x_{p})\approx_{t}A(x_{1},...,x_{l},...,x_{i},...,x_{p})$**

$\Rightarrow(x_{i},\delta_{k})$* is role interchangeable with respect to $\{\delta_{j}\}_{j\in J}$ in $A$ for all $\{\delta_{j}\}_{j\in J}$ and $k$.*

When $p=2$, the converse holds. It immediately follows from Proposition 4.19.

Proposition 4.21**.**

$A(x_{1},x_{2})\approx_{t}A(x_{2},x_{1})$**

$\Leftrightarrow(x_{1},\delta_{k})$* is role interchangeable with respect to $\{\delta_{j}\}_{j\in J}$ in $A$ for all $\{\delta_{j}\}_{j\in J}$ and $k$.*

We define openness. This can be regarded as a generalization of identity [22, Subsection 2.2.5].

Definition 4.22**.**

$x$* is open with respect to $\delta$ in $A$ iff*

[TABLE]

This is also very weak. As a matter of fact, openness is neither preserved by restriction nor parallel composition.

Example 4.23**.**

Let $\delta(z):z=m$. Let

[TABLE]

Then $\forall\rho\forall\mathbf{tr}\in\mathrm{tr_{max}}(P\rho);$

[TABLE]

However,

[TABLE]

Example 4.24**.**

Let $\delta(z):z=m$. Let

[TABLE]

We arbitrarily take $\rho,\mathbf{tr}\in\mathrm{tr}(P\rho)$ and $\mathbf{tr}^{\prime}\in\mathrm{tr}(Q\rho)$. Then

[TABLE]

where $\sigma=[x\mapsto m]$ and $\mathbf{tr}_{0}$ is

[TABLE]

In fact, when $\sigma^{\prime}\neq\sigma$, we can take the trace below:

[TABLE]

Then, $\mathbf{tr}_{0}\sim_{t}\mathbf{tr}_{1}$. That is, $x$ is not open with respect to $\delta$ in $P|Q$.

Problem 4.25**.**

Input: An extended process $A$, an assignment $\rho$, a trace $\mathbf{tr}\in\mathrm{tr}(A)$, a non-negative number $i\leq|\mathbf{tr}|$ and a formula $\varphi$.

Question: Does $A,\rho,\mathbf{tr},i\models\varphi$ hold?

This problem is trivially undecidable in general because word problem is undecidable in general.

Proposition 4.26**.**

Problem 4.25 is undecidable in general, even when the word problem in $\Sigma$ is decidable.

Proof.

We again reduce the decision problem for static equivalence to Problem 4.25.

Let $\varphi$ and $\psi$ be frames. We assume that $\mathrm{dom}(\varphi)=\mathrm{dom}(\psi)$.

Let \varphi=\nu\widetilde{n}.\{\raisebox{1.72218pt}{\smallM_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}},...,\raisebox{1.72218pt}{\smallM_{l}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{l}}\},\psi=\nu\widetilde{m}.\{\raisebox{1.72218pt}{\smallN_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}},...,\raisebox{1.72218pt}{\smallN_{l}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{l}}\}.

Let $P=\nu\widetilde{n}.\overline{a}\langle M_{1}\rangle...\overline{a}\langle M_{l}\rangle,Q=\nu\widetilde{m}.\overline{a}\langle N_{1}\rangle...\overline{a}\langle N_{l}\rangle$, where $a\notin\widetilde{n}\cup\widetilde{m}$.

Let $A=\mathrm{if}~{}x=b~{}\mathrm{then}~{}P~{}\mathrm{else}~{}Q$ and $\rho:x\mapsto b$.

Let tr be A\rho\overset{\nu x_{1}.\overline{a}\langle x_{1}\rangle}{\longrightarrow}\nu\widetilde{n}.(\overline{a}\langle M_{2}\rangle...\overline{a}\langle M_{l}\rangle|\{\raisebox{1.72218pt}{\smallM_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}}\})\overset{\nu x_{2}.\overline{a}\langle x_{2}\rangle}{\longrightarrow}...\overset{\nu x_{l}.\overline{a}\langle x_{l}\rangle}{\longrightarrow}\nu\widetilde{n}.\{\raisebox{1.72218pt}{\smallM_{1}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{1}},...,\raisebox{1.72218pt}{\smallM_{l}}\raisebox{0.0pt}{\large/}\raisebox{-0.86108pt}{\smallx_{l}}\}.

