MD Karine Dahan
email: karine.dahan@aphp.fr

PhD Hanna Debiec

MD,PhD Emmanuelle Plaisier

MsC Marine Cachanado

PhD Alexandra Rousseau

MsC Laura Wakselman

MD Pierre-Antoine Michel

MD Fabrice Mihout

MD, PhD Bertrand Dussol

MD, PhD Marie Matignon

MD, PhD Christiane Mousson

PhD Tabassome Simon

MD, PhD Pierre Ronco
email: pierre.ronco@upmc.fr

Gemritux Study Group

Rituximab for Severe Membranous Nephropathy: A 6-Month Trial with Extended Follow-Up

INTRODUCTION (3188 /3000 words)

Membranous nephropathy (MN) accounts for about 20% of cases of nephrotic syndrome in the adult and is the leading glomerulopathy recurring after kidney transplantation. [START_REF] Ponticelli | Glomerular diseases: Membranous nephropathy-A modern view[END_REF] Thickening of glomerular capillary walls results from subepithelial formation of immune deposits containing IgG, the membrane attack complex of complement, which is the major mediator of proteinuria, and antigens. Primary forms of MN, improperly called primary membranous nephropathy, represent 70% to 80% of all cases. A major breakthrough was the identification of the podocyte antigen PLA2R as the target of circulating antibodies in about 70% of PMN, which confirmed that the disease was auto-immune in nature. [START_REF] Beck | M-type phospholipase A2 receptor as target antigen in idiopathic MN[END_REF] The optimal treatment of patients with PMN is still a matter of debate. 3,4 Thirty to 40% of affected patients will undergo spontaneous, usually partial remission, usually within one year from disease onset, whereas about one third will progress to end-stage kidney disease. [START_REF] Schieppati | Prognosis of untreated patients with idiopathic membranous nephropathy[END_REF][START_REF] Polanco | Grupo de Estudio de las Enfermedades Glomerulares de la Sociedad Española de Nefrología : Spontaneous remission of nephrotic syndrome in idiopathic membranous nephropathy[END_REF] Treatments with corticosteroids and alkylating agents significantly increase the rates of remission and slow renal function loss in patients with persistent nephrotic syndrome. [7][8][9][START_REF] Howman | Immunosuppression for progressive membranous nephropathy: a UK randomized controlled trial[END_REF][START_REF] Chen | Immunosuppression for membranous nephropathy: a systematic review and meta-analysis of 36 clinical trials[END_REF] Calcineurin inhibitors induce remission in a majority of patients, but relapse rates exceed 50% and renal toxicity is a concern. [START_REF] Howman | Immunosuppression for progressive membranous nephropathy: a UK randomized controlled trial[END_REF][START_REF] Cattran | A controlled trial of cyclosporine in patients with progressive membranous nephropathy. Canadian Glomerulonephritis Study Group[END_REF][START_REF] Cattran | North America Nephrotic Syndrome Study Group : Cyclosporine in patients with steroid-resistant membranous nephropathy: a randomized trial[END_REF][START_REF] Praga | Estudio de la Nefropatía Membranosa: Tacrolimus monotherapy in membranous nephropathy: a randomized controlled trial[END_REF] The latest Kidney Disease Improving Global Outcomes (KDIGO) guidelines restricted the indication of alkylating agents to patients at high risk of progression, and considered calcineurin inhibitors as an alternative therapy. [START_REF]Kidney Disease: Improving Global Outcomes (KDIGO) Glomerulonephritis Work Group. KDIGO clinical practice guideline for glomerulonephritis[END_REF] In patients with even more restricted indications of alkylating agents, the rate of serious adverse events (SAE), particularly malignancy, was higher in patients who received long-term immunosupression than in those with supportive therapy. [START_REF] Van Den Brand | Long-term outcomes in idiopathic membranous nephropathy using a restrictive treatment strategy[END_REF] Both the evidence that B cells play a key role in the pathogenesis of PMN and drug toxicity led to target B-cells with rituximab. [START_REF] Remuzzi | Rituximab for idiopathic membranous nephropathy[END_REF] Rituximab induced remission of nephrotic syndrome in 60% to 80 % of the patients with long-lasting proteinuria despite blockade of the renin-angiotensin system [START_REF] Fervenza | Rituximab treatment of idiopathic membranous nephropathy[END_REF][START_REF] Bomback | Rituximab therapy for membranous nephropathy: a systematic review[END_REF][START_REF] Fervenza | Rituximab therapy in idiopathic membranous nephropathy: a 2-year study[END_REF][START_REF] Ruggenenti | Rituximab in idiopathic membranous nephropathy[END_REF] and in patients who had previously failed other treatments.

Reduction of PLA2R-Ab titre preceded remission of proteinuria by several months which suggested a causal relationship. [START_REF] Beck | Anti-PLA2R autoantibodies and response to rituximab treatment in membranous nephropathy[END_REF][START_REF] Ruggenenti | Anti-PLA2R antibody titer predicts postrituximab outcome of membranous nephropathy[END_REF] A previous study showed that a B-cell driven approach with only one or two infusions of Rituximab 375 mg/m² per week could allow reducing cost in comparison with the standard 4 weekly infusions [START_REF] Cravedi | Titrating rituximab to circulating B cells to optimize lymphocytolytic therapy in idiopathic membranous nephropathy[END_REF] Because of the lack of randomized controlled trial (RCT) using rituximab and of high rate of spontaneous remission, the present trial was designed in order to evaluate the efficacy of rituximab given to all patients at a standard dose (375 mg/m 2 ) in 2 infusions added to supportive therapy compared to supportive therapy alone, in patients with persistent nephrotic syndrome.

RESULTS

Between January 17, 2012, and July 3, 2014, eighty patients were enrolled in the RCT phase (Figure 1). Three patients withdrew their consent before randomization. Thirty-nine patients were assigned to NIAT-rituximab and 38 to NIAT only. Thirty-seven patients in the NIATrituximab group and 38 in the NIAT group received the assigned treatment. Baseline characteristics in the two groups were similar (Table 1).

Primary end point. The 6-month trial failed to achieve the primary end point. Thirteen patients (35.1%, 95% CI-19.7; 50.5) in the NIAT-rituximab group and 8 patients (21.1 %, 95% CI-8.1; 34.0) in the NIAT group achieved proteinuria remission at month 6 following randomization (p= 0.2055), (Table 2; OR 2.0 95% CI 0.7-5.7). Results were not sensitive to missing data replacement.

Secondary end points. Protein/creatinine ratio decreased similarly in both groups at months 3 and 6 (Table 2, Figure 2A). Percent increase of serum albumin was significantly higher at months 3 and 6 in the NIAT-rituximab group (Figure 2B). Serum creatinine and eGFR by MDRD formula, serum triglycerides, total and LDL cholesterol, body weight, and need for diuretic therapy did not differ at months 3 and 6 between the 2 groups (Table 2, Supplemental Table S1).

PLA2R-Ab was detected in 27 (73%) and 28 (74%) patients at baseline in the NIATrituximab and the NIAT groups, respectively (Table 1). As early as month 3, rate of PLA2R-Ab positive patients (31 % vs. 83 %, p<0.0001) and PLA2R-Ab titer (0.0 IQR [0.0; 49.1] vs. 54.6 IQR [16.5; 278.4] RU/ml, p=0.0005) were lower in the NIAT-rituximab group than in the NIAT alone (Table 2). No further decrease in the rate of PLA2R-Ab positive patients was observed between months 3 and 6, and the difference between PLA2R-Ab titer at month 3 and month 6 was 0.0 [0.0; 19.8] in the NIAT-rituximab group. No change in the rate of PLA2R-Ab positive patients and in PLA2R-Ab titer occurred between baseline, and months 3 and 6 in the NIAT group (Table 2).

In the subgroup of patients who were initially positive for PLA2R-Ab, a significant decrease of the titer of PLA2R-Ab was observed at month 3 (0.0 [0.0; 60.5] RU/ml, p<0.0001) and month 6 (8.3 [0.0; 73.5], p=0.0004) compared to baseline (102. 5 [36.1 ; 672.5]) in the NIAT-rituximab group, and only at month 6 (62.9 [16.6 ; 449.3] vs 199.5 [24.2 ; 491.4] RU/ml at baseline, p=0.0168) in the NIAT alone. Percent decrease of PLA2R-Ab titer was significantly higher in the NIAT-rituximab group at month 3 and month 6 (Figure 2C).

Complete immunological remission (full PLA2R-Ab depletion) was observed in the NIATrituximab group in 14/25 (56 %) and 13/26 (50 %) patients at months 3 and 6, respectively, as compared with 1/23 (4 %, p=0.0001) and 3/25 (12 %, p=0.0035) patients, respectively, in the NIAT group (Table 2). Of the 14 rituximab-treated patients that were antibody depleted at months 3, 6 (43 %) patients subsequently achieved the primary end point, compared with only 2 of the 11 patients (18%) without antibody depletion. PLA2R-Ab level <275 RU/mL at baseline was associated with the primary end point (OR 4.3, 95% CI 1.1-17.3, p=0.0424), and this was independent from treatment group, age, gender, baseline proteinuria, serum albumin and creatinine (Supplemental Table S2).

PLA2R-Ab was also measured at a very early time point (Day 8). Rates of PLA2R-Ab positivity, and PLA2R-Ab titer in the whole population and in the subset of patients who were positive at baseline were similar in both treatment groups (Table 2). Among the 8 patients of the NIAT-rituximab group who were PLA2R positive at baseline and achieved remission at 6 months, 2 were antibody depleted at day 8, and 2 had a marked reduction by 78% and 42% of antibody titer, respectively.

Twenty patients had undetectable PLA2R-Ab at baseline (10 in the NIAT-rituximab group and 10 in the NIAT group). However, 3 patients in the NIAT group later developed PLA2R-Ab, and were considered as having PLA2R-related PMN. At baseline, no statistical difference in age, protein/creatinine ratio, serum albumin and eGFR was seen according to presence (n=55 patients) or absence (n=20) of PLA2R-Ab. The effect of rituximab on proteinuria remission did not differ according to the serological status at baseline. Two PLA2R-Ab negative patients were positive for THSD7A-Ab. The first patient (1/100 dilution at baseline) received NIAT-rituximab and achieved remission at month 6 with sustained antibody depletion from month 3. The second patient was treated with NIAT alone, achieved partial remission at month 6, but relapsed at one year. In this patient, THSD7A-Ab remained detectable at low level (1/10) at any time. CD19+ B-cells remained below normal range (100 to 500/mm 3 ) throughout the observation period in the NIAT-rituximab group. Median CD19+ B-cell count was 11/mm 3 (IQR=(2.0; 22.0)) at month 3 and 61/mm 3 (IQR=(34.0; 100)) at month 6 (Table 2). Among PLA2R-Ab positive patients at baseline, there was no difference in CD19 count between patients who were PLA2R-Ab depleted and those who were not, at month 3 (p=0.7587, N=23 patients) and month 6 (p=0.8862, N=24 patients), respectively.

Post-hoc composite end point. In a post-hoc analysis that includes reduction of proteinuria > 50% and an increase of serum albumin level > 30% at month 6, fifteen patients (41 %) in the NIAT-rituximab group and 5 patients (13 %) in the NIAT group achieved the composite end point at month 6 following randomization (OR 0.22, 95% CI 0.07-0.70, p=0.0073) (Table 2).

