Type-based information flow analysis for $π$-calculus with a dynamically extensible security lattice

Unknown

Conceptio › Archive › arXiv CS

arXiv CSopen access

Type-based information flow analysis for $π$-calculus with a dynamically extensible security lattice

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

cryptography, security, privacy, cybersecurity

arXiv:2606.27059v1 [cs.CR] 25 Jun 2026

Type-based information flow analysis for π -calculus with a dynamically extensible security lattice Yukihiro Oda

Eijiro Sumii

Graduate School of Information Sciences Tohoku University Tohoku, Japan yukihiro.oda.e5 [at] tohoku.ac.jp ORCID:0000-0002-6216-3193

Graduate School of Information Sciences Tohoku University Tohoku, Japan sumii [at] tohoku.ac.jp

classification by annotating types with security levels. Though called “language-based” with “programs,” this approach is not limited to programs or programming languages in the narrow sense (such as C and Java), but is applicable to various models of systems as well. Traditionally, the “languages” (or models) have been imperative [3] or functional [5], and sequential. They have also been extended with (mainly thread-based) concurrency, where determinism has often been essential and non-interference has been proved in probabilistic settings or under a strong restriction on the concurrent computations—for instance, no low-level communication is allowed after high-level synchronization, or observable non-determinism is forbidden at all; see [4, Section IV-B] for a survey. Kobayashi [6] removed such strong restrictions by adopting a type system for lock-freedom [7] in π calculus [8]–[10], a rather general and expressive model of both sequential and concurrent computations. In short, even high-level synchronization is allowed before low-level communications as long as the former is lock-free. Non-interference is proved as (barbed [11]) bisimulation-based congruence, which is also a general and robust notion of equivalence (and can be extended with probability; see, for instance, [12]–[15], among many others).1 However, Kobayashi [6] only considered the security lattice with 2 elements (high and low). In the present work, we extend Kobayashi [6] with general security lattices. Furthermore, we allow dynamic extension of the lattice, that is, new security levels can be added while the system is running, which is a mandatory functionality for many modern systems that allow registration/creation of new users/accounts.

Abstract—We develop a type system for secure information flow where new security levels can be created and inserted into the security lattice dynamically, i.e., even in the middle of an execution of a system. Our system is formalized by extending Kobayashi’s type-based secure information flow analysis for Milner’s pi-calculus, which is one of the most expressive models (or “languages”) supporting both sequential and concurrent computations, with concise syntax, reduction-based semantics, and bisimulation equivalence as a robust formalization of secrecy as noninterference. The development required careful treatment of extensions of lattices themselves as well as deliberate generalization from the simple 2-element lattice (consisting of only High and Low) in the original system. Index Terms—language-based security, pi-calculus, barbed bisimulation, non-interference, dynamic extension of security lattice, runtime creation and insertion of new security levels

1. Introduction Lattice-based secure information flow [1] classifies data into security levels—such as H(igh) and L(ow)— that are elements of the security lattice, and aims to prevent leakage of higher-level information into lowerlevel actors. Unlike mere access control, secure information flow also addresses indirect information leakage— like if bH then 1L else 0L where bH is a high-level Boolean value and 1L , 0L are low-level integers—and even if bH then 1L else diverge() when terminationsensitive. Absence of information leakage is formalized as non-interference [2], which asserts the equivalence of two systems with different high-level information when observed from a low level. To account for such indirect information flows, language-based—and, more specifically, type-based— information flow analysis [3], [4] models systems as programs and adopts a static type system that imposes the

1. Equivalence (and therefore non-interference) of concurrent processes with general interactions (as opposed to “threads” with limited concurrency primitives) has by itself been a significant research challenge, e.g. classically [16], [17] and more recently [18], just to name a few. While no single definition of equivalence may be considered satisfactory in every respect, barbed bisimulation is “fine” (as opposed to coarse) and suﬀicient as a proof of soundness of a security type system.

Even the former generaliztion by itself is non-trivial— all the definitions, statements, and proofs need to be carefully parameterized with the level l of the attacker (namely, observer for the equivalence) being considered (Definition 3.13, Definition 3.14, Definition 4.11, and so forth). The latter extension is, to the best of our knowledge, new, even for sequential languages. It also requires careful treatment of the “current” security lattice of the system, throughout our technical developments such as reduction (Definition 2.6) and typing rules (Figure 1), as well as the definition of a “safe” extension of a lattice itself (Definition 2.5) and all the proofs (in the Appendices). The rest of this paper is as follows: Section 2 introduces the syntax and reduction semantics of our language along with definitions concerning the security lattices. Section 3 defines our type system for information flow analysis. Section 4 proves the non-interference theorem and Section 5 concludes. Further details of our technical developments and proofs are given in the Appendices.

if v then P else P where ξ ranges over the core channel types (defined later in Definition 3.1). By convention, we give a lower precedence to | than to other operators, so (νx : ξ)P1 | P2 means ((νx : ξ)P1 ) | P2 for example. We also assume | is left-associative. As usual, everyyi ∈ ỹ in x?ỹ.P , x in (νx : ξ)P , and, ˜ ˜ in particular, l in l1 < νl < l2 P are bound in P and subject to implicit α-conversion such that each of them is different from other (bound or unbound) names. We write FN(P ), FCN(P ), and FSN(P ), respectively, for the set of free (i.e., unbound) names, free channel names, and free secrecy level names of process P . A sub-process of a process P is defined as a subexpression of P that is also a process. We write P for the set of processes. We write P [y0 7→ v0 , . . . , yn 7→ vn ] for the process obtained by respectively replacing all the free occurrences of y0 , . . . , yn in P with v0 , . . . , vn . We often abbreviate P [y0 7→ v0 , . . . , yn 7→ vn] as P [ỹ 7→ ṽ] and (νx0 : ξ0 ) . . . (νxn : ξn )P as ν x̃ : ξ˜ P .

2. π L -calculus

2.2. Lattice of secrecy levels L

This section introduces our process calculus π for type-based information flow analysis, which extends the π -calculus [8]–[10] with a lattice of secrecy levels.

In this section, we give definitions and prove lemmas for the lattice of secrecy levels.

2.1. Syntax

Definition 2.2 (Lattice). We define a lattice as a poset (L, ≤L ) where, for any finite S ⊆ L, there exist the supremum and infimum of S .

Our language is π -calculus [6], [8]–[10] augmented with a ν operation for extending the lattice of secrecy levels, as in the definition below. Intuitively, the new process form (l1 , . . . , lm < νl < l10 , . . . , ln0 )P creates a new level l above (resp. below) existing levels l1 , . . . , lm (resp. l10 , . . . , ln0 ), and then execute P . (Its formal semantics will be defined in the next sections.) In the rest of this paper, we often write ˜l, x̃, etc. to abbreviate sequences like l1 , . . . , lm and x1 , . . . , xn when their lengths m, n ≥ 0 are arbitrary or clear from the context. For a sequence t̃ where t is a meta-variable of any kind, we write a ∈ t̃ if a is an element of t̃. We write Chan and SecLev for the distinct sets of channel names and secrecy level names, respectively. Also, we assume at least two distinct secrecy level names >, ⊥ ∈ SecLev.

Note that the supremum of ∅ is the minimum of (L, ≤L ), and the infimum of ∅ is the maximum of (L, ≤L ). Thus, for each lattice, its maximum and minimum exist.2 We sometimes write 1L and 0L for the maximum and minimum of (L, ≤L ), respectively. For simplicity, we often write just L for a lattice (L, ≤L ). For (L, ≤L ) and a, b ∈ L, we write a <L b if a ≤L b and a 6= b. We also write a 6≤L b (resp. a 6<L b) when a ≤L b (resp. a <L b) does not hold. For S ⊆ L, we write supL (S) and infL (S) for the supremum and infimum of S in L, respectively. Note also a ≤L b ⇐⇒ supL ({a, b}) = b ⇐⇒ infL ({a, b}) = a. The following definition is crucial for “safe” extension of a lattice, as we will adopt in the rest of this paper. In short, an extension L of a lattice L0 must be a “superlattice” of L0 , that is, L0 must be a sublattice of L.

Definition 2.1 (Syntax of π L -calculus). We define processes as follows x, y, . . . ∈ Chan k, l, m ∈ SecLev

Definition 2.3 (Sublattice). For a lattice (L, ≤L ), we define a sublattice of (L, ≤L ) as a lattice (L0 , ≤L′ ) satisfying the following conditions: (1) L0 ⊆ L (2) 1L , 0L ∈ L0

(channel name) (secrecy level name)

c ::= truel | falsel | unit (constant value) v ::= c | x (value) (process) P ::= 0 | (P | P ) | ∗P | (νx : ξ)P | x!ṽ.P | x?x̃.P | ˜l < νl < ˜l P |

2. We adopt the present definition as in [19] and [20, p. 3, Remark]; the latter explains why it is more “natural.” An alternative term for this definition is a bounded lattice [19, Section 2], which we avoid for brevity in this paper.

(3) supL′ (S) = supL (S) and infL′ (S) = infL (S) for every finite S ⊆ L0 . We write L0 v L if L0 is a sublattice of L.

(SP-Rep) ∗P ∗P | P (SP-Par) If P0 P1 , then P0 | Q P1 | Q. (SP-CNew) If P0 P1 , then (νx : ξ)P0 (νx : ξ)P1 .

Lemma 2.4. Let L be a lattice and L0 v L. For any a, b ∈ L0 , (1) a ≤L′ b if and only if a ≤L b, and (2) a <L′ b if and only if a <L b.

Definition 2.7 (Reduction). The binary relation −→ on P × L , called reduction, is defined as the least relation satisfying the following rules: (R-Com) (x!ṽ.P0 | x?ỹ.P1 , L) −→ (P 0 | P1 [ỹ 7→ ṽ],L) (R-NewLev) If l˜0 , l˜1 ⊆ L and l˜0 < νl < l˜1 L is defined, then l˜0 < νl < l˜1 P , L −→ P, l˜0 < νl < l˜1 L . (R-Par) If (P0 , L) −→ (P00 , L0 ), then (P0 | P1 , L) −→ (P00 | P1 , L0 ). (R-New) If (P, L) −→ (P 0 , L0 ), then ((νx : ξ)P , L) −→ ((νx : ξ)P 0 , L0 ). (R-SP) If P0 P00 , (P00 , L0 ) −→ (P10 , L1 ), and P10 P1 , then (P0 , L0 ) −→ (P1 , L1 ). We write −→ → for the reflexive and transitive closure of −→. We also write −→ → → for the transitive closure of −→.

We omit proofs when they are straightforward. A lattice of secrecy levels is a lattice such that its underlying set is a finite subset of SecLev, with > and ⊥ being the maximum and minimum, respectively. We write L for the set of lattices of secrecy levels. We also write ˜l ⊆ L if every li ∈ ˜l belongs to L. We then give a notation l˜0 < νl < l˜1 L for extension of lattices:3 Definition 2.5. Let (L, ≤L ) be a lattice of secrecy levels with l˜0 , l˜1 ⊆ L, and l ∈ / L for an l ∈ SecLev. Let furthermore L0 = L ∪ {l} and and transin ≤L′ be the oreflexive n o tive closure of ≤L ∪ (l0 , l) l0 ∈ l˜0 ∪ (l, l0 ) l0 ∈ l˜1 . If (L0 , ≤L′ ) is a lattice, then we write l˜0 < νl < l˜1 L for L0 .

3. Type System Our type system is an extension of Kobayashi [6]’s, with a general lattice of secrecy levels and dynamic creation of new levels.

Note that L0 may not always be a lattice, e.g., if L = {⊥, >}, l˜0 = >, and l˜1 = ⊥. We reject such extensions by definition. Note also that L0 may not always be a superlattice of L, that is, L may not be a sublattice of L0 , even if L0 is a lattice. Later, we impose L v L0 by typing.

3.1. Types and Usages Before our extension, we basically repeat Kobayashi [6]’s definition of usages—originally proposed in [21]—albeit omitting recursion for the sake of technical simplicity (while keeping usage variables for substitutions as in Definition 3.7 (a)). Informally, a usage is part of a channel type and expresses how (when and in what order) the channel is used for input and output, so as to ensure lock-freedom by checking the correctness—called reliability—of the usage. The intuitive meanings of usage expressions are briefly summarized in Table 1.

2.3. Reduction This section defines reduction in π L -calculus via structural preorder, which is a variant of standard structural congruence in π -calculus but is asymmetric for the sake of specifying canonical forms. Definition 2.6 (Structural preorder). The binary relation on processes, called structural preorder, is defined as the least reflexive and transitive relation satisfying the following rules, where P0 ≃ P1 denotes that both P0 P1 and P1 P0 hold. (SP-Zero1) P ≃ P | 0 (SP-Zero2) 0 ≃ (νx : ξ)0 (SP-Commut) P0 | P1 P1 | P0 (SP-Assoc) (P0 | P1 ) | P2 P0 | (P1 | P2 ) 4 (SP-New) (νx : ξ)P0 | P1 ≃ (νx : ξ)(P0 | P1 ) if x ∈ / FCN(P1 ) (SP-IfT) if truel then P0 else P1 P0 (SP-IfF) if falsel then P0 else P1 P1

Definition 3.1. We define types and usages as follows: τ ::= Booll | Unit | ξ/U

(type)

ξ ::= hτ̃ i (core channel type) ρ ∈ UVar (usage variable) to , tc ∈ N ∪ {∞} (obligation and capability levels) U ::= 0 | ρ | αttco .U | (U | U ) | (usage) ∗U | ↑(to ,tc ) U | U & U α ::= I | O (input and output)

We write FV(U ) for the set of usage variables occurring in a usage U . A usage U is closed if no usage variable occurs in U . Also, we write α for the co-action of α, defined as I = O and O = I . We define the type of truel and falsel as Booll and the type of unit as Unit.

3. In fact, any extension of a lattice would do for the rest of our development as long as it yields a superlattice and parallel extensions are commutative. We adopt the present definition only for the sake of concreteness. 4. The other direction can be derived from (SP-Commut) and (SP-Par).

Usages 0 αttoc .U

U0 | U1 ∗U ↑(tI ,tO ) U U0 & U1

Intuitive meaning (how the channel should be used) cannot be used at all used once for input (α = I ) or output (α = O), and then used according to U , where to and tc are natural numbers (or ∞) respectively called obligation and capability levels (not to be confused with secrecy levels) and represent when (i.e., in what order) the input or output must and can be performed, so as to prevent deadlocks and livelocks caused by self or cyclic dependencies used according to U0 and U1 , possibly in parallel (the symbol | here represents parallel composition as in π -calculus) used according to U infinitely many times in parallel used according to U , but input and output obligation levels are raised (at least) to tI and tO , respectively used according to either U0 or U1 , as chosen by the “user” (the symbol & here represents additive conjunction as in linear logic [22]) TABLE 1. Intuitive meaning of usage expressions (similar to [6, Table 1])

We assume | for usages is left-associative as well. We call Booll and Unit base types. A type τ is called a channel type if it is not a base type. The secrecy level of a type τ l is defined as l if τ is either Booll or of the form hτ̃ i /U . to For each occurrence of αtc in a usage, to and tc are respectively called the obligation and capability level annotation of the occurrence. Intuitively, they mean that the input or output α must be performed—though may not succeed—by the “time” (relative ordering in terms of natural numbers and ∞) specified by to , and will succeed by time tc if—though need not be—performed.

Definition 3.4 (Structural preorder for usages). The binary relation on usages is the least reflexive and transitive relation satisfying the following rules: (UP-Zero) 0 | U U (UP-Commut) U0 | U1 U1 | U0 (UP-Assoc) (U0 | U1 ) | U2 U0 | (U1 | U2 ) (UP-CongP) If U0 U00 , then U0 | U1 U00 | U1 . (UP-Rep) ∗U ∗U | U max(t ,t ) (UP-↑) ↑(tI ,tO ) αttco .U αtc o α .U (tI ,tO ) (U0 | U1 ) ↑(tI ,tO ) U0 | ↑(tI ,tO ) U1 (UP-Dist) ↑ (UP-Or) U0 & U1 Ui for i ∈ {0, 1} (UP-Cong↑) If U U 0 , then ↑(tI ,tO ) U ↑(tI ,tO ) U 0 . ′ ′ (UP-Commut↑) ↑(tI ,tO ) ↑(tI ,tO ) U ′ ′ ↑(tI ,tO ) ↑(tI ,tO ) U 5

Definition 3.2 (Capability). For α ∈ {I, O}, capα (U ) is defined by: capα (0) = capα (ρ) = capα αttoc .U = ∞ capα αttco .U = tc Definition 3.5 (Usage reduction). The binary relation capα (U0 | U1 ) = capα (U0 & U1 ) = min(capα (U0 ), capα (U1 )) −→ on usages, called usage reduction, is defined as the least relation satisfying the following rules: capα (∗U ) = capα ↑(tI ,tO ) U = capα (U ) t′ (1) Ottco .U0 | It′co .U1 −→ U0 | U1 (2) If U0 −→ U00 , then U0 | U1 −→ U00 | U1 . We call capI (U ) and capO (U ), respectively, the input (3) If U0 U00 , U00 −→ U10 and U10 U1 , then U0 −→ and output capability level of a usage U . U1 . Definition 3.3 (Obligation). For α ∈ {I, O}, obα (U ) is We write −→ → for the reflexive and transitive closure of defined as: −→ for usages as well. obα (0) = obα (ρ) = obα αttoc .U = ∞, Definition 3.6 (Reliability). We write conα (U ) if obα αttco .U = to , obα (U ) ≤ capα (U ), and con (U ) if both conI (U ) and conO (U ). Then we say that a usage U is reliable, written obα (U0 | U1 ) = min(obα (U0 ), obα (U1 )), rel(U ), if con (U 0 ) for any U 0 such that U −→ → U 0. obα (∗U ) = obα (U ), Next, we define the following subusage and subtyping obα ↑(tI ,tO ) U = max(tα , obα (U )), and relations. obα (U0 & U1 ) = max(obα (U0 ), obα (U1 )). Definition 3.7 (Subusage). The subusage relation <: We call, respectively, obI (U ) and obO (U ) the inon closed usages is the largest binary relation such that, put and output obligation level of a usage U . We dewhenever U0 <: U1 , the following conditions hold: fine ob (U ) = min(obI (U ), obO (U )), which is used as (a) U [ρ 7→ U0 ] <: U [ρ 7→ U1 ] for any usage U with ob (U ) = ∞ to mean U has no obligation, and write ↑ U FV(U ) = {ρ}. for ↑(tI +1,tO +1) U where tI = obI (U ) and tO = obO (U ). (b) If U1 −→ U10 , then there exists U00 such that U0 −→ U00 and U00 <: U10 . We then define reduction of usages (with structural (c) capα (U0 ) ≤ capα (U1 ) for each α ∈ {I, O}. preorder, like we did for processes), which is required for (d) For each α ∈ {I, O}, if conα (U0 ), then obα (U0 ) ≥ defining their reliability and for the statement of type obα (U1 ). preservation (subject reduction), as is usual for behavioral type systems, where static types capture dynamic 5. This rule was not present in [6] but is added for a part of our soundness proof. behavior of processes.

(a) Dom(Γ) ⊇ Dom(∆), (b) Γ(x) <: ∆(x) for each x ∈ Dom(∆), and (c) ob (Γ(x)) = ∞ for each x ∈ Dom(Γ) \ Dom(∆).

Proposition 3.8. (1) If U0 <: U1 and conα (U0 ), then conα (U1 ). (2) If U0 <: U1 and rel(U0 ), then rel(U1 ). (3) The subusage relation is reflexive and transitive.

We say that a type environment Γ is closed [6, p. 316] [23, p. 238, Definition 6.1.2] if Γ(x) is a channel type for each channel name x ∈ Dom(Γ). We also say that Γ is reliable, written rel(Γ), if, for any x ∈ Dom(Γ), Γ(x) is a channel type ξ/U with rel(U ). Note that the subtyping relation on type environments is also transitive, i.e., if Γ <: Γ0 and Γ0 <: Γ00 , then Γ <: Γ00 . For type environments Γ and ∆, we define :   Γ(x) | ∆(x) if x ∈ Dom(Γ) ∩ Dom(∆) (Γ | ∆)(x) = Γ(x) if x ∈ Dom(Γ) \ Dom(∆)   (x) if x ∈ Dom(∆) \ Dom(Γ) ∆

Definition 3.9 (Subtyping). The subtyping relation <: on types is the least reflexive relation such that ξ/U <: ξ/U 0 if U <: U 0 . Note that if τ is a base type, then τ <: τ 0 implies τ 0 = τ . Note also that the subtyping relation is transitive, i.e., τ <: τ 0 and τ 0 <: τ 00 imply τ <: τ 00 . Definition 3.10. The obligation level of a type τ , written obα (τ ), is defined by ( ∞ if τ is a base type obα (τ ) = obα (U ) if τ = ξ/U

For a type environment Γ, we write ∗Γ, ↑(tI ,tO ) Γ, and ↑ Γ for the type environments satisfying (∗Γ)(x) = ∗(Γ(x)), (↑(tI ,tO ) Γ)(x) = ↑(tI ,tO ) (Γ(x)), and (↑ Γ)(x) = ↑ (Γ(x)), respectively. Note Dom(Γ | ∆) = Dom(Γ) ∪ Dom(∆) and Dom(∗Γ) = Dom ↑(tI ,tO ) Γ = Dom(↑ Γ) = Dom(Γ). Again, we assume | is left-associative, and abbreviate v1 : τ1 | · · · | vn : τn as ṽ : τ̃ . Furthermore, we write Γ ∼ Γ0 if Dom(Γ) = Dom(Γ0 ) and Γ(x) ∼ Γ0 (x) for every x ∈ Dom(Γ). We now start to extend the type system with general lattices. The first definition below generalizes wellformed channel types [6, Definition 14]. Informally, it means the channel type is well-formed when the level of the “attacker” is l (which was just ⊥, written L in [6], in the 2-element lattice).

along with ob (τ ) = min(obI (τ ), obO (τ )). We also define ↑(tI ,tO ) τ , ↑ τ , ∗τ , and τ0 | τ1 as: ( τ if τ is a base type (tI ,tO ) ↑ τ= ξ/ ↑(tI ,tO ) U if τ = ξ/U ( τ if τ is a base type ↑τ = ξ/ ↑ U if τ = ξ/U ( τ if τ is a base type ∗τ = ξ/∗U if τ = ξ/U   if τ0 = τ1 and is a base type  τ0 τ0 | τ1 = ξ/(U0 | U1 ) if τ0 = ξ/U0 and τ1 = ξ/U1  undefined otherwise We assume | for types is also left-associative, that is, τ0 | τ1 | τ2 stands for (τ0 | τ1 ) | τ2 .

Definition 3.13 (l-secure channel type). We say that l′ a channel type hτ̃ i /U is l-secure in L when (1) if l0 ≤L l, then all the capability level annotations in U are ∞, and (2) l0 ≤L l00 for any secrecy level l00 occurring in τ̃ .

Definition 3.11 (Equivalence except usages). The relation τ ∼ τ 0 on types is the least equivalence relation l l satisfying hτ̃ i /U ∼ hτ̃ i /U 0 for l ∈ SecLev. Then τ0 | τ1 is defined if and only if τ0 ∼ τ1 . Note also that τ0 <: τ1 implies τ0 ∼ τ1 .

We write Γ k L for the pair (Γ, L) and call it an environment. Definition 3.14 (l-secure environment). For a type environment Γ and a lattice of secrecy levels L, we say that Γ k L is l-secure if every channel type in the range of Γ is l-secure in L.

3.2. Type Environments Our type environments Γ and ∆ are defined as functions from a finite set of values v (consisting of channel names x and constants c) to types τ , with constant values mapped to their respective types. We write ∅ for the empty type environment. For a value v ∈ / Dom(Γ), we write Γ, v : τ for type environment Γ0 such that Dom(Γ0 ) = Dom(Γ) ∪ {v}, Γ0 (v) = τ , and Γ0 (y) = Γ(y) for y ∈ Dom(Γ). We write v : τ for the type environment Γ with Γ(v) = τ and Dom(Γ) = {v}. We extend the subtyping relation to a relation on type environments.

3.3. Typing Rules Our type judgement Γ k L ▷m P is a tuple (Γ k L, m, P ) of an environment Γ k L, a secrecy level m ∈ L, and a process P , where every secrecy level occurring in P and Γ is in L. Intuitively, it means that the process P is secure (i.e., does not leak information about high-secrecy values to low-level “attackers” or contexts) under the type environment Γ and secrecy lattice L, where m is a lower bound of the levels that P may interact with (as in [6]).

Definition 3.12 (Subtyping relation on type environments). For type environments Γ and ∆, we write Γ <: ∆ if

m∈L (T-Zero) ∅ k L ▷m 0

Γ, x : ξ/U k L ▷m P

Γ k L ▷m P

Γ0 k L ▷m P0

∗Γ k L ▷m ∗P

Γ k L ▷m (νx : ξ)P

(T-Rep)

Γ, x : hτ̃ i 0 /U k L ▷l1 P ↑

(tc +1,tc +1)

k L ▷m if v then P else Q m ≤ L l1

(Γ | ṽ : ↑ τ̃ ) | x : hτ̃ i

↑

Γ k L ▷m Q

m ≤ L l0

Γ, x : hτ̃ i 0 /U , ỹ : τ̃ k L ▷l1 P

Γ 1 k L ▷ m P1

Γ0 | Γ1 k L ▷m P0 | P1

Γ k L ▷m P Γ | v : Bool

rel(U )

m ≤ L l0 l0

Γ0 k L ▷ m ′ P

(T-Par)

(T-If)

tc = ∞ =⇒ l0 ≤L l1

/Ot0c .U k L ▷m x!ṽ.P m ≤ L l1

Γ <: Γ0

m ≤L m0

Γ k L ▷m P

(T-Out)

tc = ∞ =⇒ l0 ≤L l1

/It0c .U k L ▷m x?ỹ.P

(Γ), x : hτ̃ i Γ k l˜1 < νl0 < l˜2 L ▷m P L v l˜1 < νl0 < l˜2 L Γ k L ▷m l˜1 < νl0 < l˜2 P (tc +1,tc +1)

(T-New)

m ≤L l˜1 , l˜2

(T-In)

(T-NewSec)

(T-Weak)

Figure 1. Typing rules ⊥

0 .0) | 0, and L = {⊥, >}. IntuΓ = y : hi /↑(1,1) (I∞ itively, P creates a new secrecy level l and internally communicates a Boolean value truel of that level. Noninterferece means that replacing it with falsel makes no difference to low-level observers.

The typing rules other than (T-NewSec) are similar to previous ones [6] except that they are all parameterized by the general levels L. The lattice of secrecy ˜ ˜ second premise L v l1 < νl0 < l2 L in (T-NewSec) ensures safe extension thanks to our previous definitions on lattices (Definition 2.3 and Definition 2.5). The “side” condition m ≤L l˜1 , l˜2 , which is more subtle, guarantees that high-secrecy operations can be erased in the proof of non-interference (the third last case in Definition F.9). We say a type judgement Γ k L ▷m P is l-secure if Γ k L is l-secure. An l-secure derivation tree is defined as a tree of l-secure type judgements constructed by instances of the rules in Figure 1. An l-secure derivation tree with root Γ k L ▷m P is called an l-secure derivation tree of Γ k L ▷m P . We say that Γ k L ▷m P is l-securely derivable from ∆ k L0 ▷m′ P 0 if there exists an l-secure derivation tree of Γ k L ▷m P whose leaves are either ∆ k L0 ▷m′ P 0 or constructed by (T-Zero). We also say that Γ k L ▷m P is l-securely derivable if there exists a derivation tree of Γ k L ▷m P whose leaves are constructed by (T-Zero), and that Γ k L ▷m P is derivable (from ∆ k L0 ▷m′ P 0 ) if it is l-securely derivable (from ∆ k L0 ▷m′ P 0 ) for some l. All the careful definitions above are needed for soundness and related proofs of our type system with a generalized (let alone extensible) security lattice (that is, lattice of secrecy levels).

The following proposition allows a weakening, namely, extension of the lattice L in an environment Γ k L. Proposition 3.16. If Γ k L ▷m P is l-securely derivable (resp. from ∆ k L0 ▷ m′ P 0 ), then 0 ˜ ˜ Γ k l0 < νl < l1 L ▷m P is also l-securely derivable (resp. from ∆ k l˜0 < νl0 < l˜1 L0 ▷m′ P 0 ), where l0 is fresh.

4. Soundness In this section, we will prove our main theorem: non-interference. To that goal, we first show two important properties of well-typed processes: subject reduction (type preservation) and lock-freedom.

4.1. Subject reduction We define Γ −→ Γ0 as Γ = (Γ0 , x : ξ/U ) for some x with U −→ U 0 and Γ0 = (Γ0 , x : ξ/U 0 ). Again, we write −→ → for the reflexive and transitive closure of −→.

Example 3.15. Figure 2 shows a >-secure derivation tree for Γ k L ▷⊥ P where the process P is l (> < νl < ⊥) νx : v : Booll (x!truel .y?.0 | x?b.0),

Lemma 4.1. If Γ k L is l-secure and Γ −→ Γ0 , then Γ0 k L is l-secure.

∅ k L0 ▷ ⊥ 0 ⊥

x : Booll /0, y : hi /0 k L0 ▷⊥ 0

∅ k L0 ▷ ⊥ 0

⊥

x : Booll /0, y : hi /0, b : Booll k L0 ▷⊥ 0

⊥

0 x : Booll /O00 , y : hi /↑(1,1) I∞ k L0 ▷⊥ x!truel .y? l

⊥

0 x : Booll /0, y : hi /I∞ k L0 ▷⊥ y?

⊥

x : Booll /I00 , y : hi /0 k L0 ▷⊥ x?b

⊥

Figure 2. An example of typing (rule names and trailing 0 are omitted), where L′ = ((⊥) < νl < (⊤))L

P (ν ỹ)(x?z̃.P0 | P1 ) with x∈ / ỹ for some P0 , P1 SBarbs (P ) = SBarbsO (P ) ∪ SBarbsI (P )

Lemma 4.2 (Structural preorder preserves typing). If Γ k L ▷m P is l-securely derivable and P P 0 , then Γ k L ▷m P 0 is also l-securely derivable.

SBarbsI (P ) =

Proof. See Appendix D.2.

The following definition specifies reduction by internal communication on a secret channel (of level l0 ) that the attacker (of level l) cannot access (l0 6≤L l).

Definition 4.3 (Substitution on type environment). For a type environment Γ, variables x̃, and values ṽ with {x̃} ∩ {ṽ} = ∅, we define a type environment Γ[x̃ 7→ ṽ] as in Figure 3. Furthermore, we say that Γ[x̃ 7→ ṽ] is well-defined if Dom(Γ[x̃ 7→ ṽ]) = (Dom(Γ) \ {x̃}) ∪ {vi | xi ∈ Dom(Γ)}.

Definition 4.7 (Secret reduction). For a type environment Γ, the binary relation −→Γl is defined as the least relation satisfying the following rules: (1) (x!(v0 , . . . , vn ).P0 | x?(y0 , . . . , yn ).P1 , L) −→Γl (P0 | P1 [y0 7→ v0 , . . . , yn 7→ vn ], L), where the 0 0 secrecy level of Γ(x) is l with l 6≤L l (2) If l˜0 , l˜1 ⊆ L and l˜0 < νl < l˜1 L is defined, then l˜0 < νl < l˜1 P , L −→Γl P, l˜0 < νl < l˜1 L .

Lemma 4.4 (Substitution lemma). If Γ k L ▷m P is l-securely derivable and Γ[x̃ 7→ ṽ] is well-defined, then Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ] is also l-securely derivable. Proof. See Appendix D.3. Proposition 4.5 (Subject reduction). If Γ k L ▷m P is l-securely derivable and (P, L) −→ (P 0 , L0 ), then there exists Γ0 such that either Γ = Γ0 or Γ −→ Γ0 , and that Γ0 k L0 ▷m P 0 is l-securely derivable.

(3) If (P0 , L) −→Γl (P00 , L0 ), then (P0 | P1 , L) −→Γl (P00 | P1 , L0 ), Γ,x:ξ/U (4) If (P, L) −→l (P 0 , L0 ), then Γ 0 0 ((νx : ξ)P , L) −→l ((νx : ξ)P , L ), (5) If P0 P00 , (P00 , L0 ) −→Γl (P10 , L1 ), and P10 P1 , then (P0 , L0 ) −→Γl (P1 , L1 ). We write −→ →Γl for the reflexive and transitive closure of Γ −→l .

Proof. By induction on the derivation of (P, L) −→ (P 0 , L0 ). See Appendix D.4 for details. Note that the L0 above is always a superlattice of L—that is, L is a sublattice of L0 —as can be proved by simple induction according to Definition 2.7.

Note that the secret reduction (P0 , L0 ) −→Γl (P1 , L1 ) implies usual reduction (P0 , L0 ) −→ (P1 , L1 ).

4.2. Lock-freedom

Lemma 4.8. Suppose that Γ k L ▷m P and ∆ k L ▷m Q are k -securely derivable, Γ|∆ is reliable, Γ | ∆ k L is k secure, and obα (Γ(x)) is finite, where α = I or α = O. Then, there exist a process R and a lattice for secrecy Γ|∆ levels L̂ such that (P | Q, L) −→ →k R, L̂ and x ∈ SBarbsα (R).

Next, we prove the lock-freedom property, which, in short, guarantees that every input or output with finite (namely, not ∞) capability will eventually succeed and, as a result, such high-level synchronization can securely be performed even before low-level communication.6 Definition 4.6 (Strong barbs). Let P be a process. We define SBarbsO (P ), SBarbsI (P ), and SBarbs (P ) as: P (ν ỹ)(x!ṽ.P0 | P1 ) with SBarbsO (P ) = x x∈ / ỹ for some P0 , P1

Proof. See Section E.2. Definition 4.9 (Context). A context is defined as an expression obtained from a process by replacing a subprocess with [ ]. We write C [P ] for the process obtained by replacing [ ] in C with P .

6. Although we do not consider timing in the present paper, it can also be incorporated [24].

Γ[x̃ 7→ ṽ](w) =

  Γ(w)           Γ(xj0 ) | · · · | Γ(xjk )

if w ∈ / ṽ and w ∈ / x̃

         Γ(xj0 ) | · · · | Γ(xjk ) | Γ(w)   

if w ∈ ṽ and w ∈ / Dom(Γ) with {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ)} = {xj0 , . . . , xjk } for 0 ≤ j0 < · · · < jk ≤ n if w ∈ ṽ and w ∈ Dom(Γ) with {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ)} = {xj0 , . . . , xjk } for 0 ≤ j0 < · · · < jk ≤ n

Figure 3. Substitution on type environment

(1) (2) depth [ ] = depth [ ] =0 (1)

(2) There exists a k -constrained derivation tree of Γ k L ▷l F . We also define an k -finite level context in L with two holes as a context with two holes F satisfying the following conditions: (1) F is of the following forms:

(2)

if [ ] and [ ] do not occur in P depth(C0 | C1 ) = depth(C0 ) + depth(C1 ) depth(x!ṽ.C0 ) = depth(C0 ) + 1 depth(x?ỹ.C0 ) = depth(C0 ) + 1 depth(∗C0 ) = depth(C0 ) depth((νx : ξ)C0 ) = depth(C0 ) depth l˜0 < νl < l˜1 C0 = depth(C0 ) + 1 depth(P ) = 0

F ::= (F (1) | F (2) ) | (F (2) | F (1) ) | (P | F ) | (F | P ) | x!ṽ.F | x?ỹ.F | (νx : ξ)F | l˜0 < νl < l˜1 F (1)

| (P | F (1) ) | (F (1) | P ) | x!ṽ.F (1) | x?ỹ.F (1) | (νx : ξ)F (1) | l˜0 < νl < l˜1 F (1)

F (1) ::= [ ]

depth(if v then C0 else C1 ) = depth(C0 ) + depth(C1 )

(2)

| (P | F (2) ) | (F (2) | P ) | x!ṽ.F (2) | x?ỹ.F (2) | (νx : ξ)F (2) | l˜0 < νl < l˜1 F (2)

F (2) ::= [ ]

Figure 4. Depth of context

(2) There exists a k -constrained derivation tree of Γ k L ▷l F . Finally, we define an k -evaluation context (resp. with two holes) as a k -finite level context (resp. with two holes) of depth 0.

A context with two holes is defined as an expression obtained from a process by replacing just two sub(1) (2) (1) (2) processes with [ ] and [ ] . We write C [P0 ] [P1 ] (1) (2) for the process obtained by replacing [ ] and [ ] in C with P0 and P1 , respectively.

Lemma 4.12. Let D0 | D1 be a context with two holes (hence, Di is a process, a context, or a context with two holes for i = 0, 1). Suppose that Γ k L ▷l D0 and ∆ k L ▷l D1 are k -securely derivable from Γ0 k L0 ▷l0 (1) (2) [ ] and Γ1 k L1 ▷l1 [ ] , Γ | ∆ is reliable, Γ | ∆ k L is k -secure, and obα (Γ(x)) is finite, where α = I or α = O. Then, there exist a context with two holes C and alattice Γ|∆ for secrecy levels L̂ such that (D0 | D1 , L) −→ →k C, L̂ and x ∈ SBarbsα (C).

Definition 4.10 (Depth of context). For a context with two holes C , we inductively define the depth of C , written depth(C), as in Figure 4. We also define the depth of a context with one hole in the same manner. Definition 4.11 (k -constrained derivation tree, k -finite level context, k -evaluation context). For a context C (resp. with two holes), we define a k -constrained derivation tree of Γ k L ▷l C as a k -secure derivation tree of (1) Γ k L ▷l C from ∆ k L0 ▷l′ [ ] (resp. ∆1 k L01 ▷l1′ [ ] (2) and ∆2 k L02 ▷l2′ [ ] ) where l0 ≤L k or tc is finite in (1) every instance of (T-Out) or (T-In) if [ ] (resp. [ ] or (2) [ ] ) occurs in P . We then define an k -finite level context in L as a context F satisfying the following conditions: (1) F is of the following forms:

Proof. Similar to Lemma 4.8. Lemma 4.13. Let F be a k -finite level context with two holes, and Γ k L ▷l F be the root of a k -constrained derivation tree. If Γ is reliable, then there exist an evaluation context E and a lattice for secrecy levels L̂ such that (F, L) −→ →Γk E, L̂ .

