Method for Validating an Untrusted Native Code Module

Abstract

A system that validates a native code module. During operation, the system receives a native code module comprised of untrusted native program code. The system validates the native code module by: (1) determining that code in the native code module does not include any restricted instructions and/or does not access restricted features of a computing device; and (2) determining that the instructions in the native code module are aligned along byte boundaries such that a specified set of byte boundaries always contain a valid instruction and control flow instructions have valid targets. The system allows successfully-validated native code modules to execute, and rejects native code modules that fail validation. By validating the native code module, the system facilitates safely executing the native code module in the secure runtime environment on the computing device, thereby achieving native code performance for untrusted program binaries without significant risk of unwanted side effects.

What is claimed is: 
     
         1 . A computer-implemented method for securing execution of code, the computer-implemented method comprising:
 monitoring, by a computing device, a native code module for an occurrence of a security event while the native code module is running, the security event indicating a bug in the native code module;   detecting, by the computing device, the occurrence of the security event; and   in response to the detecting, performing, by the computing device, one or more procedures to render the security event harmless.   
     
     
         2 . The computer-implemented method of  claim 1 , further comprising:
 receiving, by the computing device, the native code module, wherein the native code module includes a set of program instructions that match an instruction set architecture of the computing device;   loading the native code module into a memory of the computing device; and   identifying, by the computing device, a set of validation criteria that are to ensure safe execution of the native code module on the computing device, wherein the set of validation criteria is specific to the instruction set architecture of the computing device.   
     
     
         3 . The computer-implemented method of  claim 2 , further comprising:
 determining, by the computing device, after the native code module has been loaded into the memory of the computing device but before the native code module is executed on the computing device, (1) whether the native code module complies with the set of validation criteria that are to ensure safe execution of the native code module on the computing device, and (2) that a set of instructions in the native code module are aligned along byte boundaries such that a specified set of byte boundaries always contain a valid instruction and a set of control flow instructions in the native code module have valid targets; and   in response to determining that the native code module complies with the set of validation criteria and that the set of instructions in the native code module are aligned along the byte boundaries, executing the native code module on the computing device.   
     
     
         4 . The computer-implemented method of  claim 1 , wherein the security event is at least one of an infinite loop, the native code module attempts to allocate excessive amounts of memory, data output by the native code module that does not follow a valid format, or existence of at least one covert channel. 
     
     
         5 . The computer-implemented method of  claim 4 , further comprising using a loop timer to stop execution of the native code module when the security event is an infinite loop. 
     
     
         6 . The computer-implemented method of  claim 4 , further comprising using a memory limit and tracking system when the security event is the native code module attempts to allocate excessive amounts of memory. 
     
     
         7 . The computer-implemented method of  claim 4 , further comprising using data integrity checkers when the security event is a data output by the native code module that does not follow a valid format. 
     
     
         8 . The computer-implemented method of  claim 4 , further comprising applying techniques that eliminate or reduce bandwidth of at least one covert channel when the security event is an existence of the at least one covert channel. 
     
     
         9 . The computer-implemented method of  claim 8 , wherein the techniques include allowing the native module to only access a low-precision hardware timer to prevent the native code module from finely synchronizing a set of covert actions intended to convey information to external parties. 
     
     
         10 . The computer-implemented method of  claim 1 , wherein the native code module is configured to communicate with one or more other native code modules and external applications using shared memory buffers managed by a service runtime. 
     
     
         11 . The computer-implemented method of  claim 10 , further comprising providing an abstraction for memory handles used to access the shared memory buffers. 
     
     
         12 . The computer-implemented method of  claim 11 , further comprising translating the memory handles to addresses. 
     
     
         13 . The computer-implemented method of  claim 10 , wherein the native code modules and the external applications are multi-threaded, the computer-implemented method further comprising using mutexes to ensure safe concurrent access to shared memory buffers and prevent data races. 
     
     
         14 . The computer-implemented method of  claim 10 , further comprising the native code module implementing a message loop that receives at least one of messages or requests from the external applications or the service runtime using the shared memory buffers. 
     
     
         15 . The computer-implemented method of  claim 14 , further comprising the native code module receives messages or requests from the external applications that include handles referring to the shared memory buffers. 
     
     
         16 . A computing device, comprising:
 a processor; and   a non-transitory computer-readable medium having instructions stored thereon that, when executed by the processor, cause the processor to perform operations comprising:   monitoring a native code module for an occurrence of a security event while the native code module is running, the security event indicating a bug in the native code module,   detecting the occurrence of the security event; and   in response to the detecting, performing one or more procedures to render the security event harmless.   
     
     
         17 . The computing device of  claim 16 , wherein the security event is at least one of an infinite loop, the native code module attempts to allocate excessive amounts of memory, data output by the native code module that does not follow a valid format, or existence of at least one covert channel. 
     
     
         18 . The computing device of  claim 17 , wherein the operations performed by the processor further comprise using a loop timer to stop execution of the native code module when the security event is the infinite loop. 
     
     
         19 . The computing device of  claim 17 , wherein the operations performed by the processor further comprise using a memory limit and tracking system when the security event is the native code module attempts to allocate excessive amounts of memory. 
     
     
         20 . The computing device of  claim 17 , wherein the operations performed by the processor further comprise using data integrity checkers when the security event is the data output by the native code module that does not follow a valid format.