Post-RCT observational period. Median duration from inclusion to last follow-up was 17.0 (IQR= [12.5; 24.0]) and 17.0 [13.0; 23.0] months in the NIAT-rituximab and NIAT groups, respectively. The rate of KDIGO remission occurring without modification of initial immunosuppressive treatment (NIAT-rituximab) or introduction of an immunosuppressive treatment (NIAT) was 24/37 (64.9 %) and 13/38 (34.2%) in the NIAT-rituximab and NIAT groups, respectively (OR 3.5, 95% CI 1.7-9.2; p=0.009), (Table 3). Numbers of complete remission were 7/37 and 1/38 in the NIAT-rituximab and NIAT groups, respectively (p=0.0284). Median time to remission was 7.0 IQR= [5.5; 10.5] [20; 30] g/L, p=0.0337). Serum creatinine and eGFR by MDRD formula did not differ between the 2 groups (Table 3). In multivariate analyses, KDIGO remission was associated with PLA2R-Ab level <275 RU/mL at baseline (OR 3.5, 95% CI 1.1-10.7; p=0.0296), and this was independent from treatment group, age, gender, baseline proteinuria, serum albumin and creatinine (Supplemental Table S3). KDIGO remission was also associated with composite end point at month 6 (OR 30.1, 95% CI 3.9-262.8; p= 0.0012), regardless of treatment group. In the NIAT-rituximab group, CD19 counts at months 3 and 6 were not associated with remission.

Severe adverse events. Number of SAEs was comparable in both groups (Table 4). Only one SAE was related to NIAT-rituximab treatment in a patient who developed prostatitis with favourable outcome. In the rituximab group, no leukopenia was observed. Patients received a premedication protocol with 100 mg of solumedrol, 1 g of paracetamol, and 5 mg of dexchlorpheniramine; no allergic reactions were observed.

DISCUSSION

In the present randomized study, we analysed the effect of rituximab combined with NIAT in patients with PMN and severe nephrotic syndrome which had resisted maximally tolerated anti-proteinuric therapy. The RCT showed that compared to NIAT alone, addition of two infusions of rituximab to NIAT decreased PLA2R-Ab as early as month 3 and was associated with a higher percent increase of serum albumin at month 3 and 6. However, the effect of this combined treatment on the rate of proteinuria remission (primary end point) was not observed during the RCT but was delayed to the post-RCT observational period (median time to remission, 7 months). The trial thus provides new biomarkers of early treatment response.

We compared NIAT-rituximab to NIAT because there was no evidence-based proof of the efficacy of rituximab in PMN even if several non-randomized studies suggested that rituximab was efficient [START_REF] Fervenza | Rituximab treatment of idiopathic membranous nephropathy[END_REF][START_REF] Bomback | Rituximab therapy for membranous nephropathy: a systematic review[END_REF][START_REF] Fervenza | Rituximab therapy in idiopathic membranous nephropathy: a 2-year study[END_REF][START_REF] Ruggenenti | Rituximab in idiopathic membranous nephropathy[END_REF] ; the possibility of bias linked to a high rate of late spontaneous remissions as confirmed in the present study, called for a randomized trial. With this aim in mind, an ideal trial would have been a prolonged trial for more than one year. However, we considered unethical to maintain the patients on NIAT for more than 6 months. Since no major complication occurred in the NIAT group, the risk taken was acceptable although after 6 months, PLA2R-Ab positive patients had a markedly higher antibody titre in the NIAT group than in the NIAT-rituximab group, and it is uncertain whether a delay by one year in the NIAT group would impact any future response to immunosuppressive agents or to rituximab therapy. Alternatively, we could have set the end point at 12 months with prespecified measures in the most aggressive forms for the patients in the NIAT group. However, this protocol would have assessed a global treatment strategy (NIAT +/-retreatment, and NIAT+ rituximab +/-retreatment) and not only the efficacy of rituximab added to supportive therapy. We therefore opted for a pragmatic approach with a first 6-month period of RCT followed by an observational phase.

This RCT failed to reach the primary end point. The lack of effect of NIAT-rituximab on the rate of proteinuria remission at 6 months has several explanations: i) the high rate of remission (21%) in the NIAT group, ii) the lower rate of remission (35%) in the NIATrituximab group than we expected because sample size was calculated from initial studies on rituximab, [START_REF] Remuzzi | Rituximab for idiopathic membranous nephropathy[END_REF][START_REF] Fervenza | Rituximab treatment of idiopathic membranous nephropathy[END_REF][START_REF] Ruggenenti | Rituximab in idiopathic membranous nephropathy: a one-year prospective study[END_REF] which probably overestimated the rate of remission in the NIAT-rituximab group and led to a lack of power; iii) the short duration of the RCT phase, and iv) the fact that proteinuria is a delayed marker of treatment effect. [START_REF] Fervenza | Rituximab therapy in idiopathic membranous nephropathy: a 2-year study[END_REF][START_REF] Ruggenenti | Rituximab in idiopathic membranous nephropathy[END_REF][START_REF] Ruggenenti | Anti-PLA2R antibody titer predicts postrituximab outcome of membranous nephropathy[END_REF] However, we did observe an effect of rituximab on serum albumin variation from baseline (increase) and PLA2R-Ab levels as early as month 3, which was confirmed at month 6. The increase from baseline of serum albumin contrasting with persisting high-level proteinuria at month 6 in the NIAT-rituximab group might be related to decreased tubular reabsorption of albumin when serum albumin increases, [START_REF] Wagner | Supplemental material 1. Clinical trial steering committee 2. Independent data and safety monitoring committee 3[END_REF] and/or increased albumin anabolic rate in the liver resulting in increasing protein load to the glomerulus, which would offset the improving glomerular sieving function. 27 We thus considered a post-hoc composite end point with the aim to define an early clinical criterion of response to rituximab, which associated a reduction of proteinuria > 50% and an increase of serum albumin level > 30% at month 6. A significantly higher number of patients treated with NIAT-rituximab compared with NIAT reached this composite end point at month 6. Moreover, remission defined on composite end point at month 6 was associated with proteinuria remission occurring at any time before any change of initially assigned treatment. This composite end point might therefore better reflect early renal outcome although it should be validated in further studies.

We continued to follow the patients during a post-RCT observational phase. The suspected beneficial clinical effect of rituximab at month 6 was confirmed by the data of the observational phase which were recorded before any potential modification of treatment assigned at randomization. Proteinuria remission rate was substantially higher in the NIATrituximab group than in the NIAT alone group (64.9 vs. 37.5%), with proteinuria dropping to a much lower level in the NIAT-rituximab group.In the patients treated with NIAT-rituximab, proteinuria remission rate and median time to remission (7 months) during the follow-up study were similar to those reported in previous non randomized series. [START_REF] Fervenza | Rituximab therapy in idiopathic membranous nephropathy: a 2-year study[END_REF][START_REF] Ruggenenti | Rituximab in idiopathic membranous nephropathy[END_REF] Remission rate was comparable to the one achieved with the Ponticelli's protocol in the same time frame (50% at 6 months, 8 32% within one year, 9 ) considering that in those studies, patients were enrolled without a run-in period. It was lower than in patients treated with cyclosporine [START_REF] Cattran | North America Nephrotic Syndrome Study Group : Cyclosporine in patients with steroid-resistant membranous nephropathy: a randomized trial[END_REF] and tacrolimus [START_REF] Praga | Estudio de la Nefropatía Membranosa: Tacrolimus monotherapy in membranous nephropathy: a randomized controlled trial[END_REF] who had a remission rate of 75% after 26 weeks and 58% after 6 months, respectively, but baseline serum albumin was higher by >0.5 g/dl than in our study and these drugs are known to have an effect on glomerular hemodynamics with a high risk of relapse at discontinuation and to be associated with a clinically relevant nephrotoxicity. The ongoing Membranous Nephropathy Trial of Rituximab (MENTOR, ClinicalTrials.gov number, NCT01180036) will hopefully show whether rituximab is superior to cyclosporine in term of proteinuria remission over a 24-month period. The high rate of spontaneous remission that may occur more than a year after disease onset in our study and the relatively low rate of remission with NIAT-rituximab, as with other immunosuppressive treatments, indicate that we have not yet reached an optimal treatment in patients with persisting nephrotic syndrome. It is difficult to extrapolate what would be the remission rate with rituximab only since all patients with persisting nephrotic syndrome are treated with NIAT according to KDIGO recommendations.

The present trial has several strengths. First, it is the first RCT in PMN patients with a monitoring of PLA2R-Ab, detected in 71 % of the patients as in previous studies 28 , and of THSD7A-Ab. 29 Rituximab associated with NIAT reduced median PLA2R-Ab titre as early as month 3 and induced complete immunological remission in 56% and 50% of the patients at months 3 and 6, respectively. Multivariate analyses showed that PLA2R-Ab <275RU/mL at baseline was the only factor associated with remission occurring at month 6 (primary end point) and during the post-RCT observational phase without modification of treatment assigned at randomization, regardless of treatment group and other adjustment variables. Our results also suggest that THSD7A-Ab may be useful for the monitoring of MN patients. On the other hand, our univariate and multivariate analyses failed to identify classical predictors of long-term outcome and proteinuria remission such as proteinuria, serum creatinine and eGFR, serum albumin, age, and gender. A possible reason is that we studied a relatively homogeneous population after a 6-month run-in period of maximally tolerated conservative therapy. This discrepant observation gives even more importance to PLA2R-Ab as a predictor of proteinuria remission, in agreement with the auto-immune nature of the disease. The finding that PLA2R-Ab positivity and titer tended to decrease as early as 8 days in the NIATrituximab group was somewhat unexpected given the half-life of immunoglobulins of about 3 weeks, but confirmed previous observations by Hoxha et al. 30 This suggests that PLA2R-Ab might be a very early biomarker of rituximab efficacy although this has to be confirmed in further prospective studies.

Second, this trial shows that B-cell counts in rituximab treated subjects do not predict proteinuria remission and confirms that PLA2R-Ab depletion rather than CD20 + depletion, achieved in all patients, matters for prediction of rituximab response. [START_REF] Ruggenenti | Anti-PLA2R antibody titer predicts postrituximab outcome of membranous nephropathy[END_REF] It does not tell us, however, whether the absence of immunological remission at 3 months is due to lack of efficacy of rituximab or insufficient dosage, and whether patients without antibody depletion at 6 months should be re-infused or shifted to a new-generation anti-CD20 antibody or to another immunosuppressant. Third, we made the important observation that two infusions of rituximab were not associated with an increased risk of SAEs, which differs from all the other current immunosuppressive therapies for PMN.

The present trial has certain limitations. First, 11 patients among the 24 patients who entered remission in the NIAT-rituximab group reached the primary end point lately during the post-RCT observational study, as compared to only 4 in the NIAT group. However, the observational nature of the data does not provide similar strength of evidence than those provided by the randomized period. Second, one cannot exclude that some patients without circulating PLA2R-Ab at treatment onset had still PLA2R-related PMN. This question could be addressed by analysis of kidney biopsies, 31 which was not possible in this multicentric trial. Third, the trial was not blinded. However, data assessors were blinded to treatment allocation and SAEs were monitored by an independent organization. Fourth, the trial was too short to determine whether the relapse rate was influenced by immunosuppressive treatment.

Most of the remissions were partial. Since relapses of nephrotic syndrome and disease progression are more frequent in patients with partial remission, long-term studies with rituximab should be advocated.

In conclusion, this trial shows that serum albumin and PLA2R-Ab levels are early markers of NIAT-rituximab efficacy, while the effect on proteinuria remission appears after 6 months.

Addition of rituximab to NIAT has no impact on safety. This first RCT is a further step toward the use of rituximab as first-line therapy in severe forms of PMN. It also suggests that criteria for definition of remission should include serum albumin and PLA2R-Ab levels, particularly in trials where rapid responses on drug efficacy and surrogate criteria are needed.