F ::= [ ] | (P | F ) | (F | P ) | x!ṽ.F | x?ỹ.F | (νx : ξ)F | l˜0 < νl < l˜1 F

Proof. By induction on the depth of F . In case the depth of F is 0, we have the claimed result immediately.

Note that L0 v L if ∆ k L0 ▷m′ C is derivable from Γ k L ▷m [ ] .

Assume that F is of the form E0 [x!ṽ.C0 ] for an evaluation context E0 . Since Γ is reliable, obI (Γ(x)) ≤ capO (Γ(x)). Assume x is free. Since Γ k L ▷l F is the root of the k -constrained derivation tree of F , capO (Γ(x)) is finite. Hence, obI (Γ(x)) is finite. By Lemma 4.12, there exist Γ R and L̂ such that (E0 [x!ṽ.C0 ], L) −→ →k R, L̂ and x ∈ SBarbsI (R). Then (E0 [x!ṽ.F0 ], L) −→ →Γk E00 [F0 ], L̂0 for an evaluation context E00 . By the induction hypothesis, there exists an evaluation for context Eand a lattice secrecy levels L̂ such that E00 [C0 ], L̂0 −→ →Γk E, L̂ . Thus, (F, L) −→ →Γk E, L̂ In the case that x is not free, E0 [x!ṽ.F0 ] (νx)E00 [x!ṽ.F0 ] for a evaluation context E00 . Since there is a k -constrained derivation tree of Γ k L ▷l E0 [x!ṽ.F0 ], there is a k -constrained derivation tree of Γ k L ▷l (νx)E00 [x!ṽ.F0 ]. Hence, there is a k -constrained derivation tree of Γ0 , x : ξ/U k L ▷l E00 [x!ṽ.F0 ] with rel(U ). Therefore, we can show the claim in the same way to the case that x is free. In case F is of the form E [x?ỹ.F0 ], we can show the claim in the similar way to the h case F ≡ E[x!ṽ.F i 0 ]. ˜ ˜ In case F is of the form E l0 < νl < l1 F0 , we can show the claim easily.

Definition 4.17 (Barbed congruence). For processes P0 and P1 , we say that P0 and P1 are barbed (Γ k L, m)congruent, written P0 ≈ P1 , if (ΓkL,m)

(1) Γ k L ▷m Pi is derivable for i = 0, 1, and (2) for any closed ∆, lattice of secrecy levels L0 , secrecy level m0 , and any (Γ k L, m)-(∆ k L0 , m0 )-context C , • (C [P0 ], L0 ) ≈ (C [P1 ], L0 ). We say that the secrecy level of Γ k L is l if l is the supremum in L of all the secrecy levels that appear in Γ(x) for every channel name x ∈ Dom(Γ). Now, we state the non-interference theorems. Intuitively, they guarantee secrets—values of level l0 , or behavior of processes of level m0 —do not leak to attackers of level l or k . Theorem 4.18 (Non-interference (1)). For any type environment Γ, lattice of secrecy levels L, process P , and secrecy levels l, l0 , we have i h i h ′ l′ ≈ P x 7→ falsel P x 7→ true (ΓkL,m)

i ′ if Γ k L ▷m P x 7→ truel is k -securely derivable, the secrecy level of Γ k L is l, l0 6≤L l, and l0 6≤L k . h

4.3. Non-interference

Proof. It suﬀices to show that, for any closed ∆, 0 a lattice h hfor secrecy′ iilevels • L, handh a secrecy i level i l′ l 0 0 m , C P x 7→ true , L ≈ C P x 7→ false , L0 with any (Γ k L, m)-(∆ k L0 , m0 )-context C . We can construct a process Q, where h h ii • h h i i ′ • l′ , L0 ≈ (Q, L0 ) ≈ C P x 7→ falsel , L0 . C P x 7→ true

We will now show our main theorem: the noninterference property of well-typed processes. Definition 4.14 (Barbs). Let P be a process, and L be a lattice of secrecy levels. We define the barbs of (P, L), written Barbs(P, L), as:   (P, L) −→ → (P 0 , L0 ) and   x P 0 = (ν ỹ)x!ṽ.P0 | P1 or P 0 = (ν ỹ)x?z̃.P0 | P1   with x ∈ / ỹ for some P0 , P1

Hence, we have the claimed result. Q is obtained by eliminating with secrecy level higher than k h h channels′ ii l . See Section F.6 for details. from C P x 7→ true

Definition 4.15 (Barbed bisimulation). A barbed bisimulation is defined as a binary relation R on P × L satisfying the following conditions for every ((P0 , L0 ), (P1 , L1 )) ∈ R. (1) If (P0 , L0 ) −→ (P00 , L00 ), then there exists (P10 , L01 ) such that (P1 , L1 ) −→ → (P10 , L01 ) with 0 0 0 0 ((P0 , L0 ), (P1 , L1 )) ∈ R. (2) If (P1 , L1 ) −→ (P10 , L01 ), then there exists (P00 , L00 ) such that (P0 , L0 ) −→ → (P00 , L00 ) with 0 0 0 0 ((P0 , L0 ), (P1 , L1 )) ∈ R. (3) Barbs(P0 , L0 ) = Barbs(P1 , L1 )

Theorem 4.19 (Non-interference (2)). For any type environments Γ, ∆, lattices for secrecy levels L, L0 , processes P0 , P1 , and any (∆ k L0 , m0 )-(Γ k L, m)-context C , we have C [P0 ] ≈ C [P1 ] (ΓkL,m)

if ∆ k L ▷m′ Pi is k -securely derivable for i = 0, 1, the secrecy level of Γ k L is l, m0 6≤L l, and m0 6≤L k . Proof. Let Π be a closed type environment, and C be (Γ k L, m)-(Π k L0 , m00 )-context. We h i can • construct a context D, where C Ĉ[P0 ] , L ≈ h i • h i • h i D Ĉ[P0 ] , L ≈ D Ĉ[P1 ] , L ≈ C Ĉ[P1 ] , L . D is obtained by eliminating channels with secrecy level higher than k from C . See Section F.7 for details.

We say that (P0 , L0 ) and (P1 , L1 ) are barbed bisimi• lar, written (P0 , L0 ) ≈ (P1 , L1 ), if there exists a barbed bisimulation R such that ((P0 , L0 ), (P1 , L1 )) ∈ R. Definition 4.16. A context C is called an (Γ k L, m)(∆ k L0 , m0 )-context if ∆ k L0 ▷m′ C is derivable from Γ k L ▷m [ ] .

5. Conclusion

[12] K. G. Larsen and A. Skou, “Bisimulation through probabilistic testing,” Inf. Comput., vol. 94, no. 1, pp. 1–28, 1991. [Online]. Available: https://doi.org/10.1016/ 0890-5401(91)90030-6

We have defined π L -calculus, an extension of π calculus with secrecy types and an operation to extend the lattice of secrecy levels. Then, we have given a type system for secure information flow and shown the lockfreedom and non-interference properties. . Our system has extended previous work [6] with general lattices and its dynamic extensions, requiring deliberate definitions and proofs for sound generalization and safe extension of the security lattices. Future work would include further extending the calculus with polymorphism for secrecy levels so that processes can communicate and share the new levels they create, as well as considering other operations—such as deletion—to dynamically change the security lattice.

[13] G. Smith, “Probabilistic noninterference through weak probabilistic bisimulation,” in 16th IEEE Computer Security Foundations Workshop (CSFW-16 2003), 30 June - 2 July 2003, Pacific Grove, CA, USA. IEEE Computer Society, 2003, pp. 3–13. [Online]. Available: https://doi.org/10.1109/ CSFW.2003.1212701 [14] V. Castiglioni, R. Lanotte, and S. Tini, “Back to the format: A survey on SOS for probabilistic processes,” J. Log. Algebraic Methods Program., vol. 137, p. 100929, 2024. [Online]. Available: https://doi.org/10.1016/j.jlamp. 2023.100929 [15] T. Spork, C. Baier, J. Katoen, J. Piribauer, and T. Quatmann, “A spectrum of approximate probabilistic bisimulations,” in 35th International Conference on Concurrency Theory, CONCUR 2024, September 9-13, 2024, Calgary, Canada, ser. LIPIcs, R. Majumdar and A. Silva, Eds., vol. 311. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2024, pp. 37:1–37:19. [Online]. Available: https://doi.org/10.4230/LIPIcs.CONCUR.2024.37

References [1]

D. E. Denning, “A lattice model of secure information flow,” Commun. ACM, vol. 19, no. 5, pp. 236–243, 1976. [Online]. Available: https://doi.org/10.1145/360051.360056 [2] J. A. Goguen and J. Meseguer, “Security policies and security models,” in 1982 IEEE Symposium on Security and Privacy, Oakland, CA, USA, April 26-28, 1982. IEEE Computer Society, 1982, pp. 11–20. [Online]. Available: https://doi.org/10.1109/SP.1982.10014 [3] D. M. Volpano, C. E. Irvine, and G. Smith, “A sound type system for secure flow analysis,” J. Comput. Secur., vol. 4, no. 2/3, pp. 167–188, 1996. [Online]. Available: https://doi.org/10.3233/JCS-1996-42-304 [4] A. Sabelfeld and A. C. Myers, “Language-based informationflow security,” IEEE J. Sel. Areas Commun., vol. 21, no. 1, pp. 5–19, 2003. [Online]. Available: https://doi.org/10.1109/ JSAC.2002.806121 [5] N. Heintze and J. G. Riecke, “The slam calculus: Programming with secrecy and integrity,” in POPL ’98, Proceedings of the 25th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, San Diego, CA, USA, January 19-21, 1998, D. B. MacQueen and L. Cardelli, Eds. ACM, 1998, pp. 365–377. [Online]. Available: https://doi.org/10.1145/268946.268976 [6] N. Kobayashi, “Type-based information flow analysis for the pi-calculus,” Acta Informatica, vol. 42, no. 4-5, pp. 291–347, 2005. [Online]. Available: https://doi.org/10.1007/ s00236-005-0179-x [7] ——, “A type system for lock-free processes,” Inf. Comput., vol. 177, no. 2, pp. 122–159, 2002. [Online]. Available: https://doi.org/10.1006/inco.2002.3171 [8] R. Milner, Communicating and mobile systems - the Picalculus. Cambridge University Press, 1999. [9] R. Milner, J. Parrow, and D. Walker, “A calculus of mobile processes, I,” Inf. Comput., vol. 100, no. 1, pp. 1–40, 1992. [Online]. Available: https://doi.org/10.1016/0890-5401(92) 90008-4 [10] ——, “A calculus of mobile processes, II,” Inf. Comput., vol. 100, no. 1, pp. 41–77, 1992. [Online]. Available: https://doi.org/10.1016/0890-5401(92)90009-5 [11] R. Milner and D. Sangiorgi, “Barbed bisimulation,” in Automata, Languages and Programming, 19th International Colloquium, ICALP92, Vienna, Austria, July 13-17, 1992, Proceedings, ser. Lecture Notes in Computer Science, W. Kuich, Ed., vol. 623. Springer, 1992, pp. 685–695. [Online]. Available: https://doi.org/10.1007/3-540-55719-9_ 114

[16] R. J. van Glabbeek, “The linear time - branching time spectrum I,” in Handbook of Process Algebra, J. A. Bergstra, A. Ponse, and S. A. Smolka, Eds. NorthHolland / Elsevier, 2001, pp. 3–99. [Online]. Available: https://doi.org/10.1016/b978-044482830-9/50019-9 [17] ——, “The linear time - branching time spectrum II,” in CONCUR ’93, 4th International Conference on Concurrency Theory, Hildesheim, Germany, August 23-26, 1993, Proceedings, ser. Lecture Notes in Computer Science, E. Best, Ed., vol. 715. Springer, 1993, pp. 66–81. [Online]. Available: https://doi.org/10.1007/3-540-57208-2_6 [18] B. Finkbeiner and E. Olderog, “Concurrent hyperproperties,” in Theories of Programming and Formal Methods - Essays Dedicated to Jifeng He on the Occasion of His 80th Birthday, ser. Lecture Notes in Computer Science, J. P. Bowen, Q. Li, and Q. Xu, Eds., vol. 14080. Springer, 2023, pp. 211–231. [Online]. Available: https://doi.org/10.1007/ 978-3-031-40436-8_8 [19] nLab, “lattice,” https://ncatlab.org/nlab/show/lattice, as of July 2025. [20] P. T. Johnstone, Stone Spaces. Cambridge University Press, 1986. [21] E. Sumii and N. Kobayashi, “A generalized deadlockfree process calculus,” in 3rd International Workshop on High-Level Concurrent Languages, HLCL 1998, Satellite Workshop of CONCUR 1998, Nice, France, September 12, 1998, ser. Electronic Notes in Theoretical Computer Science, U. Nestmann and B. C. Pierce, Eds., vol. 16, no. 3. Elsevier, 1998, pp. 225–247. [Online]. Available: https://doi.org/10.1016/S1571-0661(04)00144-6 [22] J. Girard, “Linear logic,” Theor. Comput. Sci., vol. 50, pp. 1–102, 1987. [Online]. Available: https://doi.org/10.1016/ 0304-3975(87)90045-4 [23] D. Sangiorgi and D. Walker, The Pi-Calculus - a theory of mobile processes. Cambridge University Press, 2001. [24] N. Kobayashi, “Type systems for concurrent processes: From deadlock-freedom to livelock-freedom, time-boundedness,” in Theoretical Computer Science, Exploring New Frontiers of Theoretical Informatics, International Conference IFIP TCS 2000, Sendai, Japan, August 17-19, 2000, Proceedings, ser. Lecture Notes in Computer Science, J. van Leeuwen, O. Watanabe, M. Hagiya, P. D. Mosses, and T. Ito, Eds., vol. 1872. Springer, 2000, pp. 365–389. [Online]. Available: https://doi.org/10.1007/3-540-44929-9_27

Appendix A. Basic properties of π L -calculus Lemma A.1. For a lattice of secrecy levels L, assume that l˜0 < νl < l˜1 L is defined, and L v l˜0 < νl < l˜1 L. Let L0 = l˜0 < νl < l˜1 L. Then l˜0 < νl0 < l˜1 L0 is defined and L0 v l˜0 < νl0 < l˜1 L0 . Proof. Straightforward. Lemma A.2. For a lattice of secrecy levels L and l˜0 , l˜1 , l˜00 , l˜10 ⊆ L, assume that l˜0 < νl < l˜1 L and l˜00 < νl0 < l˜10 l˜0 < νl < l˜1 L are defined, and L v l˜0 < νl < l˜1 L and l˜0 < νl < l˜1 L v are del˜0 < νl < l˜1 l˜00 < νl0 < l˜10 L and Then l˜0 < νl0 < l˜10 L l˜00 < νl0 < l˜10 l˜0 < νl < l˜1 L. 0 l˜0 < νl < l˜1 l˜00 < νl0 < l˜10 L, and fined and L v l˜0 < νl0 < l˜10 L, l˜0 < νl0 < l˜10 L v 0 0 l˜00 < νl0 < l˜10 l˜0 < νl < l˜1 L = l˜0 < νl < l˜1 l˜00 < νl0 < l˜10 L. Proof. Straightforward. Proposition A.3. If P0 P00 and P1 P10 , then P0 | P1 P00 | P10 . Proof. Assume P0 P00 and P1 P10 . By (SP-Commut) and (SP-Par), we see P0 | P1 P00 | P1 P1 | P00 P10 | P00 P00 | P10

(SP-Par) (SP-Commut) (SP-Par) (SP-Commut).

Lemma A.4. P0 | (P1 | P2 ) (P0 | P1 ) | P2 . Proof. By (SP-Commut), (SP-Assoc) and (SP-Par), we see P0 | (P1 | P2 ) (P1 | P2 ) | P0 (P2 | P1 ) | P0 P2 | (P1 | P0 ) P2 | (P0 | P1 ) (P0 | P1 ) | P2

(SP-Commut) (SP-Commut) and (SP-Par) (SP-Assoc) (SP-Commut) and (SP-Par) (SP-Commut).

Lemma A.5. (1) If P0 P1 , then FN(P0 ) ⊇ FN(P1 ). (2) If P0 ≃ P1 , then FN(P0 ) = FN(P1 ). Proof. It suﬀices to show (1). We see (1) by induction on the construction of P0 P1 . Proposition A.6. If (P, L) −→ P̂ , L̂ , then either (1) P ν x̃ : ξ˜ z!ṽ.P0 | z?ỹ.P1 | P2 , ν x̃ : ξ˜ P0 | P1 [ỹ 7→ ṽ] | P2 P̂ and L̂ = L, or (2) P ν x̃ : ξ˜ l˜0 < νl < l˜1 P0 | P1 , ν x̃ : ξ˜ P0 | P1 P̂ and L̂ = l˜0 < νl < l˜1 L. Proof. By induction on the construction of (P, L) −→ P̂ , L̂ .

Appendix B. Basic properties of usages B.1. Propositions for usages Lemma B.1. Let U , U0 , and U1 be usages. Let α ∈ {I, O}. Let F be a partial mapping from usage variables to obligation levels. (1) If capα (U0 ) ≤ capα (U1 ), then capα (U [ρ 7→ U0 ]) ≤ capα (U [ρ 7→ U1 ]). (2) If capα (U0 ) = capα (U1 ), then capα (U [ρ 7→ U0 ]) = capα (U [ρ 7→ U1 ]). (3) If obα (U0 ) ≥ obα (U1 ), then obα (U [ρ 7→ U0 ]) ≥ obα (U [ρ 7→ U1 ]). (4) If obα (U0 ) = obα (U1 ), then obα (U [ρ 7→ U0 ]) = obα (U [ρ 7→ U1 ]). Proof. (1) By induction on the construction of U . (2) By induction on the construction of U . (3) By induction on the construction of U . (4) By induction on the construction of U . Lemma B.2. (1) If U0 U00 and U1 U10 , then U0 | U1 U00 | U10 . (2) U0 | (U1 | U2 ) (U0 | U1 ) | U2 . Proof. We show each clause. (1) Assume U0 U00 and U1 U10 . By (UP-Commut) and (UP-CongP), we see U0 | U1 U00 | U1 U1 | U00 U10 | U00 U00 | U10

(UP-CongP) (UP-Commut) (UP-CongP) (UP-Commut).

(2) By (UP-Commut), (UP-Assoc) and (UP-CongP), we see U0 | (U1 | U2 ) (U1 | U2 ) | U0 (U2 | U1 ) | U0 U2 | (U1 | U0 ) U2 | (U0 | U1 ) (U0 | U1 ) | U2

(UP-Commut) (UP-Commut) and (UP-CongP) (UP-Assoc) (UP-Commut) and (UP-CongP) (UP-Commut).

Lemma B.3. If U U 0 , then capα (U ) ≤ capα (U 0 ) and obα (U ) ≥ obα (U 0 ) for α ∈ {I, O} and a partial mapping F from usage variables to obligation levels. Proof. We show the claim by induction on the construction of U U 0 . We consider cases according to the clauses of the definition. Case 1. If U = U 0 , then we have the claimed result obviously. Case 2. Assume U U 00 and U 00 U 0 . By the induction hypothesis, capα (U ) ≤ capα (U 00 ), obα (U ) ≥ obα (U 00 ), capα (U 00 ) ≤ capα (U 0 ), and obα (U 00 ) ≥ obα (U 0 ). Then, we have capα (U ) ≤ capα (U 0 ) and obα (U ) ≥ obα (U 0 ). Case 3. (UP-Zero). Assume U = 0 | U1 and U 0 = U1 . Then capα (U ) = capα (0 | U1 ) = min(capα (0), capα (U1 )) = min(∞, capα (U1 )) = capα (U1 ) = capα (U 0 ) and obα (U ) = obα (0 | U1 ) = min(obα (0), obα (U1 )) = min(∞, obα (U1 )) = obα (U1 ) = obα (U 0 ). Case 4. (UP-Commut). Assume U = U1 | U2 and U 0 = U2 | U1 . Then capα (U ) = capα (U1 | U2 ) = min(capα (U1 ), capα (U2 )) = capα (U2 | U1 ) = capα (U 0 ) and obα (U ) = obα (U1 | U2 ) = min(obα (U1 ), obα (U2 )) = obα (U2 | U1 ) = obα (U 0 ).

Case 5. (UP-Assoc). Assume U = (U1 | U2 ) | U3 and U 0 = U1 | (U2 | U3 ). Then capα (U ) = capα ((U1 | U2 ) | U3 ) = min(capα (U1 | U2 ), capα (U3 )) = min(min(capα (U1 ), capα (U2 )), capα (U3 )) = min(capα (U1 ), capα (U2 ), capα (U3 )) = min(capα (U1 ), min(capα (U2 ), capα (U3 ))) = min(capα (capα (U1 ), U2 | U3 )) = capα (U1 | (U2 | U3 )) = capα (U 0 ) and obα (U ) = obα ((U1 | U2 ) | U3 ) = min(obα (U1 | U2 ), obα (U3 )) = min(obα (U1 ), obα (U2 ), obα (U3 )) = min(obα (U1 ), obα (U2 | U3 )) = obα (U1 | (U2 | U3 )) = obα (U 0 ). Case 6. (UP-CongP). Assume U1 U10 . We also assume U = U1 | U2 and U 0 = U10 | U2 . By the induction hypothesis, we have capα (U1 ) ≤ capα (U10 ) and obα (U1 ) ≥ obα (U10 ). Then capα (U ) = capα (U1 | U2 ) = min(capα (U1 ), capα (U2 )) ≤ min(capα (U10 ), capα (U2 )) = capα (U10 | U2 ) = capα (U 0 ) and obα (U ) = obα (U1 | U2 ) = min(obα (U1 ), obα (U2 )) ≥ min(obα (U10 ), obα (U2 )) = obα (U10 | U2 ) = obα (U 0 ). Case 7. (UP-Rep). Assume U = ∗U0 and U 0 = ∗U0 | U0 . Then capα (U 0 ) = capα (∗U0 | U0 ) = min(capα (∗U0 ), capα (U0 )) = capα (∗U0 ) = capα (U ) and obα (U 0 ) = obα (∗U0 | U0 ) = min(obα (∗U0 ), obα (U0 )) = obα (∗U0 ) = obα (U ). max(t ,t )

1 α Case 8. (UP-↑(∗,∗) ). Assume U = ↑(tI ,tO ) βtt21 .U0 and U 0 = βt2 .U0 . Assume β = α. capα (U ) = capα ↑(tI ,tO ) βtt21 .U0

= capα βtt21 .U0 = t2 max(t1 ,tα ) = capα βt2 .U0 = capα (U 0 )

and

obα (U ) = obα ↑(tI ,tO ) βtt21 .U0 = max tα , obα βtt21 .U0 = max(tα , t1 ) max(t1 ,tα ) = obα βt2 .U0 = obα (U 0 ).

Assume β = α.

capα (U ) = capα ↑(tI ,tO ) βtt21 .U0 = capα βtt21 .U0 =∞ max(t1 ,tα ) = capα βt2 .U0 = capα (U 0 )

and

obα (U ) = obα ↑(tI ,tO ) βtt21 .U0 = max tα , obα βtt21 .U0 = max(tα , ∞) max(t1 ,tα ) = obα βt2 .U0 = obα (U 0 ).

Case 9. (UP-Dist). Assume U = ↑(tI ,tO ) U1 | U2 and U 0 = ↑(tI ,tO ) U1 | ↑(tI ,tO ) U2 . Then capα (U ) = capα ↑(tI ,tO ) U1 | U2 = capα (U1 | U2 ) = min(capα (U1 ), capα (U2 )) = min capα ↑(tI ,tO ) U1 , capα ↑(tI ,tO ) U2 = capα ↑(tI ,tO ) U1 | ↑(tI ,tO ) U2 = capα (U 0 )

and

obα (U ) = obα ↑(tI ,tO ) U1 | U2 = max(tα , obα (U1 | U2 )) = max(tα , min(obα (U1 ), obα (U2 ))) ≥ min(max(tα , obα (U1 )), max(tα , obα (U2 ))) = min obα ↑(tI ,tO ) U1 , obα ↑(tI ,tO ) U2 = obα ↑(tI ,tO ) U1 | ↑(tI ,tO ) U2 = obα (U 0 ).

Case 10. (UP-Or). Fix i ∈ {1, 2}. Assume U = U1 & U2 and U 0 = Ui . Then capα (U ) = capα (U1 & U2 ) = min(capα (U1 ), capα (U2 )) ≤ capα (Ui ) = capα (U 0 ) and obα (U ) = obα (U1 & U2 ) = max(capα (U1 ), capα (U2 )) ≥ obα (Ui ) = obα (U 0 ). Case 11. (UP-Cong ↑(∗,∗) ). Assume U0 U00 , U = ↑(tI ,tO ) U0 , and U 0 = ↑(tI ,tO ) U00 . By the induction hypothesis, we have capα (U0 ) ≤ capα (U00 ) and obα (U0 ) ≥ obα (U00 ). Then capα (U ) = capα ↑(tI ,tO ) U0 = capα (U0 ) ≤ capα (U00 ) = capα ↑(tI ,tO ) U00 = capα (U 0 )

and

obα (U ) = obα ↑(tI ,tO ) U0 = max(tα , obα (U0 )) ≥ max(tα , obα (U00 )) = obα ↑(tI ,tO ) U00 = obα (U 0 ).

′ ′ ′ ′ Case 12. (UP-Commut ↑(∗,∗) ). Assume U = ↑(tI ,tO ) ↑(tI ,tO ) U0 and U 0 = ↑(tI ,tO ) ↑(tI ,tO ) U0 . Then ′ ′ capα (U ) = capα ↑(tI ,tO ) ↑(tI ,tO ) U0 ′ ′ = capα ↑(tI ,tO ) U0

= capα (U0 ) = capα ↑(tI ,tO ) U0 ′ ′ = capα ↑(tI ,tO ) ↑(tI ,tO ) U0 = capα (U 0 )

and

′ ′ obα (U ) = obα ↑(tI ,tO ) ↑(tI ,tO ) U0 ′ ′ = max tα , obα ↑(tI ,tO ) U0 = max(tα , max(t0α , obα (U0 ))) = max(t0α , max(tα , obα (U0 ))) = max t0α , obα ↑(tI ,tO ) U0 ′ ′ = obα ↑(tI ,tO ) ↑(tI ,tO ) U0

= obα (U 0 ).

B.2. Proof of Proposition 3.8 We show each claim. (1) Let U0 and U1 usages. Assume U0 <: U1 and conα (U0 ). By Definition 3.7 (c), we have capα (U0 ) ≤ capα (U1 ). By Definition 3.7 (d), we have obα (U0 ) ≥ obα (U1 ). By Definition 3.6, we have obα (U0 ) ≤ capα (U0 ). Then obα (U1 ) ≤ obα (U0 ) ≤ capα (U0 ) ≤ capα (U1 ). Thus, conα (U1 ). (2) Let U0 and U1 usages. Assume U0 <: U1 and rel(U0 ). Fix a usage U10 , where U1 −→ → U10 . By induction and Definition 3.7 (b), we see that there exists a usage U00 such that U0 −→ → U00 and U00 <: U10 . Since rel(U0 ), we have con (U00 ). By (1) in this proposition, we have con (U10 ). Thus, rel(U1 ). (3) Since it is obvious that the identity relation on closed usages satisfies all the conditions of Definition 3.7, we have the reflexivity of the subusage relation. We show the transitivity of the subusage relation. Let   U0 <: U1 , or   R = (U0 , U1 ) there exits U2 such that .   U0 <: U2 and U2 <: U1 It suﬀices to show that R satisfies all the conditions of Definition 3.7. Assume (U0 , U1 ) ∈ R. Then, either U0 <: U1 , or there exits U2 such that U0 <: U2 and U2 <: U1 . If U0 <: U1 , then all the conditions of Definition 3.7 hold by Definition 3.7. Assume U0 <: U2 and U2 <: U1 . (a) Fix a usage U , where FV(U ) = {ρ}. By Definition 3.7 (a), we have U [ρ 7→ U0 ] <: U [ρ 7→ U2 ] and U [ρ 7→ U2 ] <: U [ρ 7→ U1 ]. Then, we have (U [ρ 7→ U0 ], U [ρ 7→ U1 ]) ∈ R. (b) Assume U1 −→ U10 . By Definition 3.7 (b), there exists U20 such that U2 −→ U20 and U20 <: U10 . By Definition 3.7 (b), there exists U00 such that U0 −→ U00 and U00 <: U20 . Then, we see that there exists U00 such that U0 −→ U00 and (U00 , U10 ) ∈ R. (c) By Definition 3.7 (c), we have capα (U0 ) ≤ capα (U2 ) and capα (U2 ) ≤ capα (U1 ), for each α ∈ {I, O}. Then, we have capα (U0 ) ≤ capα (U1 ), for each α ∈ {I, O}. (d) Fix α ∈ {I, O}. Assume conα (U0 ). By Proposition 3.8 (1), we have conα (U2 ). Then, by Definition 3.7 (d), we have obα (U0 ) ≥ obα (U2 ) and obα (U2 ) ≥ obα (U1 ). Thus, obα (U0 ) ≥ obα (U1 ).

B.3. Property of subusages Proposition B.4. (1) For closed usages U and U 0 , if U U 0 , then U <: U 0 . (2) For closed usages U , if ob (U ) = ∞, U <: 0. (3) For closed usages U and U 0 , if ob (U ) = ∞, then U | U 0 <: U 0 . (4) Let U0 and U1 be closed usages. Then (∗U0 | ∗U1 ) <: ∗(U0 | U1 ). (5) Let U0 , . . . , Un be closed usages. Then (∗U0 | · · · | ∗Un ) <: ∗(U0 | · · · | Un ). (6) For usages U0 , U1 , U00 , and U10 , if U0 <: U00 and U1 <: U10 , then U0 | U1 <: U00 | U10 . (7 ) ↑(to ,tc ) U <: U for a usage U and to , tc ∈ N ∪ {∞}. (8) ↑ U <: U for a usage U . Proof. We show each claim of Proposition B.4. (1) For closed usages U and U 0 with U U 0 , let (U,U ′ )

= {(U0 [ρ 7→ U ], U0 [ρ 7→ U 0 ]) | U0 is a usage with FV(U0 ) ⊆ {ρ}}. (U,U ′ )

It suﬀices to show that R1 satisfies all the conditions of Definition 3.7. (U,U ′ ) 0 Fix closed usages U and U with U U 0 . Assume (U0 [ρ 7→ U ], U0 [ρ 7→ U 0 ]) ∈ R1 . (a) Let U00 be a usage with FV(U00 ) = {ρ0 }. Since FV(U0 ) ⊆ {ρ} and FV(U00 ) = {ρ0 }, we have U00 [ρ0 7→ (U0 [ρ 7→ U ])] = (U00 [ρ0 7→ U0 ])[ρ 7→ U ] and U00 [ρ0 7→ (U0 [ρ 7→ U 0 ])] = (U00 [ρ0 7→ U0 ])[ρ 7→ U 0 ]. Hence, (U,U ′ ) (U00 [ρ0 7→ (U0 [ρ 7→ U ])], U00 [ρ0 7→ (U0 [ρ 7→ U 0 ])]) ∈ R1 . ′ (U,U ) (U,U ′ ) 0 (b) To show that R1 satisfies Definition 3.7 (b), we show that if (U0 [ρ 7→ U , and ], U0 [ρ 7→ U ]) ′ ∈ R1 (U,U ) 0 U0 [ρ 7→ U ] V̂ , then there exists a closed usage V̌ such that U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 .

(U,U ′ )

Assume (U0 [ρ 7→ U ], U0 [ρ 7→ U 0 ]) ∈ R1 and U0 [ρ 7→ U 0 ] V̂ . We show that there exists a closed usage V̌ ′ (U,U ) such that U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 . The proof is by induction on the construction of U0 [ρ 7→ U ] V̂ . 0 0 0 0 Assume U0 = ρ. Then, we have U0 [ρ 7→ U ] =′ U . Since U U and U V̂ , we have U V̂ . Let V̌ = V̂ . Then, (U,U ) we see that U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 if V̌ = V̂ .

We consider other cases according to the last rule of the construction of U0 [ρ 7→ U ] V̂. (U,U ′ ) Case 1. Assume V̂ = U0 [ρ 7→ U 0 ]. Let V̌ = U0 [ρ 7→ U ]. Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 . Case 2. Assume that there exists V̂ 0 such that U0 [ρ 7→ U0 ] V̂0 and V̂ 0 V̂ . By the induction hypothesis, there (U,U ′ ) (U,U ′ ) exists a closed usage V̌ 0 such that U0 [ρ 7→ U ] V̌ 0 and V̌ 0 , V̂ 0 ∈ R1 . Since V̌ 0 , V̂ 0 ∈ R1 and V̂ 0 V̂ , (U,U ′ ) the induction hypothesis implies that there exists a closed usage V̌ such that V̌ 0 V̌ and V̌ , V̂ ∈ R1 . Since U0 [ρ 7→ U ] V̌ 0 , we have U0 [ρ 7→ U ] V̌ . Case3. (UP-Zero). Assume U0 = 0 | U1 and V̂ = U1 [ρ 7→ U 0 ]. Let V̌ = U1 [ρ 7→ U ]. Then, we have U0 [ρ 7→ U ] V̌ (U,U ′ ) . and V̌ , V̂ ∈ R1

Assume U0 = (U1 | U2 ) | U3 and V̂ = U1 [ρ 7→ U 0 ] | (U2 [ρ 7→ U 0 ] | U3 [ρ 7→ U 0 ]). Let (U,U ′ ) . V̌ = U1 [ρ 7→ U ] | (U2 [ρ 7→ U ] | U3 [ρ 7→ U ]). Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 Case 6. (UP-CongP). Assume U0 = U1 | U2 , U1 [ρ 7→ U 0 ] V̂1 , and V̂ = V̂1 | U2 [ρ 7→ U 0 ]. Then, we have (U,U ′ ) (U1 [ρ 7→ U ],U1 [ρ 7→ U 0 ]) ∈ R1 . By hypothesis, there exists a usage V̌1 such that U1 [ρ 7→ U ] V̌1 the induction ′ (U,U ) (U,U ′ ) and V̌1 , V̂1 ∈ R1 . Since V̌1 , V̂1 ∈ R1 , there exists a usage U10 such that FV(U10 ) ⊆ {ρ}, V̌1 = U10 [ρ 7→ U ], (U,U ′ ) . By (UP-CongP) and and V̂1 = U10 [ρ 7→ U 0 ]. Let V̌ = U10 [ρ 7→ U ] | U2 [ρ 7→ U ]. Then, we have V̌ , V̂ ∈ R1 transitivity, we see U1 [ρ 7→ U ] | U2 [ρ 7→ U ] U10 [ρ 7→ U ] | U2 [ρ 7→ U ]. 0 0 0 Case 7. (UP-Rep). Assume U0 = ∗U 1 and V̂ ′ = ∗U1 [ρ 7→ U ] | U1 [ρ 7→ U ]. Let V̌ = ∗U1 [ρ 7→ U ] | U1 [ρ 7→ U ]. Then, (U,U ) . we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1

max(t ,t )

Case 8. (UP-↑(∗,∗) ). Assume U0 = ↑(tI ,tO ) ρ, U 0 = αtt21 .U1 , and V̂ = αt2 1 α .U1 . Since U U 0 , we have either ′ ′ t′ U = U 0 or U = ↑(tI ,tO ) αt21 .U1 with t1 = max(t01 , t0α ). (U,U ′ ) Assume U = U 0 . Let V̌ = V̂ . Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 . ′ t′I ,t′O ) t1 (∗,∗) ( 0 0 Assume U = ↑ ) and transitivity, we have α .U with t = max(t , t ). By (UP-Cong ↑ t2

↑(tI ,tO ) ↑(

t′I ,t′O

) αt′1 .U ↑(tI ,tO ) αt1 .U αmax(t1 ,tα ) .U . 1 1 1 t2 t2 t2

(U,U ′ ) Let V̌ = V̂ . Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 . max(t1 ,tα )

Assume U0 = ↑(tI ,tO ) αtt21 .U1 and V̂ = αt2 (U,U ′ ) U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 .

max(t1 ,tα )

. U1 [ρ 7→ U 0 ]. Let V̌ = αt2

. U1 [ρ 7→ U ]. Then, we have

Case 9. (UP-Dist). Assume U0 = ↑(tI ,tO ) ρ, U 0 = U1 | U2 , and V̂ = ↑(tI ,tO ) U1 | ↑(tI ,tO ) U2 . By (UP-Cong ↑(∗,∗) ) and transitivity, ↑(tI ,tO ) U ↑(tI ,tO ) U 0 ↑(tI ,tO ) U1 | ↑(tI ,tO ) U2 . (U,U ′ ) Let V̌ = V̂ . Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 . (tI ,tO ) 0 Assume U0 = ↑(tI ,tO ) U1 | U2 and V̂ = ↑(tI ,tO ) U1[ρ 7→ U U2 [ρ 7→ U 0 ]. Let V̌ = ↑(tI ,tO ) U1 [ρ 7→ U ] | ]|↑ ′ (U,U ) ↑(tI ,tO ) U2 [ρ 7→ U ]. Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 .

