JP2007226277A - Method and apparatus for virtual machine alteration inspection - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a virtual machine that operates safely without applications being eavesdropped or altered by guaranteeing the normal operation of the virtual machine itself. <P>SOLUTION: Alteration inspection of the virtual machine is performed at predetermined timing at a safe execution part that cannot be altered. If alteration is detected, an application execution device is forcibly shut down. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  In a terminal device having a function of executing a program by a virtual machine method (particularly a Java (R) virtual machine), when executing a program downloaded from a medium outside the terminal such as the Internet or a DVD, It relates to preventing tampering.

  2. Description of the Related Art Conventional electronic devices such as digital TVs and mobile phones are increasingly equipped with functions for downloading and executing programs written in Java (R) language. For example, in mobile phones, NTT DoCoMo provides a service called i-appli. In this service, a mobile phone terminal downloads a Java program from an application distribution server on the Internet and executes it on the terminal. In Europe, a specification called DVB-MHP (Digital Video Broadcasting-Multimedia Home Platform) has been established, and operation based on the specification has already been started. In digital broadcasting based on the DVB-MHP standard, a digital TV receives a Java (R) program multiplexed on a broadcast wave and executes it.

  In such a program distribution service, the program to be distributed is protected by the intellectual property rights of the developer of the program, and it is necessary to prevent a malicious attacker from eavesdropping. In addition, programs that have been altered by malicious attackers must be prevented from performing unintended operations by users and application creators. In order to realize these, conventional electronic devices have the following functions.

  The encrypted program is downloaded and decrypted inside the terminal to prevent eavesdropping and tampering during communication.

  Using a hash function or the like, the program verifies whether or not the program has been tampered with at the time of download, thereby preventing execution of the tampered program.

  An example of a conventional method for inspecting falsification of a program is described in Patent Document 1. As shown in FIG. 2, this conventional method for inspecting the alteration of a program mainly includes a safety verification unit 201, a safe storage unit 202, and an execution unit 203.

The safety verification unit 201 verifies whether or not the downloaded program has been tampered with, and stores only the program that has been confirmed not to be tampered into the safe storage unit 202 that guarantees that the program cannot be rewritten by other units. The execution means 203 reads the program from a safe storage device and executes it. This ensures that the program executed by the execution unit 203 has not been tampered with.
JP 2001-195247 A

  However, in the conventional technology, it can be guaranteed that the program has not been tampered with before the program is executed, but it cannot be guaranteed that the program being executed will not be tampered with.

  Recent electronic devices are composed of a large number of software modules. Those who have specialized knowledge can also tamper with the software in the terminal by exploiting bugs in these software modules. The same can be realized by using a tool such as a debugger or an ICE (In-Circuit Emulator). Furthermore, when the environment for executing the program itself is realized by software, such as a virtual machine such as a Java (R) virtual machine, when using a debugger or ICE, the virtual machine being executed is broken. By setting points, it becomes possible to pause the operation of the virtual machine at an arbitrary timing, and wiretap and tamper with the memory used by the virtual machine. An application that is encrypted and distributed is also decrypted into plain text during execution. Therefore, if an attacker sets a breakpoint in the process of loading a class or executing a method in the virtual machine process, the attacker can access a plain text application.

  Therefore, the virtual machine and the downloaded program itself can be altered at the time of execution to make the behavior different from the original behavior. In particular, when the program includes a copyright management function and a billing function, there arises a problem that these functions can be invalidated. In the future, as the program distribution business using the Internet or the like becomes full-scale, the problem of such eavesdropping and falsification of the program is expected to become serious.

  Tamper resistant technology exists as a technology to prevent such attacks, but with conventional tamper resistant technology, the size of programs that can be protected is very small, and careful handling is required especially for key management and billing processing. It applies only to processing, and it is impossible to protect an entire huge program such as a virtual machine.

  In the present invention, a tampering inspection unit in a safe execution environment without fear of tampering inspects whether or not a virtual machine has been tampered with at a predetermined timing, and it is determined that the virtual machine has been tampered as a result of the inspection. In this case, the purpose is to provide a virtual machine that guarantees that the virtual machine itself operates normally by immediately stopping the execution of the application, and that operates safely without eavesdropping or tampering with the application.