CONCISE METHODS

Study design

Patients were enrolled at 31 hospital nephrology units throughout France in the present multicentre, open-labelled, randomized, controlled trial. After a run-in period of 6 months during which patients were treated with maximal tolerated dose of Non Immunosuppressive Antiproteinuric Treatment (NIAT, angiotensin-converting enzyme inhibitors and/or angiotensin-2 receptor blockers, diuretics and statin), patients were randomly assigned to 6month therapy with NIAT plus rituximab or NIAT alone (Figure 3). The NIAT group was aimed to determine the percentage of non immunosuppressant-induced remissions, which was known to be high during the first 12 months. [START_REF] Polanco | Grupo de Estudio de las Enfermedades Glomerulares de la Sociedad Española de Nefrología : Spontaneous remission of nephrotic syndrome in idiopathic membranous nephropathy[END_REF] We deliberately opted for a short trial of 6 months to avoid any loss of a chance of receiving an immunosuppressive treatment in patients who only received a supportive treatment. After the end of the randomized phase, patients were followed up to 24 months during a post-RCT observational phase. The study was approved by an institutional review board in Paris, France (Comité de Protection des Personnes Ile-de-France XI).

Patients

Eligible patients were 18 years of age or older, had a biopsy proven diagnosis established less than 2 years before inclusion, a urinary protein excretion or a urinary protein/creatinine ratio greater than, or equal to, 3.5 g/day or 3500 mg/g, respectively, and a serum albumin lower than 30 g/l for at least 6 months despite maximal tolerated dose of Non Immunosuppressive Antiproteinuric Treatment (NIAT, angiotensin-converting enzyme inhibitors and/or angiotensin-2 receptor blockers, diuretics and statin). Proteinuria was measured repeatedly before inclusion and treatment assignment to confirm persistence of full-blown nephrotic syndrome. The estimated GFR by MDRD formula had to be above 45 ml/min/1.73m 2 .

Exclusion criteria were secondary MN, pregnancy, breast-feeding, immunosuppressive treatment in the three preceding months, and active infectious disease. Hepatitis B serology included Hbs antigen, and Hbs and Hbc antibodies. Patients with active hepatitis B and those with past hepatitis B infection without anti-Hbs antibodies were excluded. Four patients had previously received chemotherapy according to Ponticelli's protocol: one in the NIATrituximab group had chemotherapy completed 13 months before inclusion; three in the NIAT group had chemotherapy completed 8 months, 2.5 and 6 years, respectively, before inclusion.

After 12 months, we deleted the time limit for the kidney biopsy and we decreased the eGFR threshold down to 30 ml/min/1.73m² to improve recruitment. Sixty-nine patients had a renal biopsy taken less than 2 years before inclusion. In the 5 remaining patients, the renal biopsy was taken 25, 26, 28, 41, 78 months, respectively, before inclusion. Seven patients had an eGFR  45 and > 30 ml/min/1.73 m². All patients gave written informed consent.

Procedures and follow-up

Patients received NIAT in association with 375 mg/m² of intravenous rituximab on days 1 and 8 following randomization, or NIAT alone (Figure 3). We selected this dosing schedule on the basis of previous reports of rituximab's ability to induce proteinuria remission and CD19 depletion. [START_REF] Fervenza | Rituximab treatment of idiopathic membranous nephropathy[END_REF][START_REF] Cravedi | Titrating rituximab to circulating B cells to optimize lymphocytolytic therapy in idiopathic membranous nephropathy[END_REF] At the end of the 6-months randomized phase, referring physicians were free of re-infusing rituximab or shifting immunosuppressant, and introducing an immunosuppressant, in patients of the NIAT-rituximab and NIAT groups, respectively, and patients were followed up to 24 months during an observational period. The same antiproteinuric drugs were allowed before and after randomization.

Study visits occurred at baseline, at weeks 1 and 2, and at months 3 and 6 during the RCT.

At each study visit, clinical data and medications were recorded. Blood and urine samples were collected at baseline, months 3 and 6 for serum creatinine, serum albumin and proteinuria over creatinine ratio or proteinuria excretion per day. PLA2R-Ab was measured at baseline, day 8, and months 3 and 6. CD19+ B-lymphocyte counts were measured at months 3 and 6 in the NIAT-rituximab group.

During the post-RCT observational phase, visits occurred according to the habits of the clinician in charge. Proteinuria, serum albumin, serum creatinine, and immunosuppressive treatment modifications, were collected. Data were collected in each of the 31 hospital nephrology units in a paper case report form and entered in a database located at URCEST, an external and independent organization.

Outcomes

The primary end point was the percentage of patients with complete or partial remission of nephrotic syndrome at 6 months of follow-up. Remission was defined accordingly to 2012 KDIGO [START_REF]Kidney Disease: Improving Global Outcomes (KDIGO) Glomerulonephritis Work Group. KDIGO clinical practice guideline for glomerulonephritis[END_REF] as 1) complete in case of urinary protein excretion less than 500 mg per day or 500 mg/g creatinine; 2) partial in case of urinary protein excretion < 3.5 g per day or 3500 mg/g creatinine and  500 mg/g creatinine with at least 50% reduction compared to baseline. Secondary end points were rate of proteinuria, serum albumin, serum creatinine, PLA2R-Ab levels and SAEs. PLA2R-Ab was measured by using a quantitative ELISA (EuroImmune AG, Lübeck, Germany); anti-thrombospondin domain 7A antibodies (THSD7A-Ab) were assessed by an immunofluorescence test (EuroImmune). Antibody depletion was defined as complete disappearance of antibodies in PLA2R-Ab positive patients. Because albumin level may be an earlier marker of response than end points defined by proteinuria only, [START_REF] Ruggenenti | Anti-PLA2R antibody titer predicts postrituximab outcome of membranous nephropathy[END_REF]27 we also considered a post-hoc composite end point defined as reduction of proteinuria > 50% and increase of serum albumin level > 30% at month 6 follow-up.

Adverse events and unexpected changes in clinical or laboratory parameters were reported in patient case report forms and monitored up to complete resolution. All SAEs were monitored by URCEST and reported to the sponsor.

During the observational phase, remission defined according to KDIGO and other variables were recorded before potential modification of treatment assigned at randomization, i.e. before any amendment of initial immunosuppressive treatment in the NIAT-rituximab group or addition of an immunosuppressive treatment in the NIAT group. Follow-up was too short to record relapses.

Statistical Analyses

Based on previous studies, [START_REF] Remuzzi | Rituximab for idiopathic membranous nephropathy[END_REF][START_REF] Fervenza | Rituximab treatment of idiopathic membranous nephropathy[END_REF][START_REF] Ruggenenti | Rituximab in idiopathic membranous nephropathy: a one-year prospective study[END_REF] rituximab was effective in decreasing proteinuria as early as 3 months [START_REF] Ruggenenti | Rituximab in idiopathic membranous nephropathy[END_REF]30 and achieving remission at 20 weeks [START_REF] Remuzzi | Rituximab for idiopathic membranous nephropathy[END_REF] to one year [START_REF] Fervenza | Rituximab treatment of idiopathic membranous nephropathy[END_REF][START_REF] Ruggenenti | Rituximab in idiopathic membranous nephropathy: a one-year prospective study[END_REF] in 60% to 80% of patients with PMN and nephrotic syndrome persisting after 6 months of supportive therapy.

The trial was designed to establish whether rituximab was superior in term of efficacy as assessed by the number of remissions. Assuming a remission rate of 20% in the NIAT group, the inclusion of 80 patients would provide 80% power at two-sided α of 0.05 to detect a 30% absolute increase in the remission rate (50%) and under assumption of 10% exclusion or dropout rates (Fisher exact test).

Baseline characteristics of the study population were expressed as frequency and percentage for qualitative variables and as median and interquartile range (IQR) for continuous variables. Remission rates were expressed as frequency and percentage and its 95% confidence interval. All PLA2R-Ab titres not achieving the 14 RU/ml detection threshold of the method were spiked at 0. PLA2R-Ab titre was considered as a continuous variable, as a binary variable (absence/presence), or at baseline only, as a categorical variable according to tertiles (<22.5, lowest; 22.5-275.5, middle; 275.5, highest, RU/ml). Because at univariate analysis, tertiles 1 and 2 did not show any statistically significant difference, a binary variable was created (highest versus middle/lowest). Quantitative variables were compared by a Student's t-test or a Wilcoxon rank-sum test, and categorical variables were compared by a Pearson's Chi-square test or a Fisher's exact test.

Sensitivity analyses were performed to check the impact of replacement methods of missing values with missing data considered as 1) success (remission) in the NIAT group and as failure (no remission) in the NIAT-rituximab group; 2) failure in the NIAT group and as success in the NIAT-rituximab group. Additional analyses were performed with missing data being replaced by last available data (proteinuria at 3 months) and with available data under the hypothesis of data missing completely at random (MCAR).

Additional logistic regression analyses were performed to identify potential prognostic factors of remission. Following variables of interest were analysed in univariate and multivariate analysis: treatment, age, gender, proteinuria, serum creatinine, serum albumin at baseline, and presence of PLA2R-Ab at baseline. In other exploratory analyses, mean percent changes from baseline of proteinuria, serum albumin and PLA2R-Ab levels at months 3 and 6 were plotted and compared using Wilcoxon matched-pair signed rank test.

Statistical analyses were performed blinded to treatment allocation, based on intention-totreat, including all patients who received at least one dose of treatment and without consent withdrawal. Safety population was defined as patients who received at least one dose of treatment.

All tests were two-sided and p values <0.05 were considered to indicate statistical significance, except when Bonferroni correction was applied and mentioned. SAS V.9.3 software (SAS Institute, Cary, North Carolina, USA) was used for statistical analyses. values were established according to manufacturers' protocol and the results were considered as negative for<14 RU/ml and positive for ≥ 14 RU/ml. The coefficients of variation (CV)

NIAT-rituximab

Group

were assessed by using 3 selected serum samples covering the measuring range. The intraassay and inter-assay CVs were based on 20 measurements for each serum in one set or on threefold replica in ten sets, respectively. In our laboratory, the calculated intra andinter-assay CVs are <4% and <9%, respectively. Up to five freeze/thaw cycles were found not to affect PLA2R-Ab binding by ELISA. All sera at the various time points were assessed in triplicates at the same time in the same ELISA run to allow optimal comparisons of antibody titre. For each group, number of participants (denominator) included in each analysis and whether the analysis was by original assigned groups 14, Tables 1 through 4

6.