Case 10. (UP-Or). Fix U0 = U1 & U2 and V̂ = Ui [ρ 7→ U 0 ]. Let V̌ = Ui [ρ 7→ U ]. Then, we have i ∈ {1, 2}. Assume (U,U ′ ) U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 . Case 11. (UP-Cong ↑(∗,∗) ). Assume U0 = ↑(tI ,tO ) ρ, U 0 U 00 , and V̂ = ↑(tI ,tO ) U 00 . By (UP-Cong ↑(∗,∗) ) and transitivity, we have ↑(tI ,tO ) U ↑(tI ,tO ) U 0 ↑(tI ,tO ) U 00 . (tI ,tO ) 0 Assume U0 = ↑(tI ,tO ) U1 , U1 [ρ 7→ V̂1 . By the induction hypothesis, there exists a usage U ] V̂1 , and V̂′ = ↑ (U,U ) V̌1 such that U1 [ρ 7→ U ] V̌1 and V̌1 , V̂1 ∈ R1 . By (UP-Cong ↑(∗,∗) ), we have

↑(tI ,tO ) U1 [ρ 7→ U ] ↑(tI ,tO ) V̌1 . (U,U ′ ) . Let V̌ = ↑(tI ,tO ) V̌1 . Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 ′ ′ (∗,∗) (tI ,tO ) t′I ,t′O ) ( 0 U1 , and V̂ = ↑(tI ,tO ) ↑(tI ,tO ) U1 . Let V̌ = V̂ . Case 12. ↑ ). Assume U0 = ↑ ρ, U = ↑ (UP-Commut (U,U ′ ) . By (UP-Cong ↑(∗,∗) ), we have Then V̌ , V̂ ∈ R1 ′

′

U0 [ρ 7→ U ] = ↑(tI ,tO ) U ↑(tI ,tO ) U 0 ↑(tI ,tO ) ↑(tI ,tO ) U1 = V̌ .

Hence, U0 [ρ 7→ U ] V̌ . ′ ′ ′ ′ ′ ′ Assume U0 = ↑(tI ,tO ) ↑(tI ,tO ) U1and V̂ = ↑(tI ,tO ) ↑(tI ,tO ) U1 [ρ 7→ U 0 ]. Let V̌ = ↑(tI ,tO ) ↑(tI ,tO ) U1 [ρ 7→ U ]. Then, ′ (U,U ) . we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 (U,U ′ )

Now, we show that if (U0 [ρ 7→ U ], U0 [ρ 7→ U 0 ]) ∈ R1 and there exists aclosed usage V̂ such that (U,U ′ ) . U0 [ρ 7→ U 0 ] −→ V̂ , then there exists a usage V̌ such that U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R1 (U,U ′ )

Assume (U0 [ρ 7→ U ], U0 [ρ7→ U 0 ]) ∈ R1 and U0 [ρ 7→ U 0 ] −→ V̂ . We show that there exists a usage V̌ such that (U,U ′ ) U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R1 . We show the claim by induction on the construction of U0 [ρ 7→ U 0 ] −→ V̂ . Assume U0 = ρ. Then, we have U0 [ρ 7→ U 0 ] = U 0 and U0 [ρ 7→ U ] = U . Then, we see U U 0 −→ V̂ (U,U ′ ) Let V̌ = V̂ . Then, we see that U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R1 if V̌ = V̂ .

We consider other cases according to the last rule of the construction of U0 [ρ 7→ U 0 ] −→ V̂ . t′ Case 1. Assume U0 = ρ | Ot′co .U2 , U 0 = Ittco .U1 , and V̂ = U1 | U2 [ρ 7→ U 0 ]. ′′ ′′ 00 Since U U 0 , we have either U = U 0 or U = ↑(tI ,tO ) Ittc1 .U1 with to= max (t1 , tI ). ′ (U,U ) Assume U = U 0 . Let V̌ = V̂ . Then, we have U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R1 . ′′ ′′ Assume U = ↑(tI ,tO ) I t1 .U with t = max(t , t00 ). By (UP-↑(∗,∗) ), we have tc

) I t1 .U | O .U [ρ 7→ U ] I to .U | Ot′′o .U [ρ 7→ U ] −→ U | U [ρ 7→ U ]. 1 2 1 2 1 2 tc tc tc ′ (U,U ) Let V̌ = U1 | U2 [ρ 7→ U ]. Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 . ↑(

t′o t′c

′′ t′′ I ,tO

t′

Assume U0 = Ittco .U1 | ρ, U 0 = Ot′co .U2 , and V̂ = U1 [ρ 7→ U 0 ] | U2 . ′′ ′′ Since U U 0 , we have either U = U 0 or U = ↑(tI ,tO ) Ott′c1 .U1 with t0o = max(t1 , t00O ). (U,U ′ ) Assume U = U 0 . Let V̌ = V̂ . Then, we have U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R1 . ′′ t′′ ,t (∗,∗) t ( ) 0 00 1 Assume U = ↑ I O O ′ .U with t = max(t , t ). By (UP-Commut) and (UP-↑ ), we have tc

Ittco .U1 [ρ 7→ U ] | ↑(

′′ t′′ I ,tO

) Ot′1 .U ↑(t′′I ,t′′O ) Ot′1 .U | I to .U [ρ 7→ U ] 2 2 1 tc tc tc t′

Ot′co .U2 | Ittco .U1 [ρ 7→ U ] t′

Ittco .U1 [ρ 7→ U ] | Ot′co .U2 −→ U1 [ρ 7→ U ] | U2 . (U,U ′ ) Let V̌ = U1 [ρ 7→ U ] | U2 . Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R1 .

t′

Assume U0 = Ittco .U1 | Ot′co .U2 and V̂ = U1 [ρ 7→ U 0 ] | U2 [ρ 7→ U 0 ]. Let V̌ = U1 [ρ 7→ U ] | U2 [ρ 7→ U ]. Then, we have (U,U ′ ) U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R1 . Case 2. Assume U0 = U1 | U2 , U1 [ρ 7→ U 0 ] −→V̂1 , and V̂ = V̂1 | U2 [ρ 7→ U 0 ]. By the induction hypothesis, there exists (U,U ′ ) (U,U ′ ) a usage V̌1 such that U1 [ρ 7→ U ] −→ V̌1 and V̌1 , V̂1 ∈ R1 . Let V̌ = V̌1 | U2 [ρ 7→ U ]. Since V̌1 , V̂1 ∈ R1 , there exists a usage U10 such that FV(U10 ) ⊆ {ρ}, V̌1 = U10 [ρ 7→ U ], and V̂1 = U10 [ρ 7→ U 0 ]. Hence, we see V̌′ = (U,U ) U10 [ρ 7→ U ] | U2 [ρ 7→ U ] and V̂ = U10 [ρ 7→ U 0 ] | U2 [ρ 7→ U 0 ]. Then, we have U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R1 . Case 3. Assume that there exist usages V̂1 and V̂2 such that U0 [ρ 7→ U 0 ] V̂1 , V̂1 −→ V̂2 , and V̂2 V̂ . Since (U,U ′ ) (U0 [ρ7→ U ],U0 [ρ 7→ U 0 ]) ∈ R1 and U0 [ρ 7→ U 0 ] V̂1 , there exists a closed usage V̌1 such that U0 [ρ 7→ U ] V̌1 ′ (U,U ) and V̌1 , V̂1 ∈ R1 . By the induction hypothesis, there exists a closed usage V̌2 such that V̌1 −→ V̌2 and (U,U ′ ) (U,U ′ ) and V̂2 V̂ , there exists a closed usage V̌ such that V̌2 V̌ and . Since V̌2 , V̂2 ∈ R1 V̌2 , V̂2 ∈ R1 (U,U ′ ) . Since U0 [ρ 7→ U ] V̌1 , V̌1 −→ V̌2 , and V̌2 V̌ , we have U0 [ρ 7→ U ] −→ V̌ . V̌ , V̂ ∈ R1 (c) By Lemma B.1 (1) and Lemma B.3. (d) By Lemma B.1 (3) and Lemma B.3. (2) For a closed usage U with ob (U ) = ∞, let (U )

= {(U0 [ρ 7→ U ], U0 [ρ 7→ 0]) | U0 is a usage with FV(U0 ) = {ρ}}. (U )

It suﬀices to show that R2 satisfies all the conditions of Definition 3.7. Fix a usage U0 with FV(U0 ) ⊆ {ρ}. Fix a closed usage U with ob (U ) = ∞. Assume (U ) (U0 [ρ 7→ U ], U0 [ρ 7→ 0]) ∈ R2 . 0 (a) Let U be a usage with FV(U 0 ) = {ρ0 }. Since FV(U0 ) ⊆ {ρ} and FV(U 0 ) = {ρ0 }, we have U 0 [ρ0 7→ (U0 [ρ 7→ U ])] = (U 0 [ρ0 7→ U0 ])[ρ 7→ U ] and U 0 [ρ0 7→ (U0 [ρ 7→ 0])] = (U 0 [ρ0 7→ U0 ])[ρ 7→ 0]. Hence, (U ) (U 0 [ρ0 7→ (U0 [ρ 7→ U ])], U 0 [ρ0 7→ (U0 [ρ 7→ 0])]) ∈ R2 . (U ) (U ) (b) To show that R2 satisfies Definition 3.7 (b), if (U0 [ρ 7→ U ], U0 [ρ 7→ 0]) ∈ R2 and U0 [ρ 7→ 0] V̂ , then there (U ) exists V̌ such that U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R2 . (U )

Assume (U0 [ρ 7→ U ], U 0]) ∈ R2 and U0 [ρ 7→ 0] V̂ . We show that there exists a closed usage V̌ such 0 [ρ 7→ (U ) that U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R2 . The proof is by the induction on the construction of U0 [ρ 7→ 0] V̂ . We consider cases according to the last rule of the construction. (U ) Case 1. Assume V̂ = U0 [ρ 7→ 0]. Let V̌ = U0 [ρ 7→ U ]. Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R2 . Case 2. Assume U0 [ρ 7→ 0] V 0 and V 0 V̂ . By the induction hypothesis, there exists a closed usage V̌ 0 such that (U ) (U ) U0 [ρ 7→ U ] V̌ 0 and V̌ 0 , V 0 ∈ R2 . Since V̌ 0 , V 0 ∈ R2 and V 0 V̂ , the induction hypothesis implies that (U ) there exists a closed usage V̌ such that V̌ 0 V̌ and V̌ , V̂ ∈ R2 . Since U0 [ρ 7→ U ] V̌ 0 and V̌ 0 V̌ , we have U0 [ρ 7→ U ] V̌ . Case3. (UP-Zero). Assume U0 = 0 | U1 and V̂ = U1 [ρ 7→ 0]. Let V̌ = U1 [ρ 7→ U ]. Then, we have U0 [ρ 7→ U ] V̌ (U ) and V̌ , V̂ ∈ R2 .

Case 6. (UP-CongP). Assume U0 = U1 | U2 , U1 [ρ 7→ 0] V̂1 , and V̂ = V̂1 | U2 [ρ 7→ 0]. By theinduction hypothesis, (U ) (U ) there exists a closed usage V̌1 such that U1 [ρ 7→ U ] V̌1 and V̌1 , V̂1 ∈ R2 . Since V̌1 , V̂1 ∈ R2 , there exists (U ) Ǔ0 such that V̌1 = Ǔ1 [ρ 7→ U ] and V̂1 = Ǔ1 [ρ 7→ 0]. Let V̌ = Ǔ1 [ρ 7→ U ] | U2 [ρ 7→ U ]. Then, we have V̌ , V̂ ∈ R2 . By (UP-CongP), we have U1 [ρ 7→ U ] | U2 [ρ 7→ U ] Ǔ1 [ρ 7→ U ] | U2 [ρ 7→ U ]. Case 7. (UP-Rep). Assume U0 = ∗U1 and V̂ = ∗U1 [ρ 7→ 0] | U1 [ρ 7→ 0]. Let V̌ = ∗U1 [ρ 7→ U ] | U1 [ρ 7→ U ]. Then, we (U ) have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R2 . max(t1 ,tα )

) t1 Case 8. (UP-↑(∗,∗) ). Assume U0 = ↑(tI ,tO αt2 .U1 and V̂ = αt2 (U ) Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R2 .

max(t1 ,tα )

. U1 [ρ 7→ 0]. Let V̌ = αt2

. U1 [ρ 7→ U ].

(tI ,tO ) Case 9. (UP-Dist). Assume U0 = ↑(tI ,tO ) U1 | U2 and V̂ = ↑(tI ,tO )U1 [ρ 7→ U2 [ρ 7→ 0]. Let V̌ 0] | ↑ (U ) (tI ,tO ) (tI ,tO ) ↑ U1 [ρ 7→ U ] | ↑ U2 [ρ 7→ U ]. Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R2 .

Case 10. (UP-Or). Fix i ∈ {1, 2}. Assume U0 = U1 & U2 and V̂ = Ui [ρ 7→ 0]. Let V̌ = Ui [ρ 7→ U ]. Then, we have (U ) U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R2 . Case 11. (UP-Cong ↑(∗,∗) ). Assume U0 = ↑(tI ,tO ) U1 , U1 [ρ 7→ 0] V̂1 , and V̂ = ↑(tI ,tO ) V̂1 . By the induction (U ) (U ) hypothesis, there exists a closed usage V̌1 such that U1 [ρ 7→ U ] V̌1 and V̌1 , V̂1 ∈ R2 . Since V̌1 , V̂1 ∈ R2 , there exists Ǔ0 such that V̌1 = Ǔ1 [ρ 7→ U ] and V̂1 = Ǔ1 [ρ 7→ 0]. Let V̌ = ↑(tI ,tO ) Ǔ1 [ρ 7→ U ]. Then, we have V̌ , V̂ ∈ (U )

R2 . By (UP-Cong ↑(∗,∗) ), we have ↑(tI ,tO ) U1 [ρ 7→ U ] ↑(tI ,tO ) Ǔ1 [ρ 7→ U ]. ′ ′ ′ ′ Case 12. (UP-Commut ↑(∗,∗) ). Assume U0 = ↑(tI ,tO ) ↑(tI ,tO) U1 and V̂ = ↑(tI ,tO ) ↑(tI ,tO ) U1 [ρ 7→ 0]. Let V̌ = ′ ′ (U ) ↑(tI ,tO ) ↑(tI ,tO ) U1 [ρ 7→ U ]. Then, we have U0 [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R2 . (U )

Now, we show that if (U0 [ρ 7→ U ], U0 [ρ 7→ 0]) ∈ R2 (U ) U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R2 .

and U0 [ρ 7→ 0] −→ V̂ , then there exists V̌ such that

(U )

Assume (U0 [ρ 7→ U ], U0 [ρ 7→ 0]) ∈ R2 and U0 [ρ 7→ 0] −→ V̂ . We show that there exists a closed usage V̌ such (U ) that U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R2 . The proof is by the induction on the construction of U0 [ρ 7→ 0] −→ V̂ . We consider cases according to the last rule of the construction. t′o to Case 1. Assume U0 = Itc .U1 | Ot′c .U2 and V̂ = U1 [ρ 7→ 0] | U2 [ρ 7→ 0]. Let V̌ = U1 [ρ 7→ U ] | U2 [ρ 7→ U ]. Then, we (U ) have U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R2 . Case 2. Assume U0 = U1 | U2 , U1 [ρ 7→ 0] −→ [ρ 7→ 0]. By the induction hypothesis, there exists V̌1 V̂1 , and V̂ =V̂1 | U2 (U ) (U ) such that U1 [ρ 7→ U ] −→ V̌1 and V̌1 , V̂1 ∈ R2 . Since V̌1 , V̂1 ∈ R2 , there exists Ǔ1 such that V̌1 = Ǔ1 [ρ 7→ U ] (U ) and V̂1 = Ǔ1 [ρ 7→ 0]. Let V̌ = Ǔ1 [ρ 7→ U ] | U2 [ρ 7→ U ]. Then, we have U0 [ρ 7→ U ] −→ V̌ and V̌ , V̂ ∈ R2 . Case 3. Assume there exists usages V1 and V2 such that U0 [ρ 7→ 0] V1 , V1 −→V2 , and V2 V̂ . Since U0 [ρ 7→ 0] V1 , (U ) (U ) there exists V̌1 such that U1 [ρ 7→ U ] V̌1 and V̌1 , V1 ∈ R2 . Since V̌1 , V1 ∈ R2 and V1 −→ V2 , the induction (U ) hypothesis implies that there exists V̌2 such that V̌1 −→ V̌2 and V̌2 , V2 ∈ R2 . Since V2 V̂ , there exists V̌ such (U ) that V̌2 V̌ and V̌ , V̂ ∈ R2 . Since U1 [ρ 7→ U ] V̌1 , V̌1 −→ V̌2 , and V̌2 V̌ , we have U1 [ρ 7→ U ] −→ V̌ . (c) Let α ∈ {I, O}. Then, we have capα (U ) ≤ ∞ = capα (0). By Lemma B.1 (1), we see capα (U0 [ρ 7→ U ]) ≤ capα (U0 [ρ 7→ 0]). (d) Let α ∈ {I, O}. By assumption, obα (U ) = ∞. Then obα (U ) = ∞ = obα (0). By Lemma B.1 (4), we have obα (U0 [ρ 7→ U ]) = obα (U0 [ρ 7→ 0]). Thus, obα (U0 [ρ 7→ U ]) ≥ obα (U0 [ρ 7→ 0]). (3) For closed usages U and U 0 , assume ob (U ) = ∞. By this proposition (2), we have U <: 0. From Definition 3.7 (a), we see U | U 0 <: 0 | U 0 . By (UP-Zero), 0 | U 0 U 0 . By this proposition (1), we have 0 | U 0 <: U 0 . By Proposition 3.8 (3), we have U | U 0 <: U 0 . (4) For closed usages U0 , U1 , let (U ,U1 )

R4 0

= {(U [ρ 7→ ∗U0 | ∗U1 ], U [ρ 7→ ∗(U0 | U1 )]) | U is a usage with FV(U ) ⊆ {ρ}}. (U ,U )

It suﬀices to show that R4 0 1 satisfies all the conditions of Definition 3.7. Fix closed usages U0 , U1 . Fix a usage U with FV(U ) ⊆ {ρ}. Assume (U ,U1 )

(U [ρ 7→ (∗U0 | ∗U1 )], U [ρ 7→ ∗(U0 | U1 )]) ∈ R4 0

Let W0 = ∗U0 | ∗U1 and W1 = ∗(U0 | U1 ). (a) Let U 0 , where FV(U 0 ) = {ρ0 }. Since FV(U ) = {ρ} and FV(U 0 ) = {ρ0 }, we 0 0 0 0 0 0 0 0 U [ρ 7→ (U [ρ 7→ W0 ])] = (U [ρ 7→ U ])[ρ 7→ W0 ] and U [ρ 7→ (U [ρ 7→ W1 ])] = (U [ρ 7→ U ])[ρ 7→ W1 ]. Hence, (U 0 [ρ0 7→ (U [ρ 7→ (∗U0 | ∗U1 )])], U 0 [ρ0 7→ (U [ρ 7→ ∗U0 | U1 ])]) ∈ R4 0

(U ,U1 )

have

(U ,U ) R4 0 1 (U ,U ) ∈ R4 0 1

(b) To show that satisfies the condition Definition 3.7 (b), we show that if (U [ρ 7→ W0 ], U [ρ 7→ W1 ]) and there exists a usage V̂ such that U [ρ 7→ W1 ] V̂ , then there exists (U ,U ) V̌ such that U [ρ 7→ W0 ] V̌ and V̌ , V̂ ∈ R4 0 1 . Assume U [ρ 7→ W1 ] V̂ . The proof is by induction on the construction of V [ρ 7→ W1 ] V̂ . We consider cases according to the last rule of the construction.

(U ,U ) Case 1. Assume V̂ = U [ρ 7→ W1 ]. Let V̌ = U [ρ 7→ W0 ]. Then, we have U [ρ 7→ W0 ] V̌ and V̌ , V̂ ∈ R4 0 1 . 0 0 0 Case 2. Assume U [ρ 7→ W1 ] V̂ and V̂ V̂ . By the induction hypothesis, then there exists V̌ such that (U0 ,U1 ) (U ,U ) . Since V̌ 0 , V̂ 0 ∈ R4 0 1 and V̂ 0 V̂ , induction implies that there U [ρ 7→ W0 ] V̌ 0 and V̌ 0 , V̂ 0 ∈ R4 (U ,U ) exists V̌ such that V̌ 0 V̌ and V̌ , V̂ ∈ R4 0 1 . Since U [ρ 7→ W0 ] V̌ 0 and V̌ 0 V̌ , we have U [ρ 7→ W0 ] V̌ .

Case3. (UP-Zero). Assume U = 0 | U 0 and V̂ = U 0 [ρ 7→ W1 ]. Let V̌ = U 0 [ρ 7→ W0 ]. Then, we have U [ρ 7→ W0 ] V̌ (U0 ,U1 ) and V̌ , V̂ ∈ R4 . Case 4. (UP-Commut). Assume U =U00 | U10 and V̂ = U10 [ρ 7→ W1 ] | U00 [ρ 7→ W1 ]. Let V̌ = U10 [ρ 7→ W0 ] | U00 [ρ 7→ W0 ]. (U ,U ) Then, we have U [ρ 7→ W0 ] V̌ and V̌ , V̂ ∈ R4 0 1 . 0 0 Case 5. (UP-Assoc). Assume U = (U00 | U10 ) | U20 and V̂ = U00 [ρ 7→ W1 ] | (U 1 [ρ 7→ W1 ] | U2 [ρ 7→ W1 ]). Let V̂ = (U ,U ) U00 [ρ 7→ W0 ] | (U10 [ρ 7→ W0 ] | U20 [ρ 7→ W0 ]). Then, we have U [ρ 7→ W0 ] V̌ and V̌ , V̂ ∈ R4 0 1 .

hypoth| U10 [ρ 7→ W1 ]. By the Case 6. (UP-CongP). Assume U = U00 | U10 , U00 [ρ 7→ W1 ] V̂0 , and V̂ = V̂0 induction (U ,U ) (U ,U ) 0 esis, there exists a closed usage V̌0 such that U0 [ρ 7→ W0 ] V̌0 and V̌0 , V̂0 ∈ R4 0 1 . Since V̌0 , V̂0 ∈ R4 0 1 , there exists Ǔ0 such that V̌0 = Ǔ0 [ρ 7→ W0 ] and V̌1 = Ǔ0 [ρ 7→ W1 ]. Let V̌ = Ǔ0 [ρ 7→ W0 ] | U10 [ρ 7→ W0 ]. Then, we (U ,U ) have U [ρ 7→ W0 ] V̌ and V̌ , V̂ ∈ R4 0 1 . Case 7. (UP-Rep). Assume U = ρ and V̂ = (∗(U U1 )) | (U0 | U1 ). Let U 0 = ρ | (U0 | U1 ) and V̌ = U 0 [ρ 7→ W0 ]. 0| (U ,U ) Then, we have V̂ = U 0 [ρ 7→ W1 ]. Hence, we have V̌ , V̂ ∈ R4 0 1 . By (UP-Commut), (UP-Rep) and Lemma B.2, we have W0 = ∗U0 | ∗U1 (∗U0 | U0 ) | (∗U1 | U1 ) ∗U0 | ∗U1 | (U0 | U1 ) = V̌ . 0 Assume U = ∗U and V̂ = ∗U 0 [ρ 7→ W1 ] | U 0 [ρ 7→ W1 ]. Let V̌ = ∗U 0 [ρ 7→ W0 ] | U 0 [ρ 7→ W0 ]. Then, we have (U0 ,U1 ) . U [ρ 7→ W0 ] V̌ and V̌ , V̂ ∈ R4

max(t1 ,tα )

Case 8. (UP-↑(∗,∗) ). Assume U = ↑(tI ,tO ) αtt21 .U 0 and V̂ = αt2 (U ,U ) Then, we have U [ρ 7→ W0 ] V̌ and V̌ , V̂ ∈ R4 0 1 .

max(t1 ,tα )

. U 0 [ρ 7→ W1 ]. Let V̌ = αt2

. U 0 [ρ 7→ W0 ].

Case 9. (UP-Dist). Assume U = ↑(tI ,tO ) U00 | U10 and V̂ = ↑(tI ,tO ) U00 [ρ 7→ | ↑(tI ,tO ) U10 [ρ 7→ W1 ]. Let V̂ = W1 ] (U ,U ) (tI ,tO ) 0 (tI ,tO ) 0 ↑ U0 [ρ 7→ W0 ] | ↑ U1 [ρ 7→ W0 ]. Then, we have U [ρ 7→ W0 ] V̌ and V̌ , V̂ ∈ R4 0 1 . 0 0 0 0 Case 10. (UP-Or). Fix i ∈ {0, 1}. Assume U = U0 & U1 and V̂ = Ui [ρ 7→ W1 ]. Let V̌ = Ui [ρ 7→ W0 ]. Then, we have (U0 ,U1 ) . U [ρ 7→ W0 ] V̌ and V̌ , V̂ ∈ R4

Case 11. (UP-Cong ↑(∗,∗) ). Assume U = ↑(tI ,tO ) U 0 , U 0 [ρ 7→ W1 ] V̂ 0 , and V̂ = ↑(tI ,tO ) V̂ 0 . By the induction (U ,U ) hypothesis, there exists a closed usage V̌ 0 such that U 0 [ρ 7→ W0 ] V̌ 0 and V̌ 0 , V̂ 0 ∈ R4 0 1 . Let V̌ = ↑(tI ,tO ) V̌ 0 . (U ,U ) Then, we have U [ρ 7→ W0 ] V̌ . By Definition 3.7 (a) we have shown, ↑(tI ,tO ) V̌ 0 , ↑(tI ,tO ) V̂ 0 ∈ R4 0 1 i. e. (U ,U ) V̌ , V̂ ∈ R4 0 1 . ′ ′ ′ ′ Case 12. (UP-Commut ↑(∗,∗) ). Assume U0 = ↑(tI ,tO ) ↑(tI ,tO ) U V̂ = ↑(tI ,tO ) ↑(tI ,tO ) U1 [ρ 7→ W1 ]. Let V̌ = 1 and ′ ′ (U ,U ) ↑(tI ,tO ) ↑(tI ,tO ) U [ρ 7→ W ]. Then, we have U [ρ 7→ U ] V̌ and V̌ , V̂ ∈ R 0 1 . 1

4 (U0 ,U1 ) Now, we show that if (U [ρ 7→ W0 ], U [ρ 7→ W1 ]) ∈ R4 and there exists a usage V̂ such that U [ρ 7→ W1 ] −→ V̂ , (U ,U ) then there exists V̌ such that U [ρ 7→ W0 ] −→ V̌ and V̌ , V̂ ∈ R4 0 1 .

Assume U [ρ 7→ W1 ] −→ V̂ . The proof is by induction on the construction of V [ρ 7→ W1 ] −→ V̂ . We consider cases according to the last rule of the construction. t′ Case 1. Assume U = Ittco .U00 | Ot′co .U10 and V̂ = U00 [ρ 7→ W1 ] | U10 [ρ 7→ W1 ]. Let V̌ = U00 [ρ 7→ W0 ] | U10 [ρ 7→ W0 ]. Then, (U ,U ) we have U [ρ 7→ W0 ] −→ V̌ and V̌ , V̂ ∈ R4 0 1 . Case 2. Assume U = U00 | U10 , U00 [ρ 7→ W1 ] −→ V̂0 , and V̂ = V̂0 | U10 [ρ7→ W1]. By the induction hypothesis, there (U ,U ) (U ,U ) exists V̌0 such that U00 [ρ 7→ W0 ] −→ V̌0 and V̌0 , V̂0 ∈ R4 0 1 . Since V̌0 , V̂0 ∈ R4 0 1 , there exists Ǔ0 such that

0 V̌ 0 = Ǔ0 [ρ 7→ W0 ] and V̌1 = Ǔ0 [ρ 7→ W1 ]. Let V̌ = Ǔ0 [ρ 7→ W0 ] | U1 [ρ 7→ W0 ]. Then, we have U [ρ 7→ W0 ] −→ V̌ and (U0 ,U1 ) V̌ , V̂ ∈ R4 .

Case 3. Assume there exists usages V0 and V1 such that U [ρ 7→ V0 , V0 −→ V1 , and V1 V̂ . Since U [ρ 7→ W1 ] W1 ](U ,U ) (U ,U ) V0 , there exists V̌0 such that U [ρ 7→ W0 ] V̌0 and V̌0 , V0 ∈ R4 0 1 . Since V̌0 , V0 ∈ R4 0 1 and V0 −→ V1 , (U0 ,U1 ) the induction hypothesis implies that there exists V̌1 such that . Since V̌1 , V1 ∈ V̌0 −→ V̌1 and V̌1 , V1 ∈ R4 (U ,U ) (U ,U ) R4 0 1 and V1 V̂ , there exists V̌ such that V̌1 V̌ and V̌ , V̂ ∈ R4 0 1 . Since U [ρ 7→ W0 ] V̌0 , V̌0 −→ V̌1 , and V̌1 V̌ , we have U [ρ 7→ W0 ] −→ V̌ . (c) Let α ∈ {I, O}. Then capα (∗(U0 | U1 )) = capα (U0 | U1 ) = min(capα (U0 ), capα (U1 )) = min(capα (∗U0 ), capα (∗U1 )) = capα (∗U0 | ∗U1 ). By Lemma B.1 (2), we have capα (U [ρ 7→ ∗(U0 | U1 )]) = capα (U [ρ 7→ (∗U0 | ∗U1 )]). Thus, capα (U [ρ 7→ ∗(U0 | U1 )]) ≤ capα (U [ρ 7→ (∗U0 | ∗U1 )]). (d) Let α ∈ {I, O}. Then obα (∗(U0 | U1 )) = obα (U0 | U1 ) = min(obα (U0 ), obα (U1 )) = min(obα (∗U0 ), obα (∗U1 )) = obα (∗U0 | ∗U1 ). By Lemma B.1 (4), we have obα (U [ρ 7→ ∗(U0 | U1 )]) = obα (U [ρ 7→ (∗U0 | ∗U1 )]). Thus, obα (U [ρ 7→ ∗(U0 | U1 )]) ≥ obα (U [ρ 7→ (∗U0 | ∗U1 )]). (5) By this proposition (4) and Proposition 3.8 (3), ∗(U0 | · · · | Un ) :> ∗(U0 | · · · | Un−1 ) | ∗Un .. :> . .. .. . . :> (∗U0 | · · · | ∗Un ).

(6) Assume U0 <: U00 and U1 <: U10 . By Definition 3.7 (a), we have U0 | U1 <: U00 | U1 . We also have U00 | U1 <: U00 | U10 . By Proposition 3.8 (3), we see U0 | U1 <: U00 | U10 . (7) For a tuple of variables hρ̃ = i(ρ0 , . . . , ρn ) and a tuple of usages Ũ = (U0 , . . . , Un ), we abbreviate U [ρ0 7→ U0 , . . . , ρn 7→ Un ] for U ρ̃ 7→ Ũ . Let h i! ( ) ∞ (t ,t ) (t ,t ) [ U0 , . . . , Un are closed usages, and V ρ0 7→ ↑ I 0 O 0 U0 , . . . , ρn 7→ ↑ I n O n Un , R5 = . V is a usage with FV(V ) ⊆ {ρ0 , . . . , ρn } V [ρ0 7→ U0 , . . . , ρn 7→ Un ] n=0 It suﬀices to show that R5 satisfies all the conditions of Definition 3.7. Fix closed usages U0 , . . . , Un , a usage V with . Let FV(V ) ⊆ {ρ0 , . . . , ρn }, and tO 0 , . . . , tO n, tI h0 , . . . tI n i∈ Nh∪ {∞}i (tI 0 ,tO 0 ) (tI n ,tO n ) 0 0 ρ̃ = (ρ0 , . . . , ρn ), Ũ = (U0 , . . . , Un ), and Ũ = ↑ U0 , . . . , ↑ Un . Assume V ρ̃ 7→ Ũ , V ρ̃ 7→ Ũ ∈ R5 . (a)h Let V 0 hbe a ii usage with FV(V 0 ) h = {ρ0i}. Since hFV(V ) ⊆h{ρ0 , . . . ,ii ρn } and FV(V 0 ) =h {ρ0 }, iwe have 0 0 0 0 0 0 0 V ρ 7→ V ρ̃ 7→ Ũ = (V [ρ 7→ V ]) ρ̃ 7→ Ũ and V ρ 7→ V ρ̃ 7→ Ũ = (V 0 [ρ0 7→ V ]) ρ̃ 7→ Ũ 0 . Hence, h h ii h h ii V 0 ρ0 7→ V ρ̃ 7→ Ũ 0 , V 0 ρ0 7→ V ρ̃ 7→ Ũ ∈ R5 . h i h i h i (b) To show that R5 satisfies Definition 3.7 (b), if V ρ̃ 7→ Ũ 0 , V ρ̃ 7→ Ũ ∈ R5 and V ρ̃ 7→ Ũ V̂ , then there h i exists V̌ such that V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 .

h i h i h i Assume V ρ̃ 7→ Ũ 0 , V ρ̃ 7→ Ũ ∈ R5 and V ρ̃ 7→ Ũ V̂ . We show that there exists a closed usage V̌ such h i h i that V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . The proof is by the induction on the construction of V ρ̃ 7→ Ũ V̂ . h i h i Assume V = ρi with some i = 0, . . . , n. Then, we have V ρ̃ 7→ Ũ = Ui and V ρ̃ 7→ Ũ 0 = ↑(tIi ,tOi ) Ui . Let V̌ = ↑(tIi ,tOi ) V̂ . Then, we have ↑(tIi ,tOi ) V̂ , V̂ ∈ R5 . By (UP-Cong ↑(∗,∗) ), Ui V̂ implies ↑(tIi ,tOi ) Ui V̌ . h i We consider other cases according to the last rule of the construction of V ρ̃ 7→ Ũ V̂ . h i h i h i Case 1. Assume V̂ = V ρ̃ 7→ Ũ . Let V̌ = V ρ̃ 7→ Ũ 0 . Then, we have V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . h i Case 2. Assume V ρ̃ 7→ Ũ V 0 and V 0 V̂ . By the induction hypothesis, there exists a closed usage V̌ 0 such h i that V ρ̃ 7→ Ũ 0 V̌ 0 and V̌ 0 , V 0 ∈ R5 . Since V̌ 0 , V 0 ∈ R5 and V 0 V̂ , the induction hypothesis implies that h i there exists a closed usage V̌ such that V̌ 0 V̌ and V̌ , V̂ ∈ R5 . Since V ρ̃ 7→ Ũ 0 V̌ 0 and V̌ 0 V̌ , we have h i V ρ̃ 7→ Ũ 0 V̌ . h i h i h i Case 3. (UP-Zero). Assume V = 0 | V0 and V̂ = V0 ρ̃ 7→ Ũ . Let V̌ = V0 ρ̃ 7→ Ũ 0 . Then, we have V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . h i h i h i h i Case 4. (UP-Commut). Assume V = V0 | V1 and V̂ = V1 ρ̃ 7→ Ũ | V0 ρ̃ 7→ Ũ . Let V̌ = V1 ρ̃ 7→ Ũ 0 | V0 ρ̃ 7→ Ũ 0 . h i Then, we have V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . h i Case 5. (UP-Assoc). Assume V = ρi | V2 , Ui = V0 | V1 and V̂ = V0 | V1 | V2 ρ̃ 7→ Ũ for some i = 0, . . . , n. Then h i h i t ,t V ρ̃ 7→ Ũ 0 = ↑( Ii Oi ) (V | V ) | V ρ̃ 7→ Ũ 0 . By (UP-Dist) and transitivity, we have 0

h i h i ↑(tIi ,tOi ) (V0 | V1 ) | V2 ρ̃ 7→ Ũ 0 ↑(tIi ,tOi ) V0 | ↑(tIi ,tOi ) V1 | V2 ρ̃ 7→ Ũ 0 h i ↑(tIi ,tOi ) V0 | ↑(tIi ,tOi ) V1 | V2 ρ̃ 7→ Ũ 0 . h i h i Let V̌ = ↑(tIi ,tOi ) V0 | ↑(tIi ,tOi ) V1 | V2 ρ̃ 7→ Ũ 0 . Then, we have V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . h i h i h i h i Assume V = (V0 | V1 ) | V2 and V̂ = V0 ρ̃ 7→ Ũ | V1 ρ̃ 7→ Ũ | V2 ρ̃ 7→ Ũ . Let V̌ = V0 ρ̃ 7→ Ũ 0 | h i h i h i V1 ρ̃ 7→ Ũ 0 | V2 ρ̃ 7→ Ũ 0 . Then, we have V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . h i h i Case 6. (UP-CongP). Assume V = V0 | V1 , V0 ρ̃ 7→ Ũ V̂0 , and V̂ = V̂0 | V1 ρ̃ 7→ Ũ . By the induction hypothesis, h i there exists a closed usage V̌0 such that V0 ρ̃ 7→ Ũ 0 V̌0 and V̌0 , V̂0 ∈ R5 . Since V̌0 , V̂0 ∈ R5 , there exists closed usages W0 , . . . , Wm , a usage V 0 with FV(V 0 ) ⊆ {ρ00 , . . . , ρ0m }, and t0O 0 , . . . , t0O m , t0I 0 , . . . t0I m ∈ N ∪ {∞} such that h i V̌ = V 0 ρ0 7→ ↑(tI0 ,tO0 ) W , . . . , ρ0 7→ ↑(tIm ,tOm ) W and 0

V̂0 = V

[ρ00 7→ W0 , . . . , ρ0m 7→ Wm ].

