Verification of un-trusted code for consumption on an insecure device

• US 8,196,213 B2
• Filed: 07/11/2008
• Issued: 06/05/2012
• Est. Priority Date: 07/11/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Klucher, Michael, Bleisch, Paul L., Brown, Joerg Raymound, Unoki, Robert S.
• Primary Examiner(s): Simitoski, Michael
• Assistant Examiner(s): MOHAMMADI, FAHIMEH M
• Application Number:
  US12/171,936
• Publication Number:
  US 20100011446A1
• Time in Patent Office: 1,425 Days
• Field of Search: 726/27, 718/1, 719328-331
• US Class Current: 726/27
• CPC Class Codes: G06F 21/1064 Restricting content processing at operating system level
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

Disclosed is a code verification service that detects malformed data in an automated process and rejects submission and distribution if any malicious code is found. Once the submission is verified it may be packaged in container. The container may then be deployed to a mobile device, and the public key may be used to verify that the container authentic. The device can load trusted managed libraries needed to execute the application and a manager can ensure that only trusted libraries access native resources of the device.

Claims

1. A computer readable storage medium excluding signals including computer executable instructions for securing a computing device, the computer readable storage medium comprising:

instructions for validating, by a title player effectuated by native instructions, a digital signature of a manager and a digital signature of a managed library;

instructions for granting, to the managed library, access to native functions of an operating system in response to validating a first digital certificate associated with the managed library; and

instructions for denying, by the manager, an attempt by a managed application to access a native function of the operating system in response to determining that a second digital certificate associated with the managed application indicates that the managed application is required to access native functions of the operating system through the managed library.

2. The computer readable storage medium of claim 1, wherein the managed library comprises instructions generated by a trusted developer.

3. The computer readable storage medium of claim 1, further comprising:

instructions for verifying a digital signature associated with a container that includes the managed application; and

instructions for loading the managed application.

4. The computer readable storage medium of claim 1, wherein the native functions of the operating system are accessed through instructions for a runtime host, further wherein the instructions for the runtime host are effectuated by native instructions.

5. The computer readable storage medium of claim 1, further comprising:

instructions for verifying a digital signature associated with the managed library; and

instructions for loading the managed library.

6. The computer readable storage medium of claim 1, wherein the managed application includes instructions verified by a remote device, further wherein the verified instructions are type safe.

7. A method for protecting a closed computing device from executing un-trusted instructions, the method comprising:

validating, by a title player effectuated by native instructions, a digital signature of a manager and a digital signature of a managed library;

receiving, by the manager, a request from a managed application to access a native system resource through the managed library;

authorizing, by the manager, the request to access the native system resource through the managed library, wherein the manager includes information that identifies managed libraries that the managed application is authorized to access, further wherein the manager is effectuated by native instructions;

authorizing, by the manager, the request to access the native system resource by the managed library, wherein information that identifies that the managed library is authorized to access the native system resource was obtained from a digital certificate associated with the managed library;

sending, by the managed library, a request to access the native system resource to a runtime host, wherein the runtime host is effectuated by native instructions; and

accessing, by the runtime host, the native system resource.

8. The method of claim 7, wherein the native system resource is accessed from a platform invoke.

9. The method of claim 7, further comprising:

determining, by the manager, that the managed application is permitted to access a premium native system resource, wherein information that identifies that the managed application is permitted to access the premium native system resource was obtained from a premium certificate associated with the managed application.

10. The method of claim 7, wherein the managed application is stored in a container that includes a digital signature.

11. The method of claim 7, further comprising:

validating, by the title player, a digital signature associated with the runtime host; and

executing the runtime host.

12. The method of claim 7, further comprising:

validating, by the title player, a digital signature associated with the manager; and

executing the manager.

13. The method of claim 7, further comprising:

loading, by the title player, the managed application;

determining, by the title player, that the managed application is un-trusted; and

denying, by the manager, the managed application access to native system resources.

14. The method of claim 9, further comprising:

transmitting the container to a remote mobile device.

15. The method of claim 9, wherein the managed application includes instructions verified by a service provider, further wherein the verified instructions are type safe instructions.

16. A computer system for publishing videogames configured to execute on a mobile device, the system comprising:

a processor; and

a memory coupled to the processor, the memory including instructions that upon execution cause the computer system to;

validate, by a native executable that is configured to launch executables and host them within the native executable, a digital signature of a manager and a digital signature of a managed library;

receive a package from a networked computer system;

identify a package executable in the package;

verify managed metadata associated with the package executable, wherein the managed metadata describes the structure of package executable, further wherein verifying the managed metadata includes inspecting the managed metadata at runtime to determine that the executable includes type safe code;

store the verified executable in a digitally signed container;

authorize, by the manager, a request by the package executable to access a native system resource through the managed library, wherein the manager includes information that identifies managed libraries that the managed application is authorized to access, further wherein the manager is effectuated by native instructions.

17. The system of claim 16, wherein the memory further includes instructions that upon execution cause the computer system to:

transmit the digitally signed container to a mobile device.

18. The system of claim 16, wherein the memory further includes instructions that upon execution cause the computer system to:

determine that the executable in the file includes managed dependencies.

19. The system of claim 16, wherein the memory further includes instructions that upon execution cause the computer system to:

validate header fields of the executable.