Outcomes and estimation 17a For each primary and secondary outcome, results for each group, and the estimated effect size and its precision (such as 95% confidence interval)

Findings

  from the trial are described in accordance with Consolidated Standards of Reporting Trials (CONSORT) guidelines (www.consort-statement.org). The trial was registered as GEMRITUX Clinical Trials.gov number, NCT01508468. Proximal tubules have the capacity to regulate uptake of albumin. J Am Soc Nephrol 27:482-494, 2016 27. Ruggenenti P, Mise N, Pisoni R, Arnoldi F, Pezzotta A, Perna A, Cattaneo D, Remuzzi G: Diverse effects of increasing lisinopril doses on lipid abnormalities in chronic nephropathies. Circulation 107: 586-592, 2003 28. Du Y, Li J, He F, Lv Y, Liu W, Wu P, Huang J, Wei S, Gao H : The diagnosis accuracy of PLA2R-AB in the diagnosis of idiopathic membranous nephropathy: a meta-analysis. PLoS One 9: e104936, 2014 29. Tomas NM, Beck LH Jr, Meyer-Schwesinger C, Seitz-Polski B, Ma H, Zahner G, Dolla G, Hoxha E, Helmchen U, Dabert-Gay AS, Debayle D, Merchant M, Klein J, Salant DJ, Stahl RA, Lambeau G : Thrombospondin type-1 domain-containing 7A in idiopathic membranous nephropathy. N Engl J Med 371: 2277-2287, 2014 30. Hoxha E, Harendza S, Zahner G, Panzer U, Steinmetz O, Fechner K, Helmchen U, Stahl RA : An immunofluorescence test for phospholipase A₂-receptor antibodies and its clinical usefulness in patients with membranous glomerulonephritis. Nephrol Dial Transplant 26:2526-2532, 2011 31. Debiec H, Ronco P: PLA2R autoantibodies and PLA2R glomerular deposits in membranous nephropathy. N Engl J Med 364: 689-690, 2011

FIGURESFigure 1 :

 1 FIGURES

Figure 2 :

 2 Figure 2: Percent changes in proteinuria, serum albumin and PLA2R-Ab with time

Figure 3 :

 3 Figure 3: Study design

  Figure 1

  Figure 2A

Table 1 . Baseline characteristics NIAT-rituximab Group

 1 TABLES Median and IQR of PLA2R-Ab titre in all patients with and without PLA2R-Ab. ACE, angiotensin converting enzyme; ARB, angiotensin-2 receptor blocker; ELISA, enzyme-linked immunosorbent assay; eGFR, estimated glomerular filtration rate (calculated according to the Modification of the Diet in Renal Disease equation); NIAT Non Immunosuppressive,

		NIAT Group	Total
	(N =37)	(N=38)	(N=75)

Table 2 : Efficacy outcome variables NIAT-rituximab group

 2 Complete and partial remission was defined according to 2012 KDIGO criteria based on proteinuria; composite end point was defined as reduction of proteinuria > 50% and increase of serum albumin > 30%. ** Patients with at least one positive detection of PLA2R-Ab at any time. eGFR, estimated glomerular filtration rate (calculated according to the Modification of the Diet in Renal Disease equation);

	(N=37)	NIAT group (N=38)	P Value

*

Table 3 . Results of Efficacy Analysis at Last Follow-up

 3

	NIAT-rituximab group (N=37)	NIAT group (N=38)	P Value

* Complete and partial remission was defined according to 2012 KDIGO criteria based on proteinuria.

Table 4 . Severe Adverse Events According to Treatment Group.

 4

Table S1 : Lipids, body weight and need for diuretics at baseline and during follow-up in the 2 treatment groups.

 S1 If relevant, description of the similarity of interventions Not applicable Statistical methods 12a Statistical methods used to compare groups for primary and secondary outcomes 13, 14 12b Methods for additional analyses, such as subgroup analyses and adjusted analyses 14

	6 months mechanism		31(83.8)	29(76.3)	0.4189
	Implementation	10	Who generated the random allocation sequence, who enrolled participants, and who assigned participants to	Suppl page 3
			interventions
	Blinding	11a If done, who was blinded after assignment to interventions (for example, participants, care providers, those	14, Suppl
			assessing outcomes) and how			page 3
	11b Results
	Participant flow (a	13a For each group, the numbers of participants who were randomly assigned, received intended treatment, and	4 and figure
	diagram is strongly		were analysed for the primary outcome		1
	recommended)	13b For each group, losses and exclusions after randomisation, together with reasons	4, 26, and
						figure 1
	Recruitment	14a Dates defining the periods of recruitment and follow-up	4
		14b Why the trial ended or was stopped
	Baseline data	15	A table showing baseline demographic and clinical characteristics for each group	Table 1,
						pages 19
	Numbers analysed	16	NIAT-rituximab group (N=37)	NIAT group (N=38)	P Value	and 20
	Triglycerides-mmol/L
	Baseline		1.9 [1.3 ; 3.0]	2.2 [1.6 ; 3.1]
	3 months		1.9 [1.1 ; 3.1]	2.1 [1.6 ; 3.0]	0.3315
	6 months		1.9 [1.3 ; 2.5]	1.8 [1.4 ; 2.6]	0.7682
	LDL cholesterol--mmol/L
	Baseline		4.4 [3.3 ; 5.9]	5.3 [3.4 ; 6.9]
	3 months		4.0 [3.4 ; 5.5]	4.9 [3.6 ; 7.2]	0.1835
	6 months		3.5 [2.7 ; 4.5]	3.5 [2.9 ; 5.2]	0.6851
	Total cholesterol-mmol/L
	Baseline		7.1 [5.5 ; 8.7]	7.5 [6.2 ; 9.5]
	3 months		6.6 [5.6 ; 8.2]	7.4 [5.8 ; 10.5]	0.1894
	6 months		5.9 [4.9 ; 6.9]	6.2 [5.4 ; 7.0]	0.4752
	Body weight--kg
	Baseline		76.0 (70.0 ; 85.0)	76.5 (67.0; 85.0)
	3 months		76.6 (72.0; 84.0)	76 (65.0;86.0)	0.8574
	6 months		78.0 (72.0; 84.0)	77.4 (67.0; 85.0)	0.9490
	Diuretics
	Baseline		32(86.5)	32 (84.2)
	3 months		31(83.8)	30 (78.9)	0.5910

  Harms 19All important harms or unintended effects in each group (for specific guidance see CONSORT for harms) 7, Table4

				4, 5
		17b For binary outcomes, presentation of both absolute and relative effect sizes is recommended
	Ancillary analyses	18	Results of any other analyses performed, including subgroup analyses and adjusted analyses, distinguishing	6, 7
			pre-specified from exploratory
	Discussion
	Limitations	20	Trial limitations, addressing sources of potential bias, imprecision, and, if relevant, multiplicity of analyses	10
	Generalisability	21	Generalisability (external validity, applicability) of the trial findings	9, 10
	Interpretation	22	Interpretation consistent with results, balancing benefits and harms, and considering other relevant evidence	10
	Other information
	Registration	23	Registration number and name of trial registry	3, 14

Acknowledgments

This study was funded by grants from the Programme Hospitalier de Recherche Clinique, French Ministry of Health (AOM10089); from the European Research Council ERC-2012-ADG_20120314 (Grant Agreement 322947); from Agence Nationale pour la Recherche Programme Blanc SVSE1 (2012) Decision ANR-12-BSE1-0002-01; from Fondation pour la Recherche Médicale Equipe FRM 2012 grant; and from 7th Framework Programme of the European Community Contract 2012-305608 (European Consortium for High-Throughput Research in Rare Kidney Diseases). The sponsor of this study was Assistance Publique-Hôpitaux de Paris (Département de la Recherche Clinique et du Développement, Clinical Research and Development Department). Rituximab was given by Hoffmann-La Roche. None of the funding source played a role in the writing of the manuscript or the decision to submit it for publication. We thank Nora Semai, Jennifer Piro, Julie Claudepierre, Benjamin Laverdant, Matthieu Le lay, Anne Seguin, Dominique Damas and Elodie Drouet from the Clinical Research Unit, INSERM CIC P 0901, Saint Antoine University Hospital (Assistance Publique-Hôpitaux de Paris, Université Pierre et Marie Curie, Paris) for trial monitoring and handling, preparation, and submission of all required research ethics and regulatory documents. We thank Emmanuel Roux for monitoring and handling the biobank at Tenon hospital, Paris (Prof. Isabelle Brocheriou) and Christine Vial (UMR_S1155) for help in the preparation of the manuscript.

Disclosures

Pierre Ronco is a paid adviser for Otsuka, BMS, Amicus, and Air Liquide, has received lecture fees from Shire (Belgium), Servier, Chugai and the Mayo Clinic, and research grants from Amgen and Otsuka. Karine Dahan has received grants from the French Ministry of Health and Roche Pharmaceutical. Tabassome Simon is a paid adviser for, and has received lecture fees from AstraZeneca, Astellas, Bayer, BMS, Lilly, MSD and Sanofi; she has received research grants from Astra Zeneca, Daiichi-Sankyo, Eli-Lilly, GSK, MSD, Novartis and Sanofi. Emmanuelle Plaisier is a paid adviser for, and has received lecture fees from Gilead Sciences; she has received research grants from Amgen. Hoffmann-La Roche provided Rituximab for the study.

Methods

Randomization

Once full eligibility was confirmed, patients were randomly assigned, in a 1:1 ratio, to receive NIAT plus rituximab or NIAT only for 6 months (Figure 1) by the investigator. Patients were assigned to groups centrally through computer-generated block randomisation (size 4) prepared by URCEST. Data assessors were blinded to treatment allocation and SAEs were monitored by an independent organization.

Role of the funding source

The funder was the French Ministry of health (PHRC, AOM10089), and the sponsor was Assistance Publique -Hôpitaux de Paris. Hoffmann-La Roche provided rituximab for the study. The funders of the study had no role in study design, data analysis, data interpretation or writing the report. The corresponding author had full access to all the data in the study and had final responsibility for the decision to submit for publication.

Anti-PLA2R autoantibody (PLA2R-Ab) evaluation

After sampling, all sera were immediately aliquoted, frozen and stored at -20° C. They were thawed only at the time of ELISA measurements. Previously unfrozen samples were never used for the tests. After thawing, all serum samples were tested for the presence of anti-PLA2R total IgG antibodies using the quantitative ELISA test commercialized by EuroImmune AG (Lübeck, Germany). In brief, sera diluted to 1:100were incubated with PLA2R already coated microplates and detected by incubation with antihuman IgG HRP conjugate. The final concentrations for each sample were calculated from the calibration curve extinction values plotted against the concentration for each calibrator. ELISA cut-off 7. Table S2


Mariangiola Dezani-Ciancaglini

Silvia Ghilezan

Jovanka Pantović
email: pantovic@uns.ns.ac.yu

Daniele Varacca
email: varacca@pps.jussieu.fr

Security Types for Dynamic Web Data 1

. An Xdπ-network is a network of locations, where each location consists of both a data tree (which contains scripts and pointers to nodes in trees at different locations) and a process, for modelling process interaction, process migration and interaction between processes and data. Our type system is based on types for locations, data and processes, expressing security levels. A tree can store data of different security level, independently from the security level of the enclosing location. The access and mobility rights of a process depend on the security level of the "source" location of the process itself, i.e. of the location where the process was in the initial network or where the process was created by the activation of a script. The type system enjoys type preservation under reduction (subject reduction). In consequence of subject reduction we prove the following security properties. In a well-typed Xdπ-network, a process P whose source location is of level h can copy data of security level at most h and update data of security level less than h. Moreover, the process P can only communicate data and go to locations of security level equal or less than h.

Introduction

Information systems have evolved into open distributed systems that include decentralised peer-to-peer networks. An essential role of such systems is management of data, which appear to be semi-structured and distributed. Data-sharing applications require to integrate mobile processes and semi-structured data.

As information networks become more open and dynamic, the need for security and privacy grows stronger. Systems must be able to exchange data and processes while preserving security. One solution is to ground them on typed models. In such models, a well-typed network must reduce only to well-typed networks, assuring access and movement rights.

In this paper we propose a type system for the Xdπ calculus [START_REF] Gardner | Modelling Dynamic Web Data[END_REF]. An Xdπ-network is a network of locations, where each location consists of both a data tree and of a running process, for modelling process interaction, process migration and interaction between processes and data. The leaves of data trees contain pointers to nodes in trees of different locations, and scripts, i.e. static processes, which can be activated. In turn, scripts, pointers and trees can occur inside scripts and running processes.

In addition to the original syntax, we decorate location names with security levels taken from a partially ordered set of security levels with a bottom element. Therefore a location in a well-formed network will be of the shape:

l h [ T P ]
where l is a location name, h is its security level, T is a tree of data and P is a running process. Pointers, scripts and running processes are assigned security levels by means of a typing system.

The access and mobility rights of a process depend on the security level of the "source" location of the process itself, i.e. of the location where the process was in the initial network or where the process was created by the activation of a script. Hence in a well typed network each process has the security level of its source location. Security levels of scripts and pointers in trees, however, don't depend on the level of the enclosing location.

Processes migrate thanks to the go command. The go command can only move a process from one location to a location of security level lower or equal to the level of the process itself. Processes can also communicate data via channels. The security levels of the communicated data will never exceed the security level of the process.