Without loss we can assume {ρ0, . . . , ρn }∩{ρ00 , . . . , ρ0m } = ∅. Let ρ̃0 = (ρ00 , . . . , ρ0m ), W̃ = (W0 , . . . , Wm ), of′ generality, ′ ′ ′ t ,t ( ) and W̃ 0 = ↑ I 0 O 0 W0 , . . . , ↑(tI m ,tO m ) Wm . h i h i Let V̌ = V 0 ρ̃0 7→ W̃ 0 | V1 ρ̃ 7→ Ũ 0 . Then, we have V̌ , V̂ ∈ R5 . By (UP-CongP), we have h i h i h i h i 0 V0 ρ̃ 7→ Ũ 0 | V1 ρ̃ 7→ Ũ 0 V ρ̃0 7→ W̃ 0 | V1 ρ̃ 7→ Ũ 0 . h i h i h i h i Case 7. (UP-Rep). Assume V = ∗V0 and V̂ = ∗V0 ρ̃ 7→ Ũ | V0 ρ̃ 7→ Ũ . Let V̌ = ∗V0 ρ̃ 7→ Ũ 0 | V0 ρ̃ 7→ Ũ 0 . Then, h i we have V0 ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . max(t ,t ) max(t ,t ) Case 8. (UP-↑(∗,∗) V = ↑(tI ,tO ) ρi , Ui = αtt21 .V0 , and V̂ = αt2 1 α .V0 . Let V̌ = ↑(tIi ,tOi ) αt2 1 α .V0 . ). Assume Then, we have V̌ , V̂ ∈ R5 . By (UP-Commut ↑(∗,∗) ) and (UP-Rep), we have h i max(t1 ,tα ) (t ,t ) (t ,t ) t t ,t t ,t t ,t t .V0 = V̌ . V ρ̃ 7→ Ũ 0 = ↑ I O ↑( Ii Oi ) αt21 .V0 ↑( Ii Oi ) ↑ I O αt21 .V0 ↑( Ii Oi ) αt2

h i Therefore, we have V ρ̃ 7→ Ũ 0 V̌ . max(t1 ,tα )

Assume V = ↑(tI ,tO ) αtt21 .V0 and V̂ = αt2 h i V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 .

h i h i max(t ,t ) . V0 ρ̃ 7→ Ũ . Let V̌ = αt2 1 α . V0 ρ̃ 7→ Ũ 0 . Then, we have

h i h i Case 9. (UP-Dist). Assume V = ↑(tI ,tO ) V0 | V1 and V̂ = ↑(tI ,tO ) V0 ρ̃ 7→ Ũ | ↑(tI ,tO ) V1 ρ̃ 7→ Ũ . Let V̌ = h i h i h i ↑(tI ,tO ) V0 ρ̃ 7→ Ũ 0 | ↑(tI ,tO ) V1 ρ̃ 7→ Ũ 0 . Then, we have V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . h i h i Case 10. (UP-Or). Fix j ∈ {0, 1}. Assume V = V0 & V1 and V̂ = Vj ρ̃ 7→ Ũ . Let V̌ = Vj ρ̃ 7→ Ũ 0 . Then, we have h i V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . h i Case 11. (UP-Cong ↑(∗,∗) ). Assume V = ↑(tI ,tO ) V0 , V0 ρ̃ 7→ Ũ V̂0 , and V̂ = ↑(tI ,tO ) V̂0 . By the induction h i hypothesis, there exists a closed usage V̌0 such that V0 ρ̃ 7→ Ũ 0 V̌0 and V̌0 , V̂0 ∈ R5 . Since V̌0 , V̂0 ∈ R5 , there exist closed usages W0 , . . . , Wm , a usage V 0 with FV(V 0 ) ⊆ {ρ00 , . . . , ρ0m }, and t0O 0 , . . . , t0O m , t0I 0 , . . . t0I m ∈ N ∪ {∞} such that h i V̌0 = V 0 ρ00 7→ ↑(tI0 ,tO0 ) W0 , . . . , ρ0m 7→ ↑(tIm ,tOm ) Wm and V̂0 = V 0 [ρ00 7→ W0 , . . . , ρ0m 7→ Wm ].

′ ′ ′ ′ (W0 , . . . , Wm ), and W̃ 0 = ↑(tI 0 ,tO 0 ) W0 , . . . , ↑(tI m ,tO m ) Wm . Let ∈ R5 . By (UP-Cong ↑(∗,∗) ), we have V̌ = ↑(tI ,tO ) V 0 [ρ00 7→ W0 , . . . , ρ0m 7→ Wm ]. Then, we have V̌ , V̂ h i h i ↑(tI ,tO ) V0 ρ̃ 7→ Ũ 0 ↑(tI ,tO ) V 0 ρ̃0 7→ W̃ 0 . ′ ′ ′ ′ (tI ,tO ) Case 12. (UP-Commut ↑(∗,∗) ). Assume V = ↑ ρi , Ui = ↑(tI ,tO ) V0 , and V̂ = ↑(tI ,tO ) ↑(tI ,tO ) V0 . Let V̌ = ′ ′ ↑(tI ,tO ) ↑(tI ,tO ) ↑(tIi ,tOi ) V . Then, we have V̌ , V̂ ∈ R . By (UP-Commut ↑(∗,∗) ) and (UP-Cong ↑(∗,∗) ), we have Let ρ̃0

(ρ00 , . . . , ρ0m ), W̃

(t ,t ) t ,t t′ ,t′ V ρ̃ 7→ Ũ 0 = ↑ I O ↑( Ii Oi ) ↑( I O ) V0 ′ ′ ↑(tI ,tO ) ↑(tI ,tO ) ↑(tIi ,tOi ) V0 ′ ′ ↑(tI ,tO ) ↑(tI ,tO ) ↑(tIi ,tOi ) V

= V̌ .

h i Hence, we have V ρ̃ 7→ Ũ 0 V̌ . h i h i ′ ′ ′ ′ ′ ′ Assume V = ↑(tI ,tO ) ↑(tI ,tO ) V0 and V̂ = ↑(tI ,tO ) ↑(tI ,tO ) V0 ρ̃ 7→ Ũ . Let V̌ = ↑(tI ,tO ) ↑(tI ,tO ) V0 ρ̃ 7→ Ũ 0 . Then, h i we have V ρ̃ 7→ Ũ 0 V̌ and V̌ , V̂ ∈ R5 . h i h i h i ∈ R5 and V ρ̃ 7→ Ũ −→ V̂ , then there exists V̌ such that Now, we show that if V ρ̃ 7→ Ũ 0 , V ρ̃ 7→ Ũ h i V ρ̃ 7→ Ũ 0 −→ V̌ and V̌ , V̂ ∈ R5 . h i h i h i Assume V ρ̃ 7→ Ũ 0 , V ρ̃ 7→ Ũ ∈ R5 and V ρ̃ 7→ Ũ −→ V̂ . We show that there exists a closed usage V̌ such h i h i that V ρ̃ 7→ Ũ 0 −→ V̌ and V̌ , V̂ ∈ R5 . The proof is by the induction on the construction of V ρ̃ 7→ Ũ −→ V̂ . h i h i h i h i t′ Case 1. Assume V = Ittco .V0 | Ot′co .V1 and V̂ = V0 ρ̃ 7→ Ũ | V1 ρ̃ 7→ Ũ . Let V̂ = V0 ρ̃ 7→ Ũ 0 | V1 ρ̃ 7→ Ũ 0 . Then, we h i have V ρ̃ 7→ Ũ 0 −→ V̌ and V̌ , V̂ ∈ R5 . h i h i Case 2. Assume V = V0 | V1 , V0 ρ̃ 7→ Ũ −→ V̂0 , and V̂ = V̂0 | V1 ρ̃ 7→ Ũ . By the induction hypothesis, there exists h i a closed usage V̌0 such that V0 ρ̃ 7→ Ũ 0 −→ V̌0 and V̌0 , V̂0 ∈ R5 . Since V̌0 , V̂0 ∈ R5 , there exists closed usages W0 , . . . , Wm , a usage V 0 with FV(V 0 ) ⊆ {ρ00 , . . . , ρ0m }, and t0O 0 , . . . , t0O m , t0I 0 , . . . t0I m ∈ N ∪ {∞} such that i h V̌0 = V 0 ρ00 7→ ↑(tI0 ,tO0 ) W0 , . . . , ρ0m 7→ ↑(tIm ,tOm ) Wm and V̂0 = V 0 [ρ00 7→ W0 , . . . , ρ0m 7→ Wm ].

Without loss we can assume {ρ0, . . . , ρn }∩{ρ00 , . . . , ρ0m } = ∅. Let ρ̃0 = (ρ00 , . . . , ρ0m ), W̃ = (W0 , . . . , Wm ), of′ generality, ′ ′ ′ and W̃ 0 = ↑(tI 0 ,tO 0 ) W0 , . . . , ↑(tI m ,tO m ) Wm . h i h i h i h i Let V̌ = V 0 ρ̃0 7→ W̃ 0 | V1 ρ̃ 7→ Ũ 0 . Then, we have V̌ , V̂ ∈ R5 . We also have V0 ρ̃ 7→ Ũ 0 | V1 ρ̃ 7→ Ũ 0 −→ h i h i V 0 ρ̃0 7→ W̃ 0 | V1 ρ̃ 7→ Ũ 0 . h i h i Case 3. Assume there exists usages V0 and V1 such that V ρ̃ 7→ Ũ V0 , V0 −→ V1 , and V1 V̂ . Since V ρ̃ 7→ Ũ i h V0 , there exists V̌0 such that V ρ̃ 7→ Ũ 0 V̌0 and V̌0 , V0 ∈ R5 . Since V̌0 , V0 ∈ R5 and V0 −→ V1 , the induction hypothesis implies that there exists V̌1 hsuch that i V̌0 −→ V̌1 and V̌1 , V1 ∈ R5 . Since V1 h V̂ , there i exists V̌ such 0 0 that V̌1 V̌ and V̌ , V̂ ∈ R5 . Since V ρ̃ 7→ Ũ V̌0 , V̌0 −→ V̌1 and V̌1 V̌ , we have V ρ̃ 7→ Ũ −→ V̌ . (c) By Lemma B.1 (2). (d) By Lemma B.1 (4). (8) By this proposition (7).

Appendix C. Basic properties of types and type environments C.1. A basic property of types Proposition C.1. (1) Let τ0 and τ1 be types. Then τ0 | τ1 <: τ1 | τ0 . (2) Let τ0 , τ1 , and τ2 be types. Then (τ0 | τ1 ) | τ2 <: τ0 | (τ1 | τ2 ). (3) For types τ0 , τ00 , τ1 and τ10 , if τi <: τi0 for each i = 0, 1, then τ0 | τ1 <: τ00 | τ10 . (4) Let τ0 , τ1 , and τ2 be types. Then τ0 | (τ1 | τ2 ) <: (τ0 | τ1 ) | τ2 . (5) For types τ and τ 0 , ob (τ ) = ∞ implies τ | τ 0 <: τ 0 . (6) For types τ and τ 0 , if τ <: τ 0 , then ∗τ <: ∗τ 0 . (7 ) Let τ be a type. Then ∗τ <: ∗τ | τ . (8) Let τ0 , . . . , τn be types. Then (∗τ0 | · · · | ∗τn ) <: ∗(τ0 | · · · | τn ). (9) Let τ be a type. Then ↑(tI ,tO ) τ <: τ . (10) Let τ be a type. Then ↑ τ <: τ . Proof. We show each claim. (1) We show τ0 | τ1 <: τ1 | τ0 . Assume τ0 is a base type and τ0 = τ1 . Then τ0 | τ1 = τ0 . Since τ0 = τ1 , we see that τ1 is a base type. Then τ1 | τ0 = τ1 . Since τ0 = τ1 , we have τ0 | τ1 = τ1 | τ0 . Hence, we have τ0 | τ1 <: τ1 | τ0 . Assume τ0 = ξ/U0 and τ1 = ξ/U1 . Then, we have τ0 | τ1 ≡ ξ/U0 | U1 and τ1 | τ0 ≡ ξ/U1 | U0 . Since U0 | U1 U1 | U0 , Proposition B.4 (1) implies U0 | U1 <: U1 | U0 . Thus, τ0 | τ1 <: τ1 | τ0 . (2) We show (τ0 | τ1 ) | τ2 <: τ0 | (τ1 | τ2 ). Assume τ0 is a base type and τ0 = τ1 . Then τ0 | τ1 = τ0 . Because τ0 is a base type and τ0 | τ2 is defined, we have τ0 = τ2 and τ0 | τ2 = τ0 . Hence, (τ0 | τ1 ) | τ2 = τ0 = τ0 | τ1 = τ0 | (τ1 | τ2 ). Assume τ0 = ξ/U0 and τ1 = ξ/U1 . Then τ0 | τ1 = ξ/U0 | U1 . Because (τ0 | τ1 ) | τ2 is defined, there exists a usage U2 such that τ2 = ξ/U2 . Hence, (τ0 | τ1 ) | τ2 = ξ/((U0 | U1 ) | U2 ). We also have τ0 | (τ1 | τ2 ) = ξ/(U0 | (U1 | U2 )). Since (U0 | U1 ) | U2 U0 | (U1 | U2 ), we see (U0 | U1 ) | U2 <: U0 | (U1 | U2 ). Thus, (τ0 | τ1 ) | τ2 <: τ0 | (τ1 | τ2 ). (3) Assume τi <: τi0 for each i = 0, 1. We show τ0 | τ1 <: τ00 | τ10 . Assume τ0 is a base type and τ0 = τ1 . Then τ0 | τ1 = τ0 . Since τ0 <: τ00 , we have τ00 = τ0 . Since τ0 = τ1 , we see that τ1 is a base type. Since τ1 <: τ10 , we have τ10 = τ1 . Then τ0 | τ1 ≡ τ00 | τ10 . Hence, we have τ0 | τ1 <: τ00 | τ10 . Assume τ0 = ξ/U0 and τ1 = ξ/U1 . Then τ0 | τ1 ≡ ξ/U0 | U1 . For each i = 0, 1, because of τi <: τi0 , we have 0 τi = ξ/Ui0 and Ui <: Ui0 . By Proposition B.4 (6), we have U0 | U1 <: U00 | U10 . Then τ0 | τ1 ≡ ξ/U0 | U1 <: ξ/U00 | U10 ≡ τ00 | τ10 .

(4) We show τ0 | (τ1 | τ2 ) <: (τ0 | τ1 ) | τ2 . By (1), (2), (3), and transitivity of <:, we have τ0 | (τ1 | τ2 ) <: (τ1 | τ2 ) | τ0 <: (τ2 | τ1 ) | τ0 <: τ2 | (τ1 | τ0 ) <: (τ1 | τ0 ) | τ2

<: (τ0 | τ1 ) | τ2 .

Thus, τ0 | (τ1 | τ2 ) <: (τ0 | τ1 ) | τ2 . (5) Assume ob (τ ) = ∞. Assume that τ is a base type. Since τ | τ 0 is defined, we have τ 0 is a base type and τ = τ 0 . Then, we have τ | τ 0 = τ = τ 0 . Therefore, we have τ | τ 0 <: τ 0 . Assume that τ ≡ ξ/U and ob (U ) = ∞. Since τ | τ 0 is defined, there exists a usage U 0 such that τ 0 ≡ ξ/U 0 . Then, we have τ | τ 0 = ξ/U | U 0 . By Proposition B.4 (3), we have U | U 0 <: U 0 . By Definition 3.9, τ | τ 0 <: τ 0 . (6) Assume τ <: τ 0 . Assume that τ is a base type. Then, we have τ = τ 0 . We also have ∗τ = τ . Because τ 0 is a base type, ∗τ 0 = τ 0 . Hence, ∗τ = ∗τ 0 . Therefore, ∗τ <: ∗τ 0 . Assume that τ ≡ ξ/U . Then ∗τ ≡ ξ/∗U . Since τ <: τ 0 , there exists U 0 such that U <: U 0 and τ 0 ≡ ξ/U 0 . Then 0 ∗τ ≡ ξ/∗U 0 . By Definition 3.7 (a), we have ∗U <: ∗U 0 . Thus, ∗τ <: ∗τ 0 . (7) We show ∗τ <: ∗τ | τ . Assume that τ is a base type. Then, we have ∗τ = τ . Since τ is a base type, we have ∗τ | τ = τ | τ = τ . Therefore, ∗τ <: ∗τ | τ . Assume that τ ≡ ξ/U . Then ∗τ ≡ ξ/∗U and ∗τ | τ ≡ ξ/∗U | U . Since ∗U ∗U | U , Proposition B.4 (1) implies ∗U <: ∗U | U . Therefore, ∗τ <: ∗τ | τ . (8) We show (∗τ0 | · · · | ∗τn ) <: ∗(τ0 | · · · | τn ). Assume that τ0 is a base type. Then, we have ∗τ0 = τ0 . Since (∗τ0 | · · · | ∗τn ) is defined, ∗τ1 , . . . , ∗τn are base types. Then, we see that ∗τi = τi and τi is a base type for each i = 0, . . . , n. Hence, (∗τ0 | · · · | ∗τn ) = (τ0 | · · · | τn ). Since τ0 | · · · | τn is defined and τ0 is a base type, we have τ0 | · · · | τn = τ0 . Then ∗τ0 | · · · | τn = ∗τ0 = τ0 . Therefore, (∗τ0 | · · · | ∗τn ) <: ∗(τ0 | · · · | τn ). Assume that τ0 ≡ ξ/U0 . Then ∗τ0 ≡ ξ/∗U0 . Since ∗(τ0 | · · · | τn ) is defined, τ0 | · · · | τn is defined. Hence, τi is the form of ξ/Ui for each i = 1, . . . , n. Then, we have (∗τ0 | · · · | ∗τn ) = ξ/(∗U0 | · · · | ∗Un ) and ∗(τ0 | · · · | τn ) = ξ/∗(U0 | · · · | Un ).

By Proposition B.4 (5), we have (∗τ0 | · · · | ∗τn ) <: ∗(τ0 | · · · | τn ). (9) We show ↑(tI ,tO ) τ <: τ . Assume τ is a base type. Then ↑(tI ,tO ) τ = τ . Hence, ↑(tI ,tO ) τ <: τ Assume τ = ξ/U . Then ↑(tI ,tO ) τ = ξ/↑(tI ,tO ) U . By Proposition B.4 (7), we have ↑(tI ,tO ) U <: U . Hence, (tI ,tO ) ↑ τ <: τ . (10) We show ↑ τ <: τ . Assume τ is a base type. Then ↑ τ = τ . Hence, ↑ τ <: τ Assume τ = ξ/U . Then ↑ τ = ξ/↑ U . By Proposition B.4 (8), we have ↑ U <: U . Hence, ↑ τ <: τ .

Assume x ∈ Dom(Γ1 ) \ Dom(Γ0 ). Then, we have Γ0 | Γ1 (x) = Γ1 (x) and Γ1 | Γ0 (x) = Γ1 (x). Hence, Γ0 (x) | Γ1 (x) <: Γ1 (x) | Γ0 (x). Assume x ∈ Dom(Γ0 ) \ Dom(Γ1 ). Then, we have Γ0 | Γ1 (x) = Γ0 (x) and Γ1 | Γ0 (x) = Γ0 (x). Hence, Γ0 (x) | Γ1 (x) <: Γ1 (x) | Γ0 (x). (c) Dom(Γ0 | Γ1 ) = Dom(Γ1 | Γ0 ). Then Dom(Γ0 | Γ1 ) \ Dom(Γ1 | Γ0 ) = ∅. Thus, Definition 3.12 (c) holds obviously. (2) We show Γ0 | (Γ1 | Γ2 ) <: (Γ0 | Γ1 ) | Γ2 . (a) We see Dom(Γ0 | (Γ1 | Γ2 )) = Dom(Γ0 ) ∪ Dom(Γ1 ) ∪ Dom(Γ2 ) = Dom((Γ0 | Γ1 ) | Γ2 ). Then, we have Dom(Γ0 | (Γ1 | Γ2 )) ⊇ Dom((Γ0 | Γ1 ) | Γ2 ). (b) Let x ∈ Dom((Γ0 | Γ1 ) | Γ2 ). Assume x ∈ Dom(Γ0 | Γ1 ) ∩ Dom(Γ2 ). Then (Γ0 | Γ1 ) | Γ2 (x) = Γ0 | Γ1 (x) | Γ2 (x). Assume x ∈ Dom(Γ0 ) ∩ Dom(Γ1 ). Then (Γ0 | Γ1 ) | Γ2 (x) = (Γ0 (x) | Γ1 (x)) | Γ2 (x). By Proposition C.1 (2), (Γ0 | Γ1 ) | Γ2 (x) = Γ0 (x) | (Γ1 (x) | Γ2 (x)). Since Γ0 | (Γ1 | Γ2 )(x) = Γ0 (x) | (Γ1 (x) | Γ2 (x)), we have (Γ0 | Γ1 ) | Γ2 (x) = Γ0 | (Γ1 | Γ2 )(x). Assume x ∈ Dom(Γ0 ) \ Dom(Γ1 ). Then (Γ0 | Γ1 ) | Γ2 (x) = Γ0 (x) | Γ2 (x). Since Γ0 | (Γ1 | Γ2 )(x) = Γ0 | Γ2 (x), we have (Γ0 | Γ1 ) | Γ2 (x) = Γ0 | (Γ1 | Γ2 )(x). Assume x ∈ Dom(Γ1 ) \ Dom(Γ0 ). Then (Γ0 | Γ1 ) | Γ2 (x) = Γ1 (x) | Γ2 (x). Since Γ0 | (Γ1 | Γ2 )(x) = Γ1 | Γ2 (x), we have (Γ0 | Γ1 ) | Γ2 (x) = Γ0 | (Γ1 | Γ2 )(x). Assume x ∈ Dom(Γ0 | Γ1 ) \ Dom(Γ2 ). Then (Γ0 | Γ1 ) | Γ2 (x) = Γ0 | Γ1 (x). Since Γ0 | (Γ1 | Γ2 )(x) = Γ0 | Γ1 (x), we have (Γ0 | Γ1 ) | Γ2 (x) = Γ0 | (Γ1 | Γ2 )(x). Assume x ∈ Dom(Γ2 ) \ Dom(Γ0 | Γ1 ). Then (Γ0 | Γ1 ) | Γ2 (x) = Γ2 (x). Since Γ0 | (Γ1 | Γ2 )(x) = Γ2 (x), we have (Γ0 | Γ1 ) | Γ2 (x) = Γ0 | (Γ1 | Γ2 )(x). (c) Dom(Γ0 | (Γ1 | Γ2 )) = Dom((Γ0 | Γ1 ) | Γ2 ). Then Dom(Γ0 | (Γ1 | Γ2 )) \ Dom((Γ0 | Γ1 ) | Γ2 ) = ∅. Thus, Definition 3.12 (c) holds obviously. (3) Assume Γ0 <: Γ00 . We show Γ0 | Γ1 <: Γ00 | Γ1 . (a) Since Γ0 <: Γ00 , we have Dom(Γ0 ) ⊇ Dom(Γ00 ). Thus, Dom(Γ0 | Γ1 ) = Dom(Γ0 ) ∪ Dom(Γ1 ) ⊇ Dom(Γ00 ) ∪ Dom(Γ1 ) = Dom(Γ00 | Γ1 ). (b) Let x ∈ Dom(Γ00 | Γ1 ). Since Dom(Γ0 | Γ1 ) ⊇ Dom(Γ00 | Γ1 ), we have x ∈ Dom(Γ0 | Γ1 ). Assume x ∈ Dom(Γ00 ) ∩ Dom(Γ1 ). Then, we have Γ00 | Γ1 (x) = Γ00 (x) | Γ1 (x). Since Dom(Γ0 ) ⊇ Dom(Γ00 ), we have x ∈ Dom(Γ0 ) ∩ Dom(Γ1 ). Then, we see Γ0 | Γ1 (x) = Γ0 (x) | Γ1 (x). Since Γ0 <: Γ00 , we have Γ0 (x) <: Γ00 (x). By Proposition C.1 (3), Γ0 (x) | Γ1 (x) <: Γ00 (x) | Γ1 (x). Thus, Γ0 | Γ1 (x) <: Γ00 | Γ1 (x). Assume x ∈ Dom(Γ00 ) \ Dom(Γ1 ). Then Γ00 | Γ1 (x) = Γ00 (x). Since Dom(Γ0 ) ⊇ Dom(Γ00 ), we have x ∈ Dom(Γ00 ) \ Dom(Γ1 ). Then Γ0 | Γ1 (x) = Γ0 (x). Since Γ0 <: Γ00 , we have Γ0 (x) <: Γ00 (x). Thus, Γ0 | Γ1 (x) <: Γ00 | Γ1 (x). Assume x ∈ Dom(Γ1 ) \ Dom(Γ00 ). Then Γ00 | Γ1 (x) = Γ1 (x). Assume x ∈ Dom(Γ0 ). Then Γ0 | Γ1 (x) = Γ0 (x) | Γ1 (x). Since x ∈ Dom(Γ0 ) \ Dom(Γ00 ), and Γ0 <: Γ00 , we have ob (Γ0 (x)) = ∞. By Proposition C.1 (5), we see Γ0 (x) | Γ1 (x) <: Γ1 (x). Thus, Γ0 | Γ1 (x) <: Γ00 | Γ1 (x). Assume x ∈ / Dom(Γ0 ). Then Γ0 | Γ1 (x) = Γ1 (x). Thus, Γ0 | Γ1 (x) <: Γ00 | Γ1 (x). (c) Let x ∈ Dom(Γ0 | Γ1 ) \ Dom(Γ00 | Γ1 ). Then x ∈ (Dom(Γ0 ) ∪ Dom(Γ1 )) \ (Dom(Γ00 ) ∪ Dom(Γ1 )). Hence, x ∈ Dom(Γ0 ) \ Dom(Γ00 ) and x ∈ / Dom(Γ1 ). Therefore, Γ0 | Γ1 (x) = Γ0 (x). Since Γ0 <: Γ00 , we have ob (Γ0 (x)) = ∞. Thus, ob (Γ0 | Γ1 (x)) = ∞. (4) Assume Γ0 <: Γ00 and Γ1 <: Γ01 . By this proposition (3), Γ0 | Γ1 <: Γ00 | Γ1 . From this proposition (1), Γ00 | Γ1 <: Γ1 | Γ00 . This proposition (3) implies Γ1 | Γ00 <: Γ01 | Γ00 . From this proposition (1), Γ01 | Γ00 <: Γ00 | Γ01 . By transitivity, Γ0 | Γ1 <: Γ00 | Γ01 . (5) By (1), (2), (4), and transitivity of <:, we have (Γ0 | Γ1 ) | Γ2 <: Γ2 | (Γ0 | Γ1 ) <: Γ2 | (Γ1 | Γ0 ) <: (Γ2 | Γ1 ) | Γ0 <: Γ0 | (Γ2 | Γ1 ) <: Γ0 | (Γ1 | Γ2 ).

Thus, (Γ0 | Γ1 ) | Γ2 <: Γ0 | (Γ1 | Γ2 ). (6) Assume Γ <: Γ0 . We show ∗Γ <: ∗Γ0 .

(a) Since Γ <: Γ0 , we have Dom(Γ) ⊇ Dom(Γ0 ). Since Dom(∗Γ) = Dom(Γ) and Dom(∗Γ0 ) = Dom(Γ0 ), we have Dom(∗Γ) ⊇ Dom(∗Γ0 ). (b) Let x ∈ Dom(∗Γ0 ). Since Dom(∗Γ0 ) = Dom(Γ0 ), we have x ∈ Dom(Γ0 ). Since Γ <: Γ0 , we see Γ(x) <: Γ0 (x). By Proposition C.1 (7), ∗Γ(x) <: ∗Γ0 (x). Then, we have ∗Γ(x) <: ∗Γ0 (x). (c) Let x ∈ Dom(∗Γ) \ Dom(∗Γ0 ). Since Dom(∗Γ) = Dom(Γ) and Dom(∗Γ0 ) = Dom(Γ0 ), we have x ∈ Dom(Γ) \ Dom(Γ0 ). Since Γ <: Γ0 , we see ob (Γ(x)) = ∞. Then ob (∗Γ(x)) = ob (∗Γ(x)) = ob (Γ(x)) = ∞. (7) We show ∗Γ <: ∗Γ | Γ. (a) Since Dom(∗Γ) = Dom(Γ) and Dom(∗Γ | Γ) = Dom(∗Γ) ∪ Dom(Γ) = Dom(Γ) ∪ Dom(Γ) = Dom(Γ), we have Dom(∗Γ) ⊇ Dom(∗Γ | Γ). (b) Let x ∈ Dom(∗Γ | Γ). By Proposition C.1 (7), we have ∗Γ(x) <: (∗Γ | Γ)(x). (c) Dom(∗Γ) = Dom(∗Γ | Γ). Then Dom(∗Γ) \ Dom(∗Γ | Γ) = ∅. Thus, Definition 3.12 (c) holds obviously. (8) Assume Γ <: Γ0 . We show (Γ, x : τ ) <: (Γ0 , x : τ ). (a) Since Γ <: Γ0 , we have Dom(Γ) ⊇ Dom(Γ0 ). Hence, Dom(Γ, x : τ ) ⊇ Dom(Γ0 , x : τ ). (b) Let y ∈ Dom(Γ0 , x : τ ). If y = x, then (Γ0 , x : τ )(y) = τ = (Γ, x : τ )(y). Assume y 6= x. Then y ∈ Dom(Γ0 ). Since Γ <: Γ0 , Γ(y) <: Γ0 (y). Thus, (Γ, x : τ )(y) <: (Γ0 , x : τ )(y). (c) Let y ∈ Dom(Γ, x : τ ) \ Dom(Γ0 , x : τ ). Then, we have y ∈ Dom(Γ) \ Dom(Γ0 ). Since Γ <: Γ0 , we see ob (Γ(y)) = ∞. Thus, ob ((Γ, x : τ )(y)) = ∞. / Dom(Γ) and x ∈ / Dom(Γ0 ). We show Γ <: Γ0 . (9) Assume (Γ, x : τ ) <: (Γ0 , x : τ ). Then x ∈ 0 (a) Since (Γ, x : τ ) <: (Γ , x : τ ), x ∈ / Dom(Γ), and x ∈ / Dom(Γ0 ), we have Dom(Γ) ⊇ Dom(Γ0 ). 0 0 (b) Let y ∈ Dom(Γ ). Since x ∈ / Dom(Γ ), we have y 6= x. We also see y ∈ Dom(Γ0 , x : τ ). Since (Γ, x : τ ) <: (Γ0 , x : τ ), 0 we have (Γ , x : τ )(y) <: (Γ, x : τ )(y). Thus, Γ0 (y) <: Γ(y). (c) Let y ∈ Dom(Γ) \ Dom(Γ0 ). Then, we have y ∈ Dom((Γ, x : τ )) \ Dom((Γ0 , x : τ )). Since (Γ, x : τ ) <: (Γ0 , x : τ ), we see ob ((Γ, x : τ )(y)) = ∞. Thus, ob (Γ(y)) = ∞. (10) We show ↑(tI ,tO ) Γ <: Γ. (tI ,tO ) (a) Since Dom ↑ Γ = Dom(Γ), we have Dom ↑(tI ,tO ) Γ ⊇ Dom(Γ). (tI ,tO ) (b) Let x ∈ Dom(Γ) Γ(x) = Γ(x). . By Proposition C.1 (9), we have ↑ (tI ,tO ) (tI ,tO ) (c) Dom ↑ Γ = Dom(Γ). Then Dom ↑ Γ \ Dom(Γ) = ∅. Thus, Definition 3.12 (c) holds obviously. (11) We show ↑ Γ <: Γ. (a) Since Dom(↑ Γ) = Dom(Γ), we have Dom(↑ Γ) ⊇ Dom(Γ). (b) Let x ∈ Dom(Γ). By Proposition C.1 (10), we have ↑ Γ(x) = Γ(x). (c) Dom(↑ Γ) = Dom(Γ). Then Dom(↑ Γ) \ Dom(Γ) = ∅. Thus, Definition 3.12 (c) holds obviously.

Proposition C.3. For type environments Γ0 and Γ1 , if Γ0 <: Γ1 and rel(Γ0 ), then rel(Γ1 ). Proof. Straightforward. Lemma C.4. Let Γ, ∆ be type environments and L be a lattice of secrecy levels. Assume that both Γ k L and ∆ k L are l-secure. Then: (1) Γ | ∆ k L is l-secure. (2) ∗Γ k L is l-secure. (3) ↑(tI ,tO ) Γ k L is l-secure. (4) ↑ Γ k L is l-secure. Proof. Straightforward.

Appendix D. The details of proof of subject reduction D.1. Inversion lemma Lemma D.1 (Inversion). Assume that Γ k L ▷m P is l-securely derivable. (1) If P ≡ 0, then Γ <: ∅. (2) If P ≡ P0 | P1 , then there exist two type environments Γ00 , Γ01 , and m0 ∈ L such that Γ <: Γ00 | Γ01 , L0 v L, and m ≤L m0 and Γ0i k L0 ▷m′ Pi is l-securely derivable for each i = 0, 1.

(3) If P ≡ x!(ṽ).P0 , then there exist a type environments Γ0 , secrecy levels l0 , m0 ∈ L, types τ̃ , a usage U and l tc ∈ N ∪ {∞} such that Γ <: Γ00 , m ≤L l0 , and m ≤L m0 , Γ0 , x : hτ̃ i 0 /U k L ▷m0 P0 is l-securely derivable, l Γ00 k L is l-secure, and tc = ∞ implies l0 ≤L m0 , where Γ00 ≡ ↑(tc +1,tc +1) Γ0 | ṽ : ↑ τ̃ | x : hτ̃ i 0 /Ot0c U . (4) If P ≡ x?(ỹ).P0 , then there exist a type environments Γ0 , secrecy levels l0 , m0 ∈ L, types τ̃ , a usage U and l tc ∈ N ∪ {∞} such that Γ <: Γ00 , m ≤L l0 , and m ≤L m0 hold, Γ0 , x : hτ̃ i 0 /U , ỹ : τ̃ k L ▷m0 P0 is l-securely l derivable, Γ00 k L is l-secure, and tc = ∞ implies l0 ≤L m0 , where Γ00 ≡ ↑(tc +1,tc +1) Γ0 , x : hτ̃ i 0 /It0c U . (5) If P ≡ ∗P0 , then there exist a type environments Γ0 , and m0 ∈ L such that m ≤L m0 , and Γ <: ∗Γ0 , and Γ0 k L ▷m′ P0 is l-securely derivable. (6) If P ≡ (νx : ξ)P0 , then there exist a type environments Γ0 , a usage U , and m0 ∈ L such that m ≤L m0 , rel(U ) 0 0 and Γ <: Γ , and Γ , x : ξ/U k L ▷m′ P0 is l-securely derivable. (7 ) If P ≡ l˜1 < νl0 < l˜2 P0 , then there exist a type environments Γ0 , and m0 ∈ L such that m ≤L m0 and Γ <: Γ0 , m0 ≤L l0 for any l0 ∈ l˜1 , l˜2 , and Γ0 k l˜1 < νl0 < l˜2 L ▷m′ P0 is l-securely derivable. (8) If P ≡ if v then Q0 else Q1 , then there exist a type environments Γ0 , and m0 ∈ L such that m ≤L m0 , and ′ Γ <: Γ0 | v : Boolm , and Γ0 k L ▷m′ Q0 and Γ0 k L ▷m′ Q1 are l-securely derivable. Proof. By induction on the size of derivation tree of Γ k L ▷m P . Lemma D.2. If Γ k L ▷m P is l-securely derivable and x ∈ / FV(P ), then Γ0 k L ▷m P is l-securely derivable and 0 0 Γ <: Γ , where Γ is the restriction of Γ to (Dom(Γ) \ {x}). Proof. By induction on the size of derivation tree of Γ k L ▷m P . Lemma D.3. If Γ k L ▷m P is l-securely derivable and x ∈ FV(P ), then x ∈ Dom(Γ). Proof. By induction on a derivation tree of Γ k L ▷m P .

D.2. Proof of Lemma 4.2 We show Lemma 4.2. Let P and P 0 be processes, Γ be a type environment, L be a lattice of secrecy levels. Let m ∈ L. Assume that Γ k L ▷m P is l-securely derivable and P P 0 . We show that Γ k L ▷m P 0 is l-securely derivable. The proof is by induction on the construction of P P 0 . We consider cases according to the last rule of the construction of P P 0 . Case 1. If P 0 ≡ P , the assumptions immediately imply that Γ k L ▷m P 0 is l-securely derivable. Case 2. Assume that there exists a process P 00 such that P P 00 and P 00 P 0 . By the induction hypothesis, Γ k L ▷m P 00 is l-securely derivable. Then P 00 P 0 and the induction hypothesis imply that Γ k L ▷m P 0 is l-securely derivable. Case 3. (SP-Zero1). Assume P 0 ≡ P | 0. By assumption, there exists an ¯l-secure derivation tree π of Γ k L ▷m P . Then, we have an l-secure derivation tree as follows: π Γ k L ▷m P

∅ k L ▷m 0

(T-Zero) .

Γ | ∅ k L ▷m P | 0 0

Since Γ | ∅ ≡ Γ, we see that Γ k L ▷m P is l-securely derivable. Assume P ≡ P 0 | 0. By Lemma D.1 (2), there exist two type environments Γ00 , Γ01 , and m0 ∈ L such that Γ <: Γ00 | Γ01 , and m ≤L m0 and both Γ00 k L ▷m′ P 0 and Γ01 k L ▷m′ 0 are an l-securely derivable. By Lemma D.1 (1), we have Γ01 <: ∅. By Proposition C.2 (4), Γ00 |Γ01 <: Γ00 |∅. Since Γ00 | ∅ ≡ Γ00 , we have Γ00 |Γ01 <: Γ00 . By Γ <: Γ00 |Γ01 , we have Γ <: Γ00 . Let π 0 be an l-secure derivation tree of Γ00 k L ▷l′ P 0 . Then, we have an l-secure derivation tree as follows: π0 Γ00 k L ▷m′ P 0

Γ <: Γ00 Γ k L ▷m P 0

m ≤ L m0

. (T-Weak)

Thus, we see that Γ k L ▷m P 0 is derivable. Case 4. (SP-Zero2). Assume P ≡ 0 and P 0 ≡ (νx : ξ)0. By Lemma D.1 (1), Γ <: ∅. We have an l-secure derivation tree as follows: ∅ k L ▷m 0

(T-Zero) ∅ k L ▷m P

x : ξ/0 <: ∅

(T-Weak)

Γ <: ∅

Γ k L ▷m P 0

. (T-Weak)

Thus, we see that Γ k L ▷m P 0 is l-securely derivable. Assume P ≡ (νx : ξ)0 and P 0 ≡ 0. By Lemma D.1 (6), there exist a type environments Γ0 , a usage U , and 0 m ∈ L such that m ≤L m0 , rel(U ) and Γ <: Γ0 , and Γ0 , x : ξ/U k L ▷m′ 0 is l-securely derivable. By Lemma D.1 (1), Γ0 , x : ξ/U <: ∅. By Definition 3.12 (c), we have ob (ξ/U ) = ∞. Then Γ0 <: Γ0 , x : ξ/U . Hence, we have Γ0 <: ∅. Therefore, Γ <: ∅. We have an l-secure derivation tree as follows: ∅ k L ▷m 0

(T-Zero)

Γ <: ∅

Γ k L ▷m P

m ≤L m

(T-Weak) .