We prove that $\varphi\approx_{s}\psi\Leftrightarrow A,\rho,\mathbf{tr},i\models P(x\neq b)$.

tr is the only trace of $A$ which is statically equivalent to tr.

We arbitrarily take an assignment $\rho^{\prime}$ which does not map $x$ to $b$.

A trace $\mathbf{tr}^{\prime}\in\mathrm{tr}(A\rho^{\prime})$ whose actions correspond to tr is the only below:

[TABLE]

Because $A,\rho^{\prime},\mathbf{tr}^{\prime},i\models x\neq b$, it holds that $A,\rho,\mathbf{tr},i\models P(x\neq b)\Rightarrow\varphi\approx_{s}\psi$.

On the other hand, it holds that $\mathbf{tr}\sim_{t}\mathbf{tr}^{\prime}$ if $\varphi\approx_{s}\psi$. This is similar to the proof of Proposition 2.17.

Hence, it follows that $\varphi\approx_{s}\psi\Rightarrow A,\rho,\mathbf{tr},i\models P(x\neq b)$. ∎

Lemma 4.27**.**

Let $A$ be an extended process and $B$ a closed extended process.

Consider a modal formula $\varphi$, assignments $\rho,\rho^{\prime}$ and an arbitrary $\mathbf{tr}\in\mathrm{tr}(B)$, together with a permutation $\pi$ which does not alter names in $A$, $\mathbf{tr}[0,i]$ and $\varphi$ for some $i\leq|\mathbf{tr}|$.

We assume that $\rho^{\prime}$ is obtained by $\pi$ from $\rho$.

Let $X_{i}=\{\mathbf{tr}^{\prime}\in\mathrm{tr}(A\rho)|\mathbf{tr}^{\prime}[0,i]\sim_{t}\mathbf{tr}[0,i]\}$ and $Y_{i}=\{\mathbf{tr}^{\prime}\in\mathrm{tr}(A\rho^{\prime})|\mathbf{tr}^{\prime}[0,i]\sim_{t}\mathbf{tr}[0,i]\}$.

Then there exists a bijection $f_{i}:X_{i}\rightarrow Y_{i}$ such that

[TABLE]

Proof.

We define $f_{i}$ as $f_{i}(\mathbf{tr}^{\prime})=\pi(\mathbf{tr}^{\prime})$.

By assumption, $\rho^{\prime}=\pi(\rho)$.

[TABLE]

∎

Lemma 4.28**.**

Let $T$ be a finite set of variables. Let $S$ be a finite set of names.

We define an equivalence relation $\asymp_{S}$ between assignments which is a map from $T$ to names.

[TABLE]

Then the quotient space by $\asymp_{S}$ is finite.

Proof.

Let $T=\{x_{1},...,x_{l},y_{1},...,y_{m_{n}}\}$ and

[TABLE]

where $a_{1},...,a_{l}$ are names in $S$ and $b_{1},...,b_{n}$ are names which is not in $S$. In addition, $i\neq j\Rightarrow b_{i}\neq b_{j}$, but we do not assume that $i\neq j\Rightarrow a_{i}\neq a_{j}$.

Then $\rho\asymp_{S}\rho^{\prime}\Leftrightarrow[\rho(x_{i})=\rho^{\prime}(x_{i})$ and $\rho^{\prime}(y_{i})=\pi(\rho(y_{i}))$ for some $\pi$].

Each equivalence class is determined by a division of variables such as described above. The number of such divisions is finite, so the quotient space is finite. ∎

We a bit change semantics of $K\varphi$.

[TABLE]

where $\rho^{\prime}$ is an assignment to names.

Proposition 4.29**.**

If static equivalence and word problem in $\Sigma$ are decidable and $\rho$ is restricted to an assignment to names, then Problem 4.25 is decidable.

Proof.

We prove by induction on $\varphi$.

$\top$.

$A,\rho,\mathbf{tr},i\models\top$ always holds, so this is decidable. 2. 2.

$M_{1}=M_{2}$.

By assumption, this is decidable. 3. 3.