Running processes can activate scripts in the local tree by the command run p , where p is a path expression which identifies a set of nodes. In a well-typed network a scripted process can be activated only if its security level is at most the one of the enclosing location.

Running processes can also modify the local tree and use the information in that tree by means of the command update. All trees can be copied by all processes, but only trees containing no data can be deleted and possibly replaced. A process of security level h can only read data of security level at most h, and modify data of security level less than h. The only exception being that processes generated by activating scripts can modify scripts of the same security level and in the same positions in trees.

Related Work

The Xdπ calculus [START_REF] Gardner | Modelling Dynamic Web Data[END_REF][START_REF] Maffeis | Behavioural Equivalencies for Dynamic Web Data[END_REF] models both localised, mobile processes and distributed, dynamic, semi-structured data, allowing to represent data-sharing applications. It can be seen as an extension of the Active XML model [START_REF] Abiteboul | Active XML, Security and Access Control[END_REF].

The locations and the processes of Xdπ are essentially those of dπ [START_REF] Hennessy | Resource Access Control in Systems of Mobile Agents[END_REF] enriched with capabilities for data manipulation. The only difference is that a process in dπ can migrate to a location independently from the existence of the location itself in the current network, while in Xdπ such an existence is a necessary condition for migration. The data trees of Xdπ are related to those in [START_REF] Abiteboul | Data on the Web : From Relations to Semistructured Data and XML[END_REF][START_REF] Cardelli | A Query Language Based on the Ambient Logic[END_REF] and the treatment of shared distributed data is inspired by [START_REF] Sahuguet | ubQL: A Distributed Query Language to Program Distributed Query Systems[END_REF]. We refer to [START_REF] Gardner | Modelling Dynamic Web Data[END_REF] for further references related to the calculus design.

Many type systems controlling the use of resources and the mobility of processes have been proposed for the dπ calculus [START_REF] Hennessy | Resource Access Control in Systems of Mobile Agents[END_REF] and for related calculi [START_REF] De | Types for Access Control[END_REF][START_REF] Castagna | The Seal Calculus[END_REF][START_REF] Cardelli | Types for the Ambient Calculus[END_REF]. The types discussed here are essentially inspired by the security types checking access rights for π-calculus of [START_REF] Hennessy | Information Flow vs Resource Access in the Asynchronous π-calculus[END_REF]. For simplicity we do not distinguish between reading and mobility rights, but our type system can be extended to take them into account. Another simplification is to have elements of a partially ordered set with a bottom element as security levels instead of elements of a lattice as it is usual [START_REF] Sandhu | Lattice-based Access Control Models[END_REF], this choice being justified by the fact that we do not use meets and joins. We formalise the network properties assured by our type system using the notions of network invariant and initial network as in [START_REF] Ahern | Formalising Java RMI with Explicit Code Mobility[END_REF].

The present paper is an expanded and revised version of [START_REF] Dezani-Ciancaglini | Security Types for Dynamic Web Data[END_REF], the main differences being:

• the data in trees can be of different security levels and do not depend on the security level of the enclosing location, while in [START_REF] Dezani-Ciancaglini | Security Types for Dynamic Web Data[END_REF] each location was only allowed to contain data of at most the security level of the location itself; • the communication, copying, updating and mobility rights of processes only depend on their source location, while in [START_REF] Dezani-Ciancaglini | Security Types for Dynamic Web Data[END_REF] they were depending on the enclosing location, but for the possibility of processes to move back to their source locations; • the capability of modifying data requires a higher security level than the capability of reading data, while in [START_REF] Dezani-Ciancaglini | Security Types for Dynamic Web Data[END_REF] there was no difference; • there is a special type for data-less trees, i.e. trees whose leaves contain no data, because only data-less trees can be deleted or replaced (they can be considered garbage).

Outline of the paper Section 2 and Section 3 introduce the syntax, the reduction rules, and the typing rules of typed Xdπ, exemplified by the examples in Section 5.

The properties of the calculus are discussed in Section 4 and proved in Appendices B and C. Section 6 contains a few final remarks.

Syntax and Operational Semantics

The Xdπ calculus we consider here is essentially the calculus introduced in [START_REF] Gardner | Modelling Dynamic Web Data[END_REF], with a few important differences.

The main difference between the original Xdπ and the present one is the use of a typed syntax. We decorate the location names with security levels and the channel names with value types. (An alternative approach could avoid these decorations by fixing an environment for locations and channels.)

More importantly, the syntax includes a typed matching function instead of an untyped one. Pattern matching needs to take types into account, in order to have type preservation under reduction. We will explain and motivate this choice at the end of the section.

In order to simplify the syntax we only allow monadic instead of polyadic communication and we do not distinguish between public channels (which cannot be restricted) and session channels (which must be restricted in the scripts). 2 These features of the original Xdπ can be easily handled by our type system.

Syntax

Networks A network is a parallel composition ( | ) of locations consisting of a tree and a process, where processes at different locations can share communication channels. In a well-formed network the locations have different names. The syntax of networks is given in Table 1. We use l, m to range over location names, and h, i, j over security levels. The location l h [ T P ] is well-formed if both the tree T and the process P do not contain occurrences of free variables. We use c to range over channel names and T v to denote a value type as defined in Table 9. The binder ν is, as usual, the restriction operator.

Trees The data model is an unordered edge-labelled rooted tree with leaves containing empty trees, scripts and pointers. The syntax of trees is presented in Table 2, using a to denote an edge label.

A script is a static process embedded in a tree that can be activated by a process from the same location. We use Π to range over processes and variables, and a script is denoted by Π. A path identifies nodes in a tree. Table 3 gives the formation rules of paths, using p to range over paths. In a path, "a" denotes a step along an edge a, " // " denotes any node, ".." a step back, "." the path from the root to the current node, x a variable and "/ " the path composition. We will say that a path is a local path if it contains ".". 3We use λ to range over variables and location names super-scripted by security levels. A pointer p@λ refers to the set of nodes identified by the path p in the tree at location λ.

N ::= 0 | | N | N | | l h [T P ] | | (νc T v )N
p ::= a | | // | | .. | | . | | x | | p / p

Processes

The processes that we are concerned with are essentially dπ-calculus processes [START_REF] Hennessy | Resource Access Control in Systems of Mobile Agents[END_REF], where the local communication modelled by π-calculus processes [START_REF] Milner | A Calculus of Mobile Processes, I-II[END_REF], [START_REF] Sangiorgi | The π-calculus: a Theory of Mobile Processes[END_REF] is extended with migration between locations (command go). There are two more commands for local communication between processes and data: one

v ::= c T v | | T | | P | | l h | | p Table 5
Syntax of values

χ ::= x DL | | x | | x j | | y ⋆ @x j V ::= T | | P | | p@λ Table 6
Syntax of patterns and data terms for updating (copy, paste, cut, etc.) the data tree (update) and the other one that activates the execution of scripts that are embedded in local data tree (run). We use P, Q, R to range over processes, and γ to range over channel names (decorated by value types) and variables. The syntax of processes is given in Table 4.

A value is either a channel name super-scripted with a value type, a tree, a script of a fixed security level, a location name super-scripted with a security level or a path. Using v to range over values, the syntax of values is given in Table 5.

The argument of go is a location name (super-scripted with a security level) or a variable, or the symbol " ", which can only occur in scripts to denote the location where the script will be activated.

The two arguments of the update command are respectively a pattern χ and a data term V , whose syntax is given in Table 6. A pattern is either a data-less tree variable, or a tree variable, or a script pattern, or a pointer pattern. In a pointer pattern j is a security level and ⋆ ∈ {Local, ǫ}4 indicates whether y stands for a local path or for a path without occurrences of ".". Data terms can be trees, scripts or pointers. The need to distinguish generic trees from data-less trees (that is trees whose leaves are empty) arises from the facts that trees themselves do not have security level. In order for a process to delete or replace a tree, it has to have permission to delete all the data contained in the tree first. Then any process, regardless of its security level, can delete or replace a data-less trees.

In update p (χ, V ).P the variables of χ can occur both in V and in P and they are bound. For this reason we allow variable occurrences in trees, scripts, pointers and processes.

Reduction rules

The reduction relation describes three forms of interactions:

• processes can communicate with each other within a location (rules (com) and (com!)); • processes can move between locations (rules (stay) and (go));

• process can interact with the local data (rules (update) and (run)).

The reduction relation is the least relation on networks which is closed with respect to structural congruence, reduction rules given in Table 7 and reduction contexts, given by

C ::= -| | C | N | | (νc T v )C.
The standard definition of structural congruence is presented in Appendix A.

The rules, (com) and (com!) are the communication rules from the π-calculus [START_REF] Milner | A Calculus of Mobile Processes, I-II[END_REF][START_REF] Sangiorgi | The π-calculus: a Theory of Mobile Processes[END_REF].

Processes can communicate only if they are in the same location.

There are two rules for migration. Rule (go) describes migration to a distinct location. The other rule, (stay), describes staying at the location where you are.

(com) l h [ T || cT v v | c T v (z).P | Q ] → l h [ T || P {v/ /z} | Q ] (com!) l h [ T || cT v v |!c T v (z).P | Q ] → l h [ T || !c T v (z).P | P {v/ /z} | Q ] (stay) l h [ T || go l h .P | Q ] → l h [ T || P | Q ] (go) l h [ T 1 || go m j .P | Q ] | m j [ T 2 || R ] → l h [ T 1 || Q ] | m j [ T 2 || P | R ] (run) p(T ) p,l h , x h , x T, {{ P 1 / / x}, . . . , { P n / / x}} l h [ T || run p | Q ] → l h [ T || P 1 | . . . | P n | Q ] (update) p(T ) p,l h ,χ,V T ′ , {s 1 , . . . , s n } l h [ T update p (χ, V ).P | Q ] → l h [ T ′ P s 1 | . . . | P s n | Q ] Table 7
Reduction rules

(Empty tree) ∅ θ ∅, ∅ (Script)
P θ P, ∅ (Pointer) p@l h θ p@l h , ∅ (Node) T θ T ′ , Θ a[T ] θ a[T ′ ], Θ (Par) T θ T ′ , Θ 1 S θ S ′ , Θ 2 T |S θ T ′ |S ′ , Θ 1 ∪ Θ 2 (Up) match(U, χ) = s V s θ V ′ , Θ θ = p, l h , χ, V a[U ] θ a[V ′ ], {s{l h / / , p/ /.}} ∪ Θ Table 8
Definition of the update function

The command run p finds all the scripts in the local tree identified by the path p and activates their parallel execution, after replacing " " and "." by the enclosing location and the path p, respectively.

The update command update p (χ, V ).P traversing top-down the local tree finds all the data terms V k given by the path p and pattern matches these data terms with χ to obtain substitutions s k when they exist. For each successful pattern matching it replaces the V k with V s k and starts P s k in parallel. The match function, in order to check if a data term agrees with a pattern, requires not only the data term to be, respectively, a data-less tree, a tree, a pointer or a script, according to the four shapes of the pattern (as in [START_REF] Gardner | Modelling Dynamic Web Data[END_REF]), but it requires also the data terms to satisfy the type information given by the pattern. This means that:

(1) if the pattern is x DL , then the data term must be a data-less tree, (2) if the pattern is x, then the data term must be a tree, (3) if the pattern is y ⋆ @x j , then the data term must be a pointer in which (i) the path can be a local path only if ⋆ = Local and (ii) the location must be of level j, (4) if the pattern is x j , then the data term must be a script of level j.