  In order to solve the above-described conventional problems, the present invention includes a step of loading a virtual machine by a virtual machine loader executed by a secure execution unit that prevents eavesdropping and tampering by a third party, and the loaded virtual machine A step of notifying the tampering inspection unit executed by the secure execution unit, and a step of determining whether or not the tampering inspection unit has altered the address region of the virtual machine at a predetermined timing. And, as a result of the determination, when it is determined that the virtual machine has been tampered with, the tampering inspection unit immediately stops the execution of the virtual machine.

  As described above, according to the present invention, there is provided a method for inspecting tampering that occurs during execution of a virtual machine, and the virtual machine loader executed by a safe execution unit that prevents eavesdropping and tampering by a third party. A step of loading a machine, a step of notifying the tampering inspection unit executed by the secure execution unit of the address region of the loaded virtual machine, and the tampering inspection unit altering the address region of the virtual machine. Determining whether the virtual machine has been tampered with, and if the result of the determination is that the virtual machine has been tampered with, the tampering inspection unit immediately stops the execution of the virtual machine Including the step of causing the virtual machine to detect tampering during execution of the virtual machine and immediately terminate the operation of the virtual machine when tampering is detected. Kill.

  Further, the virtual machine loader further includes a step of decrypting the encrypted virtual machine, whereby the virtual machine stored in the terminal in an encrypted state can be loaded. As a result, it is possible to prevent the virtual machine from being analyzed by extracting the ROM in the terminal.

  Further, since the address area of the virtual machine is an area from the start address to the end address of the virtual machine, it becomes possible to detect any alteration in the virtual machine area.

  Further, the address area of the virtual machine is an area from the start address to the end address of the subprogram constituting the virtual machine, so that only the subprogram deeply related to the handling of bytecode can be inspected, The time required for tampering inspection can be shortened.

  In addition, immediately before the virtual machine performs a predetermined process, the virtual machine calls the falsification inspection unit and performs a falsification inspection, so that a falsification inspection is always performed when the virtual machine performs processing for handling bytecode. It becomes possible.

  In addition, since the predetermined process includes a class load process, it is possible to always perform a falsification inspection when the virtual machine performs the class load process.

  Further, since the predetermined process includes a method call process, it is possible to always perform a falsification inspection when the virtual machine performs the method call process.

  In addition, since the predetermined process includes a byte code verify process, it is possible to always perform a falsification inspection when the virtual machine performs the byte code verify process.

  In addition, since the predetermined process includes a JIT compilation process, a tampering inspection can always be performed when the virtual machine performs the JIT compilation process.

  In addition, the security attribute embedded or attached to the class file is read, and the predetermined processing is dynamically changed according to the security attribute, so that the tampering inspection is strengthened according to the security level required for the application being executed. Can be adjusted.

  In addition, by performing periodic alteration inspection of the virtual machine by the alteration inspection unit at a predetermined interval, it is possible to periodically inspect the alteration of the virtual machine regardless of the processing content of the virtual machine. Can do.

  By reading the security attributes embedded or attached to the class file and dynamically changing the predetermined interval according to the security attributes, the strength of the tampering inspection according to the security level required for the running application Can be adjusted.

  In addition, while the application running on the virtual machine is in an idle state, the tampering inspection of the virtual machine by the tampering inspection unit is temporarily stopped to stop the tampering inspection when the application is not operating. This can reduce wasteful power consumption.

  Also, a virtual machine loading unit that includes a software execution unit and a safe software execution unit that prevents eavesdropping and falsification by a third party, and is executed in the safe software execution unit and loads a virtual machine into the software execution unit And whether or not the virtual machine has been tampered with at a predetermined timing, and if it is determined that the virtual machine has been tampered with as a result of the inspection, the virtual machine is terminated. By providing the tampering inspection unit, it is possible to detect tampering during execution of the virtual machine, and immediately terminate the operation of the virtual machine when tampering is detected.

  In addition, since the secure execution unit is a software execution unit protected by a tamper resistance function in the virtual machine tampering inspection apparatus, it is possible to make it difficult to tamper with the tampering inspection unit itself.

  Further, since the safe execution unit is hardware built in the virtual machine alteration inspection device, the alteration inspection unit itself cannot be altered.

  In addition, since the secure execution unit is a smart card that can be attached to and detached from the virtual machine alteration inspection device, the alteration inspection unit itself cannot be altered.

  In addition, the tampering inspection unit is characterized in that when the virtual machine is determined to be tampered with, the virtual machine tampering inspection device is turned off to ensure that tampering is detected. The attacker's attack can be terminated.

