Safely executing an untrusted native code module on a computing device

Patent metadata

Field	Value
Publication number	US-9536079-B2
Application number	US-201514621550-A
Country	US
Kind code	B2
Filing date	Feb 13, 2015
Priority date	May 8, 2008
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

A system that safely executes a native code module on a computing device. During operation, the system receives the native code module, which is comprised of untrusted native program code expressed using native instructions in the instruction set architecture associated with the computing device. The system then loads the native code module into a secure runtime environment, and proceeds to execute a set of instructions from the native code module in the secure runtime environment. The secure runtime environment enforces code integrity, control flow integrity, and data integrity for the native code module. Furthermore, the secure runtime environment moderates which resources can be accessed by the native code module on the computing device and/or how these resources can be accessed. By executing the native code module in the secure runtime environment, the system facilitates achieving native code performance for untrusted program code without a significant risk of unwanted side effects.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium storing instructions that, when executed by a computer that has hardware implementing a particular instruction set architecture, cause the computer to perform a method comprising:
receiving, by an application of the computer that has hardware implementing a particular instruction set architecture, a native code module that includes untrusted binary code native instructions for the particular instruction set architecture;
validating, by a validator included in the application on the computer, the untrusted binary code native instructions in the native code module to determine whether to execute the untrusted binary code native instructions included in the native code module by:
performing a decoding traversal, by the validator on the computer, of all executable instructions in the native code module; and
determining, by the validator on the computer, that the decoded traversed executable instructions in the native code module a) are compliant with a plurality of security requirements for the particular instruction set architecture and b) can be executed; and

executing the untrusted binary code native instructions directly on the hardware of the computer and in a secure runtime environment that is included in the application (i) in response to determining that the decoded traversed executable instructions in the native code module a) are compliant with the plurality of security requirements for the particular instruction set architecture and b) can be executed and (ii) after validating the untrusted binary code native instructions.

2. The computer-readable storage medium of claim 1 , wherein executing the untrusted binary code native instructions in the secure runtime environment includes providing, by the secure runtime environment, to each of a plurality of client applications on the computer, respective interfaces for the native code module.

3. The computer-readable storage medium of claim 2 , wherein providing the respective interfaces includes exporting a respective list of invocable functions of the native code module to each of the plurality of client applications on the computer.

4. The computer-readable storage medium of claim 1 , wherein executing the untrusted binary code native instructions in the secure runtime environment comprises limiting data accesses by the native code module to a specific data segment for the native code module.

5. The computer-readable storage medium of claim 1 , wherein executing the untrusted binary code native instructions in the secure runtime environment ensuring that an address of a memory text region for the native code module starts at zero.

6. The computer-readable storage medium of claim 1 , wherein determining that the decoded traversed executable instructions in the native code module a) are compliant with the plurality of security requirements for the particular instruction set architecture and b) can be executed comprises:
determining that the decoded traversed executable instructions do not include restricted instructions from the particular instruction set architecture; and
determining that the decoded traversed executable instructions do not access restricted features of the computer.

7. The computer-readable storage medium of claim 6 , wherein determining that the decoded traversed executable instructions do not include restricted instructions from the particular instruction set architecture comprises determining that the decoded traversed executable instructions do not include indirect control flow instructions with a target in a memory region that is not valid for the native code module.

8. The computer-readable storage medium of claim 1 , wherein determining that the decoded traversed executable instructions in the native code module a) are compliant with the plurality of security requirements for the particular instruction set architecture and b) can be executed comprises:
determining that the untrusted binary code instructions are laid out in a region of a memory of the computer so that, for each byte boundary that satisfies an alignment granularity condition within the region of the memory, a native instruction is aligned on the byte boundary; and
determining that a respective target of each control flow instruction in the untrusted binary code instructions is an address on a byte boundary that satisfies the alignment granularity condition within the region of the memory.

9. The computer-readable storage medium of claim 1 , wherein determining that the decoded traversed executable instructions in the native code module a) are compliant with the plurality of security requirements for the particular instruction set architecture and b) can be executed comprises:
determining that indirect control flow instructions in the native code module do not include return instructions, far call instructions, or far jump instructions;
determining that call instructions and jump instructions in the native code module use relative addressing; and
determining that register indirect call instructions and register indirect jump instructions are encoded in a sequence of instructions of the native code module so that, during execution of the native code module, control flow targets valid instruction addresses within the native code module.

10. The computer-readable storage medium of claim 1 , wherein performing the decoding traversal, by the validator on the computer, of all executable instructions in the native code module comprises:
performing a decoding traversal, by the validator on the computer, of all executable instructions in the native code module using a sequential traversal of the untrusted binary code native instructions that starts at a base address of the native code module.

11. The computer-readable storage medium of claim 1 , the method comprising:
modifying, before validating, one or more code sequences in the native code module to enable runtime enforcement of control-flow integrity in compliance with the plurality of security requirements for the particular instruction set architecture.

12. The computer-readable storage medium of claim 11 , wherein modifying the one or more code sequences in the native code module to enable runtime enforcement of control-flow integrity in compliance with the plurality of security requirements for the particular instruction set architecture comprises inserting a set of trampoline instructions into a lowest portion of a memory text region for the native code module to allow the native code module to access trusted routines or trusted services on the computer using the trampoline instructions.

13. The computer-readable storage medium of claim 1 , the method comprising:
loading, by the application, a plug-in that includes as software components the validator, and the secure runtime environment.

14. A system comprising:
a computer having hardware implementing a particular instruction set architecture; and
one or more storage devices storing instructions that are operable, when executed by the computer, to cause the computer to perform operations comprising:
receiving, by an application of the computer, a native code module that includes untrusted binary code native instructions for the particular instruction set architecture;
validating, by a validator included in the application on the computer, the untrusted binary code native instructions in the native code module to determine whether to execute the untrusted binary code native instructions included in the native code module by:
performing a decoding traversal, by the validator on the computer, of all executable inst

Assignees

• Google Inc

Inventors

• Chen J Bradley
• Harren Matthew T
• Papakipos Matthew
• Sehr David C
• Yee Bennet S
• Dardyk Gregory

Classifications

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F9/30174

  for non-native instruction set, e.g. Javabyte, legacy code · CPC title

• G06F9/44589

  Program code verification, e.g. Java bytecode verification, proof-carrying code (high-level semantic checks G06F8/43; prevention of errors by analysis, debugging or testing of software G06F11/36) · CPC title

• G06F2221/033

  Test or assess software · CPC title