Caching untrusted modules for module-by-module verification
AssigneeSun Microsystems, Inc.
InventorsTimothy G. Lindholm, Gilad Bracha, Sheng Liang
Life of this patent
Estimating the term…
Abstract
A method, computer program, signal transmission and apparatus for trusted verification of instructions in a module of a computer program first determine whether a suspect module to be loaded is from an untrusted source, such as on the internet. If from an untrusted source, the suspect module is loaded and one-module-at-a-time pre-verification is performed on the suspect module before linking. If the suspect module passes such pre-verification, the module is stored in a cache.
Claims49
A method for trusted verification of instructions in a module of a computer program, one-module-at-a-time, the method comprising:
- determining whether checking an instruction in a first module requires information in a referenced module different than the first module;
- and
- if the information is required, writing a constraint for the referenced module without requiring access to the referenced module and digitally signing the written constraint.
A method for trusted verification of instructions in a module of a computer program, the method comprising:
- determining whether a suspect module to be loaded is from an untrusted source;
- loading the suspect module and performing one-module-at-a-time pre-verification on the suspect module before linking based on a determination that the suspect module is from an untrusted source, wherein the pre-verification comprises determining whether an instruction in the suspect module requires information in a referenced module different than the suspect module, writing a pre-verification constraint for the referenced module in a trusted cache without requiring access to the referenced module based on a determination that the information is required, and checking the instruction assuming the pre-verification constraint is met;
- and
- storing the suspect module in a trusted cache if the suspect module passes the pre-verification .
A method for trusted verification of instructions in a module of a computer program during linking, the method comprising:
- determining whether a first module has passed pre-verification one-module-at-a-time;
- if the first module has passed pre-verification, determining whether results are trusted;
- if the results are trusted, reading a pre-verification constraint on a constrained module, if any;
- if any pre-verification constraint, determining if the constrained module is loaded;
- and
- if the constrained module is loaded, enforcing the pre-verification constraint.
A computer program product for trusted verification of instructions in a module of a computer program, one-module-at-a-time, the computer program product comprising:
- a computer readable storage medium;
- and
- computer controlling commands, stored on the computer readable storage medium, for determining whether checking an instruction in a first module requires information in a referenced module different than the first module, and, if the information is required, writing a constraint for the referenced module without requiring access to the referenced module and digitally signing the written constraint.
A computer program product for trusted verification of instructions in a module of a computer program, the computer program product comprising:
- a computer readable storage medium;
- and
- computer controlling commands, stored on the computer readable storage medium for determining whether a suspect module to be loaded is from an untrusted source;
- for loading the suspect module and performing one-module-at-a-time pre-verification on the suspect module before linking based on a determination that the suspect module is from an untrusted source, wherein the pre-verification comprises determining whether an instruction in the suspect module requires information in a referenced module different than the suspect module, writing a pre-verification constraint for the referenced module in a trusted cache without requiring access to the referenced module based on a determination that the information is required, and checking the instruction assuming the pre-verification constraint is met;
- and for storing said module in a trusted cache if the suspect module passes the pre-verification.
A computer program product for trusted verification of instructions in a module of a computer program during linking, the computer program product comprising:
- a computer readable storage medium;
- and
- computer controlling commands, stored on the computer readable storage medium for determining whether a first module has passed pre-verification one-module-at-a-time, for determining whether results are trusted based on a determination that the first module has passed pre-verification, for reading a pre-verification constraint on a constrained module, if any, based on a determination that the results are trusted, for determining whether the constrained module is loaded if any pre-verification constraint is read, for enforcing the pre-verification constraint based on a determination that the constrained module is loaded, and for loading the constrained module and enforcing the pre-verification constraint based on a determination that the constrained module is not loaded.
A trusted pre-verifier apparatus for trusted verification of instructions in a module of a computer program, one-module-at-a-time, the apparatus comprising:
- a computer readable storage medium for storing a module of a computer program;
- a memory into which a module is loaded;
- and
- a processor configured to determine whether checking an instruction in a first module requires information in a referenced module different than the first module, and, if the information is required, to write a constraint for the referenced module without requiring access to the referenced module and digitally sign the written constraint.