  The tampering inspection unit restarts the virtual machine tampering inspection device when it is determined that the virtual machine has been tampered with. The attack can be terminated.

  Embodiments of the present invention will be described below with reference to the drawings.

(Embodiment 1)
An embodiment of a virtual machine tampering inspection apparatus according to the present invention will be described with reference to the drawings. In the present embodiment, a Java (R) application execution apparatus (referred to as an application execution apparatus) having a virtual machine tampering inspection function such as a Java (R) virtual machine will be described as an example.

  FIG. 1 is a block diagram showing the configuration of the application execution apparatus. The downloadable program 100 is an application program that can be downloaded from a Java (R) application execution device 110 (referred to as an application execution device 110), and specifically, an encrypted Java (R) application.

  The application execution device 110 is a terminal device, and includes an execution unit 120 and a safe execution unit 130. Specifically, the application execution apparatus corresponds to all electronic devices equipped with a Java (R) virtual machine such as a digital TV, a set top box, a DVD recorder, a BlueRay Disc (BD) recorder, a car navigation terminal, a mobile phone, and a PDA. .

  The execution unit 120 is the same as a program execution unit installed in a normal personal computer, digital home appliance, or the like, and includes an application acquisition program 121, a Java (R) virtual machine 122 (referred to as a virtual machine 122), and an OS 123. The first CPU 124, the first RAM 125, and the first ROM 126.

  The secure execution unit 130 is a program execution unit that can execute a program safely while preventing an attack from a malicious third party, and includes a tampering inspection unit 131, a Java (R) virtual machine loader 132 (virtual (Referred to as a machine loader 132), a second CPU 133, a second RAM 134, and a second ROM 135.

  The application acquisition program 121 is a Java (R) program that acquires an application from outside the terminal by an arbitrary method. The application acquisition program 121 corresponds to, for example, a Java (R) program that downloads a Java (R) application from a server on the Internet according to a protocol such as TLS (Transport Layer Security) or HTTP (Hypernet Transfer Protocol). TLS is a data transfer method that prevents data tapping and tampering during communication by encryption. Details of TLS are described in RFC 2246, and detailed description thereof is omitted here. HTTP is a data transfer method generally used in data communication on the Internet. Details of HTTP are described in RFC 2616, and detailed description thereof is omitted here.

  The application acquisition program 121 may be a Java (R) program that reads a Java (R) application embedded in an MPEG2 transport stream into a terminal as a digital broadcast data broadcast. Details of the MPEG2 transport stream are described in the MPEG standard document ISO / IEC13881-1, and the details are omitted in the present embodiment. A method for embedding a Java (R) program in an MPEG2 transport stream is described in the MPEG standard ISO / IEC138181-6 as a DSMCC method. Here, detailed description of DSMCC is omitted. The DSMCC method defines a method for encoding a file system composed of directories and files used in a computer in a packet of an MPEG2 transport stream.

  Further, the application acquisition program 121 may be a Java (R) program that reads a Java (R) application recorded on an SD card, a CD-ROM, a DVD, a BlueRay Disc, or the like into the first RAM 125.

  The application acquisition program 121 may be a Java (R) program that reads a Java (R) application recorded in the first ROM 126 in the application execution device 110 into the first RAM 125.

  In the present embodiment, the application acquisition program 121 is a Java (R) program written in the Java (R) language, but it is realized by a program written in a native language or hardware having an equivalent function. The present invention can be similarly implemented.

  The virtual machine 122 is a Java (R) virtual machine that sequentially analyzes and executes a program written in the Java (R) language. A program written in the Java (R) language is compiled into intermediate code called bytecode, which does not depend on hardware. The Java® virtual machine is software or hardware that interprets and executes this bytecode. In addition, some Java® virtual machines have a function called a JIT compiler that translates bytecode into an execution format that the first CPU 124 can understand. Some Java® virtual machines may be composed of a processor that can directly execute some or all of the bytecodes and an interpreter that executes bytecodes that cannot be directly executed by the processor. Details of the Java (R) language are described in many books such as the book "Java (R) Language Specification (ISBN 0-201-63451-1)". The details are omitted here. The virtual machine 122 is composed of a plurality of subprograms. FIG. 3 is an example of a subprogram constituting the virtual machine 122. In FIG. 3, a bytecode interpreter 301, a class loader 302, a verifier 303, a Java (R) heap management unit 304 (referred to as a heap management unit 304), a Java (R) native library 305 (referred to as a native library 305), a JIT A compiler 306 is used.

