Resource Bound Certiication

Various code certiication systems allow the certiication and static veriication of important safety properties such as memory and control-ow safety. These systems are valuable tools for verifying that untrusted and potentially malicious code is safe before execution. However, one important safety property that is not usually included is that programs adhere to speciic bounds on resource consumption, such as running time. We present a decidable type system capable of specifying and certifying bounds on resource consumption. Our system makes two advances over previous resource bound certiica-tion systems, both of which are necessary for a practical system: We allow the execution time of programs and their subroutines to vary, depending on their arguments, and we provide a fully automatic compiler generating certiied ex-ecutables from source-level programs. The principal device in our approach is a strategy for simulating dependent types using sum and inductive kinds. 1 Introduction A current trend in systems software is to allow untrusted extensions to be installed in protected services, relying on language technology to protect the integrity of the service instead of hardware-based protection mechanisms 11, 20, 1, 16, 14]. For example, the SPIN project 1] relies on the Modula-3 type system to protect an operating system kernel from erroneous extensions. Similarly, web browsers rely on the Java Virtual Machine bytecode veriier 11] to protect users from malicious applets. In both situations, the goal is to eliminate expensive inter-process communications or boundary crossings by allowing extensions to access directly the resources they require. Recently, Necula and Lee 16, 15] have proposed Proof-Carrying Code (PCC) and Morrisett et al. 14] have proposed Typed Assembly Language (TAL) as language technologies that provide the security advantages of high-level languages, but without the overheads of interpretation or just-in-time compilation. In both systems, low-level machine code can be heavily optimized, by hand or by compiler , and yet be automatically veriied through proof-or type-checking.