Control of data access by dynamically verifying legal references

• US 20070168313A1
• Filed: 12/16/2004
• Published: 07/19/2007
• Est. Priority Date: 12/30/2003
• Status: Active Grant

• Current Assignee: Trusted Logic (Thales SA)
• Original Assignee: Trusted Logic (Thales SA)
• Inventors: Leroy, Xavier, Marlet, Renaud, Hameau, Patrice, Regnault, Nicolas
• Granted Patent: US 8,321,668 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system

Abstract

The inventive method for controlling access to data which is used by reference in a program execution system (including processes and aims) during the program execution consists in memorising by the system the totality of references obtainable by said program with the aid of means considered legal, before any operation which can be prohibited if it relates to values which are not legal references, in verifying by the system whether said values are amongst the legal references memorised for the program and in accepting or rejecting the operation, respectively.

Claims

1. A method for controlling access to data handled by references in a system for executing programs (including processes and tasks), wherein upon executing a program, it comprises the following steps:

having the system store the whole of the references which the program obtains by means considered as licit;

before any operation intended to be forbidden, if it deals with values which are not licit references, having the system check that these values are among the licit references which have been stored for this program, and acceptance or rejection of the operation accordingly.

2. The method according to claim 1, wherein the references are pointers and/or handles.

3. The method according to claim 1, wherein the licit means for a program in order to obtain reference values comprise at least one of the following operations:

reading a variable or a datum belonging to the system or to another program,

writing into a variable or datum of said program by the system or by another program,

receiving arguments upon calling a routine of said program by the system or by another program,

utilization of the return value from the call by said program of a routine belonging to the system or to another program,

having said program catch up a raised exception during execution of a routine belonging to the system or to another program,

receiving by said program an interruption or a valuated signal.

4. The method according to claim 1, wherein:

the system comprises a mechanism which determines whether a given value is a valid reference, and/or

the stored licit references are limited to the sole references on data considered as sensitive for the system, and/or

said checks check that the values are among the sensitive licit references which were stored for this program or else which are references determined as valid and dealing with data which are not sensitive.

5. The method according to claim 4, wherein the system comprises a firewall which forbids certain operations by certain programs on certain referenced data, data considered as being sensitive for the system being those for which the operations are not forbidden by the firewall.

6. The method according to claim 5, wherein the firewall forbids certain operations by a program on data belonging to other programs, except on those declared as shareable.

7. The method according to claim 6, wherein the system is based on a Java Card virtual machine and wherein:

a program consists of the whole of the code which is found in a “

Java Card package”

;

the firewall is that of the Java Card Runtime Environment (JCRE);

the data declared as shareable (and therefore sensitive) are objects which are instances of classes which implement the “

Javacard.framework.Shareable”

interface as well as, possibly, the objects with public use of the system;

global arrays and Entry Point Objects of JCRE.

8. The method according to claim 7, wherein the system stores in sets of sensitive licit references associated with a package all the references which appear in the following cases:

receiving arguments of “

Javacard.framework.Shareable”

type when a method of said package is called by another package or by the system,

“

Javacard.framework.Shareable”

type return value when said package calls a method from another package or from the system (including the a “

getAppletSharreableInterfaceObject”

method of “

Javac ard.framework.JCSystem package”

),

reading a public static field of “

Javacard.framework.Shareable”

type in another package or in the system,

catching up an instance object of a class from (inheriting from) “

java.lang.Throwable” and

implementing “

Javacard.framework.Shareable”

.

9. The method according to claim 1, wherein the whole of the licit stored references is represented by a table.

10. The method according to claim 1, wherein the set of the licit stored references is emptied, by means of a possibly conservative garbage collector, of references which have become inactive.

11. The method according to claim 1, wherein:

the references are represented in the system by handles and tables of pointers,

some of said tables are possibly reserved for licit references,

the sets of licit stored references are represented by vectors of bits associated with some of the tables of pointers, where a bit has a given index which represents the presence or the absence of the corresponding reference in said sets,

said vectors of bits are possibly hollow and represented by means of a sequence of indexes or lengths corresponding to the extents of bits positioned in the same way.