  The bytecode interpreter 301 is a subprogram that interprets and executes the bytecode loaded by the class loader 302, and is a subprogram that performs core processing in the Java (R) virtual machine.

  The class loader 302 receives the class file from the application acquisition program 121 and loads it into the virtual machine 122. The class file is a file including information such as a byte code, and is defined in the book “Java® Virtual Machine Specification (ISBN 0-201-63451-)”. The class loader 302 also performs class unload processing. The class unloading process is a process of removing from the Java (R) virtual machine 122 a class that has been executed and is no longer needed.

  The verifier 303 determines the deficiency of the data format of the class and the safety of the bytecode included in the class. Since the bytecode security inspection method is defined by Java (R) Virtual Machine Specification, detailed description thereof is omitted. The class loader 302 does not load a class determined to be invalid by the verifier 303.

  The heap management unit 304 secures a working memory used by the Java® application. A working memory is secured in the first RAM 125. The heap management unit 304 also performs garbage collection. Garbage collection is a well-known technique for releasing a working memory that is no longer necessary for executing an application so that it can be reused for other purposes, and will not be described in detail.

  The native library 305 is a library that is called from a Java (R) application, and functions provided by the OS 123 and hardware, subprograms, etc. that are not shown in FIG. To provide.

  The JIT compiler 306 translates the bytecode into an execution format that can be understood by the first CPU 124.

  The OS 123 is a subprogram that is activated by the first CPU 124 when the application execution apparatus 110 is powered on. The OS 123 is an abbreviation for an operating system, and Linux or the like is an example. The OS 123 is a generic name for known techniques including a kernel and a library that execute other subprograms in parallel, and detailed description thereof is omitted. The OS 123 executes the virtual machine 122 as a subprogram.

  The first CPU 124 executes a program acquired by the virtual machine 122, the OS 123, and the application acquisition unit 121.

  Specifically, the first RAM 125 includes a primary storage memory such as an SRAM or a DRAM, and is used for temporarily storing data when the first CPU 124 performs processing.

  Specifically, the first ROM 126 is configured by a nonvolatile memory such as a flash memory or a hard disk, and stores data and programs instructed from the first CPU 124. FIG. 4 shows an example of data stored in the first ROM 126 in the present embodiment. As shown in FIG. 4, the first ROM 126 includes an encrypted virtual machine 401, an encrypted application acquisition program 402, and an encrypted startup class name 403. The encrypted activation class name 403 is a class name of a program that is executed first when the virtual machine 122 is activated. In the present embodiment, it is assumed that the application acquisition program 121 is specified for the encryption activation class name 403. The first ROM 126 may store data other than that shown in FIG.

  The falsification inspection unit 131 inspects whether the virtual machine 122 has been falsified, and if it is determined that the virtual machine 122 has been falsified as a result of the inspection, the first CPU 124 causes the execution of the virtual machine 122 to stop. I do. The falsification inspection unit 131 will be described in detail later.

  The virtual machine loader 132 performs processing for making the virtual machine 122 executable by the first CPU 125 after the application execution device 110 is powered on. The virtual machine loader 132 will be described in detail later.

  The second CPU 133 executes the falsification inspection unit 131 and the virtual machine loader 132.

  The second RAM 134 is specifically composed of a DRAM, SRAM, or the like, and is used to temporarily store data when the second CPU 133 performs processing, and reads data stored in the second RAM 134 from other than the second CPU 133. Guarantees that neither can nor write. The second RAM 134 may be embedded in the CPU 133.

  The second ROM 135 is a read-only nonvolatile memory, and guarantees that data stored in the second ROM 135 cannot be read from other than the second CPU 133. FIG. 5 shows an example of data stored in the second ROM 135. The second ROM 135 is for decrypting the encrypted Java® virtual machine 401 (referred to as the virtual machine 401), the encrypted application acquisition program 402, and the encrypted startup class name 403 stored in the first ROM 126. The decryption key 501 and the hash value 502 are recorded. The hash value 502 is a value obtained by executing a hash function with the virtual machine 122 as an input. A hash function (also called a message digest function) is a function that generates a fixed-length pseudorandom number from an input original, and is a known technique. The hash value has a feature that the original text cannot be reproduced from the hash value, and it is extremely difficult to create different data having the same hash value. In this embodiment, the virtual machine, the application acquisition program, and the activation class name are decrypted by only one key 501, but the present invention can be implemented by using different keys for each. The second ROM 135 may store other data not shown in FIG.

