Method and apparatus for improving security of Java sandbox
AssigneeAlibaba Group Holding Limited
InventorsXuefeng Li, Yanbing Zhang
Life of this patent
Estimating the term…
Abstract
A method and apparatus for improving security of a Java sandbox is provided. The method includes performing a permission check on a to-be-checked code, determining whether a method bypassing the permission check exists in a call stack of the code, and if a method bypassing the permission check exists, determining whether methods in the call stack have a signature. The method also includes determining that the to-be-checked code has a security problem if the methods have no signature.
Claims10
A method for improving security of a Java sandbox, comprising:
- performing a permission check on a to-be-checked code;
- determining whether a method bypassing the permission check exists in a call stack of the code;
- in response to the method bypassing the permission check existing, determining whether methods in the call stack have a signature;
- and
- processing the to-be-checked code based on the determination whether the methods in the call stack have the signature, wherein processing the to-be-checked code comprises:
- in response to a determination that methods in the call stack have the signature, determining whether a depth of a method corresponding to the signature is greater than a depth of a privileged method, and
- in response to a determination that the depth of the method corresponding to the signature is not greater than the depth of the privileged method, determining that the to-be-checked code has a security problem,
- wherein processing the to-be-checked code further comprises:
- acquiring preset calling information from a policy file in response to the methods having the signature,
- determining whether calling information of the methods in the call stack is the same as the preset calling information, and
- determining that the to-be-checked code has a security problem in response to the calling information of the methods in the call stack not being the same as the preset calling sequence.
A non-transitory computer-readable medium storing a set of one or more instructions that is executable by one or more processors of a computer system to perform a method comprising:
- performing a permission check on a to-be-checked code;
- determining whether a method bypassing the permission check exists in a call stack of the code;
- in response to the method bypassing the permission check existing, determining whether methods in the call stack have a signature;
- and
- processing the to-be-checked code based on the determination whether the methods in the call stack have the signature, wherein processing the to-be-checked code comprises:
- in response to a determination that methods in the call stack have the signature, determining whether a depth of a method corresponding to the signature is greater than a depth of a privileged method, and
- in response to a determination that the depth of the method corresponding to the signature is not greater than the depth of the privileged method, determining that the to-be-checked code has a security problem,
- wherein processing the to-be-checked code further comprises:
- acquiring preset calling information from a policy file in response to the methods having the signature,
- determining whether calling information of the methods in the call stack is the same as the preset calling information, and
- determining that the to-be-checked code has a security problem in response to the calling information of the methods in the call stack not being the same as the preset calling sequence.
Dependencies are inferred from the claim text.