$M\in\mathrm{dom}$.

This is trivially decidable. 4. 4.

$\delta_{1}\lor\delta_{2}$.

By induction hypothesis, $\delta_{1}$ and $\delta_{2}$ are decidable, so $\delta_{1}\lor\delta_{2}$ is so.

Moreover, $\lnot\delta,\varphi_{1}\lor\varphi_{2}$ and $\lnot\varphi$ are similar. 5. 5.

$\langle\mu\rangle_{-}\varphi$.

Whether $\mathbf{tr}[i-1]\overset{\mu}{\longrightarrow}\mathbf{tr}[i]$ holds in tr is clearly decidable.

By induction hypothesis, $A,\rho,\mathbf{tr},i-1\models\varphi$ is decidable, so $\langle\mu\rangle_{-}\varphi$ is so. 6. 6.

$F\varphi$.

By induction hypothesis, $A,\rho,\mathbf{tr},i\models\varphi,...,A,\rho,\mathbf{tr},|\mathbf{tr}|\models\varphi$ are decidable, so $F\varphi$ is so. 7. 7.

$K\varphi$.

We consider a quotient space by $\asymp_{\mathrm{n}(\mathbf{tr}[0,i])\cup\mathrm{n}(A)\cup\mathrm{n}(\varphi)}$. By Lemma 4.28, this space is finite. Here, $\mathrm{n}(\mathbf{tr}[0,i])$ is a set of names which appear in $\mathbf{tr}[0,i]$.

Each equivalence class is determined by a division of variables, so this is computable.

We arbitrarily take a representative $\rho^{\prime}$ of each equivalence class.

By Proposition 2.18, whether there exists $\mathbf{tr}^{\prime}\in\mathrm{tr}(A\rho^{\prime})$ such that $\mathbf{tr}[0,i]\sim_{t}\mathbf{tr}^{\prime}[0,i]$ is decidable.

If such traces exist, the number of them is finite.

We arbitrarily take $\mathbf{tr}^{\prime}\in\mathrm{tr}(A\rho^{\prime})$ such as $\mathbf{tr}^{\prime}[0,i]\sim_{t}\mathbf{tr}[0,i]$.

By induction hypothesis, $A,\rho^{\prime},\mathbf{tr}^{\prime},i\models\varphi$ is decidable.

We arbitrarily take $\rho^{\prime\prime}\asymp_{\mathrm{n}(\mathbf{tr}[0,i])\cup\mathrm{n}(A)\cup\mathrm{n}(\varphi)}\rho^{\prime}$.

By Lemma 4.27,

[TABLE]

for some $\pi$ such that $\rho^{\prime\prime}=\pi(\rho^{\prime})$. Moreover, $\mathbf{tr}^{\prime}[0,i]\sim_{t}f_{i}(\mathbf{tr}^{\prime})[0,i]$. This is because $f_{i}(\mathbf{tr}^{\prime}[0,i])\sim_{t}\mathbf{tr}[0,i]$.

This is why we only have to check whether a representative $\rho^{\prime}$ of each equivalence class satisfies that $A,\rho^{\prime},\mathbf{tr}^{\prime},i\models\varphi$.

This procedure can always be completed because of the finiteness of the quotient space.

In other words, $A,\rho,\mathbf{tr},i\models K\varphi$ is decidable.

∎

It is proved in [2, Theorem 1] that static equivalence on a convergent subterm theory is decidable, so the corollary below immediately follows.

Corollary 4.30**.**

If the equational theory on $\Sigma$ is a convergent subterm theory and $\rho$ is restricted to an assignment to names, then Problem 4.25 is decidable.

We again change semantics.

[TABLE]

where $\rho^{\prime}$ is an assignment to names and inputted messages in tr are only variables.

Problem 4.31**.**

Input: An extended process $A$ and a formula $\varphi$.

Question: Does $A\models\varphi$ hold?

Corollary 4.32**.**

If the equational theory on $\Sigma$ is a convergent subterm theory and $A$ contains no replications, Problem 4.31 is decidable.

Chapter 5 Related Work

5.1 Process Algebras

Process algebras are special labelled transition systems. Many kinds of them are proposed. Calculus of Communicating Systems (CCS) [17] is one of the origins. In CCS, a process can do interaction and silent action. This is a difference between an automaton and a process. However, communication topology cannot change because a process cannot exchange messages.