  In the present embodiment, the application execution apparatus 110 includes two CPUs. However, one CPU may behave virtually like two CPUs by a method such as switching operation modes.

  The first RAM 125 and the second RAM 134 may treat one RAM virtually as two RAMs.

  The first ROM 126 and the second ROM 135 may treat one ROM virtually as two ROMs.

  The entire safe execution unit 130 may be realized by hardware. In this case, data communication between the first CPU 124 and the second CPU 133 is performed in an encrypted manner to prevent eavesdropping by a third party. This is performed by encrypting data when transmitting it to a data bus (not shown) connecting both CPUs, and decrypting the data after receiving it. The safe execution unit 130 may be a device that can be detached from the application execution device 110, such as a smart card or an IC card. Smart cards and IC cards are well-known technologies that include a CPU, memory, and security circuit inside the card, and will not be described in detail. In this case, data transfer between the execution unit 120 and the safe execution unit 130 is performed while preventing eavesdropping by a third party using a technique such as SAC (Secure Authenticated Channel). SAC is a known technique for securely performing mutual authentication between an IC card and an external device and sharing of an encryption key.

  Next, a description will be given of a tampering inspection function of the Java (R) virtual machine, which is a main function of the present invention.

  When the user turns on the power of the application execution device 110, the first CPU 124 activates the OS 123. After starting, the OS 123 instructs the second CPU 133 to start the virtual machine loader 132 through the first CPU 124. The virtual machine loader 132 activated by the second CPU 133 loads the virtual machine 122 onto the first RAM 125 according to the procedure shown in FIG. First, in step 601, the encrypted virtual machine 401, the encrypted application acquisition unit 402, and the encrypted startup class name 403 stored in the first ROM 126 are read through the second CPU 133. Next, in step 602, the decryption key 501 is obtained from the second ROM 135, and in step 603, decryption processing is performed. Then, the decrypted virtual machine and application acquisition program are stored in the first RAM 125 through the second CPU 133. (Step 604) At this time, the address range in which the Java (R) virtual machine is written is stored in the second RAM 134. FIG. 7 shows the address of the virtual machine 122 stored in the second RAM 134 and loaded onto the first RAM 125 by the virtual machine loader 132. The virtual machine 122 is loaded between addresses 040000000 and 04019ffff.

  Referring to FIG. 6, in step 605, the virtual machine loader 132 designates the range of addresses of the virtual machine 122 stored in the second RAM 134 and executes the falsification inspection unit 131 to determine whether or not the virtual machine 122 has been falsified. Confirm. FIG. 8 shows the processing contents of the falsification inspection unit 131.

  In step 801, the hash value of the virtual machine 122 is calculated based on the address range of the virtual machine 122 designated from the virtual machine loader 132. Next, in step 802, the correct hash value 502 of the virtual machine 122 stored in the second ROM 135 is read. Then, the two are compared (step 803), and if the two match as a result of the comparison, it is determined that the virtual machine 122 has not been tampered with, and the tampering inspection unit 131 ends successfully (step 804). However, if the comparison result does not match in step 803, it is determined that the virtual machine 122 has been tampered with, and the application execution apparatus 110 is powered off or restarted (step 805).

  With reference to FIG. 6, when the execution of the falsification inspection unit 131 is successfully completed in step 605, the loading of the virtual machine 122 is ended.

  The OS 123 receives the end of the virtual machine loader 132, designates the decrypted startup class name stored in the first RAM 125, and starts the execution of the virtual machine 122.

  The virtual machine 122 calls the falsification inspection unit 131 through the CPU 124 immediately before performing a predetermined process. As in the processing step 805 of the tampering inspection unit 131, when the virtual machine 122 is tampered with, the application execution device 110 is turned off or restarted, so that a malicious program such as a debugger is downloaded. It is possible to prevent eavesdropping on and tampering with other applications. Here, the predetermined process corresponds to, for example, a method calling process, a class loading process, a verifying process, and a JIT compiling process. In particular, it is preferable to perform this when reading the byte code from the first RAM 125.

  With the configuration as described in the above embodiment, when the virtual machine 122 is tampered with at the time of execution, the operation of the application execution apparatus 110 is immediately stopped. Therefore, the download Java (R) executed by the Java (R) virtual machine 122 is performed. ) It is possible to prevent the application from being tapped and tampered with.