A trusted verifier apparatus for trusted verification of instructions in a module of a computer program, the trusted verifier comprising:
- a computer readable storage medium for storing a module of a computer program;
- a memory into which a module is loaded;
- and
- a processor configured to determine whether a suspect module to be loaded is from an untrusted source;
- to load the suspect module and perform one-module-at-a-time pre-verification on the suspect module before linking based on a determination that the suspect module is from an untrusted source, wherein the pre-verification comprises determining whether an instruction in the suspect module requires information in a referenced module different than the suspect module, writing a pre-verification constraint for the referenced module in a trusted cache without requiring access to the referenced module based on a determination that the information is required, and checking the instruction assuming the pre-verification constraint is met;
- and to store said module in a trusted cache if the suspect module passes the pre-verification.
A dynamic linking apparatus for trusted verification of a module during dynamic linking, the apparatus comprising:
- a computer readable storage medium for storing a module of a computer program;
- a memory into which a module is loaded;
- and
- a processor configured to determine whether a first module has passed pre-verification one-module-at-a-time, to determine whether results are trusted based on a determination that the first module has passed pre-verification, to read a pre-verification constraint on a constrained module, if any, based on a determination that the results are trusted, to determine whether the constrained module is loaded based on a determination that any pre-verification constraint is read, to enforce the pre-verification constraint based on a determination that the constrained module is loaded, and to load the constrained module and enforce the pre-verification constraint based on a determination that the constrained module is not loaded.
A signal transmission comprising:
- a carrier wave on a communications line;
- and
- signals indicative of computer controlling commands, transmitted using the carrier wave, for determining whether checking an instruction in a first module requires information in a referenced module different than the first module, and, if the information is required, writing a constraint for the referenced module without requiring access to the referenced module and digitally signing the written constraint.
A signal transmission comprising:
- a carrier wave on a communications line:
- and
- signals indicative of computer controlling commands, transmitted using the carrier wave, for determining whether a suspect module to be loaded is from an untrusted source;
- for loading the suspect module and performing one-module-at-a-time pre-verification on the suspect module before linking based on a determination that the suspect module is from an untrusted source, wherein the pre-verification comprises determining whether an instruction in the suspect module requires information in a referenced module different than the suspect module, writing a pre-verification constraint for the referenced module in a trusted cache without requiring access to the referenced module based on a determination that the information is required, and checking the instruction assuming the pre-verification constraint is met;
- and for storing said module in a trusted cache if the suspect module passes the pre-verification.
A signal transmission comprising:
- a carrier wave on a communications line:
- and
- signals indicative of computer controlling commands, transmitted using the carrier wave, for determining whether a first module has passed pre-verification one-module-at-a-time, for determining whether results are trusted based on a determination that the first module has passed pre-verification, for reading a pre-verification constraint on a constrained module, if any, based on a determination that the results are trusted, for determining whether the constrained module is loaded if any pre-verification constraint is read, for enforcing the pre-verification constraint based on a determination that the constrained module is loaded, and for loading the constrained module and enforcing the pre-verification constraint based on a determination that the constrained module is not loaded.
A trusted pre-verification system comprising:
- a network;
- a computer readable storage medium connected to the network for storing a module of a computer program;
- a trusted cache connected to the network for storing modules and constraints under the control of a single processor;
- a memory connected to the network into which a module is loaded;
- a processor connected to the network configured to determine whether a suspect module to be loaded is from an untrusted source, and, if from an untrusted source, to load the suspect module and perform one-module-at-a-time pre-verification on the suspect module before linking, and, to store said module in a trusted cache if the suspect module passes said pre-verification;
- a processor connected to the network configured to perform said one-module-at-a-time pre-verification by determining whether checking an instruction in the suspect module requires information in a referenced module different than the suspect module, and by writing a constraint for the referenced module in the trusted cache without requiring access to the referenced module based on a determination that the information is required;
- and
- a processor connected to the network configured to determine whether a first module has passed pre-verification one-module-at-a-time;
- to determine whether results are trusted if the first module has passed pre-verification, to read a pre-verification constraint on a constrained module, if any, if the results are trusted, to determine whether the constrained module is loaded if any pre-verification constraint is read, and to enforce the pre-verification constraint if the constrained module is loaded,
- whereby verification is performed one-module-at-a-time before linking with reduced verification during linking.
A computer-readable medium bearing information for use by one or more processors that are participating in verification of at least two modules, the information comprising a constraint on a second module and a digital signature, said information written in response to pre-verification of a first module, wherein the pre-verification comprises determining whether checking an instruction in the first module requires information in the second module, and writing the constraint on the second module without requiring access to the second module and digitally signing the constraint based on a determination that the first module required the information in the second module.
A signal transmission on a communications line bearing information for use by one or more processors that are participating in verification of at least two modules, the information comprising a constraint on a second module and a digital signature, said information written in response to pre-verification of a first module, wherein the pre-verification comprises determining whether checking an instruction in the first module requires information in the second module, and writing the constraint on the second module without requiring access to the second module and digitally signing the constraint based on a determination that the first module required the information in the second module.