The pi calculus [19, 20, 18] is an extension of CCS. The pi calculus processes can pass and create names, so this model handles mobility, that is, change of topology of process connection. The pi calculus is simple, but it is powerful enough to simulate the lambda calculus.

The spi calculus [3] is an extension of the pi calculus. It enables us to handle symmetric key encryption based on the Dolev-Yao model [11]. In the spi calculus, two cyphertexts obtained by encrypting different plaintexts are indistinguishable unless an observer gets a secret key. Abadi and Gordon proved authenticity and secrecy of Wide Mouthed Frog protocol to use the spi calculus.

We focused on the applied pi calculus [1]. It is also an extension of the pi calculus. It can handle an arbitrary algebra, so in particular, it can handle public key encryption. Proverif [5] is a tool to check bisimilarity and it is used for formal methods. In this calculus, a process can send not only names but also terms via an alias variable. We can handle not only merely secrecy but also stricter properties such as non-malleability because of these features.

5.2 Logics

Combining logic and a labelled transition system is well investigated.

Hennessy-Milner logic [13] is an origin of logic about the behaviour of labelled transition systems. It is a modal logic characterizing observational congruence on labelled transition systems. Namely, systems satisfying the same modal formulas are observational equivalent when these labelled transition systems are image-finite.

Logical characterizations of strong static equivalence and labelled bisimulation in the applied pi calculus are provided in [21]. This logic resembles Hennessy-Milner logic, but it also states relations between terms. Strong static equivalence demands that two frames enable a term to reduce same times and it is strictly stronger than ordinal static equivalence. In the report, only convergent subterm theories are considered.

An epistemic logic for the applied pi calculus was already developed by Chadha, Delaune and Kremer [7]. They defined formulas Has and $\widehat{\mathrm{\textbf{evt}}}$. Has directly represents an attacker’s knowledge, and $\widehat{\mathrm{\textbf{evt}}}$ means that a particular event had occurred. They also suggested that trace equivalence is more suitable than labelled bisimilarity when we handle privacy. On the other hand, a correspondent relation between logic and behaviour of processes was not provided. As a matter of fact, $\alpha$-equivalent processes do not always satisfy the same formulas.

Knight, Mardare and Panangaden [14] provided an epistemic logic for a labelled transition system. This framework is based on Hennessy-Milner logic, and it handles multiple agent’s knowledge. Knowledge is based on a sequence of transitions, which is called a history. They also proved weak completeness to construct Fischer-Ladner closure. However, compositionality was not discussed.

5.3 Formal Approaches

Formal methods enable us to prove that a security protocol satisfies desired properties. Many methods were developed.

Nowadays, multiple cryptographic protocols are often composed (e.g. electronic voting). Universally composability [6] ensures that security properties are preserved by embedding in other protocols. In this framework, a program is expressed as a probabilistic polynomial time interactive Turing machine. In addition, security properties are represented as indistinguishability between an actual protocol and an ideal protocol.

Dolev-Yao model assumes that it is impossible to break a cypher without a key, but of course, real encryption algorithms are not perfect. That is, soundness of Dolev-Yao model is not trivial. However, it was proved in [16] that Dolev-Yao model is sound if encryption is IND-CCA secure.

Hoare logic is used to prove the correctness of a program. Variants of Hoare logic are often used to prove safeness of a security protocol.

The safeness of encryption is often proved using games. Namely, it is proved that the probability is almost $\frac{1}{2}$ that a probabilistic polynomial time attacker decodes a cryptogram of $1$ bit. In this regard, the game is transformed into a trivial game. Probabilistic Hoare logic ensures that transformation of games is reasonable. For instance, the security of ElGamal cryptosystem was proved by this logic in [8], but the proof was not perfectly formal.

Protocol composition logic [9] is also a variant of Hoare logic. It enables us to modularize a proof for a protocol because it is possible sequentially to compose Hoare triples. In the paper, ISO-9798-3 protocol was divided into two parts, and it was proved that the protocol is safe composing proofs that each part is safe.

Privacy and anonymity are also well studied and formulated.