  In this embodiment, the hash value of the entire virtual machine 122 is calculated and tampering is determined. However, it may be configured to calculate the hash value of some subprograms and perform tampering determination. The present invention can be implemented. In that case, the first ROM 126 stores the hash value 502 of the subprograms (for example, the bytecode interpreter 301 and the class loader 302) of the virtual machine 122, and the virtual machine loader 132 changes the address range of the two subprograms to the falsification checking unit 131. In step 801, the falsification inspection unit 131 may obtain hash values for the address ranges of the two subprograms.

  FIG. 9 shows an example of an address range notified from the virtual machine loader 132 to the tampering inspection unit 131. Column 901 represents a subprogram, and column 902 represents an address range into which the subprogram is loaded. When tampering inspection is performed for a plurality of subprograms as shown in FIG. 9, the tampering inspection unit 131 obtains a hash value for the address range of each subprogram and compares it with a correct hash value stored in the second ROM 135. FIG. 10 shows an example of correct hash values stored in the second ROM 135 when tampering inspection is performed on a plurality of subprograms. A column 1001 represents a subprogram, and a column 1002 represents a correct hash value. The tampering inspection unit 131 determines that the virtual machine 122 has not been tampered with when the hash values of all the subprograms are correct.

  Thereby, the time for calculating the hash value in step 801 can be shortened. Further, tampering determination may be performed with a finer granularity (for example, a function unit) instead of a subprogram unit.

  In this embodiment, the encrypted virtual machine 401, the encrypted application acquisition program 402, and the encrypted startup class name 403 are stored in the first ROM 126 in an encrypted state. It is possible to apply the present invention even if it is not encrypted. Further, even if these are stored in the second ROM 135 instead of the first ROM 126, the present invention can be similarly applied.

(Embodiment 2)
In the first embodiment, when the entire Java (R) virtual machine performs a predetermined process, the falsification inspection unit 131 performs a falsification inspection. The method of the falsification inspection relates to the processing of the Java (R) virtual machine. Alternatively, it may be performed at predetermined intervals.

  FIG. 11 shows the processing of the falsification inspection unit 131 in the present embodiment. Steps 1101 to 1103 and 1105 are the same as those in FIG. 8 of the first embodiment, and thus detailed description thereof is omitted. In step 1104, execution of the falsification inspection unit 131 for a predetermined time is interrupted. By doing so, it is possible to check whether the virtual machine 122 has been tampered with regardless of the execution state of the virtual machine 122.

  The predetermined time may be selectable according to the execution state of the virtual machine 122. For example, when an application running on the virtual machine 122 is in an idle state, processing such as increasing the interval of tampering inspection may be performed. Whether or not the application is in an idle state can be determined by examining the state of a thread managed by the virtual machine 122. If all the threads that make up the application are idle, it can be seen that the application is idle. As a result, the number of useless alteration inspections can be suppressed, and the power consumption of the application execution apparatus 110 can be reduced.

(Embodiment 3)
In the first and second embodiments, it is possible to inspect whether or not the virtual machine 122 has been falsified at the time of execution by performing falsification inspection frequently. However, it is conceivable that the execution of the Java (R) application becomes slow because the time required for the falsification inspection increases as the falsification inspection is frequently performed. The frequency with which inspections are sufficient depends on the degree of security required by the Java (R) application. Knowing the degree of security of the application executed by the virtual machine 122 makes it possible to appropriately adjust the frequency of tampering inspection.

  FIG. 12 shows the structure of a class file defined by Java (R) Virtual Machine Specification. Although many elements are stored in the class file, only the method information 1214 particularly related to the present embodiment will be described here, and detailed description of other elements will be omitted.

  FIG. 13 shows the detailed contents of methods 1214. The methods 1214 includes access_flags 1301, name_inde 1302, descriptor_inde 1303, attributes_count 1304, and attributes 1305. access_flags 1301 is a flag for storing a callable condition of this method. Callable conditions include callable only from the own class, callable from all classes, and the like. The name_inde 1302 is an index of an entry in the constant_pool 1205 that includes the name of this method. The descriptor_inde 1303 is an index of an entry in the constant_pool 1205 that includes an argument of this method and a return value type. The attributes_count 1304 represents the number of entries of the following attributes 1305. The attributes 1305 store the attributes of this method. The attribute includes, for example, a code attribute for storing a bytecode.