These conditions are enforced by using the type assignment system of next section. If the typed match is successful, the function returns a substitution which replaces the variables in the pattern by the corresponding data terms. More precisely the definition of the match function is:

(1) match(T, x DL ) = {T / /x} if ⊢ T : DLT ree; (2) match(T, x) = {T / /x} if ⊢ T : T ree;
(3) match(p@l j , y ⋆ @x j ) = {l j / /x, p/ /y} if ⊢ p : P ath ⋆ ; (4) match( P, x j ) = { P / / x} if ⊢ P : P rocLocal(j).

In principle it would be desirable to avoid security level matching at run time, and rely on static typing only. However in this setting, static typing would be too restrictive. Values in a tree can have any security level, and we cannot statically know the security levels of values found using the path "//". This is why dynamic checking is necessary.

The reduction rules for update and run are based on the definition of the update function , parametrised on p, l h , χ, V , which applied to a tree or to a node label returns a data term and a set of substitutions. Table 8 defines the function . The only interesting rule is (Up): it matches the selected (underlined) U in p(T ) with χ obtaining a substitution s. Then it continues updating V s obtaining the data term V ′ and the set of substitutions Θ. Finally it replaces U with V ′ and adds to Θ the substitution s{l h / / , p/ /.}. This is useful when s = { P / / x} for solving the references to the enclosing location and to the current path. We convene that occurrences of " " and "." inside scripts in P are unaffected by this substitution. Similarly if s = {T / /x} we convene that occurrences of " " and "." inside scripts in T leaves are unaffected by this substitution, i.e. that {T / /x}{l h / / , p/ /.} = {T / /x} for any T, x, l h , p. Some special forms of the update command have been already defined in [START_REF] Gardner | Modelling Dynamic Web Data[END_REF]:

cut p (χ).Q := update p (χ, ∅).Q copy p (χ).Q := update p (χ, χ).Q paste p T .Q := update p (x, x|T ).Q
where x does not occur in T, Q.

We will freely use these shorthands in the examples.

T v ::= Ch(T v) | | Loc(i) | | Script(i) | | P ath ⋆ | | DLT ree | | T ree ⋆ Table 9
Syntax of types

Type Assignment

The main goals of our type system are to control communication of values, access to data and migration of processes between locations. We will formalise this in Section 4.

We rely on a notion of security levels, and therefore we assume a fixed partial order (L, ≤) of security levels with a bottom ⊥. As already said in Section 2 we use h, i, j to range over elements of L.

The syntax of types is the content of Table 9. Clearly the types correspond to the syntactic categories of the previous section. We use the suffix Local when we allow local paths. This distinction is useful since a run or an update command containing a local path as index cannot be executed, but it can appear inside a script.

We will use P ath ⋆ as short for P ath or P athLocal and similarly for the other types. When more than one ⋆ appears in a typing rule we always assume that all of them are replaced either by ǫ or by Local.

We define the security level of a value type (notation |T v|) as follows:

• |Ch(T v)| = |T v|; • |Loc(i)| = |Script(i)|= i; • |P ath ⋆ | = |DLT ree| = |T ree ⋆ | = ⊥.
An environment Σ gives the association between:

• variables and value types • variables and local process types i.e. we define:

Σ := ∅ | | Σ, x : T v | | Σ, x : P rocLocal(i).
We use the environment by means of a standard axiom:

(axiom) Σ, x : σ ⊢ x : σ where σ ranges over value types and local process types.

Typing rules for channels, locations and scripts are as expected (recall that Π ranges over processes and variables):

(chan) Σ ⊢ c T v : Ch(T v) (loc) Σ ⊢ l i : Loc(i) Σ ⊢ Π : P roc ⋆ (i) (script) Σ ⊢ Π : Script(i)
Typing rules for paths are given in Table 10: a local path always gets the type P athLocal instead of P ath.

The typing rule for pointers

Σ ⊢ λ : Loc(i) Σ ⊢ p : P ath ⋆ (pointer) Σ ⊢ p@λ : P ointer ⋆ (i) gives a P ointer or a P ointerLocal type according to the path type. The security level of the pointer is the security level of the pointed location.

Typing rules for trees are given in Table 11. According to these typing rules:

• a tree is data-less, i.e. it has the type DLT ree, only if all its leaves are labelled by ∅; • a tree that has at least one node labelled by a local pointer will be typed by T reeLocal.

(patha) Σ ⊢ a : P ath

(
Σ ⊢ T : DLT ree (treeDLa) Σ ⊢ a[T ] : DLT ree Σ ⊢ T : T ree ⋆ (treea) Σ ⊢ a[T ] : T ree ⋆ Σ ⊢ T 1 : DLT ree Σ ⊢ T 2 : DLT ree (treeDL|) Σ ⊢ T 1 | T 2 : DLT ree Σ ⊢ Π : Script(i) (treeScript) Σ ⊢ a[ Π] : T ree Σ ⊢ T 1 : T ree ⋆ Σ ⊢ T 2 : T ree ⋆ (tree|) Σ ⊢ T 1 | T 2 : T ree ⋆ Σ ⊢ p@λ : P ointer ⋆ (i) (treeP ointer) Σ ⊢ a[p@λ] : T ree ⋆ Σ ⊢ T : DLT ree (treeDL) Σ ⊢ T : T ree Σ ⊢ T : T ree (treeL) Σ ⊢ T : T reeLocal

Table 11 Typing of trees

Typing rules for processes are given in Table 12. The rule (go) allows a process whose source location is of security level i to migrate to a location at security level j only if j ≤ i.

In the typing rules for update we assume that χ ∈ {x DL , x,y ⋆ @x j , x j }, and we define the environment Σ χ for associating types to the variables bound by the pattern.

Σ χ =                    x : DLT ree if χ = x DL , x : T ree if χ = x, x : Loc(j), y : P ath ⋆ if χ = y ⋆ @x j , x : P rocLocal(j) if χ = x j
We define the security level of a pattern (notation |χ|) as expected:

(proc0) Σ ⊢ 0 : P roc ⋆ (i) Σ ⊢ P 1 : P roc ⋆ (i) Σ ⊢ P 2 : P roc ⋆ (i) (proc|) Σ ⊢ P 1 | P 2 : P roc ⋆ (i) Σ ⊢ P : P roc ⋆ (i) |T v| ≤ i (procν) Σ ⊢ (νc T v )P : P roc ⋆ (i) Σ ⊢ v : T v Σ ⊢ γ : Ch(T v) |T v| ≤ i (out) Σ ⊢ γ v : P roc ⋆ (i) Σ, x : T v ⊢ P : P roc ⋆ (i) Σ ⊢ γ : Ch(T v) |T v| ≤ i (input) Σ ⊢ γ(x).P : P roc ⋆ (i) Σ, x : T v ⊢ P : P roc ⋆ (i) Σ ⊢ γ : Ch(T v) |T v| ≤ i (!input) Σ ⊢ !γ(x).P : P roc ⋆ (i) Σ ⊢ P : P roc ⋆ (i) Σ ⊢ λ : Loc(j) j ≤ i (go) Σ ⊢ go λ.P : P roc ⋆ (i) Σ ⊢ P : P roc ⋆ (i) (goHome) Σ ⊢ go .P : P rocLocal(i) Σ ⊢ p : P ath ⋆ (run) Σ ⊢ run p : P roc ⋆ (i) Σ ⊢ p : P ath ⋆ Σ ∪ Σ χ ⊢ P : P roc ⋆ (i) |χ| ≤ i (copy) Σ ⊢ update p (χ, χ).P : P roc ⋆ (i) Σ ⊢ p : P ath ⋆ Σ ∪ Σ χ ⊢ P : P roc ⋆ (i) χ = x |χ| < i Σ χ ⊢ V : T P S(j) j ≤ i
(paste) Σ ⊢ update p (χ, V ).P : P roc ⋆ (i) Σ, x : P rocLocal(i) ⊢ P : P rocLocal(i)

x : P rocLocal(i) ⊢ V : T P S(j) j ≤ i (pasteHere) Σ ⊢ update . ( x i , V ).P : P rocLocal(i)

Table 12

Typing of processes

• |x DL | =|x| = ⊥; • |y ⋆ @x j | = | x j | = j.
In these rules T P S(j) stands for T ree or P ointer ⋆ (j) or Script(j).

The three typing rules for the updating command are necessary since we require:

• all processes to be allowed to copy all trees and to replace only data-less trees ∅ ⊢ T : T ree ∅ ⊢ P : P roc(i)

(netIloc) ⊢ l i [ T P ] : N et ∅ ⊢ T : T ree ∅ ⊢ P : P roc(j) (netOloc) ⊢ l i [ T P ] : N et (net0) ⊢ 0 : N et ⊢ N : N et (netν) ⊢ (νc T v )N : N et ⊢ N 1 : N et ⊢ N 2 : N et N (N 1 ) ∩ N (N 2 ) = ∅ (net|) ⊢ N 1 | N 2 : N et Table 13
Typing of networks (rules (copy) and (paste)); • processes at the same security level of a leaf to be allowed to copy the leaf (rule (copy)); • processes at a higher security level than a leaf to be allowed to replace the leaf with a data term of a security level not greater than the security level of the process itself (rule (paste)); • a process script in a leaf to be able to replace itself with a data term of a security level not greater than its own security level (rule (pasteHere)).

As a consequence a process can replace a non data-less tree only if all the leaves of this tree contain data terms of security levels lower than the security level of the process itself. For this purpose the process needs first to replace all the leaves containing pointers and scripts by the empty tree and then to replace the so obtained data-less tree.

Typing rules for networks are given in Table 13. For typing a location in a network we have two typing rules: the initial rule (netIloc) and the ongoing rule (netOloc).

The first rule requires the process to have the same security level of the enclosing location, while the second one allows a process of any security level. This reflects the requirement that access and mobility rights of processes depend on their source locations, as we will discuss in Section 4.

The function N associates to a network the set of its location names:

N (0) = ∅ N (l i [ T P ]) = {l} N (N 1 | N 2 ) = N (N 1 ) ∪ N (N 2 ).
It is used in rule (net|) to assure that each location name occurs at most once in a typed network.

The system satisfies subject reduction:

Theorem 3.1 (Subject reduction) Let ⊢ N : Net and N → N ′ , then ⊢ N ′ : Net.
The proof is presented in Appendix B. It uses some Generation and Substitution lemmas which are also presented in Appendix B.

Safety properties

In the present section, using the subject reduction, we can show some relevant properties of typed initial networks. We say that a network is initial when its locations can be typed by means of the initial typing rules.

More meaningful than the subject reduction theorem are the following properties of initial networks:5 P0 a channel in a process whose source location has level h can communicate only values whose security level is less than or equal to h; P1 a process whose source location has level h can migrate to a location of level j only if j ≤ h; P2 a process whose source location has level h can copy from the local tree only data of level j with j ≤ h; P3 a process whose source location has level h can modify in the local tree only data of level j with j < h, unless the process itself was generated by running a script of security level h in a tree at path p, and in this case it can modify scripts which are both of the security level h and reachable by the path p; P4 a script of level j which is a leaf of a tree in a location of level i can be activated only if j ≤ i.

In order to discuss these properties we need to formalise the notion of "source" location of a process. Roughly by "source" location of a process we mean the location where the process was in the initial net or where the process was created by a run command.