Three privacy-type properties, vote-privacy, receipt-freeness and coercion-resistance, of electronic voting were formulated in [10] using the applied pi calculus. It is noteworthy that indistinguishability is represented by labelled bisimilarity. Three voting protocols are considered in the paper. For instance, it was proved that FOO92 [12] satisfies privacy and does not satisfy receipt-free.

(Strong) Unlinkability and (strong) anonymity were formulated by the applied pi calculus in [4]. These are defined for special forms of processes called well-formed $p$-party protocols. Unlinkability was formulated using traces, while strong unlinkability was formulated using labelled bisimilarity. Anonymity was similar. It is proved that unlinkability is not stronger than anonymity and vice versa. Namely, they are independent notions.

Tsukada, Sakurada, Mano and Manabe [22] studied sequential and parallel compositionality of security notions to use an epistemic logic for a multiagent system. They proved that neither anonymity nor privacy is generally preserved by composition. They also provided a sufficient condition for preservation. In addition, role interchangeability implies privacy and anonymity under the suitable assumption. Privacy of FOO92 was also proved in the multi-agent system. However, this word “parallel” merely means that the same agent acts two actions. In other words, concurrency was not considered.

Chapter 6 Conclusion

6.1 Summary

In this thesis, we proved that trace equivalence is a congruence and provided an epistemic logic for the applied pi calculus to handle secrecy. We defined concurrent normal traces to use partial normal forms for analyzing transitions of parallel composed processes. In addition, we formulated secrecy, role-interchangeability, and openness to generalize privacy, role-interchangeability, and onymity regarding multiagent systems. Moreover, we associated trace equivalence with total secrecy. Minimal secrecy is not preserved by an application of context, but total secrecy is preserved because of congruency of trace equivalence. We also give a sufficient condition for role-interchangeability.

The definition of concurrent normal traces is very complex. This is caused by difficulty in handling bound names.

We conclude that trace equivalence is a suitable notion to express indistinguishability in the view of security in the presence of a non-adaptive active adversary.

6.2 Future Work

In this thesis, we focused on trace equivalence. Many interesting problems remain.

It is proved in [2, Proposition 5] that even static equivalence is not decidable. On the other hand, [2, Theorem 1] proves that static equivalence is decidable in polynomial time for convergent subterm theories. We intend to study conditions to make trace equivalence decidable.

Secondly, our epistemic logic states only an adversary’s knowledge. We intend to construct a logic for a process’s knowledge. It will bridge a gap between multiagent systems and process calculi.

Thirdly, formalizations of other security properties such as non-malleability and unlinkability are also next topics.

Finally, what logic is suitable for security in the presence of an adaptive attacker is still open.

Appendix A Lemmas for Chapter 3

We prove lemmas used in chapter 3.

Lemma A.1** (Lemma 3.2).**

$P\overset{\alpha\sigma}{\longrightarrow}A\Rightarrow\sigma|P\overset{\alpha}{\longrightarrow}\sigma|A$.

Proof.

We prove by case analysis.

$\alpha=N(M)$

By [1, Lemma B.10], $P\equiv\nu\widetilde{n}.(N\sigma(x).P^{\prime}|P_{2})$ and $A\equiv\nu\widetilde{n}.(P^{\prime}\{M\sigma/x\}|P_{2})$ for some $\widetilde{n},P^{\prime},P_{2}$.

Hence, $\sigma|P\equiv\sigma|\nu\widetilde{n}.(N(x).P^{\prime}|P_{2})$ and $\sigma|A\equiv\sigma|\nu\widetilde{n}.(P^{\prime}\{M/x\}|P_{2})$.

Therefore, $\sigma|P\overset{\alpha}{\longrightarrow}\sigma|A$. 2. 2.

$\alpha=\nu x.\overline{N}\langle x\rangle$

By [1, Lemma B.10], $P\equiv\nu\widetilde{n}.(\overline{N\sigma}\langle M\sigma\rangle.P^{\prime}|P_{2})$ and $A\equiv\nu\widetilde{n}.(P^{\prime}|\{M\sigma/x\}|P_{2})$ for some $\widetilde{n},P^{\prime},P_{2}$.

Hence, $\sigma|P\equiv\sigma|\nu\widetilde{n}.(\overline{N}\langle M\rangle.P^{\prime}|P_{2})$ and $\sigma|A\equiv\sigma|\nu\widetilde{n}.(P^{\prime}|\{M/x\}|P_{2})$.