  FIG. 14 is a diagram showing the configuration of attributes 1305. attribute_name_inde 1201 is an index of an entry including the name of this attribute (eg, code attribute) in constant_pool 1205. Attribute_length 1402 is the number of bytes of info1403 that follows. The info 1403 stores attribute values. In the case of a code attribute, a byte code is stored in info1403. Extensions that add new attributes to these attributes are allowed in the Java® language specification. In the present embodiment, a security attribute representing the security strength required for the method is newly added.

  FIG. 15 shows examples of security attributes. A value 1501 indicates that the name of the security attribute is included in the 19th entry of constant_pool 1205. A value 1502 indicates that this security attribute has 4 bytes of information. A value 1503 represents the security level of the method having this security attribute. In this embodiment, the greater the security level value, the stronger the required security level, and the security level 0 class is a class that does not need to be protected. Further, when a class has a plurality of methods having different security levels, the highest level among the security levels is referred to as the security level of the class. In the present embodiment, a security attribute is added to the attributes 1305 in the methods 1214. However, a security attribute may be added to the attributes 1215 as an attribute for each class. In this case, it is determined that all methods included in the class have the security level specified by attributes 1215. By adding the security attribute to the class file in this way, the virtual machine 122 can recognize the security attribute required for the method being executed.

  FIG. 16 shows a method call process performed by the bytecode interpreter 301 when performing a tampering inspection of the virtual machine 122 only when a method with a security level greater than 0 is processed. In step 1601, the security level of the method to be called is checked. If the result is greater than 0 (step 1602), the falsification checking unit 131 checks whether the virtual machine 122 has been falsified (step 1603). . Thereafter, normal method call processing (step 1604) is executed. It is also possible to perform a falsification inspection according to a security level value during class loading processing or JIT compilation processing. Thereby, when executing a class that does not particularly require security, the tampering inspection process can be omitted, and a decrease in the execution time of the Java (R) application can be suppressed.

  Further, it may be configured such that a tampering inspection is periodically performed only while a class having a method of a specific security level is loaded in the virtual machine 122. For example, the interruption time of the falsification inspection unit 131 in step 1104 shown in FIG. 11 can be changed according to the highest security level among the classes loaded in the virtual machine 122.

  FIG. 17 shows an example of the correspondence between the security level and the interruption time of the falsification inspection unit 131. As shown in FIG. 17, the tampering inspection is performed once every 10 seconds while the security level 3 class is loaded in the virtual machine 122. If the security level is at most 1, the tampering inspection is performed once every 60 seconds. If only classes with a security level of 0 are loaded, tampering inspection is not performed at all, and the frequency of tampering can be flexibly changed depending on the application to be executed, reducing unnecessary tampering inspection. Can do.

  In the present embodiment, the security level is embedded in the extended attribute of the class file. However, the present invention can be implemented even if the security level is defined using other methods. For example, when the application acquisition unit 121 acquires an ML file in which a security level is recorded at the same time as the Java® application and passes the file to the virtual machine 122, the virtual machine 122 can know the security level of the method. FIG. 18 is an example of such an ML file.

  The virtual machine alteration inspection device according to the present invention inspects whether or not the virtual machine has been altered at the time of execution from a safe alteration inspection unit that is realized by hardware and difficult to eavesdrop and tamper at a predetermined timing. This makes it possible to quickly detect virtual machine tampering and take actions such as forcibly terminating the application execution device, so that downloaded applications can be protected from eavesdropping and tampering during execution. It is possible to protect the rights of content creators in the application download distribution business.

Configuration diagram of an embodiment of an application execution apparatus according to the present invention Configuration diagram of an embodiment of a conventional application execution device Configuration diagram of an example of a configuration of a virtual machine according to the present invention Configuration diagram of an example of information stored in a first ROM included in an application execution device according to the present invention The block diagram of an example of the information memorize | stored in 2nd ROM with which the application execution apparatus which concerns on this invention is provided The flowchart which shows the loading procedure of the application execution apparatus which concerns on this invention The figure which shows an example of the address after loading of the virtual machine of the application execution apparatus which concerns on this invention The flowchart which shows an example of the alteration inspection method of the application execution apparatus which concerns on this invention The figure which shows the address range of the subprogram of the virtual machine which concerns on this invention The figure which shows the example of the correct hash value for every subprogram memorize | stored in 2nd ROM135 which concerns on this invention The flowchart which shows an example of the alteration inspection method of the application execution apparatus which concerns on this invention Configuration diagram of class file contents defined in the virtual machine specifications Configuration diagram of the contents of the method information table defined in the virtual machine specifications Configuration diagram of attribute table contents defined in virtual machine specifications Configuration diagram of contents of security extended attribute according to the present invention A flowchart showing a part of the processing of the bytecode interpreter according to the present invention. The figure which shows an example of the correspondence of the security level which concerns on this invention, and a tampering inspection interval The figure which shows an example of the ML file which defines the security extended attribute which concerns on this invention

