Method for validating an untrusted native code module

Patent metadata

Field	Value
Publication number	US-9710654-B2
Application number	US-201615172879-A
Country	US
Kind code	B2
Filing date	Jun 3, 2016
Priority date	May 8, 2008
Publication date	Jul 18, 2017
Grant date	Jul 18, 2017

Abstract

A system that validates a native code module. During operation, the system receives a native code module comprised of untrusted native program code. The system validates the native code module by: (1) determining that code in the native code module does not include any restricted instructions and/or does not access restricted features of a computing device; and (2) determining that the instructions in the native code module are aligned along byte boundaries such that a specified set of byte boundaries always contain a valid instruction and control flow instructions have valid targets. The system allows successfully-validated native code modules to execute, and rejects native code modules that fail validation. By validating the native code module, the system facilitates safely executing the native code module in the secure runtime environment on the computing device, thereby achieving native code performance for untrusted program binaries without significant risk of unwanted side effects.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, by a computing device, executable code for a native code module, wherein the executable code includes a set of instructions that match an instruction set architecture of the computing device, wherein the set of instructions specifies operations to perform on program data associated with the native code module;
loading, by the computing device, (i) the program data into a first region of a memory segment of the computing device and (ii) the executable code into a second region of the memory segment that is different from the first region,
wherein the computing device is configured to restrict the native code module from accessing data stored outside of the first region of the memory segment,
wherein the computing device is configured to restrict the native code module from transferring control to instructions stored outside of the second region of the memory segment;

in response to loading the executable code into the second region of the memory segment, determining, by the computing device, whether the native code module complies with a set of security constraints; and
in response to determining that the native code module complies with the set of security constraints, executing the native code module with the computing device.

2. The computer-implemented method of claim 1 , wherein:
the native code module is an untrusted web-based application that is configured to be run in a web browser on the computing device; and
executing the native code module comprises running the untrusted web-based application in a secure runtime environment of the web browser on the computing device.

3. The computer-implemented method of claim 1 , comprising allocating, in the first region of the memory segment of the computing device, (i) a first range of addresses for storing at least one of thread or heap data, and (ii) a second range of addresses for storing stack data,
wherein loading the program data into the first region of the memory segment comprises loading the program data into memory corresponding to the first or second ranges of addresses.

4. The computer-implemented method of claim 1 , comprising allocating, in the second region of the memory segment of the computing device, (i) a first range of addresses for storing the executable code for the native code module and (ii) a second range of addresses for storing trampoline instructions that are configured, when executed, to interact with a limited set of runtime resources of the computing device outside of the memory segment, wherein the computing device is configured to restrict the native code module from interacting with the limited set of runtime resources except indirectly via the trampoline instructions in the second range of addresses.

5. The computer-implemented method of claim 4 , wherein the trampoline instructions include instructions that would be deemed illegal if included in the executable code for the native code module, wherein the trampoline instructions are configured, when executed, to transfer control flow out of the native code module to particular runtime resources of the computing device or to communicate messages between the native code module and particular runtime resources of the computing device.

6. The computer-implemented method of claim 4 , comprising padding the second region of the memory segment of the computing device so that a size of the second region of the memory segment is an even power of two.

7. The computer-implemented method of claim 4 , wherein the trampoline instructions include instructions that, when executed, cause the computing device to trigger a stack switch.

8. The computer-implemented method of claim 1 , wherein determining whether the native code module complies with the set of security constraints comprises determining whether the set of instructions of the executable code for the native code module includes instructions in a specified list of restricted instructions.

9. The computer-implemented method of claim 1 , wherein determining whether the native code module complies with the set of security constraints comprises determining whether instructions in the set of instructions of the executable code for the native code module are aligned in the memory segment along a specified set of byte boundaries.

10. The computer-implemented method of claim 1 , wherein determining whether the native code module complies with the set of security constraints comprises:
determining a set of valid control-flow targets that occur in the executable code and a set of known control-flow targets that occur in the executable code; and
verifying that each target address identified in the set of known control-flow targets is among the set of valid control-flow targets.

11. A non-transitory computer-readable storage medium having instructions stored thereon that, when executed by one or more processors of a computing device, cause the one or more processors to perform operations comprising:
receiving, by a computing device, executable code for a native code module, wherein the executable code includes a set of instructions that match an instruction set architecture of the computing device, wherein the set of instructions specifies operations to perform on program data associated with the native code module;
loading, by the computing device, (i) the program data into a first region of a memory segment of the computing device and (ii) the executable code into a second region of the memory segment that is different from the first region,
wherein the computing device is configured to restrict the native code module from accessing data stored outside of the first region of the memory segment,
wherein the computing device is configured to restrict the native code module from transferring control to instructions stored outside of the second region of the memory segment;

in response to loading the executable code into the second region of the memory segment, determining, by the computing device, whether the native code module complies with a set of security constraints; and
in response to determining that the native code module complies with the set of security constraints, executing the native code module with the computing device.

12. The non-transitory computer-readable storage medium of claim 11 , wherein:
the native code module is an untrusted web-based application that is configured to be run in a web browser on the computing device; and
executing the native code module comprises running the untrusted web-based application in a secure runtime environment of the web browser on the computing device.

13. The non-transitory computer-readable storage medium of claim 11 , wherein the operations comprise allocating, in the first region of the memory segment of the computing device, (i) a first range of addresses for storing at least one of thread or heap data, and (ii) a second range of addresses for storing stack data,
wherein loading the program data into the first region of the memory segment comprises loading the program data into memory corresponding to the first or second ranges of addresses.

14. The non-transitory computer-readable storage medium of claim 11 , wherein the operations comprise allocating, in the second region of the memory segment of the computing device, (i) a first range of addresses for storing the executable code for the native code module and (ii) a second range of addresses for storing trampoline instructions that are configured, when executed, to interact with a limited set of runtime resources of the computing device outside of the memory segment, where

Assignees

• Google Inc

Inventors

• Chen J Bradley
• Harren Matthew T
• Papakipos Matthew
• Sehr David C
• Yee Bennet S

Classifications

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title