Therefore, $\sigma|P\overset{\alpha}{\longrightarrow}\sigma|A$.

∎

Lemma A.2** (Lemma 3.3).**

$\nu u.A\overset{\mu}{\longrightarrow}B\land A:\mathrm{closed}\land\mathrm{fv}(\mu)\subseteq\mathrm{dom}(\nu u.A)\land\mathrm{n}(\mu)\cap\mathrm{bn}(\nu u.A)=\emptyset$**

$\Rightarrow\exists B^{\prime}\ s.t.\ A\overset{\mu}{\longrightarrow}B^{\prime}\land B\equiv\nu u.B^{\prime}$**

Proof.

Let $\mathrm{pnf}(A)=\nu\widetilde{n}.(\sigma|P)$. We prove by case analysis.

$u$ is a name $n$, and $\mu$ is silent.

$\mathrm{pnf}(\nu n.A)=\nu n\widetilde{n}.(\sigma|P)$.

By [1, Lemma B.23], $P\longrightarrow P^{\prime}$ and $B\equiv\nu n\widetilde{n}.(\sigma|P^{\prime})$ for some closed $P^{\prime}$.

Therefore, $\nu\widetilde{n}.(\sigma|P)\longrightarrow\nu\widetilde{n}.(\sigma|P^{\prime})$ because internal reductions are closed by an application of an evaluation context.

$B^{\prime}=\nu\widetilde{n}.(\sigma|P^{\prime})$ satisfies this lemma. 2. 2.

$u$ is a name $n$, and $\mu$ is a labelled action $\alpha$.

$\mathrm{pnf}(\nu n.A)=\nu n\widetilde{n}.(\sigma|P)$.

By [1, Lemma B.19], $P\overset{\alpha\sigma}{\longrightarrow}C$ and $B\equiv\nu n\widetilde{n}.(\sigma|C)$ for some $C$.

By Lemma 3.2, $\sigma|P\overset{\alpha}{\longrightarrow}\sigma|C$.

Therefore, $\nu\widetilde{n}.(\sigma|P)\overset{\alpha}{\longrightarrow}\nu\widetilde{n}.(\sigma|C)$.

$B^{\prime}=\nu\widetilde{n}.(\sigma|C)$ satisfies this lemma. 3. 3.

$u$ is a variable $x$, and $\mu$ is silent.

$\mathrm{pnf}(\nu x.A)=\nu\widetilde{n}.(\sigma^{\prime}|P)$ where $\sigma^{\prime}=\sigma_{|dom(\sigma)\setminus\{x\}}$. Note that $\sigma^{\prime}\equiv\nu x.\sigma$.

By [1, Lemma B.23], $P\longrightarrow P^{\prime}$ and $B\equiv\nu\widetilde{n}.(\sigma^{\prime}|P^{\prime})$ for some closed $P^{\prime}$.

Therefore, $\nu\widetilde{n}.(\sigma|P)\longrightarrow\nu\widetilde{n}.(\sigma|P^{\prime})$ because internal reductions are closed by an application of an evaluation context.

$B^{\prime}=\nu\widetilde{n}.(\sigma|P^{\prime})$ satisfies this lemma. 4. 4.

$u$ is a variable $x$, and $\mu$ is a labelled action $\alpha$.

$\mathrm{pnf}(\nu x.A)=\nu\widetilde{n}.(\sigma^{\prime}|P)$ where $\sigma^{\prime}=\sigma_{|dom(\sigma)\setminus\{x\}}$.

By [1, Lemma B.19], $P\overset{\alpha\sigma^{\prime}}{\longrightarrow}C$ and $B\equiv\nu\widetilde{n}.(\sigma^{\prime}|C)$ for some $C$.

By Lemma 3.2, $\sigma^{\prime}|P\overset{\alpha}{\longrightarrow}\sigma^{\prime}|C$.

Therefore, $\nu\widetilde{n}.(\sigma|P)\overset{\alpha}{\longrightarrow}\nu\widetilde{n}.(\sigma|C)$.

$B^{\prime}=\nu\widetilde{n}.(\sigma|C)$ satisfies this lemma.