Explanation of symbols

100 Downloadable Program 110 Application Execution Device 120 Execution Unit 121 Application Acquisition Program 122 Virtual Machine 123 OS
124 1st CPU
125 1st RAM
126 1st ROM
130 Safe Execution Unit 131 Tampering Inspection Unit 132 Virtual Machine Loader 133 Second CPU
134 Second RAM
135 2nd ROM

Claims (19)

A tamper-proof execution unit for inspecting tampering of a virtual machine that operates while converting a program expressed in a platform-independent intermediate language into instructions that depend on the platform, and prevents eavesdropping and tampering by a third party Loading a virtual machine with a virtual machine loader executed in
Notifying the address region of the loaded virtual machine to the tampering inspection unit executed by the tamper resistant execution unit;
Determining at a predetermined timing whether or not the address area of the virtual machine has been tampered with by the tampering inspection unit;
As a result of the determination, when it is determined that the virtual machine has been tampered with, the tampering inspection unit includes a step of stopping execution of the virtual machine. The virtual machine tampering inspection method according to claim 1, further comprising the step of the virtual machine loader decrypting the encrypted virtual machine. The virtual machine alteration inspection method according to claim 1, wherein the address area of the virtual machine is an area from a start address to an end address of the virtual machine. The virtual machine alteration inspection method according to claim 1 or 2, wherein the address area of the virtual machine is an area from a start address to an end address of a subprogram constituting the virtual machine. The virtual machine falsification inspection method according to any one of claims 1 to 4, wherein the virtual machine calls the falsification inspection unit and performs falsification inspection immediately before the virtual machine performs a predetermined process. The virtual machine tampering inspection method according to claim 5, wherein the predetermined process includes a class load process. The virtual machine alteration inspection method according to claim 5, wherein the predetermined process includes a method call process. The virtual machine alteration inspection method according to claim 5, wherein the predetermined process includes a bytecode verification process. The virtual machine alteration inspection method according to claim 5, wherein the predetermined process includes a JIT compilation process. The virtual machine tampering inspection according to any one of claims 5 to 9, wherein a security attribute embedded or attached to a class file is read, and the predetermined processing is changed during the execution of the application according to the security attribute. Method. The virtual machine falsification inspection method according to claim 1, wherein the falsification inspection of the virtual machine by the falsification inspection unit is periodically performed at a predetermined interval. The virtual machine tampering inspection method according to claim 11, wherein a security attribute embedded or attached to a class file is read, and the predetermined interval is dynamically changed according to the security attribute. The virtual machine tampering inspection method according to any one of claims 1 to 12, wherein the tampering inspection of the virtual machine by the tampering inspection unit is temporarily stopped while an application running on the virtual machine is in an idle state. . A virtual machine loading means for loading a virtual machine into the software execution unit, the software execution unit and a tamper resistant software execution unit that prevents tapping and tampering by a third party, and executed in the tamper resistant software execution unit; It is inspected at a predetermined timing whether or not the virtual machine has been falsified at the time of execution, and if it is determined that the virtual machine has been falsified as a result of the inspection, a falsification inspection that terminates the virtual machine And a virtual machine tampering inspection device. The virtual machine tampering inspection apparatus according to claim 14, wherein the safety software execution unit is a software execution unit protected by a tamper resistance function in the virtual machine tampering inspection apparatus. The virtual machine tampering inspection apparatus according to claim 14, wherein the tamper resistant execution unit is hardware built in the virtual machine tampering inspection apparatus. The virtual machine tampering inspection apparatus according to claim 14, wherein the tamper resistant software execution unit is a smart card that is detachable from the virtual machine tampering inspection apparatus. The falsification inspection unit turns off the virtual machine falsification inspection device when it is determined that the virtual machine has been falsified. Virtual machine tampering inspection device. The falsification inspection unit restarts the virtual machine falsification inspection device when it is determined that the virtual machine has been falsified. Virtual machine alteration inspection device.

Images