Thus, we see that Γ k L ▷m P 0 is l-securely derivable. Case 5. (SP-Commut). Assume P ≡ P0 | P1 and P 0 ≡ P1 | P0 . By Lemma D.1 (2), there exist two type environments Γ00 , Γ01 , and m0 ∈ L such that Γ <: Γ00 | Γ01 and m ≤L m0 , and Γ0i k L ▷m′ Pi is l-securely derivable for each i = 0, 1. By Proposition C.2 (1), Γ00 | Γ01 <: Γ01 | Γ00 . Hence, Γ <: Γ01 | Γ00 . Let πi be an l-secure derivation tree of Γ0i k L ▷m′ Pi for each i = 0, 1. Then, we have an l-secure derivation tree as follows: π1

π0

Γ01 k L ▷m′ P1

Γ00 k L ▷m′ P0 0 0 Γ 1 | Γ 0 k L ▷ m ′ P1 | P0

(T-Par)

Γ k L ▷m P

Γ <: Γ01 | Γ00

m ≤L m

(T-Weak)

Thus, we see that Γ k L ▷m P 0 is l-securely derivable. In case P ≡ P1 | P0 and P 0 ≡ P0 | P1 , we have an l-secure derivation tree of Γ k L ▷m P 0 in the same way. Case 6. (SP-Assoc). Assume P ≡ (P0 | P1 ) | P2 and P 0 ≡ P0 | (P1 | P2 ). By Lemma D.1 (2), there exist two type environments Γ001 , Γ02 , and m0 ∈ L such that Γ <: Γ001 | Γ02 , and m ≤L m0 and Γ001 k L ▷m′ P0 | P1 and Γ02 k L ▷m′ P2 are l-securely derivable. Because Γ001 k L ▷m′ P0 | P1 is l-securely derivable, Lemma D.1 (2) implies that there exist two type environments Γ000 , Γ001 , and m00 ∈ L such that Γ001 <: Γ00 | Γ01 , and m0 ≤L m00 and Γ00i k L ▷m′′ Pi is l-securely derivable for each i = 0, 1. By Proposition C.2 (4) and transitivity of <:, we have Γ <: (Γ000 | Γ001 ) | Γ02 . By Proposition C.2 (5) and transitivity of <:, we see Γ <: Γ000 | (Γ001 | Γ02 ). Let πi be an l-secure derivation tree of Γ00i k L ▷m′′ Pi for each i = 0, 1. Let π2 be an l-secure derivation tree of Γ02 k L ▷m′ P2 . Then, we have an l-secure derivation tree as follows: π1 π0 Γ000 k L ▷m′′ P0 Γ000 k L ▷m′ P0

Γ001 k L ▷m′′ P1

(T-Weak)

Γ001 k L ▷m′ P1

π2

(T-Weak)

Γ02 k L ▷m′ P2

Γ001 | Γ02 k L ▷m′ P1 | P2

Γ000 | (Γ001 | Γ02 ) k L ▷m′ P0 | (P1 | P2 ) Γ k L ▷m P 0

(T-Par)

(T-Weak)

Thus, we see that Γ k L ▷m P 0 is l-securely derivable. Case 7. (SP-New). Assume P ≡ (νx : ξ)(P0 ) | P1 , P 0 ≡ (νx : ξ)(P0 | P1 ), and x ∈ / FN(P1 ). By Lemma D.1 (2), there exist two type environments Γ00 , Γ01 , and m0 ∈ L such that Γ <: Γ00 | Γ01 , and m ≤L m0 and Γ00 k L ▷m′ (νx : ξ)P0 and Γ01 k L ▷m′ P1 are l-securely derivable. Because Γ00 k L ▷m′ (νx : ξ)P0 is l-securely derivable, Lemma D.1 (6) implies that there exist a type environments Γ000 , a usage U , and m00 ∈ L such that m0 ≤L m00 , rel(U ) and Γ00 <: Γ000 , and Γ000 , x : ξ/U k L ▷m′′ P0 is l-securely derivable. Since Γ01 k L ▷m′ P1 is l-securely derivable, and x ∈ / FN(P1 ),

Lemma D.2 implies that Γ001 k L ▷m′ P1 is l-securely derivable and Γ01 <: Γ001 , where Γ001 is the restriction of Γ01 to (Dom(Γ01 ) \ {x}). Then (Γ000 , x : ξ/U ) | Γ001 ≡ (Γ000 | Γ001 ), x : ξ/U . Since Γ00 <: Γ000 and Γ01 <: Γ001 , Proposition C.2 (4) implies that Γ00 | Γ01 <: Γ000 | Γ001 . By transitivity of <:, we have Γ <: Γ000 | Γ001 . Let π0 be an l-secure derivation tree of Γ000 , x : ξ/U k L ▷m′′ P0 , and π1 be an l-secure derivation tree of Γ001 k L ▷m′ P1 . Then, we have an l-secure derivation tree as follows: π0

π1

Γ000 , x : ξ/U k L ▷m′′ P0

Γ001 k L ▷m′′ P1

(Γ000 | Γ001 ), x : ξ/U k L ▷m′ P0 | P1 Γ000 | Γ001 k L ▷m′ (νx : ξ)(P0 | P1 )

(T-Par) .

(T-New) (T-Weak)

Γ k L ▷m P 0

Thus, we see that Γ k L ▷m P 0 is l-securely derivable. The case P = (νx : ξ)(P0 | P1 ), P 0 = (νx : ξ)(P0 ) | P1 , and x ∈ / FN(P1 ) is straightforward. ′′ Case 8. (SP-IfT). Assume P = if truem then P0 else P1 and P 0 = P0 . By Lemma D.1 (8), there exist a type ′′ ′ environments Γ0 and m0 ∈ L such that m ≤L m0 , and Γ <: Γ0 | truem : Boolm , and Γ0 k L ▷m′ P0 and Γ0 k L ▷m′ P1 ′ ′ m′′ m′′ 00 are l-securely derivable. Since the type of true is Bool , we see m = m0 and Γ0 | truem : Boolm = Γ0 . Hence, 0 0 Γ <: Γ . Let π be an l-secure derivation tree of Γ k L ▷m′ P0 . Then, we have an l-secure derivation tree as follows: π Γ 0 k L ▷ m ′ P0 Γ k L ▷m P 0

. (T-Weak)

Thus, we see that Γ k L ▷m P 0 is l-securely derivable. ′′ Case 9. (SP-IfF). Assume P = if falsem then P0 else P1 and P 0 = P1 . By Lemma D.1 (8), there exist a type ′′ ′ environments Γ0 , and m0 ∈ L such that m ≤L m0 , and Γ <: Γ0 |falsem : Boolm , and Γ0 k L ▷m′ P0 and Γ0 k L ▷m′ P1 ′ ′′ ′ m′′ are l-securely derivable. Since the type of false is Boolm , we see m00 = m0 and Γ0 | falsem : Boolm = Γ0 . Hence, 0 0 Γ <: Γ . Let π be an l-secure derivation tree of Γ k L ▷m P1 . Then, we have an l-secure derivation tree as follows: π Γ 0 k L ▷ m ′ P1 Γ k L ▷m P 0

. (T-Weak)

Thus, we see that Γ k L ▷m P 0 is l-securely derivable. Case 10. (SP-Rep). Assume P = ∗P0 and P 0 = ∗P0 | P0 . By Lemma D.1 (5), there exist a type environments Γ0 , and m0 ∈ L such that m ≤L m0 , and Γ <: ∗Γ0 , and Γ0 k L ▷m′ P0 is l-securely derivable. By Proposition C.2 (7), we have ∗Γ0 <: ∗Γ0 | Γ0 . Hence, we have Γ <: ∗Γ0 | Γ0 . Let π be an l-secure derivation tree of Γ0 k L ▷m′ P0 . Then, we have an l-secure derivation tree as follows: π Γ 0 k L ▷ m ′ P0 ∗Γ0 k L ▷m′ ∗P0

(T-Rep)

Γ 0 k L ▷ m ′ P0

∗Γ0 | Γ0 k L ▷m′ ∗P0 | P0 Γ k L ▷m P 0

. (T-Par)

(T-Weak)

Thus, we see that Γ k L ▷m P 0 is l-securely derivable. Case 11. (SP-Par). Assume P = P0 | Q and P 0 = P1 | Q with P0 P1 . By Lemma D.1 (2), there exist two type environments Γ0 , Γ00 , and m0 ∈ L such that Γ <: Γ0 | Γ00 , and m ≤L m0 and Γ0 k L ▷m′ P0 and Γ00 k L ▷m′ Q are l-securely derivable. Since P0 P1 , the induction hypothesis implies that Γ0 k L ▷m′ P1 is l-securely derivable. Let

π1 be an l-secure derivation tree of Γ0 k L ▷m′ P1 , and π be an l-secure derivation tree of Γ00 k L ▷m′ Q. Then, we have an l-secure derivation tree as follows: π1

Γ0 k L ▷m′ P1 0

Γ00 k L ▷m′ Q

Γ | Γ k L ▷ m ′ P1 | Q Γ k L ▷m P 0

(T-Par)

(T-Weak)

Thus, we see that Γ k L ▷m P 0 is l-securely derivable. Case 12. (SP-CNew). Assume P = (νx : ξ)P0 and P 0 = (νx : ξ)P1 with P0 P1 . By Lemma D.1 (6), there exist a type environments Γ0 , a usage U , and m0 ∈ L such that m ≤L m0 , rel(U ) and Γ <: Γ0 , and Γ0 , x : ξ/U k L ▷m′ P0 is l-securely derivable. Since P0 P1 , the induction hypothesis implies that Γ0 , x : ξ/U k L ▷m′ P1 is l-securely derivable. Let π1 be an l-secure derivation tree of Γ0 , x : ξ/U k L ▷m′ P1 . Then, we have an l-secure derivation tree as follows: π1 Γ0 , x : ξ/U k L ▷m′ P1 0

Γ k L ▷m′ (νx : ξ)P1 Γ k L ▷m P 0

(T-New)

(T-Weak)

Thus, we see that Γ k L ▷m P 0 is l-securely derivable.

D.3. Proof of substitution lemma Lemma D.4. For type environments Γ0 , Γ1 , a tuple of variables x̃ = (x0 , . . . , xn ), and values ṽ = (v0 , . . . , vn ), if Γ0 [x̃ 7→ ṽ] is well-defined and Γ0 <: Γ1 , then Γ1 [x̃ 7→ ṽ] is well-defined and Γ0 [x̃ 7→ ṽ] <: Γ1 [x̃ 7→ ṽ]. Proof. For type environments Γ0 , Γ1 , a tuple of variables x̃ = (x0 , . . . , xn ), and values ṽ = (v0 , . . . , vn ), assume that Γ0 [x̃ 7→ ṽ] is well-defined and Γ0 <: Γ1 . Let Dj = (Dom(Γj ) \ {x0 , . . . , xn }) ∪ {vi | xi ∈ Dom(Γj )}

for j = 0, 1. We note that D0 ⊇ D1 because of Dom(Γ0 ) ⊇ Dom(Γ1 ). We show that Γ1 [x̃ 7→ ṽ] is well-defined. By the assumption Γ0 <: Γ1 , we have Dom(Γ0 ) ⊇ Dom(Γ1 ) and Γ0 (w) <: Γ1 (w) for each w ∈ Dom(Γ0 ). For each w ∈ Dom(Γ1 ), by Γ0 (w) <: Γ1 (w), we have Γ0 (w) ∼ Γ1 (w). Let w ∈ D1 . When w ∈ / ṽ holds, Γ1 [x̃ 7→ ṽ](w) is defined as Γ1 (w). Assume that w ∈ ṽ , w ∈ / Dom(Γ1 ), and {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ1 )} = {xj0 , . . . , xjk } with 0 ≤ j0 < · · · < jk ≤ n. We show Γ1 (xi0 ) ∼ Γ1 (x D1 ⊆ D0 , we have w ∈ D0 . Let i1 ) for any i0 , i1 ∈ {j00, . . . , jk }. From 0 ′ ′ {xi ∈ x̃ | w =vi and xi ∈ Dom (Γ )} = x , . . . , x with 0 ≤ j < · · · < j ≤ n . Since Γ0 [x̃ 7→ ṽ] is well-defined, 0 jl 0 l j0 either Γ0 xj0′ | · · · | Γ0 xjk′ or Γ0 xj0′ | · · · | Γ0 xjl′ | Γ(w) is defined. Hence, Γ0 (xi0 ) ∼ Γ0 (xi1 ) for any i0 , i1 ∈ {0, . . . , l}. Since {xj0 , . . . , xjk } ⊆ xj0′ , . . . , xjl′ , we have Γ0 (xi0 ) ∼ Γ0 (xi1 ) for any i0 , i1 ∈ {0, . . . , k}. Since Γ0 (x) ∼ Γ1 (x) for each x ∈ Dom(Γ1 ), we see that Γ1 (xi0 ) ∼ Γ0 (xi0 ) ∼ Γ0 (xi1 ) ∼ Γ1 (xi1 ). Therefore, Γ1 (xj0 ) | · · · | Γ1 (xjk ) is defined. Thus, Γ1 [x̃ 7→ ṽ](w) is defined. In a similar way, we can show that Γ1 [x̃ 7→ ṽ](w) is defined in case w ∈ ṽ and w ∈ Dom(Γ1 ). We show Γ0 [x̃ 7→ ṽ] <: Γ1 [x̃ 7→ ṽ]. (a) We see Dom(Γ0 [x̃ 7→ ṽ]) ⊇ Dom(Γ1 [x̃ 7→ ṽ]) because of Dom(Γj [x̃ 7→ ṽ]) = Dj for j = 0, 1. (b) We show Γ0 [x̃ 7→ ṽ](w) <: Γ1 [x̃ 7→ ṽ](w) for each w ∈ Dom(Γ1 [x̃ 7→ ṽ]). Let w ∈ Dom(Γ1 [x̃ 7→ ṽ]). When w ∈ / ṽ , we have Γ0 [x̃ 7→ ṽ](w) = Γ0 (w) <: Γ1 (w) = Γ1 [x̃ 7→ ṽ](w). Assume that w ∈ ṽ , w ∈ / Dom(Γ1 ), and {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ1 )} = {xj0 , . . . , xjk } with 0 ≤ j0 < · · · < jk ≤ n. Then, we have Γ1 [x̃ 7→ ṽ](w) = Γ1 (xj0 ) | · · · | Γ1 (xjk ). Assume {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ1 )} = {y0 , . . . , yk } ∪ {z0 , . . . , zl }. By Proposition C.1 (1) and (2), we have Γ0 [x̃ 7→ ṽ](w) <: Γ0 (y0 ) | · · · | Γ0 (yk ) | Γ0 (z0 ) | · · · | Γ0 (zl ). Since zi ∈ Dom(Γ0 ) \ Dom(Γ1 ) for i = 0, . . . , l, we have ob (Γ0 [x̃ 7→ ṽ](zi )) = ∞. By Proposition C.1 (5), we have Γ0 (y0 ) | · · · | Γ0 (yk ) | Γ0 (z0 ) | · · · | Γ0 (zl ) <: Γ0 (y0 ) | · · · |

Γ0 (yk ). Since Γ0 (w) <: Γ1 (w) for any w ∈ Dom(Γ1 ), we have Γ0 (yi ) <: Γ1 (yi ) for i = 0, . . . , k . From Proposition C.1 (3), we have Γ0 (y0 ) | · · · | Γ0 (yk ) <: Γ1 (y0 ) | · · · | Γ1 (yk ). Then, we see Γ0 [x̃ 7→ ṽ](w) <: Γ1 [x̃ 7→ ṽ](w). In a similar way, we can show Γ0 [x̃ 7→ ṽ](w) <: Γ1 [x̃ 7→ ṽ](w) in case w ∈ ṽ and w ∈ Dom(Γ1 ). (c) We show ob (Γ0 [x̃ 7→ ṽ](w)) = ∞ for each w ∈ Dom(Γ0 [x̃ 7→ ṽ]) \ Dom(Γ1 [x̃ 7→ ṽ]). Assume w ∈ Dom(Γ0 [x̃ 7→ ṽ]) \ Dom(Γ1 [x̃ 7→ ṽ]). Assuming w ∈ / ṽ , we have w ∈ Dom(Γ0 ) \ Dom(Γ1 ). In case, we have ob (Γ0 [x̃ 7→ ṽ](w)) = ob (Γ0 (w)) = ∞ because of Γ0 <: Γ1 . Now, assume w ∈ ṽ and w ∈ / Dom(Γ0 ). By w ∈ Dom(Γ0 [x̃ 7→ ṽ]), we see that X = {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ0 )}

is not empty. Assume X = {xj0 , . . . , xjk } with 0 ≤ j0 < · · · < jk ≤ n. Then, we have Γ0 [x̃ 7→ ṽ](w) = / Dom(Γ1 [x̃ 7→ ṽ]), we see that {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ1 )} is empty. Hence, Γ0 (xj0 ) | · · · | Γ0 (xjk ). By w ∈ xji ∈ / Dom(Γ1 ) for i = 0, . . . , k . Therefore, ob (Γ0 (xji )) = ∞ for i = 0, . . . , k . Thus, ob (Γ0 [x̃ 7→ ṽ](w)) = ∞. Now, assume w ∈ ṽ and w ∈ Dom(Γ0 ). Let {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ0 )} = {xj0 , . . . , xjk }. Then, we have Γ0 [x̃ 7→ ṽ](w) = Γ0 (xj0 ) | · · · | Γ0 (xjk ) | Γ0 (w). In a similar way to the case w ∈ / Dom(Γ0 ), we have ob (Γ0 (xji )) = ∞ for i = 0, . . . , k . Since w ∈ / Dom(Γ1 ), we have ob (Γ0 (w)) = ∞. Thus, ob (Γ0 [x̃ 7→ ṽ](w)) = ∞. Lemma D.5. (1) For a type environment Γ, a tuple of variables x̃ = (x0 , . . . , xn ), and values ṽ = (v0 , . . . , vn ), if (∗Γ)[x̃ 7→ ṽ] is well-defined, then Γ[x̃ 7→ ṽ] is well-defined and (∗Γ)[x̃ 7→ ṽ] <: ∗Γ[x̃ 7→ ṽ]. (2) For type environments Γ0 and Γ1 , a tuple of variables x̃ = (x0 , . . . , xn ), and values ṽ = (v0 , . . . , vn ), if (Γ0 | Γ1 )[x̃ 7→ ṽ] is well-defined, then Γ0 [x̃ 7→ ṽ] and Γ1 [x̃ 7→ ṽ] are well-defined, and (Γ0 | Γ1 )[x̃ 7→ ṽ] = (Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ]). Proof. We show each statement. (1) For a type environment Γ, a tuple of variables x̃ = (x0 , . . . , xn ), and values ṽ = (v0 , . . . , vn ), assume that (∗Γ)[x̃ 7→ ṽ] is well-defined. We show that Γ[x̃ 7→ ṽ] is well-defined. Let D = (Dom(Γ) \ {x0 , . . . , xn }) ∪ {vi | xi ∈ Dom(Γ)}. Since Dom(∗Γ) = Dom(Γ) and (∗Γ)[x̃ 7→ ṽ] is well-defined, Dom((∗Γ)[x̃ 7→ ṽ]) = D. Let w ∈ D. When w ∈ / ṽ holds, Γ[x̃ 7→ ṽ](w) = Γ(w). Hence, Γ[x̃ 7→ ṽ](w) is defined. Assume that w ∈ ṽ , w ∈ / Dom(Γ), and {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ)} = {xj0 , . . . , xjk } with 0 ≤ j0 < · · · < jk ≤ n. In this case, w ∈ / Dom(∗Γ). Then (∗Γ)[x̃ 7→ ṽ](w) = (∗Γ)(xj0 ) | · · · | (∗Γ)(xjk ). Since (∗Γ)[x̃ 7→ ṽ] is well-defined, ∗Γ(xj0 ) | · · · | ∗Γ(xjk ) is defined. Then, we can show that Γ(xj0 ) | · · · | Γ(xjk ) is defined. Therefore, Γ[x̃ 7→ ṽ](w) is defined and Γ[x̃ 7→ ṽ](w) = Γ(xj0 ) | · · · | Γ(xjk ). In a similar way, we can show that Γ[x̃ 7→ ṽ](w) is defined in case w ∈ ṽ and w ∈ Dom(Γ). We show (∗Γ)[x̃ 7→ ṽ] <: ∗Γ[x̃ 7→ ṽ]. (a) We have Dom((∗Γ)[x̃ 7→ ṽ]) = D = Dom(Γ[x̃ 7→ ṽ]) = Dom(∗Γ[x̃ 7→ ṽ]). Hence, Dom((∗Γ)[x̃ 7→ ṽ]) ⊇ Dom(∗Γ[x̃ 7→ ṽ]). (b) Let w ∈ Dom(∗Γ[x̃ 7→ ṽ]). Then w ∈ D. In case w ∈ / ṽ , we have (∗Γ)[x̃ 7→ ṽ](w) = ∗Γ(w) = ∗Γ(w) = ∗Γ[x̃ 7→ ṽ](w).

Then, we have (∗Γ)[x̃ 7→ ṽ](w) <: ∗Γ[x̃ 7→ ṽ](w). Assume that w ∈ ṽ , w ∈ / Dom(Γ), and {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ1 )} = {xj0 , . . . , xjk } with 0 ≤ j0 < · · · < jk ≤ n. Then Γ[x̃ 7→ ṽ](w) = Γ(xj0 ) | · · · | Γ(xjk ) and (∗Γ)[x̃ 7→ ṽ](w) = (∗Γ)(xj0 ) | · · · | (∗Γ)(xjk ) = ∗Γ(xj0 ) | · · · | ∗Γ(xjk ). We also have ∗Γ[x̃ 7→ ṽ](w) = ∗Γ(xj0 ) | · · · | Γ(xjk ). By Proposition C.1 (8), we have ∗Γ(xj0 ) | · · · | ∗Γ(xjk ) <: ∗Γ(xj0 ) | · · · | Γ(xjk ).

Thus, (∗Γ)[x̃ 7→ ṽ](w) <: ∗Γ[x̃ 7→ ṽ](w). In a similar way, we can show (∗Γ)[x̃ 7→ ṽ](w) <: ∗Γ[x̃ 7→ ṽ](w) in case w ∈ ṽ and w ∈ Dom(Γ). (c) Because Dom((∗Γ)[x̃ 7→ ṽ]) = Dom(∗Γ[x̃ 7→ ṽ]), Definition 3.12 (c) holds obviously.

(2) For type environments Γ0 and Γ1 , a tuple of variables x̃ = (x0 , . . . , xn ), and values ṽ = (v0 , . . . , vn ), assume that (Γ0 | Γ1 )[x̃ 7→ ṽ] is well-defined. We show that Γ0 [x̃ 7→ ṽ] is well-defined. Let D0 = (Dom(Γ0 ) \ {x0 , . . . , xn }) ∪ {vi | xi ∈ Dom(Γ0 )}. Let w ∈ D0 . When w ∈ / ṽ holds, Γ0 [x̃ 7→ ṽ](w) = Γ0 (w). Assume that w ∈ ṽ , w ∈ / Dom(Γ0 ), and {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ0 )} = {xj0 , . . . , xjk } with 0 ≤ j0 < · · · < jk ≤ n. Let {xi ∈ x̃ | w = vi and xi ∈ Dom(Γ0 | Γ1 )} = xj0′ , . . . , xjl′ with 0 ≤ j00 < · · · < jl0 ≤ n. Since (Γ0 | Γ1 )[x̃ 7→ ṽ] is well-defined, we have (Γ0 | Γ1 )[x̃ 7→ ṽ](w) = (Γ0 | Γ1 ) xj0′ | · · · | (Γ0 | Γ1 ) xjl′ . Since {xj0 , . . . , xjk } ⊆ xj0′ , . . . , xjl′ , we see that Γ0 (xji ) is defined for each i = 0, . . . , k . Then, we have Γ0 [x̃ 7→ ṽ](w) = Γ0 (xj0 ) | · · · | Γ0 (xjk ). Thus, Γ0 [x̃ 7→ ṽ](w) is defined. In a similar way, we can show that Γ0 [x̃ 7→ ṽ](w) is defined in case w ∈ ṽ and w ∈ Dom(Γ0 ). Thus, we see that Γ0 [x̃ 7→ ṽ] is well-defined. In a similar way to the case Γ0 [x̃ 7→ ṽ], we can show that Γ1 [x̃ 7→ ṽ] is well-defined. We show (Γ0 | Γ1 )[x̃ 7→ ṽ] = (Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ]). Let Di = (Dom(Γi ) \ {x0 , . . . , xn }) ∪ {vi | xi ∈ Dom(Γi )}

for i = 0, 1. Then Dom((Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ])) = D0 ∪ D1 . Since (Γ0 | Γ1 )[x̃ 7→ ṽ] is well-defined, we have Dom((Γ0 | Γ1 )[x̃ 7→ ṽ]) = (Dom(Γ0 | Γ1 ) \ {x0 , . . . , xn }) ∪ {v0 , . . . , vn } = ((Dom(Γ0 ) ∪ Dom(Γ1 )) \ {x0 , . . . , xn }) ∪ {v0 , . . . , vn }. Then ((Dom(Γ0 ) ∪ Dom(Γ1 )) \ {x0 , . . . , xn }) ∪ {v0 , . . . , vn } = ((Dom(Γ0 ) \ {x0 , . . . , xn }) ∪ (Dom(Γ1 ) \ {x0 , . . . , xn })) ∪ {v0 , . . . , vn } = ((Dom(Γ0 ) \ {x0 , . . . , xn }) ∪ {v0 , . . . , vn }) ∪ ((Dom(Γ1 ) \ {x0 , . . . , xn }) ∪ {v0 , . . . , vn }) = D0 ∪ D1 .

Hence, (Γ0 | Γ1 )[x̃ 7→ ṽ](w) <: (Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ])(w). Assume that w ∈ ṽ , w ∈ / Dom((Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ])), and {xi ∈ x̃ | w = vi and xi ∈ Dom((Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ]))} = {xj0 , . . . , xjk }

with 0 ≤ j0 < · · · < jk ≤ n. Then (Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ])(w) = (Γ0 | Γ1 )(xj0 ) | · · · | (Γ0 | Γ1 )(xjk )

and (Γ0 | Γ1 )[x̃ 7→ ṽ](w) = (Γ0 | Γ1 )(xj0 ) | · · · | (Γ0 | Γ1 )(xjk ).

Hence, (Γ0 | Γ1 )[x̃ 7→ ṽ](w) = (Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ])(w). In a similar way, we can show (Γ0 | Γ1 )[x̃ 7→ ṽ](w) = (Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ])(w) in case w ∈ ṽ and w ∈ Dom((Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ])). Proof of Lemma 4.4. Assume that Γ k L ▷m P is l-securely derivable, and Γ[x̃ 7→ ṽ] is well-defined. Let x̃ = (x0 , . . . , xn ), ṽ = (v0 , . . . , vn ), τi = Γ(xi ) for i = 0, . . . , n, and τ̃ = (τ0 , . . . , τn ). We show the statement by induction on an l-secure derivation tree of Γ k L ▷m P . We proceed by a case analysis of the rule used at the root. Case 1. Assume that the rule used at the root is (T-Zero). Then Γ = Γ[x̃ 7→ ṽ] = ∅ and P = P [x̃ 7→ ṽ] = 0. Thus, Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ] is l-securely derivable.

Case 2. Assume that the rule used at the root is (T-New). Assume that Γ, y : ξ/U k L ▷m P 0 is the assumption of the rule instance, where P = (νy : ξ)P 0 and rel(U ) with y ∈ / x̃. Then, we see that Γ, y : ξ/U k L ▷m P 0 is l-securely derivable. By the induction hypothesis, Γ[x̃ 7→ ṽ], y : ξ/U k L ▷m P 0 [x̃ 7→ ṽ] is l-securely derivable. Let π be an l-secure derivation tree of Γ[x̃ 7→ ṽ], y : ξ/U k L ▷m P 0 [x̃ 7→ ṽ]. Then, we have an l-secure derivation tree as follows: π

Γ[x̃ 7→ ṽ], y : ξ/U k L ▷m P 0 [x̃ 7→ ṽ] (T-New) Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ]

Thus, Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ] is l-securely derivable. Case 3. Assume that the rule used at the root is (T-Rep). Assume that Γ0 k L ▷m P 0 is the assumption of the rule instance, where P = ∗P 0 and Γ = ∗Γ0 . Then, we see that Γ0 k L ▷m P 0 is l-securely derivable. By the induction hypothesis, Γ0 [x̃ 7→ ṽ] k L ▷m P 0 [x̃ 7→ ṽ] is l-securely derivable. By Lemma D.5 (1), Γ0 [x̃ 7→ ṽ] is well-defined and (∗Γ0 )[x̃ 7→ ṽ] <: ∗Γ0 [x̃ 7→ ṽ]. Let π be an l-secure derivation tree of Γ0 [x̃ 7→ ṽ] k L ▷m P 0 [x̃ 7→ ṽ]. Then, we have an l-secure derivation tree as follows: π Γ0 [x̃ 7→ ṽ] k L ▷m P 0 [x̃ 7→ ṽ] ∗Γ0 [x̃ 7→ ṽ] k L ▷m ∗P 0 [x̃ 7→ ṽ] (∗Γ0 )[x̃ 7→ ṽ] k L ▷m ∗P 0 [x̃ 7→ ṽ]

(T-Rep)

(T-Weak)

Thus, Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ] is l-securely derivable. Case 4. Assume that the rule used at the root is (T-Par). Assume that Γ0 k L ▷m P0 and Γ1 k L ▷m P1 are the assumptions of the rule instance, where P = P0 | P1 and Γ = Γ0 | Γ1 . Then, we see that Γ0 k L ▷m P0 and Γ1 k L ▷m P1 are l-securely derivable. By the induction hypothesis, we see that Γ0 [x̃ 7→ ṽ] k L ▷m P0 [x̃ 7→ ṽ] and Γ1 [x̃ 7→ ṽ] k L ▷m P1 [x̃ 7→ ṽ] are l-securely derivable. By Lemma D.5 (2), we have (Γ0 | Γ1 )[x̃ 7→ ṽ] = (Γ0 [x̃ 7→ ṽ]) | (Γ1 [x̃ 7→ ṽ]). Let πi be an l-secure derivation tree of Γ0 [x̃ 7→ ṽ] k L ▷m P0 [x̃ 7→ ṽ] for i = 0, 1. Then, we have an l-secure derivation tree as follows: π0

π1

Γ0 [x̃ 7→ ṽ] k L ▷m P0 [x̃ 7→ ṽ]

Γ1 [x̃ 7→ ṽ] k L ▷m P1 [x̃ 7→ ṽ]

Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ]

. (T-Par)

Thus, Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ] is l-securely derivable. Case 5. Assume that the rule used at the root is (T-If). Assume that Γ0 k L ▷m Q0 and Γ0 k L ▷m Q1 are the assumptions of the rule instance, where P = if w then Q0 else Q1 and Γ = Γ0 | w : Booll . Then, we see that Γ0 k L ▷m Q0 and Γ0 k L ▷m Q1 are l-securely derivable. By the induction hypothesis, Γ0 [x̃ 7→ ṽ] k L ▷m Q0 [x̃ 7→ ṽ] and Γ0 [x̃ 7→ ṽ] k L ▷m Q1 [x̃ 7→ ṽ] are l-securely derivable. Let πi be an l-secure derivation tree of Γ0 [x̃ 7→ ṽ] k L ▷m Qi [x̃ 7→ ṽ] for each i = 0, 1. Then, we have an l-secure derivation tree as follows: π0

π1

Γ0 [x̃ 7→ ṽ] k L ▷m Q0 [x̃ 7→ ṽ]

Γ0 [x̃ 7→ ṽ] k L ▷m Q1 [x̃ 7→ ṽ]

Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ]

. (T-If)

Thus, Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ] is l-securely derivable. l Case 6. Assume that the rule used at the root is (T-Out). Assume that Γ0 , y : hτ̃ i 1 /U k L ▷m1 P 0 is the assumption l1 (tc +1,tc +1) 0 of the rule instance, where P = y!w̃.P , Γ = ↑ Γ0 | w̃ : ↑ τ̃ | y : hτ̃ i /Ot0c U , l ≤L l1 and l ≤L m1 and l1 tc = ∞ implies l1 ≤L m1 . Then, we see that Γ0 , y : hτ̃ i /U k L ▷m1 P 0 is l-securely derivable. By the induction l hypothesis, Γ0 [x̃ 7→ ṽ], y [x̃ 7→ ṽ] : hτ̃ i 1 /U k L ▷m1 P 0 [x̃ 7→ ṽ] is l-securely derivable. Let π be an l-secure derivation l1 tree of Γ0 [x̃ 7→ ṽ], y [x̃ 7→ ṽ] : hτ̃ i /U k L ▷m1 P 0 [x̃ 7→ ṽ]. Then, we have an l-secure derivation tree as follows:

π Γ0 [x̃ 7→ ṽ], y [x̃ 7→ ṽ] : hτ̃ i 1 /U k L ▷m1 P 0 [x̃ 7→ ṽ] (T-Out) Γ[x̃ 7→ ṽ] k L ▷m y [x̃ 7→ ṽ]!w̃[x̃ 7→ ṽ]. P 0 [x̃ 7→ ṽ] l

Thus, Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ] is l-securely derivable. l Case 7. Assume that the rule used at the root is (T-In). Assume that Γ0 , y : hτ̃ i 1 /U , z̃ : τ̃ k L ▷m1 P 0 is the l assumption of the rule instance, where l ≤L l1 , l ≤L m1 , P = y?z̃.P 0 , and Γ = ↑(tc +1,tc +1) Γ0 , y : hτ̃ i 1 /It0c U , and 0 0 0 tc = ∞ implies l1 ≤L m1 . We can assume z ∈ / x̃ and z ∈ / ṽ for any z ∈ z̃ . Since the assumption of the rule instance is l l l-securely derivable, we see that Γ0 , y : hτ̃ i 1 /U , z̃ : τ̃ k L ▷m1 P 0 is l-securely derivable. Let Γ0 = Γ0 , y : hτ̃ i 1 /U , z̃ : τ̃ . l Since we have z 0 ∈ / x̃ and z 0 ∈ / ṽ for any z 0 ∈ z̃ , we see that Γ0 [x̃ 7→ ṽ] = Γ0 [x̃ 7→ ṽ], y [x̃ 7→ ṽ] : hτ̃ i 1 /U , z̃ : τ̃ is welldefined. By the induction hypothesis, we see that Γ0 [x̃ 7→ ṽ] k L ▷m1 P 0 [x̃ 7→ ṽ] is l-securely derivable. Let π be an l-secure derivation tree of Γ0 [x̃ 7→ ṽ] k L ▷m1 P 0 [x̃ 7→ ṽ]. Then, we have an l-secure derivation tree as follows:

π Γ0 [x̃ 7→ ṽ] k L ▷m1 P 0 [x̃ 7→ ṽ] (T-In) Γ[x̃ 7→ ṽ] k L ▷m1 y [x̃ 7→ ṽ]?z̃. P 0 [x̃ 7→ ṽ]

Thus, Γ[x̃ 7→ ṽ] k L ▷l P [x̃ 7→ ṽ] is l-securely derivable. Case 8. Assume that the rule used at the root is (T-NewSec). Assume that Γ k l˜1 < νl0 < l˜2 L ▷m P 0 is the assumption of the rule instance, where P = l˜1 < νl0 < l˜2 P 0 and l0 ≤L ls for any l0 ∈ l˜1 , l˜2 . Then, we see that Γ k l˜1 < νl0 < l˜2 L ▷m P 0 is l-securely derivable. By the induction hypothesis, we see that Γ[x̃ 7→ ṽ] k l˜1 < νl0 < l˜2 L ▷m P 0 [x̃ 7→ ṽ] is l-securely derivable. Let π be an l-secure derivation tree of Γ[x̃ 7→ ṽ] k l˜1 < νl0 < l˜2 L ▷m P 0 [x̃ 7→ ṽ]. Then, we have an l-secure derivation tree as follows:

. Γ[x̃ 7→ ṽ] k l˜1 < νl0 < l˜2 L ▷m P 0 [x̃ 7→ ṽ] (T-NewSec) Γ[x̃ 7→ ṽ] k L ▷m l˜1 < νl0 < l˜2 P 0 [x̃ 7→ ṽ] Thus, Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ] is l-securely derivable. Case 9. Assume that the rule used at the root is (T-Weak). Assume that Γ0 k L ▷m′ P is the assumption of the rule instance, where Γ <: Γ0 and l ≤L m0 . Then, we see that Γ0 k L ▷m′ P is l-securely derivable. By the induction hypothesis, we see that Γ0 [x̃ 7→ ṽ] k L ▷m′ P [x̃ 7→ ṽ] is l-securely derivable. By Lemma D.4, Γ0 [x̃ 7→ ṽ] is well-defined and Γ[x̃ 7→ ṽ] <: Γ0 [x̃ 7→ ṽ]. Let π be an l-secure derivation tree of Γ0 [x̃ 7→ ṽ] k L ▷m′ P [x̃ 7→ ṽ]. Then, we have an l-secure derivation tree as follows:

π Γ0 [x̃ 7→ ṽ] k L ▷m′ P [x̃ 7→ ṽ] Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ]

Thus, Γ[x̃ 7→ ṽ] k L ▷m P [x̃ 7→ ṽ] is l-securely derivable.