∎

Lemma A.3** (Lemma 3.4).**

Let $\nu\widetilde{n}.(\sigma|P)$ be a closed normal process.

$\nu\widetilde{n}.(\sigma|P)\overset{\alpha}{\longrightarrow}A\land\alpha\sigma=\beta\sigma\land\mathrm{fv}(\alpha)\subseteq\mathrm{dom}(\sigma)\land\widetilde{n}\cap(\mathrm{n}(\alpha)\cup\mathrm{n}(\beta))=\emptyset$**

$\Rightarrow\nu\widetilde{n}.(\sigma|P)\overset{\beta}{\longrightarrow}A$.

Proof.

Let $\nu\widetilde{n}.(\sigma|P)$ be a closed normal process.

By [1, Lemma B.19], $P\overset{\alpha\sigma}{\longrightarrow}B\land A\equiv\nu\widetilde{n}.(\sigma|B)$.

By the assumption, $P\overset{\beta\sigma}{\longrightarrow}B$.

By Lemma 3.2, $\sigma|P\overset{\beta}{\longrightarrow}\sigma|B$, so $\nu\widetilde{n}.(\sigma|P)\overset{\beta}{\longrightarrow}\nu\widetilde{n}.(\sigma|B)$.

Therefore, $\nu\widetilde{n}.(\sigma|P)\overset{\beta}{\longrightarrow}A$. ∎

Lemma A.4** (Lemma 3.5).**

$\sigma|A\overset{\mu}{\longrightarrow}\sigma|B\land\mathrm{dom}(\sigma)\cap\mathrm{fv}(\mu)=\emptyset\land x\in\mathrm{dom}(\sigma)\Rightarrow x\sigma$: closed

$\Rightarrow A\sigma\overset{\mu}{\longrightarrow}B\sigma$.

Proof.

Let $\widetilde{x}=\mathrm{dom}(\sigma)$.

$\nu\widetilde{x}.(\sigma|A)\overset{\mu}{\longrightarrow}\nu\widetilde{x}.(\sigma|B)$.

$A\sigma\overset{\mu}{\longrightarrow}B\sigma$. ∎

Lemma A.5** (Lemma 3.6).**

$\sigma|P\overset{\mu}{\longrightarrow}B\land\sigma|P$: closed normal $\land\mathrm{fv}(\mu)\subseteq\mathrm{dom}(\sigma)$

$\Rightarrow\exists B^{\prime}\ \mathrm{s.t.}\ P\sigma\overset{\mu\sigma}{\longrightarrow}B^{\prime}\land B\equiv\sigma|B^{\prime}$.

Proof.

$\mu$ is silent.

By [1, Lemma B.23], $P\longrightarrow Q\land B\equiv\sigma|Q$.

By [1, Lemma B.3], $P\sigma\longrightarrow Q\sigma$.

$\sigma|Q\sigma\equiv\sigma|Q\equiv B$. 2. 2.

$\mu$ is a labelled action $\alpha$.

By [1, Lemma B.19], $P\overset{\alpha\sigma}{\longrightarrow}C\land B\equiv\sigma|C$ for some $C$.

By [1, Lemma B.11], $P\sigma\overset{\alpha\sigma}{\longrightarrow}C\sigma$.

$\sigma|C\sigma\equiv\sigma|C\equiv B$.

∎

Lemma A.6** (Lemma 3.21).**

$\sigma\rho\equiv[\sigma\rho]$.

Proof.

Let $\widetilde{y}=\mathrm{dom}(\rho)$. Then, $\sigma\rho\equiv\nu\widetilde{y}.(\sigma|\rho)\equiv\nu\widetilde{y}.(\sigma\uplus\rho)\equiv[\sigma\rho]$. ∎

Lemma A.7** (Lemma 3.22).**

$\rho\sigma\equiv\rho[\sigma\rho]$.

Proof.

Let $\widetilde{x}=\mathrm{dom}(\sigma)$. Then,

[TABLE]

∎

Lemma A.8** (Lemma 3.23).**

$(\sigma|P)\rho\equiv[\sigma\rho]|P[\rho\sigma]$.

Proof.

Let $\widetilde{y}=\mathrm{dom}(\rho)$. Then,

[TABLE]

∎