A computer-readable medium bearing information for use by one or more processors that are participating in pre-verification of a first module, the information comprising an indication that the first module has been pre-verified and a digital signature, wherein the pre-verification comprises determining whether checking an instruction in the first module requires information in a second module different than the first module, and writing a constraint on the second module without requiring access to the second module and digitally signing the constraint based on a determination that the first module required the information in the second module.
A signal transmission on a communications line bearing information for use by one or more processors that are participating in pre-verification of a first module, the information comprising an indication that the first module has been pre-verified and a digital signature, wherein the pre-verification comprises determining whether checking an instruction in the first module requires information in a second module different than the first module, and writing a constraint on the second module without requiring access to the second module and digitally signing the constraint based on a determination that the first module required the information in the second module.
A method for linking modules of computer program instructions, the method comprising:
- receiving a first module with an indication that the first module has been pre-verified and a digital signature, wherein pre-verification of the first module comprises determining whether checking an instruction in the first module requires information in a second module different than the first module, and writing a constraint on the second module without requiring access to the second module and digitally signing the constraint based on a determination that the first module required the information in the second module;
- and
- executing instructions from the first module without performing intra-module checks after receiving the first module.
A method for trusted verification of instructions in a module of a computer program during linking, the method comprising:
- determining whether a first module has passed a one-module-at-a-time pre-verification;
- determining whether results are trusted based on a determination that the first module has passed the pre-verification;
- reading a pre-verification constraint on a constrained module, if any, based on a determination that the results are trusted;
- determining whether the constrained module is loaded based on a determination that any pre-verification constraint is read;
- enforcing the pre-verification constraint based on a determination that the constrained module is loaded;
- and
- retaining the pre-verification constraint as a verification constraint based on a determination that the constrained module is not loaded.
A computer program product for trusted verification of instructions in a module of a computer program during linking, the computer program product comprising:
- a computer readable storage medium;
- and
- computer controlling commands, stored on the computer readable storage medium for determining whether a first module has passed a one-module-at-a-time pre-verification, for determining whether results are trusted based on a determination that the first module has passed the pre-verification, for reading a pre-verification constraint on a constrained module, if any, based on a determination that the results are trusted, for determining whether the constrained module is loaded if any pre-verification constraint is read, for enforcing the pre-verification constraint based on a determination that the constrained module is loaded, and for retaining the pre-verification constraint as a verification constraint based on a determination that the constrained module is not loaded.
A dynamic linking apparatus for trusted verification of a module during dynamic linking, the apparatus comprising:
- a computer readable storage medium for storing a module of a computer program;
- a memory into which a module is loaded;
- and
- a processor configured to determine whether a first module has passed a one-module-at-a-time pre-verification, to determine whether results are trusted based on a determination that the first module has passed the pre-verification, to read a pre-verification constraint on a constrained module, if any, based on a determination that the results are trusted, to determine whether the constrained module is loaded based on a determination that any pre-verification constraint is read, to enforce the pre-verification constraint based on a determination that the constrained module is loaded, and to retain
- the pre-verification constraint as a verification constraint based on a determination that the constrained module is not loaded.
A signal transmission comprising:
- a carrier wave on a communications line:
- and
- signals indicative of computer controlling commands, transmitted using the carrier wave, for determining whether a first module has passed a one-module-at-a-time pre-verification, for determining whether results are trusted based on a determination that the first module has passed the pre-verification, for reading a pre-verification constraint on a constrained module, if any, based on a determination that the results are trusted, for determining whether the constrained module is loaded if any pre-verification constraint is read, for enforcing the pre-verification constraint based on a determination that the constrained module is loaded, and for retaining the pre-verification constraint as a verification constraint based on a determination that the constrained module is not loaded.
A method for trusted verification of instructions in a module of a computer program during linking, the method comprising:
- determining whether a first module has passed a one-module-at-a-time pre-verification;
- determining whether results are trusted based on a determination that the first module has passed the pre-verification;
- reading a pre-verification constraint on a constrained module, if any, based on a determination that the results are trusted;
- determining whether the constrained module is loaded based on a determination that any pre-verification constraint is read;
- enforcing the pre-verification constraint based on a determination that the constrained module is loaded;
- and
- loading the constrained module and enforcing the pre-verification constraint based on a determination that the constrained module is not loaded.
Dependencies are inferred from the claim text.