. (T-Weak)

D.4. Proof of subject reduction Lemma D.6. For type environments Γ0 , Γ00 , and Γ1 , if Γ1 −→ Γ01 and Γ0 <: Γ1 , then there exists Γ00 such that Γ0 −→ Γ00 and Γ00 <: Γ01 . Proof. Since Γ1 −→ Γ01 , there exist a name x, a core channel type ξ , and usages U1 , U10 such that Γ1 (x) = ξ/U1 , Γ01 (x) = ξ/U10 , and U1 −→ U10 . Since Γ0 <: Γ1 , there exists a core channel type ξ , and a usage U0 such that Γ0 (x) = ξ/U0 and U0 <: U1 . By Definition 3.7 (b), there exists a usage U00 such that U0 −→ U00 and U00 <: U10 . Let Γ00 = Γ0 [x 7→ ξ/U00 ]. Then Γ0 −→ Γ00 and Γ00 <: Γ01 . Lemma D.7. For type environments Γ0 , Γ00 , and Γ1 , if Γ0 −→ Γ00 , then Γ0 | Γ1 −→ Γ00 | Γ1 . Proof. Since Γ0 −→ Γ00 , there exist a name x, a core channel type ξ , and usages U0 , U00 such that Γ0 (x) = ξ/U0 , Γ00 (x) = ξ/U00 , and U0 −→ U00 . Then Γ0 | Γ1 (x) = ξ/U0 or Γ0 | Γ1 (x) = ξ/U0 | U1 with some usage U1 . If Γ0 | Γ1 (x) = ξ/U0 , then we have Γ00 | Γ1 (x) = ξ/U00 . Hence, Γ0 | Γ1 −→ Γ00 | Γ1 . If Γ0 | Γ1 (x) = ξ/U0 | U1 with some usage U1 , then we have Γ00 | Γ1 (x) = ξ/U00 | U1 . Hence, Γ0 | Γ1 −→ Γ00 | Γ1 . Now, we prove Proposition 4.5. Proof of Proposition 4.5. Let P and P 0 be processes. Assume that Γ k L ▷m P is l-securely derivable and (P, L) −→ (P 0 , L0 ). We show that there exist a type environment Γ0 such that either Γ0 = Γ or Γ −→ Γ0 and Γ0 k L0 ▷m P 0 is l-securely derivable. We show the statement by induction on the construction of (P, L) −→ (P 0 , L0 ). We proceed by a case analysis of the last rule used to construct P −→ P 0 . Case 1. We consider the case (R-Com). In this case, P = x!(v0 , . . . , vn ).P0 | x?(y0 , . . . , yn ).P1 , P 0 = P0 | P1 [y0 7→ v0 , . . . , yn 7→ vn ], and L0 = L. Let ỹ = (y0 , . . . , yn ) and ṽ = (v0 , . . . , vn ). By Lemma D.1 (2), there exist two type environments Γ00 , Γ01 , and l0 ∈ L such that Γ <: Γ00 | Γ01 , and l ≤L 0 l , Γ00 k L ▷m′ x!(v0 , . . . , vn ).P0 and Γ01 k L ▷m′ x?(y0 , . . . , yn ).P1 are ˇl-securely derivable. By Lemma D.1 (3), 00 00 there exist a type environments Γ000 , l00 that Γ00 <: ∈ L, m01 ∈ L, types τ̃ , ausage U and tc ∈ N ∪ {∞} such ′′ ′′ l00 l00 (tc +1,tc +1) 00 (tc +1,tc +1) 00 00 00 0 Γ0 | ṽ : ↑ τ̃ | x : hτ̃ i /Ot0c U k L is ↑ Γ0 | ṽ : ↑ τ̃ | x : hτ̃ i /Otc U , l0 ≤L l00 , and l0 ≤L m01 , ↑ l′′

00 l-secure, and Γ000 , x : hτ̃ i 00 /U k L ▷m′′01 P0 is l-securely derivable, and tc = ∞ implies l00 ≤L m0001 . By Lemma D.1 00 00 00 0 0 ˜ (4), there a type environments Γ1 l10 ∈ L, m11 ∈ L, types τ , a usage U and t0c ∈ N ∪ {∞} such that exist ′′ ′′ ′ ′ t +1,t +1 ( ) Γ00 , x : τ˜0 l10 /I 0′ U 0 , l ≤ l00 , and l ≤ m00 , ↑(t′c +1,t′c +1) Γ00 , x : τ˜0 l10 /I 0′ U 0 k L is ˇlc Γ001 <: ↑ c 1 L 10 1 L 1 11 1 tc tc ′′

l 00 secure, Γ001 , x : τ˜0 10/U , ỹ : τ˜0 k L ▷m′′11 P1 is l-securely derivable, and t0c = ∞ implies l10 ≤L m0011 .

Since Γ00

l′′

l′′′

↑(tc +1,tc +1) Γ000 | ṽ : ↑ τ̃ | x : hτ̃ i 00 /Ot0c U , we have Γ00 (x) ∼ hτ̃ i 00 /Ot0c U . Since Γ01 <: ′ ′′′ ′′ ′ ˜0 l10 /I 0′ U 0 , we have Γ01 (x) ∼ τ˜0 l10 /I 0′ U 0 . Since Γ00 | Γ01 is defined, Γ00 (x) ∼ Γ01 (x). Hence, ↑(tc +1,tc +1) Γ000 1 ,x : τ tc tc <:

′′

l l 00 00 hτ̃ i 00 /Ot0c U ∼ τ˜0 10 /It0′c U 0 . Therefore, τ̃ = τ˜0 and l00 = l10 . ′′ l 00 Let π0 be an ˇl-secure derivation tree of Γ0 , x : hτ̃ i 00 /U k L ▷m′′01 P0 , and π1 be an ˇl-secure derivation tree of l′′ 00 Γ1 , x : hτ̃ i 00 /U , ỹ : τ̃ k L ▷m′′11 P1 . We have an l-secure derivation tree as follows:

π0 l′′

π1 l′′

Γ000 , x : hτ̃ i 00 /U k L ▷m′′01 P0

Γ001 , x : hτ̃ i 00 /U , ỹ : τ̃ k L ▷m′′11 P1

Γ̌0 k L ▷m0 x!(v0 , . . . , vn ).P0

Γ̌1 k L ▷m1 x?(y0 , . . . , yn ).P1

Γ̌0 k L ▷m′ x!(v0 , . . . , vn ).P0

Γ̌1 k L ▷m′ x?(y0 , . . . , yn ).P1

Γ̌0 | Γ̌1 k L ▷m′ x!(v0 , . . . , vn ).P0 | x?(y0 , . . . , yn ).P1 ′ ′ l′′ l′′ where Γ̌0 = ↑(tc +1,tc +1) Γ000 | ṽ : ↑ τ̃ | x : hτ̃ i 00 /Ot0c U 0 and Γ̌1 = ↑(tc +1,tc +1) Γ001 , x : hτ̃ i 00 /It0′c U 0 . Thus, we see that ′ ′ l′′ l′′ ↑(tc +1,tc +1) Γ000 | ṽ : ↑ τ̃ | x : hτ̃ i 00 /Ot0c U | ↑(tc +1,tc +1) Γ001 , x : hτ̃ i 00 /It0′c U 0 k L ▷m′ P

is l-securely derivable. Then

Hence, we have

′ ′ l′′ Γ <: ↑(tc +1,tc +1) Γ000 | ṽ : ↑ τ̃ | ↑(tc +1,tc +1) Γ001 | x : hτ̃ i 00 /(Ot0c U | It0′c U 0 ).

Since yi ∈ / Dom(Γ001 ), we have Γ001 [ỹ 7→ ṽ] = Γ001 . By Lemma 4.4, we see that l′′

Γ001 , x : hτ̃ i 00 /U 0 | ṽ : τ̃ k L ▷m′′11 P1 [ỹ 7→ ṽ] l′′

is l-securely derivable. Let π̂0 be an l-secure derivation tree of Γ000 , x : hτ̃ i 00 /U k L ▷m′′01 P0 and π̂1 be an l-secure l′′ derivation tree of Γ001 , x : hτ̃ i 00 /U 0 | ṽ : τ̃ k L ▷m′′11 P1 [ỹ 7→ ṽ]. We have an l-secure derivation tree as follows: π̂1

π̂0 l′′

Γ000 , x : hτ̃ i 00 /U k L ▷m′′01 P0

l′′

Γ001 , x : hτ̃ i 00 /U 0 | ṽ : τ̃ k L ▷m′′11 P1 [ỹ 7→ ṽ]

′′ l00

Γ000 , x : hτ̃ i /U k L ▷m′ P0 Γ001 , x : τ˜0 /U 0 | ṽ : τ̃ k L ▷m′ P1 [ỹ 7→ ṽ] l′′ l′′ Γ000 , x : hτ̃ i 00 /U | Γ001 , x : hτ̃ i 00 /U 0 | ṽ : τ̃ k L ▷m′ P0 | P1 [ỹ 7→ ṽ]

Thus, we see that

l′′ l′′ Γ000 , x : hτ̃ i 00 /U | Γ001 , x : hτ̃ i 00 /U 0 | ṽ : τ̃ k L ▷m′ P 0

is l-securely derivable. Then

l′′ l′′ l′′ (Γ000 | Γ001 ) | ṽ : τ̃ | x : hτ̃ i 00 /(U | U 0 ) <: Γ000 , x : hτ̃ i 00 /U | Γ001 , x : τ˜0 10 /U 0 | ṽ : τ̃ .

By Proposition C.2 (10) and (11), we have ′ ′ l′′ ↑(tc +1,tc +1) Γ000 | ṽ : ↑ τ̃ | ↑(tc +1,tc +1) Γ001 | x : hτ̃ i 00 /(U | U 0 ) l′′

<: ((Γ000 ) | (Γ001 )) | ṽ : τ̃ | x : hτ̃ i 00 /(U | U 0 ).

Hence,

′ ′ l′′ ↑(tc +1,tc +1) Γ000 | ṽ : ↑ τ̃ | ↑(tc +1,tc +1) Γ001 | x : hτ̃ i 00 /(U | U 0 ) k L ▷m′ P 0

is l-securely derivable. Now, ′ ′ l′′ ↑(tc +1,tc +1) Γ000 | ṽ : ↑ τ̃ | ↑(tc +1,tc +1) Γ001 | x : hτ̃ i 00 /(Ot0c U | It0′c U 0 ) ′ ′ l′′ −→ ↑(tc +1,tc +1) Γ000 | ṽ : ↑ τ̃ | ↑(tc +1,tc +1) Γ001 | x : hτ̃ i 00 /(U | U 0 ). By Lemma D.6, there exists Γ0 such that Γ −→ Γ0 and ′ ′ l′′ Γ0 <: ↑(tc +1,tc +1) Γ000 | ṽ : ↑ τ̃ | ↑(tc +1,tc +1) Γ001 | x : hτ̃ i 00 /(U | U 0 ). Hence, Γ0 k L ▷m P 0 is l-securely derivable. Case 2. We consider the case (R-NewLev). In this case, P = l˜1 < νl0 < l˜2 P0 , P 0 = P0 and L0 = l˜1 < νl0 < l˜2 L, where l˜1 , l˜2 ⊆ L and l˜1 < νl0 < l˜2 L is defined. 0 0 0 0 0 00 By Lemma D.1 (7), there exist a type environments Γ and m ∈ L such that m ≤L m , and Γ <: Γ , m ≤L l 00 0 ˜ ˜ ˜ ˜ for any l ∈ l1 , l2 , and Γ k l1 < νl0 < l2 L ▷m′ P0 is l-securely derivable. Let π be an l-secure derivation tree of Γ0 k l˜1 < νl0 < l˜2 L ▷m′ P0 . We have an l-secure derivation tree as follows:

. Γ0 k l˜1 < νl0 < l˜2 L ▷m′ P0 (T-Weak) Γ k l˜1 < νl0 < l˜2 L ▷m P0 Hence, we have the statement. Case 3. We consider the case (R-Par). In this case, P = P0 | P1 and P 0 = P00 | P1 with (P0 , L) −→ (P00 , L0 ). By Lemma D.1 (2), there exist two type environments Γ00 , Γ01 , and m0 ∈ L such that Γ <: Γ00 | Γ01 , and m ≤L m0 and Γ0i k L ▷m′ Pi is l-securely derivable for each i = 0, 1. Since m ≤L m0 and Γ0i k L ▷m′ Pi is l-securely derivable, we see that Γ0i k L ▷m Pi is l-securely derivable for each i = 0, 1. By the induction hypothesis, then there exists a type 0 0 0 0 0 0 0 environment Γ00 such that either Γ0= Γ0 or Γ0 −→ Γ0 and Γ0 k L ▷m P0 is l-securely derivable. By Theorem A.6, 0 0 0 0 ˜ ˜ either L = L or L = l0 < νl < l1 L. By Proposition 3.16, Γ1 k L ▷m P10 is l-securely derivable. Let πi be a derivation tree of Γ0i k L ▷m Pi for each i = 0, 1. Then, we have a derivation tree as follows: π0

π1

Γ00 k L ▷m P0

Γ01 k L ▷m P1

Γ00 | Γ01 k L ▷m P0 | P1

. (T-Weak)

Let π̂0 be an l-secure derivation tree of Γ00 k L0 ▷m P00 and π̂1 be an ˇl-secure derivation tree of Γ01 k L0 ▷m P10 .

π̂0

π̂1

Γ00 k L0 ▷m P0

Γ01 k L0 ▷m P1

Γ00 | Γ01 k L0 ▷m P0 | P1

. (T-Weak)

If Γ00 = Γ00 , then we have Γ00 | Γ01 = Γ00 | Γ01 . Since Γ <: Γ00 |Γ01 , we see that Γ k L0 ▷m P0 | P1 is l-securely derivable. Assume Γ00 −→ Γ00 . By Lemma D.7, we have Γ00 | Γ01 −→ Γ00 | Γ01 . By Lemma D.6, there exists Γ0 such that Γ −→ Γ0 and Γ0 <: Γ00 | Γ01 . Since Γ0 <: Γ00 | Γ01 , we see that Γ0 k L0 ▷m P0 | P1 is l-securely derivable. Case 4. We consider the case (R-New). In this case, P = ((νx : ξ)P0 , L) and P 0 = ((νx : ξ)P00 , L0 ), where (P0 , L) −→ (P00 , L0 ). By Lemma D.1 (6), there exist a type environments Γ0 , a usage U , and m0 ∈ L0 such that m ≤L m0 , rel(U ) and Γ <: Γ0 , and Γ0 , x : ξ/U k L ▷m′ P0 is l-securely derivable. By the induction hypothesis, there exist a type environment Γ00 such that Γ00 k L0 ▷m′ P00 is l-securely derivable, where either Γ00 = Γ0 , x : ξ/U or Γ0 , x : ξ/U −→ Γ00 . Let π be an l-secure derivation tree of Γ00 k L0 ▷m′ P00 . If Γ00 = Γ0 , x : ξ/U , then we have an l-secure derivation tree as follows:

π Γ0 , x : ξ/U k L0 ▷m′ P00 0

Γ k L ▷m′ (νx : ξ)P00 Γ k L0 ▷m (νx : ξ)P00

(T-New)

(T-Weak)

Assume Γ0 , x : ξ/U −→ Γ00 . Assume Γ0 (y) −→ Γ00 (y) with y ∈ Dom(Γ0 ). Then, there exists a type environment Γ00 0 such that Γ00 = Γ00 0 , x : ξ/U and Γ0 −→ Γ00 0 . Since Γ00 = Γ00 0 , x : ξ/U , we have an l-secure derivation tree as follows:

π Γ00 0 , x : ξ/U k L0 ▷m′ P00 Γ00 0 k L0 ▷m (νx : ξ)P00

. (T-New)

Since Γ0 −→ Γ00 0 , Lemma D.6 implies that there exists Γ00 such that Γ −→ Γ0 and Γ0 <: Γ00 0 . Hence, Γ0 k L0 ▷m (νx : ξ)P00 is l-securely derivable. Assume ξ/U −→ ξ/U 0 with some usage U 0 . Then Γ00 = Γ0 , x : ξ/U 0 . Hence, we have an l-secure derivation tree as follows: π Γ0 , x : ξ/U 0 k L0 ▷m′ P00 0

Γ k L ▷m′ (νx : ξ)P00 Γ k L0 ▷m (νx : ξ)P00

(T-New)

(T-Weak)

Therefore, we have the statement. Case 5. We consider the case (R-SP). In this case, P = P0 and P 0 = P1 , where (P0 , L) (P00 , L), (P00 , L) −→ 0 (P1 , L0 ), and (P10 , L0 ) (P1 , L0 ). By Lemma 4.2, Γ k L ▷m P00 is l-securely derivable. By the induction hypothesis, there exist a type environment Γ0 such that either Γ0 = Γ or Γ −→ Γ0 and Γ0 k L0 ▷m P10 is l-securely derivable. By Lemma 4.2, Γ0 k L0 ▷m P 0 is l-securely derivable. Thus, we have the statement.

Appendix E. Lemmata for lock-freedom and the details of its proof E.1. Properties of −→Γl Lemma E.1. For type environments Γ and Γ0 , a lattice of secrecy levels L, a secrecy level l ∈ L and a process P , if Γ(x) ∼ Γ0 (x) for any value x belonging to the domain of Γ, the domain of Γ is a subset of the domain of Γ0 , and ′ (P, L) −→Γl (P 0 , L0 ), then (P, L) −→Γl (P 0 , L0 ). Proof. Straightforward. Lemma E.2. For type environments Γ and Γ0 , a lattice of secrecy levels L, a secrecy level l ∈ L and a process P , if 0 Γ 0 0 Γ′ 0 (x) ∼ Γ (x) for any value x occurring in P , and (P, L) −→ (P , L ) , then (P, L) −→ (P , L 0 ). Γ l l Proof. Straightforward.

E.2. Proof of Lemma 4.8 We show Lemma 4.8. Assume that Γ k L ▷l P and ∆ k L ▷l Q are k -securely derivable, Γ | ∆ are reliable, Γ | ∆ k L is k -secure, and obα (Γ(x)) is finite, where either α = I or α = O. Let n be obα (Γ(x)), and lP be the length of P . By induction on (n, lP ), we prove that there exists R such that Γ|∆ (P | Q, L) −→ →k R, L̂ and x ∈ SBarbsα (R). Let Γ(x) = ξ/Ux and ∆(x) = ξ/Ux0 . 0 Assume conα (Ux ) does not hold. Then obα(Ux ) > capα (Ux ). Because Γ | ∆ is reliable, we have obα (Ux | Ux ) ≤ ∅ ∅ ≤ min(capα (Ux ), capα (Ux0 )). Then obα (Ux ) > capα (Ux ) ≥ capα (Ux | Ux0 ). Hence, min obα (Ux ), obα (Ux0 ) min(capα (Ux ), capα (Ux0 )) ≥ min ob∅α (Ux ), ob∅α (Ux0 ) . Hence, n > obα (Ux0 ). By the induction hypothesis, there exists ∆|Γ ∆|Γ R such that (Q | P, L) −→ →k R, L̂ and x ∈ SBarbsα (R). Since P | Q Q | P , we have (P | Q, L) −→ →k (R, k). Γ|∆ By Lemma E.1, (P | Q, L) −→ →k R, L̂ . Assume conα (Ux ). We consider cases according to the form of P . Case 1. Since obα (Γ(x)) is finite, we have P 6= 0. Case 2. P = (P0 | P1 ). By Lemma D.1 (2), there exist two type environments Γ00 , Γ01 , and l0 ∈ L0 such that Γ <: Γ00 | Γ01 and l ≤L l0 , and Γ0i k L ▷l′ Pi is k -securely derivable for each i = 0, 1. By Proposition C.2 (4), Γ | ∆ <: Γ00 | Γ01 | ∆. By Proposition C.3, Γ00 | Γ01 | ∆ is reliable. Because Γ <: Γ00 | Γ01 and obα (Γ(x)) is finite, we have x ∈ Dom(Γ00 | Γ01 ). By Definition 3.7 (d), we have n ≥ obα (Γ00 | Γ01 (x)). Hence, either n ≥ obα (Γ00 (x)) or n ≥ obα (Γ01 (x)). Assume n ≥ obα (Γ00 (x)). The length of P0 is less then lP . By the induction hypothesis, we see that there exist R0 Γ′0 |∆ Γ|∆ →k and L̂0 such that (P0 | Q, L) −→ →k R0 , L̂0 . R0 , L̂0 and x ∈ SBarbsα (R0 ). By Lemma E.1, (P0 | Q, L) −→

Γ|∆ Γ|∆ Then (P0 | Q | P1 , L) −→ →k R0 | P1 , L̂0 . Since P0 | P1 | Q P0 | Q | P1 , we have (P | Q, L) −→ →k R0 | P1 , L̂0 . By x ∈ SBarbsα (R0 ), we see x ∈ SBarbsα (R0 | P1 ). 0 In the similar way to the case n ≥ obα (Γ00 (x)) , under the assumption that n ≥ obα (Γ1 (x)), we can show that Γ|∆ there exists R such that (P | Q, L) −→ →k R, L̂ and x ∈ SBarbsα (R). Case 3. P = y!ṽ.P0 . Γ|∆ Assume y = x. Let R = P | Q and L̂ = L. Then (P | Q, L) −→ →k R, L̂ and x ∈ SBarbsα (R). Assume y 6= x. By Lemma D.1 (3), there exist a type environments Γ0 , secrecy levels l0 , l1 ∈ L, types τ̃ , a usage U and tc ∈ N ∪ {∞} such that Γ <: Γ00 , l ≤L l0 , and l ≤L l1 , l Γ0 , y : hτ̃ i 0 /Uy k L ▷k l1 P0 is k -securely derivable, Γ00 k L is k -secure, and tc = ∞ implies l0 ≤L l1 , where l (tc +1,tc +1) 0 00 Γ = ↑ Γ | ṽ : ↑ τ̃ | y : hτ̃ i 0 /Ot0c Uy . Since Γ <: Γ00 , we have tc < tc + 1 ≤ obα (Γ00 (x)) ≤ n. Since 00 Γ k L is k -secure, we have l0 6<L k . By Proposition C.2 (4), Γ | ∆ <: Γ00 | ∆. By Proposition C.3, Γ00 | ∆ is l0 l 0 reliable. Then, we is reliable. Let ∆(y) = hτ̃ i 0 /Uy0 . Then, we have obI Ot0c Uy | Uy0 ≤ see that hτ̃ i 0 /Otc Uy | ∆(y) 0 0 0 0 capO Otc Uy | Uy . Then obI Uy ≤ capO Otc Uy | Uy ≤ tc < n. By the induction hypothesis, there exist R0 and ∆|∅

L̂0 such that (Q | 0, L) −→ →k

∆|∅

(ν w̃)y?z̃.Q0 | Q1 , L̂0 ˆ ˆ → ∆ and y ∈ / w̃ for some Q0 and Q1 . By Proposition 4.5, there exists a type environment ∆ such that ∆ −→ ˆ and ∆ k L̂0 ▷l (ν w̃)y?z̃.Q0 | Q1 is k -securely derivable. By Lemma D.1 there exist type environments ∆0 and l0 ∆1 and l0 , l1 ∈ L̂0 such ′ that′ ∆0 , y : hτ̃ i /V , z̃ : τ̃ k L̂0 ▷k l1 Q0 and ∆1 k L̂0 ▷l′ Q1 are k -securely derivable, l t +1,t +1 ( ) ˆ w̃ : τ˜0 <: ↑ c c and ∆, ∆0 , y : hτ̃ i 0 /It0′c V | ∆1 , l ≤L l0 , l ≤L l1 and l ≤L l0 . By Lemma 4.4, l ∆0 , y : hτ̃ i 0 /V , z̃ : τ̃ [z̃ 7→ ṽ] k L̂0 ▷l1 Q0 [z̃ 7→ ṽ] is k -securely derivable. By Theorem A.6 and Proposition 3.16, R0 , L̂0

and y ∈ SBarbsI (R0 ). Hence, (Q, L) −→ →k

Γ0 , y : hτ̃ i 0 /Uy k L̂0 ▷l1 P0 is k -securely derivable. Then, we see that l l Γ0 , y : hτ̃ i 0 /Uy | ∆0 , y : hτ̃ i 0 /V , z̃ : τ̃ | ∆1 [z̃ 7→ ṽ] k L̂0 ▷l1 (P0 | Q0 | Q1 )[z̃ 7→ ṽ] l l is k -securely derivable. By Proposition C.3, Γ0 , y : hτ̃ i 0 /Uy | ∆0 , y : hτ̃ i 0 /V , z̃ : τ̃ [z̃ 7→ ṽ] | ∆1 is reliable. Because Γ <: Γ00 and conα (Ux ), we have l l obα Γ0 , y : hτ̃ i 0 /Uy (x) ≤ obα ↑(tc +1,tc +1) Γ0 | ṽ : ↑ τ̃ | y : hτ̃ i 0 /Ot0c Uy (x) ≤ obα (Γ(x)) = n. l

Since the length of P0 is less then lP , we see that there exist R and k such that Γ′ ,y:hτ̃ il0 /Uy |(∆0 ,y:hτ̃ il0 /V ,z̃:τ̃ )[z̃7→ṽ]|∆1 (P0 | Q0 [z̃ 7→ ṽ] | Q1 , L) −→ → R,L̂ ( ) and x ∈ SBarbsα (R). Then, we have the claimed result. Case 4. P = y?z̃.P0 . Straightforward. Case 5. P = ∗P0 . Straightforward. Case 6. P = (νy : ξ)P0 . Straightforward. Case 7. P = l˜1 < νl0 < l˜2 P0 . By Lemma D.1 (7), l00 6<L k for some l00 ∈ l˜1 , l˜2 and there exist a type environments Γ0 , and l0 ∈ L such that l ≤L l0 and Γ <: Γ0 , l0 ≤L l00 for any l00 ∈ l˜1 , l˜2 , and Γ0 k l˜1 < νl0 < l˜2 L ▷l′ P0 is k -securely derivable. By Proposition 3.16, ∆ k l˜1 < νl0 < l˜2 L ▷l Q is k -securely derivable. Because Γ <: Γ0 length and conα (Ux ), we have obα (Γ0 (x)) ≤ obα (Γ(x)) . Since the of P0 is less then lP , we see that there Γ′ |∆ exist R and k such that P0 | Q, l˜1 < νl0 < l˜2 L −→ →k R, L̂ and x ∈ SBarbsα (R). By Lemma E.1, Γ|∆ P0 | Q, l˜1 < νl0 < l˜2 L −→ →k R, L̂ . Hence, Γ|∆ Γ|∆ (P | Q, L) −→k P0 | Q, l˜1 < νl0 < l˜2 L −→ →k R, L̂ . Case 8. P = if v then P0 else P1 . Straightforward.

Appendix F. Proof of non-interference theorems F.1. Basic properties for bisimulation Lemma F.1. For processes P , P 0 and a lattice of secrecy levels L, if P ≃ P 0 , then Barbs(P, L) = Barbs(P 0 , L).

Proof. Assume P P 0 . We show Barbs(P, L) = Barbs(P 0 , L). We show Barbs(P, L) ⊆ Barbs(P 0 , L). Assume x ∈ Barbs(P, L). We show x ∈ Barbs(P 0 , L). Assume (P, L) −→ →(P 00 , L0 ), P 00 = (ν ỹ)x!ṽ.P0 | P1 and x ∈ / ỹ . Since P 0 P , we have (P 0 , L) −→ →(P 00 , L0 ). Hence, 0 x ∈ Barbs(P , L). In the similar way to the case P 00 = (ν ỹ)x!ṽ.P0 | P1 , we have x ∈ Barbs(P 0 , L) if (P, L) −→ →(P 00 , L0 ), P 00 (ν ỹ)x?z̃.P0 | P1 and x ∈ / ỹ . In the same way to the case Barbs(P, L) ⊆ Barbs(P 0 , L), we have Barbs(P 0 , L) ⊆ Barbs(P, L). •

•

Lemma F.2. ≈ is transitive i.e. if (P0 , L0 ) ≈ (P1 , L1 ) and (P1 , L1 ) ≈ (P2 , L2 ), then (P0 , L0 ) ≈ (P2 , L2 ). Proof. Easy. •

Lemma F.3. For processes P , P 0 , Q, Q0 and a lattice of secrecy level L, if (P, L) ≈ (Q, L), P 0 ≃ P , and Q ≃ Q0 , • then (P 0 , L) ≈ (Q0 , L). •

•

Proof. Assume (P, L) ≈ (Q, L), P 0 ≃ P , and Q ≃ Q0 . Since (P, L) ≈ (Q, L), there exists a barbed bisimulation R such that ((P, L), (Q, L)) ∈ R. Let R0 = {((P 0 , L), (Q0 , L0 )) | ((P, L), (Q, L0 )) ∈ R, P 0 ≃ P, and Q ≃ Q0 , }.

We show that R0 is a barbed bisimulation. Let ((P00 , L0 ), (P10 , L1 )) ∈ R0 . Then, there exist processes P0 and P1 such that ((P0 , L0 ), (P1 , L1 )) ∈ R, P00 ≃ P0 , and P1 ≃ P10 . We note R ⊆ R0 . → (P100 , L01 ) and (1) Assume (P00 , L0 ) −→ (P000 , L00 ). We show that there exists (P100 , L01 ) such that (P10 , L1 ) −→ 0 0 0 0 00 00 00 0 ((P0 , L0 ), (P1 , L1 )) ∈ R . Since P0 ≃ P0 , we have (P0 , L0 ) −→ (P0 , L0 ). Since ((P0 , L0 ), (P1 , L1 )) ∈ R, there exists (P100 , L01 ) such that (P1 , L1 ) −→ → (P100 , L01 ) and ((P000 , L00 ), (P100 , L01 )) ∈ R. By P1 ≃ P10 , we have (P10 , L1 ) −→ → (P100 , L01 ). 0 00 0 00 0 0 By R ⊆ R , we see ((P0 , L0 ), (P1 , L1 )) ∈ R . (2) In the same way to (1). (3) By Lemma F.1, we have Barbs(P00 , L) = Barbs(P0 , L) and Barbs(P1 , L) = Barbs(P10 , L). Since ((P0 , L0 ), (P1 , L1 )) ∈ R, we have Barbs(P0 , L) = Barbs(P1 , L). Hence, we have Barbs(P00 , L) = Barbs(P10 , L). Now, we see that R0 is a barbed bisimulation. By definition of R0 , we have ((P 0 , L), (Q0 , L)) ∈ R0 . Thus, • 0 (P , L) ≈ (Q0 , L). Lemma F.4. (1) If P0 P1 , then FN(C [P0 ]) ⊇ FN(C [P1 ]) for any context C . (2) If P0 ≃ P1 , then FN(C [P0 ]) = FN(C [P1 ]) for any context C . Proof. It suﬀices to show (1). We see (1) by induction on the construction of C . Lemma F.5. For processes P0 and P1 , if P0 ≃ P1 and C [P0 ] P00 , then there exists a context C 0 such that P00 = C 0 [P0 ] and C [P1 ] C 0 [P1 ]. Proof. Assume P0 ≃ P1 and C [P0 ] P00 . We show that there exists a context C 0 such that P00 = C 0 [P0 ] and C [P1 ] C 0 [P1 ]. We proceed by induction on the construction of C [P0 ] P00 . We consider cases according to the form of C . If [ ] does not occur in C , then the required condition holds obviously. Assume C = [ ]. Let C 0 = [ ]. Then, the required condition holds. Assume C 6= [ ]. We consider cases according to the last rule of the construction of C [P0 ] P00 . Case 1. Assume P00 = C [P0 ]. Let C 0 = C . Then, the required condition holds. Case 2. Assume that there exists a process Q such that C [P0 ] Q and Q P00 . By the induction hypothesis, we see that there exists a context C 00 such that Q = C 00 [P0 ] and C [P1 ] C 00 [P1 ]. Then, we have C 00 [P0 ] P00 . By the induction hypothesis, we see that there exists a context C 0 such that C 00 [P0 ] = C 0 [P0 ] and C 00 [P1 ] C 0 [P1 ]. Since C [P1 ] C 00 [P1 ] and C 00 [P1 ] C 0 [P1 ], we have C [P1 ] C 0 [P1 ]. Case 3. (SP-Zero1). Assume P00 = C [P0 ] | 0. Let C 0 = C | 0. Then C [P1 ] C 0 [P1 ]. Assume C = C0 | [ ] and P0 = 0 for some context C0 . Then P00 = C0 [P0 ]. Let C 0 = C0 . Then, we have P00 = C 0 [P0 ]. By Proposition A.3, we have C [P1 ] = C0 [P1 ] | P1 C0 [P1 ] | 0. Hence, C [P1 ] C 0 [P1 ]. Assume C = C0 | 0 for some context C0 . Then P00 = C0 [P0 ]. Let C 0 = C0 . Then, we have P00 = C 0 [P0 ]. By (SP-Zero1), C [P1 ] = C 0 [P1 ] | 0 C 0 [P1 ]. Case 4. (SP-Zero2). Assume C = (νx : ξ)[ ] and P0 = 0. Then P00 = 0. Let C 0 = 0. Then, we have P00 = C 0 [P0 ]. By (SP-CNew), C [P1 ] = (νx : ξ)P1 (νx : ξ)0. Then C [P1 ] 0 = C 0 [P1 ]. Case 5. (SP-Commut). Assume C = C0 | C1 for some contexts C0 and C1 . Then P00 = C1 [P0 ] | C0 [P0 ]. Let 0 C = C1 | C0 . Then, we have P00 = C 0 [P0 ]. By (SP-Commut), C [P1 ] = C0 [P1 ] | C1 [P1 ] C1 [P1 ] | C0 [P1 ].