We use to denote the reflexive and transitive closure of → and ν to denote a possibly empty sequence of channel restrictions. If N is an initial network and

N ν(l h [ T || P |Q ] | N ′ )
, then the source location of the process P in this reduction is defined by induction on the reduction and by cases:

• if N ≡ ν(l h [ T || P | Q ] | N ′ ), then the source location of P is l h ; • if N ν(l h [ T || run p | Q ′ ] | N ′ ) → ν(l h [ T || P | Q ] | N ′ ) since p(T ) p,l h , x h , x T, {{ R 1 / / x}, . . . , { R n / / x}} and R 1 ≡ P | R and Q ≡ R | R 2 | . . . | R n | Q ′ , then the source location of P is l h ; • if N ν(l h [ T ′ || update p (χ, V ).P ′ | Q ′ ] | N ′ ) → ν(l h [ T || P | Q ] | N ′ ) since p(T ′ ) p,l h ,χ,V T, {s 1 , . . . , s n } and P ′ s 1 ≡ P | R and Q ≡ R | P ′ s 2 | . . . |P ′ s n | Q ′ ,
then the source location of P is the source one of update p (χ, V ).P ′ in the reduction without the last step;

• if N ν(l h [ T || c T v v | c T v (z).P ′ | Q ′ ] | N ′ ) → ν(l h [ T || P | Q ] | N ′ ) and P ′ {v/ /z} ≡ P | R and Q ≡ R | Q ′ ,
then the source location of P is the source location of c T v (z).P ′ in the reduction without the last step;

• if N ν(l h [ T c T v v | !c T v (z).P ′ | Q ′ ] | N ′ ) → ν(l h [ T P | Q ] | N ′ ) and P ′ {v/ /z} ≡ P | R and Q ≡ !c T v (z).P ′ | R | Q ′ ,
then the source location of P is the source location of !c T v (z).P ′ in the reduction without the last step;

• if N ν(l h [ T || go l h .P ′ | Q ′ ] | N ′ ) → ν(l h [ T || P | Q ] | N ′ ) and P ′ ≡ P | R and Q ≡ R | Q ′ ,
then the source location of P is the source location of go l h .P ′ in the reduction without the last step;

• if N ν(l h [T Q ′ ] | m j [ T ′ go l h .P ′ | R ] | N ′′ ) → ν(l h [ T P | Q ] | N ′ ) and P ′ ≡ P | R ′ and Q ≡ R ′ | Q ′ and N ′ ≡ m j [ T ′ || R ] | N ′′ ,
then the source location of P is the source location of go l h .P ′ in the reduction without the last step;

• if N ν(l h [ T ′ || P | Q ′ ] | N ′′ ) → ν(l h [ T || P | Q ] | N ′ )
, then the source location of P is the source location of P in the reduction without the last step.

The first two cases are the basic cases, in which the process P takes the current location as source location: in the first one the network is initial, in the second one the process P is generated by the last reduction step. In the last case the reduction does not modify the process P , which preserves its source location. In all other cases an action prefixing the process P (possibly in parallel with other processes and/or modulo the substitution of a value for a variable) is consumed and the source location of P is the source location of the process starting with that action in the reduction without the last step.

We can then formalise the above properties as follows.

(l i [ T || P | Q ] | N ′ )
, and h is the security level of the source location of P , then ⊢ P : P roc(h).

Examples

To simplify the following examples we will consider natural numbers with their order as security levels.

Insensitivity to higher level values

The security policy enforced by our typing system should not be confused with noninterference. A high level process can easily declassify information of its security level to lower levels. However in the absence of high level processes, lower level processes are insensitive even to the existence of higher level data.

Consider the following networks

N 1 = l h [ T || P ] and N 2 = l h [ T || P ] | m j [ T ′ || 0 ]
where h < j.

Then the following property holds

Proposition 5.1 For each N such that N 1 N we have N 2 N | m j [ T ′ || 0 ]. Conversely if N 2 N ′ , then N ′ = N | m j [ T ′ || 0 ] and N 1 N.
Proof The only transition that could violate the theorem would involve a go m j action. This action cannot occur in P by property P1 of Proposition 4.1. Moreover by property P4 of Proposition 4.1 no script contained in T with occurrences of go m j could be activated.

Another similar result is the following. Let N be a network all whose locations have security level less than or equal to h. Let V be a value of security level j > h. Then Proposition 5.2 Under the above condition we have N

N ′ if and only if N[∅/V ] N ′ [∅/V ],
where N[∅/V ] is the network obtained by replacing in N some occurrences of V in the leaves with the empty tree.

Proof No pattern of security level j can be contained in a process of level at most h by properties P2 and P3 of Proposition 4.1, nor in a script activated inside a location of level at most h by property P4 of Proposition 4.1.

Remote Voting System

The next example models a remote voting for election of a leader from a given list of candidates, inspired by [START_REF] Kiniry | The KOA Remote Voting System: A Summary of Work To-Date[END_REF]. In this example, we allow tree nodes to contain integers, in order to represent the counters of votes. A pattern too can be a variable of type Integer and of a fixed security level.

The network consists of an authority location, a cabin location and a fixed number of voter locations. The authority location has level 3, while the cabin and all the voter locations have level 1.

The cabin location

cabin 1 [voterList[ . . . | voterId[ P ]| . . .] | candList[ T ] || 0 ],
where P = (νc P ath )(cut . ( x 1 ).go voter 1 . bCh(P ath) c P ath | dCh(P ath) c P ath ) and T = . . . | name[ 0 2 ] | . . . , contains as data the voter list and the candidate list with counters of votes.

The voter list has for each voter an edge labelled by the voter identifier pointing to the scripted process P of security level 1. This script contains two processes. One process first destroys itself and then goes to the voter location, where it communicates a secret channel which the voter will use to express his vote. The other process simply communicates the same secret channel via the channel d.

The candidate list has for each candidate an edge labelled by the candidate name pointing to an integer (the vote counter, initially 0) of security level 2. This assures that the voter can copy the subtree with candidate list and see candidate names, but by property P2 of Proposition 4.1 he cannot see and use already memorised votes to make his decision.

A voter location contains two processes: the first process goes to the cabin and activates the process P and the second one waits to receive a channel along which he will communicate his vote, after going to the cabin and making a choice (based on the candidate list): The process in the authority location starts the elections by going to the cabin where he repeatedly collects one private channel via the channel d, receives along this private channel one candidate name and increases by 1 the corresponding candidate counter:

authority 3 [ Start[ Q] | . . . || run Start | . . . ], Q = go cabin 1 .!d(v).v(w).update candVoteList/w (t 2 , t + 1).
Similarly the authority can end the election going to the cabin and erasing the voter list.

Notice that a malicious voter cannot vote more than once, since the process P destroys itself, and if he would send the identifier of another voter, the other voter would receive the secret channel to vote. Moreover by property P3 of Proposition 4.1 a malicious voter cannot change the vote counters in the cabin location, since the vote counters have security level 2, while the voters have security level 1.

A malicious voter can send to the location of another voter a process which votes in place of the voter itself. We do not know how to avoid this kind of attacks, which model a voter stealing the position of another voter during the voting act.

The present encoding is simpler than the encoding of the same example given in [START_REF] Dezani-Ciancaglini | Security Types for Dynamic Web Data[END_REF].

Distributed Library

Let us consider a network consisting of a distributed library (main library and libraries of specific fields), readers, staff members and a head. The main library (Library) has data subtrees for management and catalogue. The library catalogue contains in its leaves pointers to full books which are distributed in leaves of specific field libraries.

For example, the reader

Reader 1 [Book[Pierce[∅] | . . . ] || go Library 1 .copy Catalog/Pierce/Types (y@x 1 ). go x.copy Pierce/Types (z 1 ).go Reader 1 .paste Book/Pierce (Types[z]) ] goes to the library, reads in the catalogue the location of the book, goes to the sublibrary, copies the book and pastes the copy in the tree of his location.

The typing system introduced in the current paper assures that the reader can copy content of any book, but he cannot modify it (property P3 of Proposition 4.1). Besides, he cannot see HourP lan in the management leaf, because he is of less security level than the HourP lan (property P2 of Proposition 4.1).

The staff is given security level 2, such that they can update catalogue, modify the book contents, but only copy the HourP lan.

The head, being of security level 3, is the only one that can update all the data at the Library. He can, for example, change working hours.

Conclusion

We discussed a typed version of the Xdπ calculus in which the access to resources and the mobility of processes must respect a security policy. Since we used a typed pattern matching which includes a dynamic type checking we will investigate both type checking and type inference for this calculus, taking into account [START_REF] Coppo | A Mobility Calculus with Local and Dependent Types[END_REF].

We plan to study modifications of our type system which allow to prevent illegal flow of information [START_REF] Sabelfeld | Language-Based Information-Flow Security[END_REF], also in presence of dynamic flow policies [START_REF] Zdancewic | Challenges for Information-flow Security[END_REF].

We want to study the impact of our typing system in proving equivalence of networks, using different notions of behavioural equivalence. We plan to start from the untyped equivalencies defined in [START_REF] Maffeis | Behavioural Equivalencies for Dynamic Web Data[END_REF] and [START_REF] Gardner | Modelling Dynamic Web Data[END_REF], and to refine them using types as done for example in [START_REF] Pierce | Behavioral Equivalence in the Polymorphic Pi-Calculus[END_REF] and [START_REF] Hennessy | Typed Behavioural Equivalences for Processes in the Presence of Subtyping[END_REF].

A Structural Congruence

The structural congruence for the Xdπ calculus is the least equivalence relation on networks that satisfies alpha-conversion, the commutative monoid properties for (∅, | ) on trees, for (0, | ) on processes and for (0, | ) on networks, and the axioms of Table A.1. As usual fn is the set of free channel names occurring in a process or in a tree or in a network.

(trees)

V ≡ V ′ ⇒ a[V ] ≡ a[V ′ ]
(scripts) P ≡ P ′ ⇒ P ≡ P ′ (processes) (νc T v )0 ≡ 0

v ≡ v ′ ⇒ cT v v ≡ cT v v ′ (νc T v )(νd T v ′ )P ≡ (νd T v ′ )(νc T v )P c T v ∈ fn(P ) ⇒ P | (νc T v )Q ≡ (νc T v )(P | Q)
V ≡ V ′ ∧ P ≡ P ′ ⇒ update p (χ, V ).P ≡ update p (χ, V ′ ).P ′ (networks) (νc T v )0 ≡ 0

(νc T v )(νd T v ′ )N ≡ (νd T v ′ )(νc T v )N c T v ∈ fn(N) ⇒ N | (νc T v )N ′ ≡ (νc T v )(N | N ′ ) T ≡ T ′ ∧ P ≡ P ′ ⇒ l h [ T P ] ≡ l h [ T ′ P ′ ] c T v ∈ fn(T ) ⇒ l h [ T (νc T v )P ] ≡ (νc T v )l h [ T P ] Table A.1 Structural congruence

B Subject Reduction

We prove that the typing of networks is preserved by structural congruence and by reduction. These proofs use generation lemmas which allow to reverse the typing rules. Notice that for networks we need to distinguish initial and ongoing typing rules.

We use τ to range over all types of Table 9.

Lemma B.1 (Generation lemma for variables, channels, locations and paths)

(1) Σ ⊢ x : τ ⇒ x : τ ∈ Σ.

(2) Σ ⊢ c T v : τ ⇒ τ = Ch(T v).

voter 1 [

 1 . . . || go cabin 1 .run voterList/voterId | b Ch(P ath) (y).go cabin 1 .Choice(z).ȳ z | . . .].

Library 1 [

 1 Management [ WorkingHours[HourP lan 2 ] | . . . ] | Catalog [ . . . | Pierce[Types[Pierce/Types@LICS 1 ] | Category[Pierce/Category@LICS 1 ] . . .] | | Cohn[Universal[Cohn/Universal@ALGEBRA 1 ] | . . .] || . . .], LICS 1 [ . . . | Pierce [ Types [ Book.pdf 1 ] | Category [ Book.pdf 1 ] | . . . ] || . . . ], ALGEBRA 1 [ . . . | . . . Cohn [ Universal [ Book.pdf 1 ] | . . . ] || . . . ].

