US6070239A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for executing verifiable programs with facility for using non-verifiable programs from trusted sources
Assignee: Sun Microsystems Inc
•
Filing: 1997-11-17
•
Granted: 2000-05-30
•
Expires: 2017-11-17
Abstract
Abstract A computer system includes a program executer that executes verifiable architecture neutral programs and a class loader that prohibits the loading and execution of non-verifiable programs unless (A) the non-verifiable program resides in a trusted repository of such programs, or (B) the non-verifiable program is indirectly verifiable by way of a digital signature on the non-verifiable program that proves the program was produced by a trusted source. In the preferred embodiment, verifiable architecture neutral programs are Java bytecode programs whose integrity is verified using a Java bytecode program verifier. The non-verifiable programs are generally architecture specific compiled programs generated with the assistance of a compiler. Each architecture specific program typically includes two signatures, including one by the compiling party and one by the compiler. Each digital signature includes a signing party identifier and an encrypted message. The encrypted message includes a message generated by a predefined procedure, and is encrypted using a private encryption key associated with the signing party. A digital signature verifier used by the class loader includes logic for processing each digital signature by obtaining a public key associated with the signing party, decrypting the encrypted message of the digital signature with that public key so as generate a decrypted message, generating a test message by executing the predefined procedure on the architecture specific program associated with the digital signature, comparing the test message with the decrypted message, and issuing a failure signal if the decrypted message digest and test message digest do not match.
Inventors
- 👤 Charles E. McManis
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 05:01
CPC Classifications
G; G06; G06F; G06F15/00; G06F15/16; G06F21/00; G06F21/50; G06F21/52; G06F9/00; G06F9/06; G06F9/44; G06F9/445; G06F2211/00; G06F2211/007
Claims Analysis
Total Claims: 16
Claim 1
Independent Claim
156 words
A method of operating a computer system, comprising the steps of: accessing trusted and untrusted object classes; the object classes each including at least one program, each program comprising a program selected from the group consisting of (A) architecture neutral programs written in an architecture neutral language and (B) architecture specific programs written in an architecture specific language; when execution of any program in an object class is requested, and the requested object class has not yet been loaded, loading the requested object class into an address space for execution unless loading of the requested object class is prevented by a security violation, including preventing the loading of any requested object class, other than any of the trusted object classes, that includes at least one architecture specific program unless every architecture specific program in the requested object class is associated with a digital signature and the digital signature is successfully verified by a digital signature verifier.
Claim 2
Independent Claim
156 words
A method of operating a computer system, comprising the steps of: accessing trusted and untrusted object classes; the object classes each including at least one program, each program comprising a program selected from the group consisting of (A) architecture neutral programs written in an architecture neutral language and (B) architecture specific programs written in an architecture specific language; when execution of any program in an object class is requested, and the requested object class has not yet been loaded, loading the requested object class into an address space for execution unless loading of the requested object class is prevented by a security violation, including preventing the loading of any requested object class, other than any of the trusted object classes, that includes at least one architecture specific program unless every architecture specific program in the requested object class is associated with a digital signature and the digital signature is successfully verified by a digital signature verifier.
Claim 3
Dependent Claim
87 words
The method of claim 1, the object class loading step including (A) verifying the integrity of every architecture neutral program in the requested object class when the requested object class is not stored in the trusted object class repository and includes at least one architecture neutral program, and (B) and preventing the loading of the requested object class, unless the requested object class is in the trusted object class repository, when the requested object class includes at least one architecture neutral program whose integrity is not verified.
Claim 4
Dependent Claim
82 words
The method of claim 2, the object class loading step including enabling execution of the requested program by an architecture neutral program executer when the requested program is an architecture neutral program and loading of the requested object class is not prevented by a security violation, and enabling execution of the requested program by an architecture specific program executer when the requested program is an architecture specific program and loading of the requested object class is not prevented by a security violation.
Claim 5
Dependent Claim
183 words
A computer comprising: a program integrity verifier that verifies that programs written in an architecture neutral language satisfy predefined program integrity criteria; a digital signature verifier that verifies digital signatures associated with programs; memory for storing trusted and untrusted object classes; the object classes each including at least one program, each program comprising a program selected from the group consisting of (A) architecture neutral programs written in the architecture neutral language and (B) architecture specific programs written in an architecture specific language whose integrity cannot be verified by the program integrity verifier; and a class loader that loads a specified one of the object classes into an address space for execution when execution of any program in the one object class is requested, the class loader including program security logic for preventing the loading of any requested object class, other than any of the trusted object classes, that includes at least one architecture specific program unless every architecture specific program in the requested object class is associated with a digital signature and the digital signature is successfully verified by the digital signature verifier.
Claim 6
Dependent Claim
183 words
A computer comprising: a program integrity verifier that verifies that programs written in an architecture neutral language satisfy predefined program integrity criteria; a digital signature verifier that verifies digital signatures associated with programs; memory for storing trusted and untrusted object classes; the object classes each including at least one program, each program comprising a program selected from the group consisting of (A) architecture neutral programs written in the architecture neutral language and (B) architecture specific programs written in an architecture specific language whose integrity cannot be verified by the program integrity verifier; and a class loader that loads a specified one of the object classes into an address space for execution when execution of any program in the one object class is requested, the class loader including program security logic for preventing the loading of any requested object class, other than any of the trusted object classes, that includes at least one architecture specific program unless every architecture specific program in the requested object class is associated with a digital signature and the digital signature is successfully verified by the digital signature verifier.
