# US 11,030,306 B2 · Method for executing a program intended to be interpreted by a virtual machine protected against fault injection attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,306 B2 - Document ID: US11030306B2 - Status: Granted - Kind: B2 - Application number: 15/957,855 - Filed: 2018-04-19 - Published: 2018-10-25 - Granted: 2021-06-08 - Earliest claimed: 2017-04-20 - Assignees: Idemia Identity & Security France - Applicants: Idemia Identity & Security France - Inventors: Ahmadou Sere; Karim Madjid Ammouche - Web page: https://patentgrep.com/patent/US11030306B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 8/61: Installation - G06F 9/30058: {Conditional branch instructions} - G06F 9/323: {for indirect branch instructions} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 16/2365: {Ensuring data consistency and integrity} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 12/1441: {for a range} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2212/151: Emulated environment, e.g. virtual machine - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present invention particularly concerns a method for executing a program (P) intended to be interpreted by a virtual machine (M), the method comprising steps of determination (102) of a reference code instruction to be interpreted when executing the program, interpretation (112) by the virtual machine of the reference code instruction using machine code. This method also comprises read-out (106) of interpretation rights data (DR) indicating a portion (P1) of the program containing code instructions interpretable by the virtual machine and, on the basis of read-out data, checking the presence (110) of the reference code instruction in the portion (P1) of the program (P), the interpretation of the reference code instruction being implemented by the virtual machine (M) only if the reference code instruction is contained in the portion (P1) of the program (P). ## Claims ### Claim 1 A method comprising: in an electronic device comprising a hardware processor that executes a virtual machine stored in a non-volatile memory, receiving, by the virtual machine, a command to execute a target program; when executing the target program, the virtual machine determines a reference code instruction intended to be interpreted using machine code, reading interpretation rights data (DR) of the target program indicating a portion (P1) of the target program containing code instructions allowed to be interpreted by the virtual machine, wherein the portion of the target program has a range of addresses defining the portion within the target program, from the read interpretation rights data, checking if the reference code instruction has an address within the range of addresses, and interpreting, by the virtual machine, the reference code instruction using machine code executed by the hardware processor, only if the address of the reference code instruction is within the range of addresses, to prevent the virtual machine from interpreting code instructions outside the range of addresses, wherein when the reference code instruction is not within the range of addresses, signaling an error indicating a security exception by the virtual machine. ### Claim 2 (depends on 1) The method according to claim 1, wherein the checking is repeated for each reference code instruction determined as having to be interpreted when executing the target program. ### Claim 3 (depends on 1) The method according to claim 1, comprising verifying at least one condition which may or may not be met by the reference code instruction, and wherein the checking is carried out only if the condition is met. ### Claim 4 (depends on 3) The method according to claim 3, wherein the condition is met whenever: the reference code instruction is a jump instruction from a first basic program block to another basic program block, including a branch instruction, a method invoke instruction or a method return instruction, or the reference code instruction is a write instruction, or the target program being executed in an electronic device, the reference code instruction takes part in communication of data between the electronic device and another device. ### Claim 5 (depends on 1) The method according to claim 1, wherein the checking is or is not carried out depending on a result of a random draw. ### Claim 6 (depends on 1) The method according to claim 1, comprising steps of: reading, in the interpretation rights data (DR), location data adapted to locate the portion of the target program, reading, in the interpretation rights data (DR), an integrity datum relating to the location data, checking integrity of the location data from the integrity datum, wherein the reference code instruction is interpreted only if it is determined at the integrity check that the location data are intact. ### Claim 7 (depends on 1) The method according to claim 1, and wherein the checking is carried out by a circuit which is different from the hardware processor. ### Claim 8 (depends on 1) A non-transitory computer-readable medium comprising a virtual machine (M), the virtual machine (M) comprising program code instructions to execute the steps of the method according to claim 1, when the method is executed by said hardware processor. ### Claim 9 (depends on 8) An electronic device, comprising: a non-transitory computer-readable medium according to claim 8, the hardware processor configured to execute the virtual machine (M). ### Claim 10 A method for generating a program (P) to be interpreted by a virtual machine (M), said virtual machine stored in a non-volatile memory, wherein the method comprises: generating a target program portion (P1) containing code instructions interpretable by the virtual machine (M) using machine code, wherein the target program portion (P1) has a range of addresses defining the portion within the target program (P); generating interpretation rights data of the target program configured to indicate to the virtual machine (M) that only the code instructions contained in the target program portion (P1) are allowed to be interpreted by the virtual machine using machine code executed by a hardware processor to execute the target program (P), to prevent the virtual machine from interpreting code instructions including the reference code instruction outside the range of addresses, wherein when the reference code instruction is not within range of addresses, signaling an error indicating a security exception by the virtual machine. ### Claim 11 A non-transitory computer-readable medium comprising a target program to be interpreted by a virtual machine (M), the target program comprising: a target program portion (P1) containing code instructions including a reference code instruction interpretable by the virtual machine (M), wherein the target program portion (P1) has a range of addresses defining the portion within the target program, interpretation rights data (DR) of the target program configured to indicate to the virtual machine (M) that only the code instructions contained in the portion (P1) of the target program are allowed to be interpreted by the virtual machine (M) using machine code executed by a hardware processor to execute the target program only if the address of the reference code instruction is within the range of addresses, to prevent the virtual machine from interpreting malicious code instructions outside the portion of the target program, wherein when the reference code instruction is not within range of addresses, an error is generated indicating a security exception by the virtual machine. ### Claim 12 (depends on 11) The non-transitory computer-readable medium according to claim 11, wherein the interpretation rights data (DR) comprise: location data adapted to locate the portion within the target program, and an integrity datum relating to the location data of the program portion. ### Claim 13 (depends on 11) The non-transitory computer-readable medium according to claim 11, of Java Card applet type, wherein the portion of the program is a component of the applet and is of “method component” type.