Compiling executable code into a less-trusted address space

a technology of executable code and address space, which is applied in the direction of memory address/allocation/relocation, multi-programming arrangements, instruments, etc., can solve the problems of application program development complicating various aspects of the above-mentioned security management approach, malicious parties can trick the jit compiler into generating harmful instructions that are executed, etc., to avoid security violations

US20080127142A1Inactive Publication Date: 2008-05-29MICROSOFT TECH LICENSING LLC
35 Cites 32 Cited by

Patent Information

Authority / Receiving Office
US · United States
Patent Type
Applications(United States)
Current Assignee / Owner
Publication Date
2008-05-29
Estimated Expiration
Not applicable · inactive patent

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

Unsafe application programs that implement managed code can be executed in a secure fashion. In particular, an operating system can be configured to execute an application program in user mode, but handle managed code compilation through a type-safe JIT compiler operating in kernel mode. The operating system can also designate a single memory location to be accessed through multiple address spaces with different permission sets. An application program operating in user mode can be executed in the read / execute address space, while the JIT compiler operates in a read / write address space. When encountering one or more pointers to intermediate language code, the application runtime can send one or more compilation requests to a kernel mode security component, which validates the requests. If validated, the JIT compiler will compile the requested intermediate language code, and the application program can access the compiled code from a shared memory heap.
Need to check novelty before this filing date? Find Prior Art

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] N / ABACKGROUND

[0002] 1. Background and Relevant Art

[0003] As computerized systems have increased in popularity, so have the various application programs used on the computerized systems. In particular, there are now a wide range of applications programs configured for any number of purposes, whether to function as complex operating systems, databases, and so forth, or as a simple calculator. In many cases, software developers will write new application programs with a particular operating system in mind, using any number of appropriate languages. Once the software is complete, the developer will compile the application into machine-executable code, which can then be installed on a computer system with the appropriate operating system.

[0004] One will appreciate, therefore, that there are a number of considerations that often must considered by developers of operating systems as well as of the individual application programs. Many of these inte...

Examples

Embodiment Construction

[0021]Implementations of the present invention extend to systems, methods, and computer program products configured to allow for the use of managed code in an operating system, where the managed code may not necessarily conform to any particular code standard. In one implementation, for example, an operating system provides access to a memory location in two different address spaces, and sets the permissions in the address spaces, such that the memory location is accessible with different permissions from the two different address spaces. In one implementation, a JIT compiler operating in one address space passes compiled code into a shared memory heap. Executable program code, in turn, accesses the compiled code from the memory heap, and executes it in the other memory address space.

[0022]As will be understood more fully herein, implementations of the present invention can provide a secure system without necessarily needing to verify that the generated code does not violate the sec...