Claim 7
Dependent Claim
100 words
The computer of claim 4, wherein the class loader includes verifier logic for invoking the program integrity verifier to verify the integrity of every architecture neutral program in the requested object class when the requested object class is not stored in the trusted object class repository and includes at least one architecture neutral program; the program security logic further preventing the loading of the any requested object class other than object classes in the trusted object class repository when the requested object class includes at least one architecture neutral program whose integrity is not verified by the program integrity verifier.
Claim 8
Dependent Claim
83 words
The computer of claim 5, wherein the class loader further enables execution of the requested program by an architecture neutral program executer when the requested program is an architecture neutral program and loading of the requested object class is rot prevented by the program security logic, and enables execution of the requested program by an architecture specific program executer when the requested program is an architecture specific program and loading of the requested object class is not prevented by the program security logic.
Claim 9
Dependent Claim
217 words
A computer program product for use in conjunction with a computer system, the computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism comprising: a program integrity verifier that verifies that programs written in an architecture neutral language satisfy predefined program integrity criteria; a digital signature verifier that verifies digital signatures associated with programs; and a class loader that loads trusted and untrusted object classes; wherein the object classes each include at least one program, each program comprising a program selected from the group consisting of (A) architecture neutral programs written in the architecture neutral language and (B) architecture specific programs written in an architecture specific language whose integrity cannot be verified by the program integrity verifier; and the class loader loads a specified one of the object classes into an address space for execution when execution of any program in the one object class is requested, the class loader including program security logic for preventing the loading of any requested object class, other than any of the trusted object classes, that includes at least one architecture specific program unless every architecture specific program in the requested object class is associated with a digital signature and the digital signature is successfully verified by the digital signature verifier.
Claim 10
Dependent Claim
217 words
A computer program product for use in conjunction with a computer system, the computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism comprising: a program integrity verifier that verifies that programs written in an architecture neutral language satisfy predefined program integrity criteria; a digital signature verifier that verifies digital signatures associated with programs; and a class loader that loads trusted and untrusted object classes; wherein the object classes each include at least one program, each program comprising a program selected from the group consisting of (A) architecture neutral programs written in the architecture neutral language and (B) architecture specific programs written in an architecture specific language whose integrity cannot be verified by the program integrity verifier; and the class loader loads a specified one of the object classes into an address space for execution when execution of any program in the one object class is requested, the class loader including program security logic for preventing the loading of any requested object class, other than any of the trusted object classes, that includes at least one architecture specific program unless every architecture specific program in the requested object class is associated with a digital signature and the digital signature is successfully verified by the digital signature verifier.
Claim 11
Dependent Claim
102 words
The computer program product of claim 7, wherein the class loader includes verifier logic for invoking the program integrity verifier to verify the integrity of every architecture neutral program in the requested object class when the requested object class is not stored in the trusted object class repository and includes at least one architecture neutral program; the program security logic further preventing the loading of the any requested object class other than object classes in the trusted object class repository when the requested object class includes at least one architecture neutral program whose integrity is not verified by the program integrity verifier.
Claim 12
Dependent Claim
85 words
The computer program product of claim 8, wherein the class loader further enables execution of the requested program by an architecture neutral program executer when the requested program is an architecture neutral program and loading of the requested object class is not prevented by the program security logic, and enables execution of the requested program by an architecture specific program executer when the requested program is an architecture specific program and loading of the requested object class is not prevented by the program security logic.
Claim 13
Independent Claim
145 words
A method of operating a computer system, comprising the steps of: accessing trusted and untrusted object classes; the object classes each including at least one program, each program comprising a program selected from the group consisting of (A) architecture neutral programs written in an architecture neutral language and (B) architecture specific programs written in an architecture specific language; and when execution of any program in an object class is requested, and the requested object class has not yet been loaded, loading the requested object class into an address space for execution unless loading of the requested object class is prevented by a security violation, including preventing the loading of any requested object class, other than any of the trusted object classes, that includes at least one architecture specific program unless the requested object class passes a predefined authenticity test performed by an authenticity test procedure.
Claim 14
Independent Claim
145 words
A method of operating a computer system, comprising the steps of: accessing trusted and untrusted object classes; the object classes each including at least one program, each program comprising a program selected from the group consisting of (A) architecture neutral programs written in an architecture neutral language and (B) architecture specific programs written in an architecture specific language; and when execution of any program in an object class is requested, and the requested object class has not yet been loaded, loading the requested object class into an address space for execution unless loading of the requested object class is prevented by a security violation, including preventing the loading of any requested object class, other than any of the trusted object classes, that includes at least one architecture specific program unless the requested object class passes a predefined authenticity test performed by an authenticity test procedure.
Claim 15
Dependent Claim
87 words
The method of claim 10, the object class loading step including (A) verifying the integrity of every architecture neutral program in the requested object class when the requested object class is not stored in the trusted object class repository and includes at least one architecture neutral program, and (B) and preventing the loading of the requested object class, unless the requested object class is in the trusted object class repository, when the requested object class includes at least one architecture neutral program whose integrity is not verified.
Claim 16
Dependent Claim
82 words
The method of claim 10, the object class loading step including enabling execution of the requested program by an architecture neutral program executer when the requested program is an architecture neutral program and loading of the requested object class is not prevented by a security violation, and enabling execution of the requested program by an architecture specific program executer when the requested program is an architecture specific program and loading of the requested object class is not prevented by a security violation.
References Cited (Backward Citations)
US5224160A
Cited
US4926476A
Cited
US5504814A
Cited
US5421006A
Cited
US5479509A
Cited
US5475753A
Cited
US5559884A
Cited
US5692047A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-05-30 | 2003-11-29 | 2004-05-30 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-05-30 | 2007-11-29 | 2008-05-30 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-05-30 | 2011-11-29 | 2012-05-30 | $7700.00 | Window Closed / Lapsed |