The Grenade Timer: Fortifying the Watchdog Timer Against Malicious Mobile Code

Systems accepting mobile code need protection from denial of service attacks staged by the guest program. While protected mode is the most general solution, it is not available to the very low-cost microcontrollers that are common in embedded systems. In this paper we introduce the grenade timer, an evolution of the watchdog timer that can place a hard upper bound on the amount of processor time that guest code may consume. Unlike its predecessor, it is resistant to malicious attacks from the software it controls; but its structure remains extremely simple and maps to very frugal hardware resources.