Case 6. (SP-Assoc). Assume C = [ ] | C2 and P0 = Q0 | Q1 for some context C2 and processes Q0 and Q1 . Then P00 = Q0 | (Q1 | C2 [P0 ]). Let C 0 = Q0 | (Q1 | C2 ). Then, we have P00 = C 0 [P0 ]. By (SP-Par), we have C [P1 ] = P1 | C2 [P1 ] P0 | C2 [P1 ] = (Q0 | Q1 ) | C2 [P1 ]. By (SP-Assoc), C [P1 ] Q0 | (Q1 | C2 [P1 ]) = C 0 [P1 ]. Assume C = (C0 | C1 ) | C2 for some contexts C0 , C1 , and C2 . Then P00 = C0 [P0 ] | (C1 [P0 ] | C2 [P0 ]). Let C 0 = C0 | (C1 | C2 ). Then, we have P00 = C 0 [P0 ]. By (SP-Assoc), C [P1 ] C0 [P1 ] | (C1 [P1 ] | C2 [P1 ]) = C 0 [P1 ]. Case 7. (SP-New). Assume C = [ ] | C1 , P0 = (νx : ξ)Q, and x ∈ / FN(C1 [P0 ]) for some context C1 . Then P00 = (νx : ξ)Q | C1 [P0 ]. Let C 0 = (νx : ξ)Q | C1 . By (SP-Par), we have C [P1 ] = P1 | C1 [P1 ] P0 | C1 [P1 ] = (νx : ξ)Q | C1 [P1 ]. By Lemma F.4 (2) and (SP-New), C [P1 ] (νx : ξ)Q | C1 [P1 ] = C 0 [P1 ]. Assume C = (νx : ξ)C0 | C1 and x ∈ / FN(C1 [P0 ]) for some contexts C0 and C1 . Then P00 = (νx : ξ)C0 [P0 ] | C1 [P0 ]. 0 Let C = (νx : ξ)C0 | C1 . By Lemma F.4 (2) and (SP-New), C [P1 ] (νx : ξ)C0 [P1 ] | C1 [P1 ] = C 0 [P1 ]. Case 8. (SP-IfT). Assume C = if [ ] then C0 else C1 and P0 = truel for some contexts C0 and C1 . Then P00 = C0 [P0 ]. Let C 0 = C0 . Since P0 ≃ P1 , we have P1 = truel . By (SP-IfT), C [P1 ] = if truel then C0 [P1 ] else C1 [P1 ] C0 [P1 ] = C 0 [P1 ]. Assume C = if truel then C0 else C1 for some contexts C0 and C1 . Then P00 = C0 [P0 ]. Let C 0 = C0 . By (SPIfT), C [P1 ] = if truel then C0 [P1 ] else C1 [P1 ] C0 [P1 ] = C 0 [P1 ]. Case 9. (SP-IfF). In the similar way to (SP-IfT). Case 10. (SP-Rep). Assume C = ∗C0 for some context C0 . Then P00 = ∗C0 [P0 ] | C0 [P0 ]. Let C 0 = ∗C0 | C0 . Then, we have P00 = C 0 [P0 ]. By (SP-Rep), C [P1 ] = ∗C0 [P1 ] ∗C0 [P1 ] | C0 [P1 ] = C 0 [P1 ]. Case 11. (SP-Par). Assume C = C0 | C1 and C0 [P0 ] Q0 for some contexts C0 and C1 , and a process Q0 . Then P00 = Q0 | C1 [P0 ]. By the induction hypothesis, we see that there exists a context C00 such that Q0 = C00 [P0 ] and C0 [P1 ] C00 [P1 ]. Let C 0 = C00 | C1 . Then, we have P00 = C 0 [P0 ]. By (SP-Par), C [P1 ] = C0 [P1 ] | C1 [P1 ] C00 [P1 ] | C1 [P1 ] = C 0 [P1 ]. Case 12. (SP-CNew). Assume C = (νx : ξ)C0 and C0 [P0 ] Q0 for some context C0 and a process Q0 . Then P00 = (νx : ξ)Q0 . By the induction hypothesis, we see that there exists a context C00 such that Q0 = C00 [P0 ] and C0 [P1 ] C00 [P1 ]. Let C 0 = (νx : ξ)C00 . Then, we have P00 = C 0 [P0 ]. By (SP-CNew), C [P1 ] = (νx : ξ)C0 [P1 ] (νx : ξ)C00 [P1 ] = C 0 [P1 ]. Lemma F.6. For processes P0 and P1 , if P0 ≃ P1 and (C [P0 ], L) −→ (P00 , L0 ), then there exists a context C 0 such that P00 = C 0 [P0 ] and (C [P1 ], L) −→ (C 0 [P1 ], L0 ). Proof. Assume P0 ≃ P1 and (C [P0 ], L) −→ (P00 , L0 ). Assume C = [ ]. In this case, C [Pi ] = Pi for i = 0, 1. Assume (P0 , L) −→ (P00 , L0 ). Since P1 P0 , we have (P1 , L) −→ (P00 , L0 ). Let C 0 = P00 . Then P00 = C 0 [P0 ] and C [P1 ] −→ C 0 [P1 ]. Assume C 6= [ ]. The proof proceeds by induction on the construction of (C [P0 ], L) −→ (P00 , L0 ). We consider cases according to the last rule of the construction of (C [P0 ], L) −→ (P00 , L0 ). Case 1. (R-Com). Assume C = C0 | C1 with contexts C0 and C1 and L0 = L. Assume C0 = [ ], C1 = x?(y0 , . . . , yn ).C10 , and P0 = x!(v0 , . . . , vn ).P . Then P00 = P | C10 [P0 ]. By Definition 2.6, we see P1 = x!(v0 , . . . , vn ).P . Then, we have C [P1 ] = x!(v0 , . . . , vn ).P | x?(y0 , . . . , yn ). C10 [P1 ]. Let C 0 = P | C10 . Then P00 = C 0 [P0 ]. By (R-Com), (C [P1 ], L) −→ (C 0 [P1 ], L). In the similar way, we can show the case C0 = x!(v0 , . . . , vn ).C00 , C1 = [ ], and P0 = x?(y0 , . . . , yn ).P . Assume C0 = x!(v0 , . . . , vn ).C00 and C1 = x?(y0 , . . . , yn ).C10 . Then P00 = C00 [P0 ] | C10 [P0 ]. Let C 0 = C00 | C10 . Then 0 0 P0 = C 0 [P0 ]. By (R-Com), (C [P1 ], L) −→ (C [P1 ], L). Case 2. (R-NewLev). Assume C = l˜0 < νl0 < l˜1 C00 , L0 = l˜0 < νl < l˜1 L, l˜0 and l˜1 ⊆ L with a context C0 . Then P00 = C00 [P0 ]. Let C 0 = C00 . Then P00 = C 0 [P0 ]. By (R-NewLev), (C [P1 ], L) −→ (C 0 [P1 ], L0 ). Case 3. (R-Par). Assume C = C0 | C1 with contexts C0 and C1 . Assume C0 = [ ]. Then, there exists a process Q such that P00 = Q | C1 [P0 ] and (P0 , L) −→ (Q, L0 ). Since P1 P0 , we have (P1 , L) −→ (Q, L0 ). Let C 0 = Q | C1 . Then P00 = C 0 [P0 ]. By (R-Par), (C [P1 ], L) −→ (C 0 [P1 ], L). Assume C0 6= [ ]. Then, there exists a process Q0 such that P00 = Q0 | C1 [P0 ] and (C0 [P0 ], L) −→ (Q0 , L0 ). By the induction hypothesis, there exists a context C00 such that Q0 = C00 [P0 ] and C0 [P1 ] −→ C00 [P1 ]. Let C 0 = C00 | C1 . Then P00 = C 0 [P0 ]. Since (C0 [P1 ], L) −→ (C00 [P1 ], L0 ) and (R-Par), we have (C [P1 ], L) −→ (C 0 [P1 ], L0 ). Case 4. (R-New). Assume that C = (νx : ξ)C0 with a context C0 , and there exists a process Q0 such that (C0 [P0 ], L) −→ (Q0 , L0 ) and P00 = (νx : ξ)Q0 . By the induction hypothesis, there exists a context C00 such that Q0 = C00 [P0 ] and C0 [P1 ] −→ C00 [P1 ]. Let C 0 = (νx : ξ)C00 . Then P00 = C 0 [P0 ]. Since (C0 [P1 ], L) −→ (C00 [P1 ], L0 ) and (R-New), we have (C [P1 ], L) −→ (C 0 [P1 ], L0 ). Case 5. (R-SP). Assume that there exist processes Q0 and Q00 such that C [P0 ] Q0 , (Q0 , L) −→ (Q00 , L0 ), and 0 Q0 P00 . By Lemma F.5, there exists a context C 00 such that Q0 = C 00 [P0 ] and C [P1 ] C 00 [P1 ]. By the induction hypothesis, there exists a context C 000 such that Q00 = C 000 [P0 ] and (C 00 [P1 ], L) −→ (C 000 [P1 ], L0 ). By Lemma F.5, there

exists a context C 0 such that P00 = C 0 [P0 ] and C 000 [P1 ] C 0 [P1 ]. Since C [P1 ] C 00 [P1 ], (C 00 [P1 ], L) −→ (C 000 [P1 ], L0 ), C 000 [P1 ] C 0 [P1 ] and (R-SP), we have (C [P1 ], L) −→ (C 0 [P1 ], L0 ). •

Lemma F.7. For processes P0 and P1 , and a lattices for secrecy levels L, if P0 ≃ P1 , then (C [P0 ], L) ≈ (C [P1 ], L) with any context C . Proof. Let R = {((C [P0 ], L), (C [P1 ], L)) | P0 ≃ P1 , C is a context, L is a lattice of secrecy levels}

To show the claim, it suﬀices to show that R is a barbed bisimulation. Fix C be a context, and processes P0 and P1 with P0 ≃ P1 . Then ((C [P0 ], L), (C [P1 ], L)) ∈ R. We show that the conditions in Definition 4.15 hold. (1) and (2) By Lemma F.6. (3) We show Barbs(C [P0 ], L) = Barbs(C [P1 ], L). To show the claim, we show Barbs(C [P0 ], L) ⊆ Barbs(C [P1 ], L). Let x ∈ Barbs(C [P0 ], L). Assume (C [P0 ], L) −→ → (Q, L0 ), Q = (ν ỹ)x!ṽ.Q0 | Q1 with x ∈ / ỹ . By Lemma F.5 and Lemma F.6, there exists a context C 0 such that (ν ỹ)x!ṽ.Q0 | Q1 = C 0 [P0 ], (C [P1 ], L) −→ → (Q0 , L0 ), and Q0 C 0 [P1 ]. Assume C 0 = [ ] and P0 = (ν ỹ)x!ṽ.Q0 | Q1 . In this case, (C [P1 ], L) −→ → (P1 , L0 ). Since P1 P0 , we have 0 (C [P1 ], L) −→ → ((ν ỹ)x!ṽ.Q0 | Q1 , L ). Hence, x ∈ Barbs(C [P1 ], L). Assume C 0 = (ν ỹ)[ ] and P0 = x!ṽ.Q0 | Q1 . In this case, (C [P1 ], L) −→ → ((ν ỹ)P1 , L0 ). Since P1 P0 , we have 0 (ν ỹ)P1 (ν ỹ)P1 . Hence, we have (C [P1 ], L) −→ → ((ν ỹ)x!ṽ.Q0 | Q1 , L ). Therefore, x ∈ Barbs(C [P1 ], L). Assume C 0 = (ν ỹ)[ ] | C1 and P0 = x!ṽ.Q0 for some context C1 . In this case, (C [P1 ], L) −→ → ((ν ỹ)P1 | C1 [P1 ], L0 ). Since P1 P0 , we have (ν ỹ)P1 | C1 [P1 ] (ν ỹ)x!ṽ.Q0 | C1 [P1 ]. Hence, we have (C [P1 ], L) −→ → ((ν ỹ)x!ṽ.Q0 | C1 [P1 ], L0 ). Therefore, x ∈ Barbs(C [P1 ], L). Assume C0 = (ν ỹ)x!ṽ.C1 | C1 for some contexts C0 and C1 . In this case, (C [P1 ], L) −→ → ((ν ỹ)x!ṽ. C0 [P1 ] | C1 [P1 ], L0 ). Hence, x ∈ Barbs(C [P1 ], L). In the similar way to the case (C [P0 ], L) −→ → (Q, L0 ), Q = (ν ỹ)x!ṽ.Q0 | Q1 , we have x ∈ Barbs(C [P1 ], L) if 0 (C [P0 ], L) −→ → (Q, L ), Q = (ν ỹ)x?z̃.Q0 | Q1 with x ∈ / ỹ . Therefore, Barbs(C [P0 ], L) ⊆ Barbs(C [P1 ], L). In the same way to the case Barbs(C [P0 ], L) ⊆ Barbs(C [P1 ], L), we have Barbs(C [P1 ], L) ⊆ Barbs(C [P0 ], L). Thus, Barbs(C [P0 ], L) = Barbs(C [P1 ], L). Lemma F.8. For processes P , P 0 , Q, Q0 and a lattice of secrecy level L, if P P0

≈

(ΓkL,l)

Q0 .

Q, P 0 ≃ P , and Q ≃ Q0 , then

(ΓkL,l)

Proof. Assume P

≈

(ΓkL,l)

Q, P 0 ≃ P , and Q ≃ Q0 . We show that the conditions in Definition 4.17 hold.

(1) By Lemma D.4. • (2) Fix C be an (Γ k L, l)-(∆ k L0 , l0 )-context. Then, we have (C [P ], L0 ) ≈ (C [Q], L0 ). Since P 0 ≃ P , and Q ≃ Q0 , • • • Lemma F.7 implies (C [P 0 ], L0 ) ≈ (C [P ], L0 ) and (C [Q], L0 ) ≈ (C [Q0 ], L0 ). By Lemma F.2, we have (C [P 0 ], L0 ) ≈ (C [Q0 ], L0 ).

F.2. Definition of Er Definition F.9 (Er). For a type environment Γ, a lattice of secrecy levels L, and a secrecy level l ∈ L, we inductively define ErL,l Γ (P ) as follows: ErL,l Γ (0) = 0

if P = 0,

ErL,l Γ (v) = unit

if P = v , v is a value, and Γ(v) is not l and not lower than l in L,

ErL,l Γ (v) = v

if P = v , v is a value, and Γ(v) is l or lower than l in L, if P = P0 | P1 for processes P0 and P1 ,

L,l L,l ErL,l Γ (P0 | P1 ) = ErΓ (P0 ) | ErΓ (P1 )

if P = ∗P 0 and 0 ErL,l Γ (∗P ) = 0

0 ErL,l Γ (P ) ≃ 0 for a process P 0 ,

if P = ∗P 0 and L,l 0 0 ErL,l Γ (∗P ) = ∗ErΓ (P )

0 ErL,l Γ (P ) 6≃ 0 for a process P 0 ,

if P = x!(v0 , . . . , vn ).P 0 for a process P 0 , l′

Γ(x) is the form hτ0 , . . . , τn i /U with l0 ≤L l, and

L,l 0 0 0 0 ErL,l Γ (x!(v0 , . . . , vn ).P ) = x!v0 , . . . , vn . ErΓ (P )

vi0 = ErL Γ (vi ) for all i = 0, . . . , n,

if P = x!(v0 , . . . , vn ).P 0 for a process P 0 , and Γ(x) is not the form

L,l 0 0 ErL,l Γ (x!(v0 , . . . , vn ).P ) = ErΓ (P )

l′

hτ0 , . . . , τn i /U with l0 ≤L l,

L,l 0 0 ErL,l Γ (x?(y0 , . . . , yn ).P ) = x?y0 , . . . , yn . ErΓ,y0 :τ0 ,...,yn :τn (P )

if P = x?(y0 , . . . , yn ).P 0 for a program P 0 , and l′

Γ(x) is the form hτ0 , . . . , τn i /U with l0 ≤L l,

if P = x?(y0 , . . . , yn ).P 0 for a process P 0 , and

L,l 0 0 ErL,l Γ (x?(y0 , . . . , yn ).P ) = ErΓ,y0 :τ0 ,...,yn :τn (P )

l′

Γ(x) is the form hτ0 , . . . , τn i /U with l0 6≤L l,

if P = x?(y0 , . . . , yn ).P 0 for a process P 0 , and Γ(x) is not

L,l 0 0 ErL,l Γ (x?(y0 , . . . , yn ).P ) = ErΓ,y0 :Unit,...,yn :Unit (P )

l′

the form hτ0 , . . . , τn i /U , if P = (νx : ξ)P 0 for a process P 0 , and

L,l 0 0 ErL,l Γ ((νx : ξ)P ) = (νx : ξ)ErΓ,x:ξ/0 (P )

ξ is the form hτ0 , . . . , τn i with l0 ≤L l,

l′

if P = (νx : ξ)P 0 for a process P 0 , and

L,l 0 0 ErL,l Γ ((νx : ξ)P ) = ErΓ,x:ξ/0 (P )

ξ is not the form hτ1 , . . . , τn i with l0 ≤L l,

l′

ErL,l Γ

(l˜1 <νl0 <l˜2 )L,l 0 l˜1 < νl0 < l˜2 P 0 = l˜1 < νl0 < l˜2 ErΓ (P )

if P = l˜1 < νl0 < l˜2 P 0 for a process P 0 , and l0 ≤L l for any l0 ∈ l˜1 , l˜2 , if P = l˜1 < νl0 < l˜2 P 0

(l˜1 <νl0 <l˜2 )L,l 0 l˜1 < νl0 < l˜2 P 0 = ErΓ (P )

for a process P 0 , and l0 6≤L l for some l0 ∈ l˜1 , l˜2 ,

L,l L,l 0 00 0 00 ErL,l Γ (if v then P else P ) = if v then ErΓ (P ) else ErΓ (P )

if P = if v then P 0 else P 00 for processes P 0 , P 00 , and ′

l 0 Γ(v) = Bool with l ≤L l,

if P = if v then P 0 else P 00 for processes P 0 , P 00 , and

0 00 ErL,l Γ (if v then P else P ) = 0

′

l Γ(v) = Bool does not hold 0 with l ≤L l.

Definition F.10 (The order of occurrences of (- < ν - < -)’s in a process P ). For a process P , we define the order P of occurrences of (-< ν - < -)’s inP as follows: l˜1 < νl0 < l˜2 P l˜10 < νl00 < l˜20 if and only if l˜1 < νl0 < l˜2 P 0 is a subexpression of P , and l˜10 < νl00 < l˜20 occurs in P 0 . L,l 0 Definition F.11 (ErL,l Γ (P )-sublattice). We say that a sublattice L of L is an ErΓ (P )-sublattice if the following conditions hold: (1) For occurrences of l1˜0 < νl00 < l2˜0 , . . . , l1˜n < νl0n < l2˜n in P , where l˜1i < νl0i < l˜2i 6≺P l1˜j < νl0j < l2˜j for i < j , if l1˜0 < νl00 < l2˜0 . . . l1˜n < νl0n < l2˜n L is defined, then there exist j0 < · · · < jm such that l1˜j0 < νl0j0 < l2˜j0 . . . l1˜jm < νl0jm < l2˜jm L0 is defined, o n = l1˜j0 < νl0j0 < l2˜j0 0 , . . . , l1˜jm < νl0jm < l2˜jm n o l˜1 < νl0 < l˜2 l˜1 < νl0 < l˜2 occurs in ErL,l (P ) ∩ Γ n o l1˜0 < νl00 < l2˜0 , . . . , l1˜n < νl0n < l2˜n .

in ErL,l (P ), where l10˜0 < νl00 0 < l20˜0 , . . . , l10˜m < νl00 m < l20˜m Γ 0 0 0 l1˜0 j < νl0j < l2˜0 j for i < j , if l10˜0 < νl00 < l20˜0 . . . l10˜m < νl0m < l20˜m L0 0i 2i 1i ErL,l (P ) Γ is defined, then there exist l1˜0 < νl00 < l2˜0 , . . . , l1˜n < νl0n < l2˜n such that l1˜0 < νl00 < l2˜0 . . . l1˜n < νl0n < l2˜n L is defined, o n l1˜0 < νl00 < l2˜0 , . . . , l1˜n < νl0n < l2˜n = n o l˜1 < νl0 < l˜2 l˜1 < νl0 < l˜2 P l˜10 i < νl00 i < l˜20 i for some i = 0, . . . , m , and l˜1i < νl0i < l˜2i 6≺P l1˜j < νl0j < l2˜j for i < j .

(2) For occurrences 0 6≺ l˜0 < νl < l˜0

We note that Γ(v) is lower than l in L for any value v freely occurring in ErL,l Γ (P ).

F.3. Basic properties of Er Lemma F.12. For a type environments Γ, a lattice for secrecy levels L, a secrecy level l ∈ L and a process P , if L,l Γ(x) is not lower than l in L, then x does not occur in ErΓ (P ).

Proof. By induction on the construction of P . Lemma F.13. For type environments Γ and Γ0 , a lattice for secrecy levels L, a secrecy level l ∈ L and a process P , L,l if Γ(x) ∼ Γ0 (x) for any value x occurring in P , then ErL,l Γ (P ) ≡ ErΓ′ (P ). Proof. By induction on the construction of P . Lemma F.14. ′For a type environments Γ, lattices for secrecy levels L, L0 , a secrecy level l ∈ L, and a process P , if ,l L,l L0 v L and ErL Γ (P ) ≃ 0, then ErΓ (P ) ≃ 0. Proof. By induction on the construction of P . Lemma F.15. For a type environment Γ,a lattice for secrecy levels L, secrecy levels l, l0 ∈ L, and a process P , if L,l′ 0 l ≤L l and ErΓ (P ) ≃ 0, then ErL,l Γ (P ) ≃ 0. Proof. By induction on the construction of P . Lemma F.16. If Γ k L ▷m P is k -securely derivable, then ErL,l Γ (P ) ≃ 0 for any secrecy level l 6≥L m. Proof. Assume that Γ k L ▷m P is k -securely derivable. We show ErL,l Γ (P ) ≡ 0 by induction on k -secure derivation tree of Γ k L ▷l P . We proceed by a case analysis of the rule used at the root. Case 1. In case the rule used at the root is (T-Zero), the claimed result holds obviously. Case 2. Assume that the rule used at the root is (T-New). In this case, there exists a process P 0 such that 0 P ≡ (νx : ξ)P 0 . Then Γ, x : ξ/U k L ▷m P 0 is derivable. Let l 6≥L m. By the induction hypothesis, ErL,l Γ,x:ξ/U (P ) ≃ 0. l′′

L,l 0 0 Assume that ξ is the form hτ1 , . . . , τn i for l00 ≤L l. Then ErL,l Γ ((νx : ξ)P ) ≡ (νx : ξ)ErΓ,x:ξ/0 (P ). By L,l L,l 0 Lemma F.13, we have (νx : ξ)ErΓ,x:ξ/0 (P ) ≃ (νx : ξ)0 ≃ 0. Hence, we see ErΓ (P ) ≃ 0. l′′

L,l 0 0 Assume that ξ is not the form hτ1 , . . . , τn i with l00 ≤L l. Then ErL,l Γ ((νx : ξ)P ) ≡ ErΓ,x:ξ/0 (P ). By Lemma F.13, L,l 0 ErL,l Γ,x:ξ/U (P ) ≃ 0. Hence, we have ErΓ (P ) ≃ 0. Case 3. Assume that the rule used at the root is (T-Rep). In this case, there exist a process P 0 and a type environment Γ0 such that P ≡ ∗P 0 and Γ = ∗Γ0 . Then Γ0 k L ▷m P 0 is derivable. Let l 6≥L m. By the induction hypothesis, L,l L,l 0 0 ErL,l Γ′ (P ) ≃ 0. By Lemma F.13, ErΓ (P ) ≃ 0. Hence, ErΓ (P ) ≡ 0. Case 4. Assume that the rule used at the root is (T-Par). In this case, there exist processes P0 and P1 such that P ≡ P0 | P1 . Then, there exist type environments Γ0 and Γ1 such that Γ ≡ Γ0 | Γ1 and Γi k L ▷m Pi is derivable for i = 0, 1. Let l 6≥L m. By the induction hypothesis, ErL,l Γi (Pi ) ≃ 0 for i = 0, 1. By Lemma F.13, we have L,l L,l ErL,l (P ) ≡ Er (P ) for i = 0, 1 . Then Er (P | P ) ≃ 0 | 0 ≃ 0. i i 0 1 Γi Γ Γ Case 5. Assume that the rule used at the root is (T-If). In this case, there exist a type environment Γ0 and processes P0 and P1 such that Γ ≡ Γ0 | v : Booll and P ≡ if v then P0 else P1 hold and Γ0 k L ▷m Pi is derivable for i = 0, 1. Let l 6≥L m. Since Γ(v) = Booll , we see ErL,l Γ (if v then P0 else P1 ) ≡ 0. Case 6. Assume that the rule used at the root is (T-Out). In this case, there exist a process P 0 , a type environments Γ0 , secrecy levels l00 , l10 ∈ L, types τ̃ , a usage U and tc ∈ N ∪ {∞} such that P ≡ x!ṽ.P 0 , m ≤L l10 and Γ ≡ l′ l′ ↑(tc +1,tc +1) Γ0 | ṽ : ↑ τ̃ | x : hτ̃ i 0 /Ot0c U with m ≤L l00 , tc = ∞ implies l00 ≤L l10 , and Γ0 , x : hτ̃ i 0 /U k L ▷l1′ P 0 is derivable. Let l 6≥L m. Since m ≤L l10 , we have l 6≥L l10 . By the induction hypothesis, ErL,l (P 0 ) ≃ 0. Since l′ ′ Γ ,x:hτ̃ i 0 /U

l 6≥L m and m ≤L l00 , we have l00 6≤L l. Since l00 6≤L l, we have

ErL,l (tc +1,tc +1) ′

′

Γ |ṽ:↑ τ̃ |x:hτ̃ il0 /Ot0c U

↑

(x!ṽ.P 0 ) ≡ ErL,l (tc +1,tc +1) ′

′

Γ |ṽ:↑ τ̃ |x:hτ̃ il0 /Ot0c U

↑

(P 0 ).

By Lemma F.13, we have ErL,l (tc +1,tc +1) ′

′

Γ |ṽ:↑ τ̃ |x:hτ̃ il0 /Ot0c U

↑

(x!ṽ.P 0 ) ≡ ErL,l ′

′

Γ ,x:hτ̃ il0 /U

(P 0 ) ≃ 0.

Case 7. Assume that the rule used at the root is (T-In). In this case, there exist a process P 0 , a type environments Γ0 , secrecy levels l00 , l10 ∈ L, types τ̃ , a usage U and tc ∈ N ∪ {∞} such that P ≡ x?(ỹ).P 0 , Γ ≡ l′ l′ (tc +1,tc +1) 0 ↑ Γ , x : hτ̃ i 0 /It0c U , m ≤L l00 , and m ≤L l10 hold, tc = ∞ implies l00 ≤L l10 , and Γ0 , x : hτ̃ i 0 /U , ỹ : τ̃ k L ▷l1′ P 0 is derivable. Let l 6≥L m. Since m ≤L l10 , we have l 6≥L l10 . By the induction hypothesis, we have (P 0 ) ≃ 0. Since l 6≥L m and m ≤L l00 , we have l00 6≤L l. Since l00 6≤L l, we have ErL,l l′ ′ Γ ,x:hτ̃ i 0 /U ,ỹ:τ̃

( ErL,l (tc +1,tc +1) ′ ↑

′

Γ ,x:hτ̃ il0 /It0c U

) ) (x?(ỹ).P 0 ) ≡ ErL,l ( (P 0 ). ′ ↑(tc +1,tc +1) Γ′ ,x:hτ̃ il0 /It0c U ,ỹ:τ̃

By Lemma F.13, we have ( ErL,l (tc +1,tc +1) ′ ↑

′

Γ ,x:hτ̃ il0 /It0c U

) (x?(ỹ).P 0 ) ≡ ErL,l ( ) (P 0 ) ≃ 0. ′ ↑(tc +1,tc +1) Γ′ ,x:hτ̃ il0 /It0c U ,ỹ:τ̃

0 00 ˜ ˜ Case 8. Assume that the rule exist used at the root is (T-NewSec). In this case, m ≤L l for any l ∈ l2 , l3 , and there 0 0 ˜ ˜ ˜ ˜ a process P such that P ≡ l2 < νl1 < l3 P . Then, the assumption of the rule instance Γ k l2 < νl1 < l3 L ▷m P 0 (l˜2 <νl1 <l˜3 )L,l 0 is derivable. Let l 6≥L m. By the induction hypothesis, we have ErΓ (P ) ≃ 0. For any l0 ∈ l˜2 and l˜3 , because ˜2 <νl1 <l˜3 )L,l l ( L,l of m ≤L l0 , we have l0 6≤L l. Then ErΓ (P ) ≡ ErΓ (P 0 ) ≃ 0. Case 9. Assume that the rule used at the root is (T-Weak). In this case, there exist a type environments Γ0 , a lattice for secrecy levels L0 , a secrecy level l0 ∈ L0 such that Γ <: Γ0 , L0 v L, and l ≤L l0 , and Γ0 k L0 ▷l′ P is ′ ′ ,l derivable. Let l 6≥L m. By the induction hypothesis, we have ErL Γ′ (P ) ≃ 0. By Lemma F.13, Theorem F.14, and Theorem F.15, we see ErL,l Γ (P ) ≃ 0.

F.4. ErL,l Γ (P ) can simulate P Lemma F.17. If Γ k L ▷m P is k -securely derivable, the secrecy level of Γ k L is l1 , and P P 0 , then ErL,l Γ (P ) 0 ErL,l Γ (P ) for any secrecy level l 6≤L l1 . Proof. Assume that Γ k L ▷m P is k -securely derivable and P P 0 . Let l1 be the secrecy level of Γ k L. Fix l 6≤L l1 . L,l 0 0 We show ErL,l Γ (P ) ErΓ (P ) by induction on the construction of P P . We consider cases according to the last rule of the construction of P P 0 . L,l 0 Case 1. If P 0 ≡ P , then ErL,l Γ (P ) ErΓ (P ) obviously. Case 2. Assume that there exists a process Q such that P Q and Q P 0 . By the induction hypothesis, we L,l L,l L,l L,l L,l 0 0 have ErL,l Γ (P ) ErΓ (Q) and ErΓ (Q) ErΓ (P ). Hence, ErΓ (P ) ErΓ (P ). L,l L,l L,l L,l 0 0 Case 3. (SP-Zero1). Assume P ≡ P | 0. Then ErΓ (P ) ≡ ErΓ (P ) | ErΓ (0) ≡ ErL,l Γ (P ) | 0. Hence, ErΓ (P ) L,l L,l 0 ErΓ (P ) | 0 ≡ ErΓ (P ). L,l 0 0 In the same way, we can show ErL,l Γ (P ) ErΓ (P ) in case P ≡ P | 0. l′ 0 Case 4. (SP-Zero2). Assume P ≡ 0 and P ≡ (νx : ξ)0. Then ErL,l Γ (P ) ≡ 0. If ξ is the′ form hτ1 , . . . , τn i l L,l 0 0 with l0 ≤L l, then ErL,l Γ (P ) ≡ (νx : ξ)ErΓ,x:ξ/0 (0) ≡ (νx : ξ)0. If ξ is not the form hτ1 , . . . , τn i with l ≤L l, then L,l L,l L,l 0 0 ErΓ (P ) ≡ 0. In both cases, we have ErΓ (P ) ErΓ (P ). L,l 0 0 In the same way, we can show ErL,l Γ (P ) ErΓ (P ) in case P ≡ (νx : ξ)0 and P ≡ 0. 0 Case 5. (SP-Commut). Assume P ≡ P0 | P1 and P ≡ P1 | P0 with processes P0 and P1 . Then ErL,l Γ (P ) ≡ L,l L,l L,l L,l L,l L,l 0 0 ErL,l Γ (P0 ) | ErΓ (P1 ) and ErΓ (P ) ≡ ErΓ (P1 ) | ErΓ (P0 ). We have ErΓ (P ) ErΓ (P ). Case 6. (SP-Assoc). Assume P ≡ (P0 | P1 ) | P2 and P 0 ≡ P0 | (P1 | P2 ) with processes P0 , P1 , and P2 . L,l L,l L,l L,l L,l L,l 0 (P ) | ErL,l (P ) ≡ Er (P ) and Er (P ) | Er Then ErΓ (P ) ≡ ErΓ (P0 ) | ErL,l 0 2 1 Γ (P1 ) | ErΓ (P2 ) . We have Γ Γ Γ Γ L,l 0 ErL,l Γ (P ) ErΓ (P ). Case 7. (SP-New). Assume P ≡ (νx : ξ)P0 | P1 and P 0 ≡ (νx : ξ)P0 | P1 with processes P0 , P1 , and l′ L,l L,l x ∈ / FN(P1 ). If ξ is the form hτ1 , . . . , τn i with l0 ≤L l, then ErL,l Γ (P ) ≡ (νx : ξ)ErΓ,x:ξ/0 (P0 ) | ErΓ,x:ξ/0 (P1 ) l′

L,l L,l 0 and ErL,l with l0 ≤L l, then Γ (P ) ≡ (νx : ξ)ErΓ,x:ξ/0 (P0 ) | ErΓ,x:ξ/0 (P1 ). If ξ is not the form hτ1 , . . . , τn i L,l L,l L,l L,l L,l 0 ErL,l Γ (P ) ≡ ErΓ,x:ξ/0 (P0 ) | ErΓ,x:ξ/0 (P1 ) and ErΓ (P ) ≡ ErΓ,x:ξ/0 (P0 ) | ErΓ,x:ξ/0 (P1 ). In both cases, we have L,l L,l ErΓ (P ) ErΓ (P 0 ). ′ Case 8. (SP-IfT). Assume P ≡ if truel then P0 else P1 and P 0 ≡ P0 with processes P0 and P1 . By Lemma D.1 (8), there exist a type environments Γ0 , a lattice for secrecy levels L0 , and l00 ∈ L0 such that L0 v L, m ≤L l00 , and l′ l′′ 0 Γ <: Γ | true : Bool , and both Γ0 k L0 ▷l′′ P0 and Γ0 k L0 ▷l′′ P1 are derivable. Then l0 = l00 . We consider cases according to l0 . ′ L,l l′ Assume l0 ≤L l. Then ErL,l if true then P else P ≡ if truel then ErL,l 0 1 Γ Γ (P0 ) else ErΓ (P1 ). Hence, ′ ErL,l if truel then P0 else P1 ErL,l Γ Γ (P0 ). ′ ′ L,l ,l 0 Assume l 6≤L l. Then ErΓ if truel then P0 else P1 ≡ 0. By Theorem F.16, we have ErL Γ′ (P0 ) ≃ 0. By ′ L,l Lemma F.13 and Theorem F.14, we have ErL,l if truel then P0 else P1 ErL,l Γ (P0 ) ≃ 0. Hence, ErΓ Γ (P0 ).

′

Case 9. (SP-IfF). Assume P ≡ if falsel then P0 else P1 and P 0 ≡ P1 with processes P0 and P1 . By Lemma D.1 (8), there Γ0 , a lattice for secrecy levels L0 , and l00 ∈ L0 such that L0 v L, m ≤L l00 , and exist ′a type environments ′′ l Γ <: Γ0 | false : Booll , and both Γ0 k L0 ▷l′′ P0 and Γ0 k L0 ▷l′′ P1 are derivable. Then l0 = l00 . We consider cases according to l0 . ′ ′ L,l Assume l0 ≤L l. Then ErL,l if falsel then P0 else P1 ≡ if falsel then ErL,l Γ Γ (P0 ) else ErΓ (P1 ). Hence, ′ ErL,l if falsel then P0 else P1 ErL,l Γ (P1 ). Γ ′ ′ L,l ,l Assume l0 6≤L l. Then ErΓ if falsel then P0 else P1 ≡ 0. By Theorem F.16, we have ErL Γ′ (P1 ) ≃ 0. By ′ L,l Lemma F.13 and Theorem F.14, we have ErL,l if falsel then P0 else P1 ErL,l Γ (P1 ) ≃ 0. Hence, ErΓ Γ (P1 ). Case 10. (SP-Rep). Assume P ≡ ∗P0 and P 0 ≡ ∗P0 | P0 with a process P0 . We consider cases according to ErL,l Γ (P0 ). L,l L,l L,l Assume ErL,l Γ (P0 ) ≃ 0. Then, we have ErΓ (∗P0 ) ≡ 0. We also have ErΓ (∗P0 | P0 ) ≡ 0 | ErΓ (P0 ). By (SPL,l L,l Zero1) and Lemma A.5 (1), we have ErL,l Γ (∗P0 ) ≡ 0 0 | 0 0 | ErΓ (P0 ) ≡ ErΓ (∗P0 | P0 ). L,l L,l L,l L,l Assume ErΓ (P0 ) 6≃ 0. Then, we have ErΓ (∗P0 ) ≡ ∗ErΓ (P0 ). Hence, we have ErL,l Γ (∗P0 ) ≡ ∗ErΓ (P0 ) L,l L,l L,l ∗ErΓ (P0 ) | ErΓ (P0 ) ErΓ (∗P0 | P0 ). Case 11. (SP-Par). Assume P ≡ P0 | P1 and P 0 ≡ P00 | P1 with P0 P00 for process P0 , P1 , and P00 . Then L,l L,l L,l L,l L,l 0 0 ErΓ (P ) ≡ ErL,l Γ (P0 ) | ErΓ (P1 ) and ErΓ (P ) ≡ ErΓ (P0 ) | ErΓ (P1 ). By the induction hypothesis, we have L,l L,l L,l L,l 0 0 ErΓ (P0 ) ErΓ (P0 ). We have ErΓ (P ) ErΓ (P ). Case 12. (SP-CNew). Assume P ≡ (νx : ξ)P0 and P 0 ≡ (νx : ξ)P00 with P0 P00 for process P0 and P00 . By l′ L,l 0 0 the induction hypothesis, we have ErL,l Γ,x:ξ/0 (P0 ) ErΓ,x:ξ/0 (P0 ). If ξ is the form hτ1 , . . . , τn i with l ≤L l, then l′

L,l L,l L,l 0 0 ErL,l Γ (P ) ≡ (νx : ξ)ErΓ,x:ξ/0 (P0 ) and ErΓ (P ) ≡ (νx : ξ)ErΓ,x:ξ/0 (P0 ). If ξ is not the form hτ1 , . . . , τn i with l ≤L l, L,l L,l L,l L,l L,l 0 0 0 then ErL,l Γ (P ) ≡ ErΓ,x:ξ/0 (P0 ) and ErΓ (P ) ≡ ErΓ,x:ξ/0 (P0 ). In both cases, we have ErΓ (P ) ErΓ (P ).

Lemma F.18. Let y0 , . . . , yn be channel names, v0 , . . . , vn be values and vi0 be ErL,l Γ (vi ). Let ỹ = (y0 , . . . , yn ), ṽ = (v0 , . . . , vn ), and v˜0 = (v00 , . . . ,vn0 ). L,l ˜0 with τ̃ = (Γ(v0 ), . . . , Γ(vn )) for a value or process P . ErL,l Γ (P [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v L,l ˜0 by induction on the construction of P . We consider cases Proof. We show ErL,l Γ (P [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v according to the form of P . Case 1. Assume P ≡ w for a value w. L,l L,l 6≡ yi for i = 0, . . . , n. Then ErL,l Γ (w[ỹ 7→ ṽ]) ≡ ErΓ (w). By Lemma F.13, ErΓ (w) ≡ Assume w ˜0 ErL,l Γ,ỹ:τ̃ (w) ỹ 7→ v . L,l Assume w ≡ yi for i = 0, . . . , n. Then ErL,l Γ (yi [ỹ 7→ ṽ]) ≡ ErΓ (vi ). L,l We consider the case where lower than l in L. In this case, ErL,l Γ (vi ) ≡ unit and ErΓ,ỹ:τ̃ (yi ) ≡ unit. Γ(vi ) is not Hence, we have ErL,l (vi ) ≡ ErL,l (yi ) ỹ 7→ v˜0 . Γ

Γ,ỹ:τ̃

L,l 0 We consider the case where l in L. In this case, ErL,l Γ (vi ) ≡ vi ≡ vi and ErΓ,ỹ:τ̃ (yi ) ≡ yi . Γ(vi ) islower than Hence, we have ErL,l (vi ) ≡ ErL,l (yi ) ỹ 7→ v˜0 . Γ

Γ,ỹ:τ̃

L,l L,l P ≡ 0. In this case, ErL,l Γ (P [ỹ 7→ ṽ]) ≡ 0 and ErΓ,ỹ:τ̃ (P ) ≡ 0. Hence, we have ErΓ (P [ỹ 7→ ṽ]) ≡ Case 2. Assume ErL,l (P ) ỹ 7→ v˜0 . Γ,ỹ:τ̃

L,l L,l Case 3. Assume P ≡ P0 | P1 . In this case, ErL,l and ErL,l (P ) ≡ Γ (P [ỹ 7→ ṽ]) ≡ ErΓ (P0 [ỹ 7→ ṽ]) | Er Γ (P1 [ỹ 7→ṽ]) Γ,ỹ:τ̃ L,l L,l L,l L,l 0 ˜ ErΓ,ỹ:τ̃ (P0 ) | ErΓ,ỹ:τ̃ (P1 ). By the induction hypothesis, we have ErΓ (Pi [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (Pi ) ỹ 7→ v for i = 0, 1. L,l ˜0 Then, we have ErL,l Γ (P [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v . L,l 0 0 Case 4. Assume P ≡ ∗P 0 . By the induction hypothesis, we have ErL,l (P [ỹ → 7 ṽ]) ≡ Er (P ) ỹ 7→ v˜0 . We Γ Γ,ỹ:τ̃ 0 consider cases according to the form of ErL,l Γ (P [ỹ 7→ ṽ]). L,l L,l 0 ˜0 ≃ 0, we have Assume ErΓ (P 0 [ỹ 7→ ṽ]) ≃ 0. Then ErΓ (∗P 0 [ỹ 7→ ṽ]) ≡ 0. Since ErL,l Γ,ỹ:τ̃ (P ) ỹ 7→ v L,l L,l 0 0 0 ˜0 ≡ 0. Thus, ErL,l (P [ỹ 7→ ṽ]) ≡ ErL,l Γ,ỹ:τ̃ (P ) ≃ 0. Hence, ErΓ,ỹ:τ̃ (∗P ) ≡ 0. Then, we have ErΓ,ỹ:τ̃ (∗P ) ỹ 7→ v Γ L,l 0 ˜ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v .

