A type system for complexity flow analysis
Jean-Yves Marion
Nancy-Universit
´
e
INPL-ENSMN
LORIA
Abstract—We propose a type system for an imperative pro-
gramming language, which certifies program time bounds. This
type system is based on secure flow information analysis. Each
program variable has a level and we prevent information from
flowing from low level to higher level variables. We also introduce
a downgrading mechanism in order to delineate a broader class
of programs. Thus, we propose a relation between security-typed
language and implicit computational complexity. We establish a
characterization of the class of polynomial time functions.
I. INTRODUCTION
This paper introduces a new static analysis method for
controlling and certifying imperative program runtime. We
propose a type system to reflect information flow and to
explore the computational complexity properties of well-typed
programs. We exhibit a relation between Implicit Computa-
tional Complexity approaches and research on language-based
information flow security.
The subject of Implicit Computational Complexity (ICC) is
the characterization of complexity classes without referring to
machines and so with no externally imposed resource bounds
on time or space. Early examples of implicit characterization
of PTIME are via bounded recursion by Cobham [1], fixpoint
logic by Immerman [2], positive-existential comprehension in
second-order logic by Leivant [3], safe recursion by Bellantoni
& Cook [4], ramified recursion by Leivant [5], restricted
lambda-calculi by Leivant & Marion [6], light linear logic by
Girard [7] and Lafont [8], linear types by Hofmann [9], and
syntactically restricted induction [10], to mention a few.
Since Bell & La Padula [11] and Biba [12], secure informa-
tion flow uses a lattice of security levels to ensure confiden-
tiality and integrity. Each variable is assigned a security level.
The type system guarantees the security policy induced by the
lattice. An important property, called non-interference [13],
consists in demonstrating that values of high level variables
are independent from values of low level variables during a
program execution. The use of type systems in this context was
pioneered by Volpano, Smith and Irvine [14]. Type systems for
secure information flow were investigated extensively see e.g.
Sabelfeld and Myers survey [15].
Another important issue is declassification. Sometimes it is
necessary to release information, which is usually done by
downgrading the security level of variables. In the context
of integrity, declassification is also called endorsement. For a
comprehensive survey, see the article by Sabelfeld and Sands
[16] .
Related works
There are several works related to ICC on resource analysis
for imperative programming language. In [17] Jones charac-
terizes PTIME by means of simple constructor free programs.
Data flow analysis to bound variables growth rate is performed
by matrix calculus in Jones & Kristiansen [18], Niggl &
Wunderlich [19], and Ben-Amram, Jones & Kristiansen [20].
However the language is restricted to loops of fixed length,
and operators are successor-like functions. Finally, Marion &
P
´
echoux [21] extend interpretation methods [22] to object
oriented languages.
There are other recent approaches to compute resource
consumption bounds. Jost, Hammond, Loidl & Hofmann [23]
work on automatic amortized cost analysis using type systems,
which is related to the study of non-size increasing systems.
Hughes, Pareto & Sabry [24] propose sized types in order
to determine bound on data structure sizes. Albert, Alonso,
Arenas, Genaim, & Puebla [25] design cost analyser for
java byte codes. Lastly, the approach of Gulwani, Mehra &
Chilimbi [26] consists in automatically finding loop invariants
and is related to abstract interpretation methods.
Contributions
We present a type system for an imperative programming
language over words. Programs are built from while loops
and expressions are built from predicates, constructor and
destructor operators. To control the size of the information
flow, the type system is based on a complexity lattice. Each
variable is assigned a type, which is a pair of tiers, i.e.
elements of the complexity lattice. There is a declassification
mechanism, which allows applying safely operators inside
loops. We demonstrate that the type system is sound with
respect to a timed structural operational semantics. For this,
we establish first a non-interference result, which shows that
values of higher tier variables do not depend on values of lower
tier variables. Then, we show that a consequence is a theorem
of temporal non-interference: the length of loops depends
only on values of higher tier variables. Another consequence
is a weak polynomial time termination procedure. Finally,
we demonstrate that terminating and well-typed programs
are computable in polynomial time over the two tier lattice
({0, 1}, , 0). Conversely, each polynomial time function is
implemented by a well-typed program.
2011 26th Annual IEEE Symposium on Logic in Computer Science
1043-6871/11 $26.00 © 2011 IEEE
DOI 10.1109/LICS.2011.41
123