METHOD AND DEVICE FOR VERIFICATION OF CODE MODULE IN VIRTUAL MACHINE

• US 20080209556A1
• Filed: 01/18/2008
• Published: 08/28/2008
• Est. Priority Date: 01/19/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wood, David Alvra, Fu, Rong Yao, Long, Hai Tao, Tracey, William J.
• Granted Patent: US 8,356,351 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/44589 Program code verification, e.g. Java bytecode verification, proof-carrying code high-level semantic checks G06F8/43; testing and debugging software G06F11/36

Abstract

A method for pre-verification of a code module when the code module is installed or updated in a virtual machine, comprising: loading codes in the installed or updated code module; performing code verification on the codes in the code module; if the code verification is passed, generating a certificate of the code module; and storing the code module passing the code verification and its certificate. The present invention also discloses a method for verification of a code module at runtime of the code module in a virtual machine, comprising loading codes in the code module; generating a certificate of the code module based on the loaded codes; if the generated certificate of the code module and a pre-stored certificate of the code module are identical, verifying the code module to be valid; otherwise performing a pre-verification on the code module.

Claims

1. A method for pre-verification of a code module when the code module is installed or updated in a virtual machine, comprising:

loading codes in the installed or updated code module;

performing code verification on the codes in the code module;

if the code verification is passed, generating a certificate of the code module; and

storing the code module which passes the code verification and its certificate.

2. The method of claim 1, further comprising:

before the step of performing the code verification, resolving dependencies between the code module and other code modules; and

wherein the step of performing the code verification performs the code verification on the code module and its dependent code modules.

3. The method of claim 1, wherein the step of performing the code verification comprises at least one of the following steps:

checking grammar of the codes;

checking semantics of the codes;

checking type-safety of the codes; and

checking linkage of the codes.

4. The method of claim 1, wherein the step of generating the certificate comprises:

generating a digest for the code module as the certificate of the code module.

5. The method of claim 4, wherein the step of generating the certificate further comprises encrypting the generated digest.

6. The method of claim 1, wherein the storing step comprises:

storing the code module which passes the code verification and its certificate separately; and

storing association information between the certificate and the corresponding code module.

7. The method of claim 1 wherein the storing step comprises:

storing the code module which passes the code verification, wherein the certificate is written into a code file of the code module as a property of the code module.

8. A method for verification of a code module at runtime of the code module in a virtual machine, comprising the steps of:

loading codes in the code module;

generating a certificate of the code module based on the loaded codes;

if the generated certificate of the code module and a pre-stored certificate of the code module are identical, verifying the code module to be valid; and

if the generated certificate of the code module and the pre-stored certificate of the code module are not identical, pre-verifying the code module using the method for pre-verification of a code module when the code module is installed or updated in a virtual machine by the steps of;

loading codes in the code module;

performing code verification on the codes in the code module;

if the code verification is passed, generating a certificate of the code module; and

storing the code module which passes the code verification and its certificate

9. The method of claim 8 further comprising the step of running the code module if the code module is verified to be valid.

10. A device for pre-verification of a code module when the code module is installed or updated in a virtual machine, comprising:

a loader for loading codes in the code module;

a code verifier for performing code verification on the codes in the code module;

a certificate generator for generating a certificate of the code module which passes the code verification; and

a memory for storing the code module which passes the code verification and its certificate.

11. The device of claim 10, further comprising:

a resolver for resolving dependencies between the code module and other code modules; and

wherein the code verifier performs the code verification on the code module and its dependent code modules.

12. The device of claim 10, wherein the code verifier comprises at least one of the following units:

a grammar check unit for checking grammar of the codes;

a semantics check unit for checking semantics of the codes;

a type-safety check unit for checking type-safety security of the codes; and

a linkage check unit for checking linkage of the codes.

13. The device of claim 10, wherein the certificate generator comprises:

a digest generation unit for generating a digest for the code module as the certificate of the code module.

14. The device of claim 13, wherein the certificate generator further comprises:

an encryption unit for encrypting the digest generated by the digest generation unit.

15. The device of claim 10 further comprising:

a rewrite unit for writing the certificate into a code file of the code module as a property of the code module.

16. The device of claim 10, wherein the memory comprises:

a module storage unit for storing the code module which passes the code verification;

a certificate storage unit for storing the certificate of the code module which passes the code verification; and

an association information storage unit for storing association information between the certificate and the corresponding code module.

17. A device for verification of a code module at runtime of the code module in a virtual machine, comprising:

a device for pre-verification of a code module when the code module is installed or updated in a virtual machine comprising;

a loader for loading codes in the code module;

a code verifier for performing code verification on the codes in the code module;

a certificate generator for generating a certificate of the code module which passes the code verification; and

a memory for storing the code module which passes the code verification and its certificate; and

a certificate verifier for verifying a certificate of the code module generated by the certificate generator according to a certificate of the code module obtained from the memory;

wherein when the certificate verifier verifies the code module to be invalid, the code verifier performs the code verification on the codes in the code module.

18. A virtual machine for running a code module, comprising:

a device for verification of a code module at runtime of the code module in a virtual machine a device for pre-verification of a code module when the code module is installed or updated in a virtual machine comprising;

a loader for loading codes in the code module;

a code verifier for performing code verification on the codes in the code module;

a certificate generator for generating a certificate of the code module which passes the code verification; and

a memory for storing the code module which passes the code verification and its certificate; and

a certificate verifier for verifying a certificate of the code module generated by the certificate generator according to a certificate of the code module obtained from the memory;

wherein when the certificate verifier verifies the code module to be invalid, the code verifier performs the code verification on the codes in the code module; and

a processing component for running the code module only when the device verifies the code module to be valid.

19. A program product embodied in a computer readable medium and comprising computer program code for perform method steps for a method for pre-verification of a code module when the code module is installed or updated in a virtual machine, wherein said method comprises:

loading codes in the installed or updated code module;

performing code verification on the codes in the code module;

if the code verification is passed, generating a certificate of the code module; and

storing the code module which passes the code verification and its certificate.