L,l L,l L,l L,l 0 0 0 Assume ErL,l Γ (P [ỹ 7→ ṽ]) 6≃ 0. Then ErΓ (P [ỹ 7→ ṽ]) ≡ ∗ErΓ (P [ỹ 7→ ṽ]) and ErΓ,ỹ:τ̃ (P ) ≡ ∗ErΓ,ỹ:τ̃ (P ). We have L,l 0 ErL,l Γ (P [ỹ 7→ ṽ]) ≡ ∗ErΓ (P [ỹ 7→ ṽ]) 0 ≡ ∗ErL,l (P ) ỹ 7→ v˜0 Γ,ỹ:τ̃ ˜0 ≡ ErL,l Γ,ỹ:τ̃ (P ) ỹ 7→ v . L,l Thus, ErL,l ( [ỹ → 7 ṽ]) ≡ Er (P ) ỹ 7→ v˜0 . P Γ Γ,ỹ:τ̃ Case 5. Assume P ≡ x!w̃.P 0 . Let x0 ≡ x ỹ 7→ v˜0 and w̃0 ≡ w̃ ỹ 7→ v˜0 . We consider cases according to the form of Γ(x). l′ ≡ Assume that Γ(x) is the form hτ1 , . . . , τn i /U with l0 ≤L l. Then, we have ErL,l Γ (P [ỹ 7→ ṽ]) L,l L,l 0 0 x0 !w̃0 . ErL,l (P [ỹ → 7 ṽ]) and Er (P ) ≡ x! w̃. Er (P ) . By the induction hypothesis, we have Γ Γ,ỹ:τ̃ Γ,ỹ:τ̃ ErL,l (P 0 [ỹ 7→ ṽ]) ≡ ErL,l (P 0 ) ỹ 7→ v˜0 . Then, we have Γ

Γ,ỹ:τ̃

L,l 0 0 0 ErL,l Γ (P [ỹ 7→ ṽ]) ≡ x !w̃ . ErΓ (P [ỹ 7→ ṽ]) 0 ˜0 ≡ x0 !w̃0 . ErL,l Γ,ỹ:τ̃ (P ) ỹ 7→ v 0 ˜0 ≡ x!w̃. ErL,l Γ,ỹ:τ̃ (P ) ỹ 7→ v ≡ ErL,l (P ) ỹ 7→ v˜0 . Γ,ỹ:τ̃ l′

L,l 0 Assume that Γ(x) is not the form hτ1 , . . . , τn i /U with l0 ≤L l. Then, we have ErL,l 7→ ṽ]) Γ (P Γ (P [ỹ [ỹ 7→ ṽ]) ≡ Er L,l L,l L,l L,l 0 0 0 0 ˜ and ErΓ,ỹ:τ̃ (P ) ≡ ErΓ,ỹ:τ̃ (P ). By the induction hypothesis, we have ErΓ (P [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v . Then, L,l (P ) ỹ 7→ v˜0 . ( [ỹ → 7 ṽ]) ≡ Er we have ErL,l P Γ,ỹ:τ̃ Γ Case 6. Assume P ≡ x?z̃.P 0 . Let x0 ≡ x ỹ 7→ v˜0 . We consider cases according to the form of Γ(x). l′

Assume that Γ(x) is the form hτ1 , . . . , τn i /U with l0 ≤L l. Then, we have ErL,l ≡ Γ (P [ỹ 7→ ṽ]) L,l L,l 0 0 0 (P ) . By the induction hypothesis, we have (P ) ≡ x?z̃. Er (P [ỹ → 7 ṽ]) and Er x ?z̃. ErL,l Γ,ỹ:τ̃ Γ,ỹ:τ̃ ,z̃:τ˜′ Γ,z̃:τ˜′ L,l 0 0 ˜0 . Then, we have ErL,l (P [ỹ → 7 ṽ]) ≡ Er (P ) ỹ → 7 v Γ,z̃:τ˜′ Γ,ỹ:τ̃ ,z̃:τ˜′ L,l 0 0 ErL,l Γ (P [ỹ 7→ ṽ]) ≡ x ?z̃. ErΓ,z̃:τ˜′ (P [ỹ 7→ ṽ]) (P 0 ) ỹ 7→ v˜0 ≡ x0 ?z̃. ErL,l Γ,ỹ:τ̃ ,z̃:τ˜′ 0 ˜0 ≡ x?z̃. ErL,l Γ,ỹ:τ̃ (P ) ỹ 7→ v ˜0 ≡ ErL,l Γ,ỹ:τ̃ (P ) ỹ 7→ v . l′

≡ Assume that Γ(x) is the form hτ1 , . . . , τn i /U with l0 6≤L l. Then ErL,l Γ (P [ỹ 7→ ṽ]) L,l L,l L,l 0 0 ErΓ,z̃:τ˜′ (P [ỹ 7→ ṽ]) and ErΓ,ỹ:τ̃ (P ) ≡ ErΓ,ỹ:τ̃ ,z̃:τ˜′ (P ). By the induction hypothesis, we have L,l 0 0 ˜0 . Then, we have ErL,l (P [ỹ 7→ ṽ]) ≡ ErL,l (P ) ỹ 7→ v˜0 . (P ) ỹ → 7 v (P [ỹ → 7 ṽ]) ≡ Er ErL,l ′ ′ ˜ ˜ Γ Γ,ỹ:τ̃ Γ,ỹ:τ̃ ,z̃:τ Γ,z̃:τ l′ L,l In case that Γ(x) is not the form hτ1 , . . . , τn i /U for any l0 , we can show ErL,l ( [ỹ → 7 ṽ]) ≡ Er (P ) ỹ 7→ v˜0 P Γ Γ,ỹ:τ̃ l′

in the similar way to the case that Γ(x) is the form hτ1 , . . . , τn i /U with l0 6≤L l. Case 7. Assume P ≡ (νx : ξ)P 0 . We consider cases according to the form of ξ . l′ Assume that ξ is the form hτ1 , . . . , τn i with l0 ≤L l. Then, we have L,l L,l L,l 0 0 ErΓ (P [ỹ 7→ ṽ]) ≡ (νx : ξ)ErΓ,x:ξ/0 (P [ỹ 7→ ṽ]) and ErΓ,ỹ:τ̃ (P ) ≡ (νx : ξ)ErL,l (P ) . By the induction Γ,ỹ:τ̃ ,x:ξ/0 hypothesis, we have ErL,l (P 0 [ỹ 7→ ṽ]) ≡ ErL,l (P 0 ) ỹ 7→ v˜0 . Then, we have Γ,x:ξ/0

Γ,ỹ:τ̃ ,x:ξ/0

L,l 0 ErL,l Γ (P [ỹ 7→ ṽ]) ≡ (νx : ξ)ErΓ,x:ξ/0 (P [ỹ 7→ ṽ]) 0 ≡ (νx : ξ) ErL,l (P ) ỹ 7→ v˜0 Γ,ỹ:τ̃ ,x:ξ/0

˜0 ≡ ErL,l Γ,ỹ:τ̃ (P ) ỹ 7→ v . l′

L,l 0 Assume that ξ is not the form hτ1 , . . . , τn i with l0 ≤L l. Then ErL,l Γ (P [ỹ 7→ ṽ]) ≡ ErΓ,x:ξ/0 (P [ỹ 7→ ṽ]) and L,l L,l 0 ErΓ,ỹ:τ̃ (P ) ≡ ErΓ,ỹ:τ̃ ,x:ξ/0 (P ). By the induction hypothesis, we have L,l 0 0 ErL,l (P [ỹ → 7 ṽ]) ≡ Er (P ) ỹ 7→ v˜0 . Γ,x:ξ/0 Γ,ỹ:τ̃ ,x:ξ/0 L,l ˜0 Then, we have ErL,l Γ (P [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v . Case 8. Assume P ≡ l˜1 < νl0 < l˜2 P 0 . Let L0 = l˜1 < νl0 < l˜2 L We consider cases according to l. ′ ,l 0 Assume l0 ≤L l for any l0 ∈ l˜1 , l˜2 . In this case, ErL,l l˜1 < νl0 < l˜2 ErL Γ (P [ỹ 7→ ṽ]) ≡ Γ (P [ỹ 7→ ṽ]) ′ ′ ,l L ,l 0 0 l˜1 < νl0 < l˜2 ErL and ErL,l Γ,ỹ:τ̃ (P ). By the induction hypothesis, we have ErΓ (P [ỹ 7→ ṽ]) ≡ Γ,ỹ:τ̃ (P ) ≡ ′ ,l L,l L,l 0 ˜0 ˜0 ErL Γ,ỹ:τ̃ (P ) ỹ 7→ v . Then, we have ErΓ (P [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v . ′ L′ ,l 0 Assume l0 6≤L l for some l0 ∈ l˜1 , l˜2 . In this case, ErL,l 7→ ṽ]) ≡ ErΓL ,l (P 0 [ỹ 7→ ṽ]) and ErL,l Γ (P [ỹ Γ,ỹ:τ̃ (P ) ≡ ErΓ,ỹ:τ̃ (P ). ′ ′ ,l L ,l L,l 0 0 ˜0 By the induction hypothesis, we have ErL Γ (P [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v . Then, we have ErΓ (P [ỹ 7→ ṽ]) ≡ ˜0 ErL,l Γ,ỹ:τ̃ (P ) ỹ 7→ v . Case 9. Assume P ≡ if w then P0 else P1 . Let w̃0 ≡ w̃ ỹ 7→ v˜0 . We consider cases according to the form of Γ(w). l′

≡ Assume that Γ(w) is the form hτ1 , . . . , τn i /U with l0 ≤L l. Then, we have ErL,l Γ (P [ỹ 7→ ṽ]) L,l L,l L,l L,l if w0 then ErL,l (P [ỹ → 7 ṽ]) else Er (P [ỹ → 7 ṽ]) and Er (P ) ≡ if w then Er (P ) else Er (P ) . By the 0 1 0 1 Γ Γ Γ,ỹ:τ̃ Γ Γ (l˜1 <νl0 <l˜2 )L,l 0 for i = 0, 1. Then, we have ˜ (Pi [ỹ 7→ ṽ]) ≡ ErL,l (P ) ỹ → 7 v induction hypothesis, we have ErΓ i Γ,ỹ:τ̃ L,l L,l 0 ˜ ErΓ (P [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v . l′

Assume that Γ(w) is not the form hτ1 , . . . , τni /U with l0 ≤L l. Then, we have ErL,l Γ (P [ỹ 7→ ṽ]) ≡ 0 and L,l L,l L,l 0 ˜ ErΓ,ỹ:τ̃ (P ) ≡ 0. Then, we have ErΓ (P [ỹ 7→ ṽ]) ≡ ErΓ,ỹ:τ̃ (P ) ỹ 7→ v . L̂,l̂ l̂ (P ) Er P̂ . Lemma F.19. (1) If Γ k L ▷m P is k -securely derivable, and (P, L) −→Γl̂ P̂ , L̂ , then ErL, Γ Γ l̂ (P )(2) If Γ k L ▷m P is k -securely derivable, and (P, L) 6−→Γl̂ P̂ , L̂ but (P, L) −→ P̂ , L̂ , then, for any ErL, Γ L̂,l̂ L,l̂ 0 0 0 0 sublattice L of L, there exists a lattice for secrecy levels L̂ such that ErΓ (P ), L −→ ErΓ P̂ , L̂ and L̂0 l̂ is an ErL̂, P̂ -sublattice of L̂. Γ Proof. We show each statements (1) Assume that Γ k L ▷m P is k -securely derivable, and (P, L) −→Γl̂ P̂ , L̂ . By induction on the construction of l̂ L̂,l̂ (P, L) −→ P̂ , L̂ , we prove ErL, (P ) Er P̂ . We consider cases according to the last rule of the construction Γ Γ of (P, L) −→Γl̂ P̂ , L̂ . = (y Case (1). In this case, P ≡ x!ṽ.P0 | x?ỹ.P1 and P̂ ≡ P0 | P1 [ỹ 7→ ṽ] with ỹ 0 , . . . , yn ) and ṽ = (v0 , . . . , vn ). L,l̂ L,l̂ L,l̂ L,l̂ l̂ L,l̂ We also have L̂ = L. Then ErΓ (P ) ≡ ErΓ (x!ṽ.P0 ) | ErΓ (x?ỹ.P1 ) and ErΓ P̂ ≡ ErL, Γ (P0 ) | ErΓ (P1 [ỹ 7→ ṽ]). ′ l By Lemma D.1, Γ(x) is the form hτ0 , . . . , τn i /U , where τi ∼ Γ(vi ) for i = 0, . . . , n. Since (P, L) −→Γl̂ P̂ , L̂ , we have l0 6≤L ˆl. Then, we see ErL,l̂ (P ) ≡ ErL,l̂ (P0 ) | ErL,l̂ (P1 ) and ErL,l̂ P̂ ≡ ErL,l̂ (P0 ) | ErL,l̂ (P1 [ỹ 7→ ṽ]). By Γ

Theorem F.18, we have

Γ,ỹ:τ̃

l̂ L,l̂ ErL, Γ (P1 [ỹ 7→ ṽ]) ≡ ErΓ,y0 :Γ(vn ),...,yn :Γ(vn ) (P1 )

ỹ 7→ v˜0 .

Because Γ k L is secure, l0 ≤L l00 for any secrecy type l00 occurring in τi with i = 0, 1, . . . . Hence, τi is not lower than ˆl for any i = 0, . . . , n. Therefore, Γ(vi ) is not lower than ˆl for any i = 0, . . . , n. By Lemma F.12, yi does not l̂ occur in ErL, Γ,y0 :Γ(vn ),...,yn :Γ(vn ) (P1 ) for any i = 0, . . . , n. Hence, l̂ ˜0 ≡ ErL,l̂ ErL, (P ) ỹ → 7 v (P ) . 1 1 Γ,y0 :Γ(vn ),...,yn :Γ(vn ) Γ,y0 :Γ(vn ),...,yn :Γ(vn )

By Lemma F.13, we have l̂ ErL̂, P̂ -sublattice of L̂. Γ

l̂ L,l̂ L,l̂ L̂,l̂ ErL, P̂ . Then L0 is an Γ,y0 :Γ(vn ),...,yn :Γ(vn ) (P1 ) ≡ ErΓ,ỹ:τ̃ (P1 ). Thus, ErΓ (P ) ErΓ

Case (2). Let l˜0 , l˜1 ⊆ L. Let P ≡ l˜0 < νl0 < l˜1 P 0 . Assume that l˜0 < νl0 < l˜1 L is defined. Then P̂ ≡ P 0 and l̂ L̂,l̂ L̂ = l˜0 < νl0 < l˜1 L. Since (P, L) −→Γl̂ P̂ , L̂ , we have l0 6≤L ˆl for some l0 ∈ l˜0 , l˜1 . Then ErL, (P ) ≡ Er P̂ . Γ Γ L,l̂ L̂,l̂ L̂,l̂ 0 Hence, ErΓ (P ) ErΓ P̂ , and L is an ErΓ P̂ -sublattice of L̂. Case (3). Straightforward. Case (4). Straightforward. Case (5). Straightforward. (2) Assume that Γ k L ▷m P is k -securely derivable, and (P, L) 6−→Γl̂ P̂ , L̂ but (P, L) −→ P̂ , L̂ . Let L0 be l̂ an ErL, Γ (P )-sublattice of L. By induction on the construction of (P, L) −→ P̂ , L̂ , we prove that there exists a l̂ L̂,l̂ L̂,l̂ 0 0 0 lattice for secrecy levels L̂0 such that ErL, (P ), L −→ Er P̂ , L̂ is an Er and L̂ P̂ -sublattice of L̂. We Γ Γ Γ consider cases according to the last rule of the construction of (P, L) −→ P̂ , L̂ . Case 1. (R-Com). In this case, P ≡ x!ṽ.P0 | x?ỹ.P1 and P̂ ≡ P0 | P1 [ỹ 7→ ṽ] with ỹ = (y0 ,. . ., yn ) l̂ L,l̂ L,l̂ L,l̂ and ṽ = (v0 , . . . , vn ). We also have L̂ = L. Then ErL, P̂ ≡ Γ (P ) ≡ ErΓ (x!ṽ.P0 ) | ErΓ (x?ỹ.P1 ) and ErΓ l′

l̂ L,l̂ is theform hτ0 , . . . , τn i /U , where τi ∼ Γ(vi ) for i = 0, . . . , n. We ErL, Γ (P0 ) | ErΓ (P1 [ỹ 7→ ṽ]). By Lemma D.1, Γ(x) l̂ 0 Γ consider cases according to l . Since (P, L) 6−→l̂ P̂ , L̂ , we have l0 ≤L ˆl. Let vi0 ≡ ErL, Γ (vi ) for all i = 0, . . . , n.

˜0 = (v00 , . . . , vn0 ), and τ̃ = hτ0 , . . . , τn i. Then, we have ErL,l̂ (P ) ≡ x!v˜0 . ErL,l̂ (P0 ) | x?ỹ. ErL,l̂ (P1 ) and Let v Γ Γ Γ,ỹ:τ̃ L,l̂ l̂ L,l̂ (P [ỹ → 7 ṽ]) . By (P ) | Er Theorem F.18, we have ErL, P̂ ≡ Er 1 0 Γ Γ Γ l̂ L,l̂ ˜0 ErL, Γ (P1 [ỹ 7→ ṽ]) ≡ ErΓ,y0 :Γ(vn ),...,yn :Γ(vn ) (P1 ) ỹ 7→ v . l̂ l̂ L,l̂ L,l̂ ˜0 ˜0 By Lemma F.13, ErL, ErL, Γ (P1 [ỹ 7→ ṽ]) ≡ Γ,ỹ:τ̃ (P1 ) ỹ 7→ v . Hence, we have ErΓ (P ) ≡ x!v . ErΓ (P0 ) | l̂ x?ỹ. ErL, Γ,ỹ:τ̃ (P1 ) and

l̂ l̂ L,l̂ ErL, P̂ ≡ ErL, Γ Γ (P0 ) | ErΓ (P1 [ỹ 7→ ṽ]) L,l̂ l̂ ˜0 ≡ ErL, Γ (P0 ) | ErΓ,ỹ:τ̃ (P1 ) ỹ 7→ v . l̂ l̂ l̂ 0 P̂ P̂ , L0 for any lattice for secrecy levels L0 , where L0 is an ErL̂, −→ ErL̂, Therefore, we have ErL, Γ Γ Γ (P ), L sublattice of L. Case 2. (R-NewLev). Let l˜0 , l˜1 ⊆ L. Let P ≡ l˜0 < νl0 < l˜1 P 0 . Assume that l˜0 < νl0 < l˜1 L is defined. Then P̂ ≡ P 0 and L̂ = l˜0 < νl0 < l˜1 L. Since (P, L) 6−→Γl̂ P̂ , L̂ , we have l0 ≤L ˆl for any l0 ∈ l˜0 , l˜1 . l̂ ˜0 < νl0 < l˜1 ErL̂,l̂ P̂ . Let L0 be an ErL,l̂ (P )-sublattice of L. Then ErL,l̂ (P ), L0 −→ (P ) ≡ l Then ErL, Γ Γ Γ Γ l̂ ˜0 < νl0 < l˜1 L0 . Then l˜0 < νl0 < l˜1 L0 is an ErL̂,l̂ P̂ -sublattice of L̂. ErL̂, P̂ , l Γ Γ Case 3. (R-Par). Straightforward. Case 4. (R-New). Straightforward. Case 5. (R-SP). Straightforward.

F.5. P can simulate ErL,l Γ (P ) 0 0 Lemma F.20. For a reliable type environment Γ, if Γ k L ▷m P is k -securely derivable, P 0 ErL,k Γ (P ) and P P̄ , L̄,k then there exist P̄ , L̄ and Γ̄ such that (P, L) −→ → P̄ , L̄ , Γ −→ → Γ̄ and P̄ 0 ErΓ̄ P̄ . 0 0 Proof. Assume that Γ k L ▷m P is k -securely derivable, P 0 ErL,k on the Γ (P ) and P P̄ . By induction construction of P 0 P̄ 0 , we show that there exist P̄ , L̄, and Γ̄ such that (P, L) −→ → P̄ , L̄ , Γ −→ → Γ̄ and P̄ 0 ErL̄,k P̄ . We consider cases according to the last rule of the construction of P 0 P̄ 0 . Γ̄ Case 1. Assume P̄ 0 ≡ P 0 . Let P̄ ≡ P , L̄ ≡ L and Γ̄ ≡ Γ. Then, we have the claimed result.

Case 2. Assume tbar there exists a process P0 such that P0 P0 and P0 P̄ 0 . By the induction hypothesis, we 0 ,k 0 ,k see tbar there exist P̄0 , L̄0 and Γ̄0 such tbar (P, L) −→ → P̄0 , L̄0 , Γ −→ → Γ̄0 and P0 ErL̄ P̄ . By P ErL̄ P̄0 0 Γ̄ Γ̄0 0 0 and the induction hypothesis, we see tbar there exist P̄ , L̄ and Γ̄ such that P̄0 , L̄0 −→ → P̄ , L̄ , Γ̄0 −→ → Γ̄ and L̄,k 0 P̄ 0 ErL̄,k P̄ . Therefore, we have (P, L) −→ → P̄ , L̄ , Γ −→ → Γ̄ and P̄ Er P̄ . Γ Γ̄ Case 3. (SP-Zero1). Straightforward. Case 4. (SP-Zero2). Straightforward. Case 5. (SP-Commut). Straightforward. Case 6. (SP-Assoc). Straightforward. Case 7. (SP-New). Straightforward. ′ 0 Case 8. (SP-IfT). Let P 0 ≡ if truel then Q0 else Q1 and P̄ 0 ≡ Q0 . Then, we have either ErL,k Γ (P ) ≡ P or L,k Q0 ErΓ (P ). 0 0 0 Assume ErL,k Γ (P ) ≡ P . Then l ≤L k . By Definition F.9, P ≡ C [P ] for some finite level context, where l′ 0 Γ(x) = hτ̃ i /U implies l 6≤L k for all x ∈ FN(C) and, for all occurrence (νx : ξ)- in C , the type of ξ is not less than k in L. FromLemma 4.13, there existsan evaluation context E and alattice for secrecy levels L̂ such that 0 Γ 0 → E [Q0 ], L̂ . Since E [P 0 ] E [Q0 ], we (C, L) −→ →k E, L̂ . Hence, (C [P ], L) −→ → E [P ], L̂ and (C [Q0 ], L) −→ have (C [P 0 ], L) −→ → E [Q0 ], L̂ . We see ErL̂,k Γ (E [Q0 ]) ≡ Q0 . Let P̄ ≡ E [Q0 ], L̄ ≡ L̂, Γ̄ ≡ Γ. Then, we have the claimed result. L,k 0 Assume Q0 ErL,k Γ (P ). Then P̄ ErΓ (P ). Let P̄ ≡ P , L̄ ≡ L and Γ̄ ≡ Γ. Then, we have the claimed result. Case 9. (SP-IfF). In the similar way to the case (SP-IfT). Case 10. (SP-Rep). Straightforward. Case 11. (SP-Par). Straightforward. Case 12. (SP-CNew). Straightforward. 0 0 Lemma F.21. For type environments Γ, ∆, lattices for secrecy levels L, Lh0 and a k -(Γ i k L, m)-(∆ k L , m )-context L′ ,m′ L′ ,m′ L,m C , if Γ k L ▷m P is k -securely derivable, then Er∆ (C [P ]) ≡ Er∆ (C) ErΓ (P ) .

Proof. By induction on k -secure derivation tree of ∆ k L0 ▷m′ C from Γ k L ▷m [ ]. 0 Lemma F.22. For a reliable type environment Γ, if Γ k L ▷m P is k -securely derivable, P 0 ErL,k Γ (P ), L is L,k 0 0 0 0 → → P̄ , L̄ , and an ErΓ (P )-sublattice of L, and (P , L ) −→ P̄ , L̄ , then there exist P̄ and L̄ such that (P, L) −→ 0 L̄,k (P ) -sublattice of L̄ . P̄ , L̄ is an Er P̄ 0 ErL̄,k Γ Γ L̂,l̂ l̂ 0 Proof. Assume that Γ k L ▷m P is k -securely derivable, P 0 ErL, Γ (P ), L is an ErΓ (P )-sublattice of L, and 0 0 0 0 (P , L ) −→ P̄ , L̄ . By Theorem A.6, either (1) P 0 ν x̃ : ξ˜ z!ṽ.P00 | z?ỹ.P10 | P20 , ν x̃ : ξ˜ P00 | P10 [ỹ 7→ ṽ] | P20 P̄ 0 and L̄0 = L0 , or (2) P 0 ν x̃ : ξ˜ l˜0 < νl < l˜1 P00 | P10 , ν x̃ : ξ˜ P00 | P10 P̄ 0 and L̄0 = l˜0 < νl < l˜1 L0 . → P̄0 , L̄0 , Γ −→ → Γ̄0 and We consider the case (1). By LemmaF.20, there exist P̄0 , L̄0 and Γ̄0 such that (P, L) −→ L̄0 ,k 0 0 0 ˜ ν x̃ : ξ z!ṽ.P0 | z?ỹ.P1 | P2 ErΓ̄0 P̄0 , and Γ̄0 k L ▷m P̄0 is k -securely derivable. Then, there exists an evaluation 0 ,k 0 (1) 0 (2) ˜ [ ](1) | [ ](2) | P 0 E . Since context with two holes E such that ErL̄ P̄ ≡ [z!ṽ.P ] [z?ỹ.P ] and ν x̃ : ξ E 0 0 1 2 Γ̄0

Γ̄0 k L ▷m P̄0 is k -securely derivable, there exists a finite level context with two holes C , process P0 , P1 and type envi(1) (2) L̄0 ,k 0 ,k 0 ,k 0 0 ronments ∆0 , ∆1 such that P̄0 ≡ C [z!ṽ.P0 ] [z?ỹ.P1 ] , ErL̄ (C) ≡ E , ErL̄ ∆0 (P0 ) ≡ z!ṽ.P0 , Er∆1 (P0 ) ≡ z?ỹ.P1 , Γ̄0

and Γ̄0 k L ▷m C is k -securely derivable from ∆0 k L01 ▷l0′ [ ] and ∆1 k L01 ▷l1′ [ ] , where li0 ≥ m for i = 0, 1. By Lemma 4.13, there exists an evaluation context Ē and a lattice for secrecy levels L̄ such that (C, L) −→ →Γk Ē, L̄ . (1) (2) (1) (2) Hence, P̄0 , L̄0 −→ → → Ē [P0 ] [P1 [ỹ 7→ ṽ]] , L̄ . By Lemma F.19, we have ν x̃ : ξ˜ [P00 ] | [P10 [ỹ 7→ ṽ]] | P20 (1) (2) (1) (2) (1) (2) L̄ ,k 0 ,k 7→ ṽ]] ErL̄ Ē [P00 ] [P10 [ỹ 7→ ṽ]] . By Lemma F.20, there exE [P00 ] [P10 [ỹ 7→ ṽ]] ≡ ErΓ̄00 (C) [P00 ] [P10 [ỹ Γ̄0 0 ,k ist P̄ , L̄, such that P̄0 , L̄0 −→ → P̄ , L̄ , and ν x̃ : ξ˜ P00 | P10 [ỹ 7→ ṽ] | P20 ErL̄ P̄ . Therefore, (P, L) −→ → → P̄ , L̄ . Γ̄0 The case (2) is obvious. (1)

(2)

Lemma F.23. Define

          

((P, L), (P 0 , L0 ))

 Γ k L ▷m P is k -securely derivable    for a reliable type environment Γ,  P 0 ErL,k Γ (P ), and l̂ L0 is an ErL, Γ (P )-sublattice of L.

    

R is a barbed bisimulation.

Proof. It suﬀices to show that R satisfies all the conditions of Definition 4.15. Assume ((P, L), (P 0 , L0 )) ∈ R. Then, we see that Γ k L ▷m P is derivable for a reliable type environment Γ, the l̂ secrecy level of Γ k L is l1 , and P 0 ErL, Γ (P ). (1) Assume (P, L) −→ P̂ , L̂ . By Proposition 4.5, there exists a type environment Γ̂ such that either Γ̂ ≡ Γ l̂ L̂,l̂ L̂,l̂ 0 or Γ −→ Γ̂ and Γ̂ k L̂ ▷m P̂ is derivable. By Lemma F.19, either ErL, (P ) Er P̂ and L is an Er P̂ Γ Γ Γ L, l̂ L̂, l̂ sublattice of L̂, or there exists a lattice for secrecy levels L̂0 such that ErΓ (P ), L0 −→ ErΓ P̂ , L̂0 and L̂0 is l̂ an ErL̂, Γ (P )-sublattice of L̂. l̂ l̂ l̂ 0 Assume ErΓL,l̂ (P ) ErL̂, P̂ . Since P 0 ErL, ErL̂, → P̂ . Hence, (P 0 , L0 ) −→ Γ Γ (P ), we have P Γ L̂,l̂ L̂,l̂ L̂,l̂ L̂,l̂ 0 0 ErΓ P̂ , L . By Lemma F.13, we have ErΓ P̂ ≡ ErΓ̂ P̂ . Since L is an ErΓ̂ P̂ -sublattice of L̂, we l̂ have P̂ , L̂ , ErL̂, P̂ , L0 ∈ R. Γ̂ l̂ L,l̂ P̂ . Then, there exists a lattice for secrecy levels L̂0 such that Assume ErΓ (P ) 6 ErL̂, Γ l̂ l̂ l̂ l̂ 0 0 ErL, P̂ , L̂0 and L̂0 is an ErL̂, −→ ErL̂, ErL, Γ (P )-sublattice of L̂. Since P Γ (P ), we have Γ (P ), L Γ l̂ L̂,l̂ L̂,l̂ L̂,l̂ 0 0 0 (P 0 , L0 ) −→ ErL̂, P̂ , L̂ . By P̂ , L0 . P̂ . Hence, (P , L ) −→ → Er Lemma F.13, we have Er P̂ ≡ Er Γ Γ̂ Γ̂ Γ l̂ P̂ , L̂0 ∈ R. We also have P̂ , L̂ , ErL̂, Γ̂ (2) By Lemma F.22. (3) Straightforward.

Lemma F.24. For a reliable type environmentΓ, a lattice for secrecy levels L and a process P , if Γ k L ▷m P is • k -securely derivable, then (P, L) ≈ ErL,l Γ (P ), L . •

Proof. Assume that Γ k L ▷m P is k -securely derivable, where m 6≤L l. By Lemma F.23, we have (P, L) ≈ L,l ErΓ (P ), L . Definition F.25. We write lowerlL (Γ) for the type environment obtained from a type environment Γ by replacing all the secrecy annotations l0 6≤L l with the infimum of {l, l0 } and all the capability level annotations with ∞. We also write lowerlL (C) for the context obtained from a context C by replacing every secrecy annotation l0 6≤L l in a type or a constant value with the infimum of {l, l0 }. We note that, for a closed type environment Γ, lowerlL (Γ) is a reliable type environment whose secrecy level is l. 0 0 Lemma F.26. For type environments Γ, ∆, lattices for secrecy levels L, L0 and a (Γ k L, m)-(∆ k L , m )-context l0 l0 0 C , if the secrecy level of Γ k L is l0 , then lowerL′ (C) is a k -(Γ k L, m)- lowerL′ (∆) k L , m̂ -context, where m̂ is the infimum of {l0 , l0 } in L0 .

Proof. Straightforward. Lemma F.27. For a type environment Γ, a lattice for secrecy levels L, a process P , and secrecy levels m, l1 , if h i Γ k L ▷m P x 7→ truel1 is k -securely derivable, then Γ k L ▷m P x 7→ falsel1 is k -securely derivable. Proof. By induction on derivation tree of Γ k L ▷m P x 7→ truel1 . Lemma F.28. For a type environment Γ, a lattice for secrecy levels L, a process P , hand secrecyi levels l0 , l1 , if L,m L,m l1 l1 l1 Γ k L ▷m P x 7→ true is k -securely derivable, then ErΓ ≡ ErΓ . P x 7→ true P x 7→ false

Proof. By induction on the construction of P . 0 0 Lemma F.29. For type environments Γ and ∆,lattices levels for secrecy L, processes P , •Q, (Γ k L, m)-(∆ k L , m )• l′′ l′′ context C , if ∆ is closed and lowerL′ (C)[P ], L ≈ lowerL′ (C)[Q], L , then (C [P ], L) ≈ (C [Q], L).

Proof. Straightforward.

F.6. Proof of Theorem 4.18 0 For a type environment Γ, a lattice for secrecy thati l0 6≤L l, h h levels L′,ia process P , and secrecy levels l, l , Assume ′ l ≈ the secrecy level of Γ k L is l and Γ k L ▷m P x 7→ true is k -securely derivable. We show P x 7→ truel (ΓkL,m) h i h i ′ ′ l l P x 7→ false . By Theorem F.27, we see that Γ k L ▷m P x 7→ false is k -securely derivable. Then, it suﬀices h h ii • ′ to show that, for any closed ∆, a lattice for secrecy levels L0 , and a secrecy level m0 , C P x 7→ truel , L0 ≈ h h i i l′ C P x 7→ false , L0 with any (Γ k L, l)-(∆ k L0 , m0 )-context C . Let ∆ be a closed type environment, and C be a (Γ k L, m)-(∆ k L0 , m0 )-context. Then lowerlL (∆) is a reliable type environment whose secrecy level is l. Let C 0 ≡ lowerlL(C). By Theorem F.26, C 0 is a (Γ k L, m)- lowerlL (∆) k L, l -context. From Theorem F.24, we have h h ii • h h ii ′ 0 l′ C 0 P x 7→ truel , L ≈ ErL,l C x → 7 true , L and P l lowerL (∆) ii • h h ii h h ′ ′ C 0 P x 7→ falsel , L ≈ ErL,l C 0 P x 7→ falsel ,L . lowerl (∆) L

Theorem F.21 implies

h h ii h h ii ′ ,l L′ ,l L,m l′ 0 l′ 0 ErL C x → 7 true ≡ Er (C ) Er x → 7 true . P P l l Γ lowerL′ (∆) lowerL′ (∆) h i h i ′ ′ Since Γ k L ▷m P x 7→ truel and Γ k L ▷m P x 7→ falsel are derivable, Theorem F.28 implies h i h i L,m l′ l′ ErL,m x → 7 true ≡ Er x → 7 false . P P Γ Γ

Then, we have

h h ii h h ii ′ ,l L′ ,l L,m 0 l′ 0 l′ ErL C x → 7 true ≡ Er (C ) Er x → 7 true P P Γ lowerlL′ (∆) lowerlL′ (∆) h h ii ′ L′ ,l L,m 0 ≡ Erlowerl (∆) (C ) ErΓ x 7→ falsel P L′ h h ii ′ L′ ,l ≡ Erlowerl (∆) C 0 P x 7→ falsel . L′

By Lemma F.2, we have

Theorem F.29 implies

h h ii • h h ii ′ l′ , L ≈ C P x 7→ falsel , L . C P x 7→ true

ii • h h h h ii ′ ′ C 0 P x 7→ truel , L ≈ C 0 P x 7→ falsel , L .

F.7. Proof of Theorem 4.19 For type environments Γ, ∆, lattices for secrecy levels L, L0 , processes P0 , P1 , and a (∆ k L0 , m0 )-(Γ k L, m)-context Ĉ , assume that m00 ∈ L and m0 6≤L m00 , the secrecy level of Γ k L is m00 , and ∆ k L0 ▷m′ Pi is derivable for i = 0, 1. We show Ĉ[P0 ] ≈ Ĉ[P1 ]. (ΓkL,m)

Since ∆ k L0 ▷m′ Pi is k -securely derivable for i = 0, 1, we see that ∆ k L0 ▷m′ Ĉ[Pi ] is k -securely derivable for i = 0, 1. ′′ Let Π be a closed type environment, and C be (Γ k L, m)-(Π k L0 , m000 )-context. Then lowerm L′ (Π) is a reliable ′′ type environment whose secrecy level is m00 . Let C 0 ≡ lowerm L′ (C).

′′ 0 00 Theorem F.26, C 0 is a (Γ k L, m)- lowerm -context. From Theorem F.24, L′ (Π) k L , m h i h i h i ′′ • 0 0 0 we have C 0 Ĉ[Pi ] , L ≈ ErL,m C Ĉ[P ] , L for i = 0, 1 . Since C Ĉ is ′′ i m lowerL (Π) ′′ m a (∆ k L0 , m0 )- lowerL (Π) k L0 , m00 -context, Theorem F.21 implies h ih i h i ′′ L,m′′ L′ ,m′ 0 0 ErL,m Ĉ ] Er ≡ C Ĉ Er [P (P ) . C ′′ ′′ i i m m ∆ lower (Π) lower (Π) By

L′

for i = 0, 1. By Lemma F.7 and Theorem F.16, we have h ih i • h i h ih i ′′ • L′ ,m′ L,m′′ L,m′′ L′ ,m′ 0 0 0 ErL,m C Ĉ Er (P ) ≈ Er C Ĉ [ 0 ] ≈ Er C Ĉ Er (P ) . ′′ ′′ ′′ 0 1 ∆ ∆ lowerm (Π) lowerm (Π) lowerm (Π) L′ L′ L′ h i • h i Hence, we have C 0 Ĉ[P0 ] , L ≈ C 0 Ĉ[P1 ] , L . Thus, we see Ĉ[P0 ] ≈ Ĉ[P1 ]. (ΓkL,m)

Record · ID 310737 · SHA-256 fe9e0bf8a4e311e2
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.