Table 1

 1

	Syntax of networks
	T ::= ∅	empty rooted tree
	| | x	tree variable
	| | T | T composition of trees, joining the roots
	| | a[T ]	edge labeled a with subtree T
	| | a[ Π] edge labeled a with script Π
	| | a[p@λ] edge labeled a with pointer p@λ
	Table 2
	Syntax of trees

Table 3

 3 Syntax of paths

Proposition 4.1

  If N is an initial network, and N ν(l i [ T || P | Q ] | N ′ ), and h is the security level of the source location of P , then: P0 P ≡ cTv v implies |T v| ≤ h; P1 P ≡ go m j .P ′ implies j ≤ h; P2 P ≡ update p (χ, χ).P ′ implies |χ| ≤ h; P3 P ≡ update p (χ, V ).P ′ implies either |χ| < h or χ = x h and P has been generated by activating a script in a tree at path p; P4 P ≡ run p implies that the execution of P can only activate scripts at security level i.

	source location: see Appendix C for the proof.
	Proposition 4.2 If N is an initial network, and N	ν
	Property P4 is an immediate consequence of the reduction rule (run). The remain-
	ing properties follow easily observing that each process has the security level of its

This work was partly funded by the project MMIT 1438 of PSNTR, by FP6-2004-510996 Coordination Action TYPES, by the project GLORA 144029 of MSEP and by the ANR project "ParSec" ANR-06-SETI-010-02.

The distinction between public and session channels is important for implementation since otherwise one needs to alpha-convert the whole data tree of a location when a process, restricting a channel name, migrates.

The path syntax allows also meaningless paths, like "./ ./ .": this could be clearly avoided either by typing or by refining the syntax.

Here and in the following we use ǫ to denote the empty string, so we get either y Local @x j or y@x j .

Notice that P0, P1, P2, P3 and P4 are network invariants in the sense of[START_REF] Ahern | Formalising Java RMI with Explicit Code Mobility[END_REF].

Acknowledgements

We thank Philippa Gardner and Sergio Maffeis for their careful reading of an earlier version of the paper and for many useful remarks on it. We also thank the anonymous referees of TGC'06 submission for detailed and appropriate comments. The final version for TGC'06 and the present version of the paper strongly improved due to their suggestions.

(3) Σ ⊢ l i : τ ⇒ τ = Loc(i). (4) Σ ⊢ p : τ and p is a local path ⇒ τ = P athLocal.

(5) Σ ⊢ p : τ and p is not a local path ⇒ τ = P ath ⋆ .

Lemma B.2 (Generation lemma for scripts, pointers and trees)

(1) Σ ⊢ Π : τ ⇒ τ = Script(i) and Σ ⊢ Π : P roc ⋆ (i).

(2) Σ ⊢ p@λ : τ ⇒ τ = P ointer ⋆ (i) and Σ ⊢ λ : Loc(i) and Σ ⊢ p : P ath ⋆ .

(3) Σ ⊢ ∅ : τ ⇒ either τ = DLT ree or τ = T ree ⋆ . (4) Σ ⊢ T 1 | T 2 : τ ⇒ either τ = DLT ree and Σ ⊢ T 1 : DLT ree and Σ ⊢ T 2 : DLT ree or τ = T ree ⋆ and Σ ⊢ T 1 : T ree ⋆ and Σ ⊢ T 2 : T ree ⋆ . ( 5) Σ ⊢ a[T ] : τ ⇒ either τ = DLT ree and Σ ⊢ T : DLT ree or τ = T ree ⋆ and Σ ⊢ T : T ree ⋆ . ( 6) Σ ⊢ a[p@λ] : τ ⇒ τ = T ree ⋆ and Σ ⊢ p@λ : P ointer ⋆ (i).

Lemma B.3 (Generation lemma for processes)

(1) Σ ⊢ 0 : τ ⇒ τ = P roc ⋆ (i).

(2) Σ ⊢ P 1 | P 2 : τ ⇒ τ = P roc ⋆ (i) and Σ ⊢ P 1 : P roc ⋆ (i) and Σ ⊢ P 2 :

|T v| ≤ i. (5) Σ ⊢ γ(x).P : τ ⇒ τ = P roc ⋆ (i) and Σ, x : T v ⊢ P : P roc ⋆ (i) and Σ ⊢ γ : ch(T v) and |T v| ≤ i. (6) Σ ⊢ !γ(x).P : τ ⇒ τ = P roc ⋆ (i) and Σ, x : T v ⊢ P : P roc ⋆ (i) and Σ ⊢ γ : ch(T v) and |T v| ≤ i. (7) Σ ⊢ go λ.P : τ ⇒ τ = P roc ⋆ (i) and ⊢ λ : Loc(j) and j ≤ i and Σ ⊢ P : P roc ⋆ (i). (8) Σ ⊢ go .P : τ ⇒ τ = P rocLocal(i) and Σ ⊢ P : P roc ⋆ (i). (9) Σ ⊢ run p : τ ⇒ τ = P roc ⋆ (i) and Σ ⊢ p : P ath ⋆ . (10) Σ ⊢ update p (χ, χ).P : τ ⇒ τ = P roc ⋆ (i) and Σ ⊢ p : P ath ⋆ and Σ ∪ Σ χ ⊢ P : P roc ⋆ (i) and |χ| ≤ i. (11) Σ ⊢ update p (χ, V ).P : τ and χ = V, x and (p = . or χ = x j for all j) ⇒ τ = P roc ⋆ (i) and Σ ⊢ p : P ath ⋆ and Σ ∪ Σ χ ⊢ P : P roc ⋆ (i) and |χ| < i and Σ χ ⊢ V : T P S(j) and j ≤ i. (12) Σ ⊢ update . ( x i , V ).P : τ ⇒ τ = P rocLocal(i) and Σ, x : P rocLocal(i) ⊢ P : P rocLocal(i) and x : P rocLocal(i) ⊢ V : T P S(j) and j ≤ i.

Lemma B.4 (Generation lemma for networks)

• either (initial) ∅ ⊢ P : P roc(i),

• or (ongoing) ∅ ⊢ P : P roc(j). ( 4) ⊢ (νc T v )N : τ ⇒ τ = Net and ⊢ N : Net.

The following two propositions point out some properties of our type system and can be easily verified by induction of deductions.

By replacing in an arbitrary process " " by a location name (whose security level agrees with that of the process) and "." by a path not containing "." we get a process typeable with a process type. Proposition B.5 If Σ ⊢ P : P roc ⋆ (i) and Σ ⊢ p : P ath and j ≤ i, then Σ ⊢ P {l j / / , p/ /.} : P roc(i).

A process which has a given security level has also all bigger security levels. The proof follows easily observing that the nil process can be typed with an arbitrary security level and that all typing rules only check that the security level of the current process is bigger than other security levels.

Proposition B.6 Σ ⊢ P : P roc ⋆ (i) and i ≤ j imply Σ ⊢ P : P roc ⋆ (j).

As usual the "core" of the subject reduction proofs are substitution lemmas.

Lemma B.7 (Substitution lemma for trees, pointers, scripts and processes)

(2) If Σ, x : P rocLocal(j) ⊢ V : T P S(i) and Σ ⊢ P : P rocLocal(j), then

(4) If Σ, x : P rocLocal(j) ⊢ P : P roc ⋆ (i) and Σ ⊢ Q : P rocLocal(j), then Σ ⊢ P { Q/ / x} : P roc ⋆ (i). (5) If Σ ⊢ update p (χ, V ).P : P roc(i) and Σ ⊢ T : T ree and T p,l i ,χ,V T ′ , Θ, then Σ ⊢ T ′ : T ree.

Proof The proofs of the first four points are standard by induction on V and P , respectively.

For (5) we need to consider three cases according to the shape of χ. We give the proof for χ = y ⋆ @x j , the remaining cases being similar. Let Θ = {s 1 , . . . , s n } and 1 ≤ k ≤ n. By construction s k = {m j / /x, p ′ k / /y}, for some m j and p ′ k such that ⊢ p ′ k : P ath ⋆ . By Lemma B.3 [START_REF] Hennessy | Resource Access Control in Systems of Mobile Agents[END_REF] or (11) Σ, x : Loc(j), y : P ath ⋆ ⊢ V : T P S(h) with h ≤ i. By Point (1) Σ ⊢ V s k : T P S(h). By construction T ′ is obtained from T by replacing top-down the nodes m j @p ′ k by V s k , so we can easily check that Σ ⊢ T ′ : T ree using the typing rules for trees. Proof We only consider some interesting cases.

and the reduction is by rule (go): We consider the ongoing case, the proof for the initial case being the same. In this case by Lemma B.3 [START_REF] Abiteboul | Data on the Web : From Relations to Semistructured Data and XML[END_REF] we have that ∅ ⊢ go m j .P : P roc(i) and then by Lemma B.3(7) ∅ ⊢ P : P roc(i). We conclude by applying the ongoing typing rules taking into account Proposition B.6.

and the reduction is by rule (run):

where p(T ) p,l h , x h , x T, {{ P 1 / / x}, . . . , { P n / / x}}. From ⊢ N : Net, by Lemma B.4(3) ∅ ⊢ T : T ree. By construction P k = P ′ k {l h / / , p/ /.}, where P ′ k matches x h and therefore ∅ ⊢ P ′ k : P rocLocal(h) and then ∅ ⊢ P k : P roc(h) by Proposition B.5. We conclude by applying the ongoing typing rules taking into account Proposition B.6.

Case N ≡ l h [ T || update p (χ, V ).P | Q] and the reduction is by rule (update):

where p(T ) p,l h ,χ,V T ′ , {s 1 , . . . , s n }. From ⊢ N : Net, by Lemma B.4(3) ∅ ⊢ T : T ree and

We consider the ongoing case with χ = y ⋆ @x j , the proof for the other cases being similar. In this case by Lemma B.7(5) ∅ ⊢ T ′ : T ree. By Lemma B.3 [START_REF] Abiteboul | Data on the Web : From Relations to Semistructured Data and XML[END_REF] we have that ∅ ⊢ update p (χ, V ).P : P roc(i) and then by Lemma B.3 [START_REF] Hennessy | Resource Access Control in Systems of Mobile Agents[END_REF] or [START_REF] Hennessy | Information Flow vs Resource Access in the Asynchronous π-calculus[END_REF] x : Loc(j), y : P ath ⋆ ⊢ P : P roc(i). By construction s k = {m j /x, p ′ k /y}, for some m j and p ′ k such that ⊢ p ′ k : P ath ⋆ . By Lemma B.7(3) this gives ∅ ⊢ P s k : P roc(i). We conclude by applying the ongoing typing rules for processes.

C Safety proof

Proof

The proof is by induction on and by cases on the definition of source location using Generation and Substitution Lemmas.

In this case i = h and ⊢ N : Net using the initial typing rules. By Lemma B.4(4), ( 2), (3) ⊢ P | Q : P roc(h) which implies ⊢ P : P roc(h) by Lemma B.3 [START_REF] Abiteboul | Data on the Web : From Relations to Semistructured Data and XML[END_REF].

Case N

ν(l i [ T ′ || update p (y ⋆ @x j , V ).

) since p(T ′ ) p,l i ,y ⋆ @x j ,V T, {s 1 , . . . , s n } and P ′ s 1 ≡ P | R and Q ≡ R | P ′ s 2 | . . . |P ′ s n | Q ′ . By induction we have that ∅ ⊢ update p (χ, V ).P : P roc(h) and then by Lemma B.3 [START_REF] Hennessy | Resource Access Control in Systems of Mobile Agents[END_REF] or [START_REF] Hennessy | Information Flow vs Resource Access in the Asynchronous π-calculus[END_REF] x : Loc(j), y : P ath ⋆ ⊢ P : P roc(h). By construction s k = {m j / /x, p ′ k / /y}, for some m j , p ′ k such that ⊢ p ′ k : P ath ⋆ . By Lemma B.7(1) this gives ∅ ⊢ P s k : P roc(h).

The proofs for the remaining cases are similar to the proof of the last case.