Denotational cost semantics for functional languages with inductive types

Danner, Norman; Licata, Daniel R.; Ramyaa, Ramyaa

doi:10.1145/2858949.2784749

Cited by 15 publications

(16 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the past years, there has been increasing interest in supporting developers to statically reason about the resource usage of their code. There are different approaches to the problem that are based on type systems [30,37,18,15,27], abstract interpretation [25,5,16], recurrence relations [20,4,36], termination analysis [46,11,8,31], and other techniques [14,19]. Among the applications of this research we find the prevention of side channels that leak secret information [38,6,35], identification of complexity bugs [39], support of scheduling decisions [1], and help in profiling [26].…”

Section: Introductionmentioning

confidence: 99%

Work Analysis with Resource-Aware Session Types

Das

Hoffmann

Pfenning

2018

Proceedings of the 33rd Annual ACM/IEEE Symposium on Logic in Computer Science

View full text Add to dashboard Cite

While there exist several successful techniques for supporting programmers in deriving static resource bounds for sequential code, analyzing the resource usage of message-passing concurrent processes poses additional challenges. To meet these challenges, this article presents an analysis for statically deriving worst-case bounds on the total work performed by message-passing processes. To decompose interacting processes into components that can be analyzed in isolation, the analysis is based on novel resource-aware session types, which describe protocols and resource contracts for inter-process communication. A key innovation is that both messages and processes carry potential to share and amortize cost while communicating. To symbolically express resource usage in a setting without static data structures and intrinsic sizes, resource contracts describe bounds that are functions of interactions between processes. Resource-aware session types combine standard binary session types and type-based amortized resource analysis in a linear type system. This type system is formulated for a core session-type calculus of the language SILL and proved sound with respect to a multiset-based operational cost semantics that tracks the total number of messages that are exchanged in a system. The effectiveness of the analysis is demonstrated by analyzing standard examples from amortized analysis and the literature on session types and by a comparative performance analysis of different concurrent programs implementing the same interface. arXiv:1712.08310v2 [cs.PL] 27 Apr 2018components that can be analyzed in isolation. After all, the resource usage of each component crucially depends on its interactions with the world.In this paper, we study the foundations of worst-case resource analysis for message-passing processes. A key idea of our approach is to rely on resourceaware session types to describe structure, protocols, and resource bounds for inter-process communication that we can use to perform a compositional and precise amortized analysis. Session types [32,33,12,13,45] prescribe bidirectional communication protocols for message-passing processes. Binary session types govern the interaction of two processes along a single channel, prescribing complementary send and receive actions for the processes at the two endpoints of a channel. We use such protocols as the basis of resource usage contracts that not only specify the type but also the potential of a message that is sent along a channel. The potential (in the sense of classic amortized analysis [43]) may be spent sending other messages as part of the network of interacting processes, or maintained locally for future interactions. Resource analysis is static, using the type system, and the runtime behavior of programs is not affected.

show abstract

Section: Introductionmentioning

confidence: 99%

Work Analysis with Resource-Aware Session Types

Das

Hoffmann

Pfenning

2018

Proceedings of the 33rd Annual ACM/IEEE Symposium on Logic in Computer Science

View full text Add to dashboard Cite

show abstract

“…The obtained size-change information forms the basis for the computation of actual bounds on loop iterations and recursion depths; using counter instrumentation [26], ranking functions [2,4,10,58], recurrence relations [1,3], and abstract interpretation itself [13,72]. Automatic resource analysis techniques for functional programs are based on sized types [66], recurrence relations [16], term-rewriting [5], and amortized resource analysis [31,34,37,57]. There exist several tools that can automatically derive loop and recursion bounds for imperative programs including SPEED [26,27], KoAT [10], PUBS [1], Rank [4], ABC [7] and LOOPUS [58,72].…”

Section: Related Workmentioning

confidence: 99%

Resource-guided program synthesis

Knoth

Wang

Polikarpova

et al. 2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

This article presents resource-guided synthesis, a technique for synthesizing recursive programs that satisfy both a functional specification and a symbolic resource bound. The technique is type-directed and rests upon a novel type system that combines polymorphic refinement types with potential annotations of automatic amortized resource analysis. The type system enables efficient constraint-based type checking and can express precise refinement-based resource bounds. The proof of type soundness shows that synthesized programs are correct by construction. By tightly integrating program exploration and type checking, the synthesizer can leverage the user-provided resource bound to guide the search, eagerly rejecting incomplete programs that consume too many resources. An implementation in the resource-guided synthesizer ReSyn is used to evaluate the technique on a range of recursive data structure manipulations. The experiments show that ReSyn synthesizes programs that are asymptotically more efficient than those generated by a resource-agnostic synthesizer. Moreover, synthesis with ReSyn is faster than a naive combination of synthesis and resource analysis. ReSyn is also able to generate implementations that have a constant resource consumption for fixed input sizes, which can be used to mitigate side-channel attacks.

show abstract

“…The focus on upper bounds is shared with automatic resource analysis techniques that are based on sized types [61], [62], linear dependent types [63], [64], and other type systems [65], [66], [67]. Similarly, semiautomatic analyses [68], [69], [70], [71] focus on upper bounds too.…”

Section: Related Workmentioning

confidence: 99%

Verifying and Synthesizing Constant-Resource Implementations with Types

Ngo

Dehesa-Azuara

Fredrikson

et al. 2017

2017 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Abstract-Side channel attacks have been used to extract critical data such as encryption keys and confidential user data in a variety of adversarial settings. In practice, this threat is addressed by adhering to a constant-time programming discipline, which imposes strict constraints on the way in which programs are written. This introduces an additional hurdle for programmers faced with the already difficult task of writing secure code, highlighting the need for solutions that give the same source-level guarantees while supporting more natural programming models.We propose a novel type system for verifying that programs correctly implement constant-resource behavior. Our type system extends recent work on automatic amortized resource analysis (AARA), a set of techniques that automatically derive provable upper bounds on the resource consumption of programs. We devise new techniques that build on the potential method to achieve compositionality, precision, and automation.A strict global requirement that a program always maintains constant resource usage is too restrictive for most practical applications. It is sufficient to require that the program's resource behavior remain constant with respect to an attacker who is only allowed to observe part of the program's state and behavior. To account for this, our type system incorporates information flow tracking into its resource analysis. This allows our system to certify programs that need to violate the constanttime requirement in certain cases, as long as doing so does not leak confidential information to attackers. We formalize this guarantee by defining a new notion of resource-aware noninterference, and prove that our system enforces it.Finally, we show how our type inference algorithm can be used to synthesize a constant-time implementation from one that cannot be verified as secure, effectively repairing insecure programs automatically. We also show how a second novel AARA system that computes lower bounds on resource usage can be used to derive quantitative bounds on the amount of information that a program leaks through its resource use. We implemented each of these systems in Resource Aware ML, and show that it can be applied to verify constant-time behavior in a number of applications including encryption and decryption routines, database queries, and other resourceaware functionality.

show abstract

Denotational cost semantics for functional languages with inductive types

Cited by 15 publications

References 26 publications

Work Analysis with Resource-Aware Session Types

Work Analysis with Resource-Aware Session Types

Resource-guided program synthesis

Verifying and Synthesizing Constant-Resource Implementations with Types

Contact Info

Product

Resources

About