System and method for generating reliable, architecture-specified, and compiled version of architecture neutral program

Description: TECHNICAL FIELD [Detailed description of the invention]

【0001】

[Industrial application field]

The present invention generally relates to distributed computer systems, in particular allowing a compiled recipient to verify the identity of the corresponding architecture-neutral program, which was compiled by a trusted third party. It relates to a program compilation system and method such that an architecture-neutral executable program is compiled by a trusted third party so that it can be verified to be one.

【0002】

[Conventional technology]

As used herein, "architecture" is defined as the operating characteristics of a family of computer models. Examples of clear architectures are Macintosh computers, IBM PC compatible computers using the DOS or Windows operating system, Sun (SUN) Microsystems computers running the Solaris operating system, and computer systems using the Unix operating system. As used herein, "architecture-neutral (or neutral)" is written in the Java (Sun Microsystems, Inc.) language, which runs on a variety of computer platforms that use many different computer architectures. Defined as the ability of some programs, such as programs.

【0003】

As used herein, "architecture specification" is defined as a request for some programs to be executed only on a computer platform using a single computer architecture. For example, an object (or purpose) code program written in 80486 assembler language can only be run on a computer that uses the IBM PC compatible computer architecture (as well as in other computers, including the IBM PC compatible computer emulator). An important feature of an architecture-neutral program (AN program) is that it includes an architecture that is independent of the program written in the architecture-neutral language (AN language). For example, a Java bytecode program can run on a computer platform that has a Java bytecode interpreter. Another important feature of Java bytecode programs is the ability to directly verify their integrity before execution by Java bytecode verification means. Java bytecode verification means determine whether a program complies with a given (or predetermined) integrity standard. This criterion includes the operand stack and data type usage restrictions. This data type usage restriction ensures that Java bytecode programs do not cause overflow or underflow of the executable computer's operand stack, and that all program instructions use only data of known data types. is there. As a result, Java bytecode programs cannot create object pointers, and generally cannot access system resources other than those explicitly authorized by the user to use them.

【0004】

Unfortunately, distributing executable programs within the AN language makes AN programs run less efficiently than taking advantage of architecture-specific features. For example, a Java bytecode program executed by a Java bytecode interpreter typically runs 2.5 to 5 times slower than the corresponding architecture-specific language (equivalent architecture-specific program (AS program) compiled in the AS language). The double slowdown is actually considered to be extraordinarily affordable for AN program executioners (executors: ie interpreters), but requires some users the ability to use equivalent programs compiled in the AS language. Or it is sufficiently inefficient to force it. It is possible to write compilers that can compile AN programs into equivalent AS programs, however, they are extremely expensive for the end user. Moreover, they are equivalently compiled. AS program integrity cannot be verified directly from compiled AS program code by AN program integrity verification means, therefore Java. In the case of bytecode programs, using an AN program compiled within an equivalent AS program will potentially lose one of the most valuable features of the AN language.

【0005】

However, there are some legitimate (or legitimate) tasks that can be performed by the integrity-verifiable AS program but not by the integrity-verifiable AN program. These include tasks that otherwise violate the operand stack and the data type usage restrictions imposed on integrity-verifiable AN programs. Moreover, these AS programs can be executed much faster than AN programs. As a result, there are many reasons why a computer system designed to have the ability to execute not only integrity-verifiable AN programs but also non-integrability AS programs is desired. Exists. It is possible for a third party to compile AN programs, but these compilations require that the third party be authenticated. That is, the information in the compiled AS program must be able to verify that it was compiled by a particular trusted third party. To be better, it should also be able to authenticate that the compiled AS program was generated by a particular trusted compiler. In addition, since the completeness of the compiled AS program cannot be directly verified against a predetermined integrity standard, the compiled AS program compiles the corresponding AN program that compiles the AS program and the AS program. Information that identifies the AS language used for the compilation should be included in a verifiable manner.

【0006】

Therefore, an object of the present invention is to identify who compiled the AN program by the user of the AS program compiled from the corresponding AN program, the identity of the corresponding AN program, and the AS language in which the AS program was compiled. It is to provide an AN program compiler and a compilation method that can authenticate and. Another object of the present invention is to execute an AN program whose integrity can be verified, and to call an AS program whose integrity cannot be verified but has a trusted or verifiable source and compilation information. AN program execution means and methods that allow essentially all proper tasks to be performed while preventing calls to AS programs whose source, compilation information, and integrity cannot be verified. To provide.

【0007】

[Means for solving problems]

An object of the present invention is a computer network comprising a program compiling computer that is operated by a compiling party and receives an architecture-neutral program generated by the calling party, wherein the architecture-neutral program is an architecture-neutral program code and a calling party. Digital signatures are designed to verify that the architecture-neutral program was signed by the outgoing party at the time of verification, and the program compiling computer provides a signature verification means to verify the outgoing party's digital signature. When the outgoing party's digital signature is verified, (A) Ah Architecture identification by compiling texture-neutral program code into architecture-specific program code in architecture-specific language and (B) adding a digital signature of the compiling party that verifies that the architecture-specific program was generated by the compiling party during validation. A program execution computer that includes a compiler that generates a program and a signature generator that generates a digital signature of a compiling party, is operated by an execution party, receives an architecture-specific program, and receives or executes an architecture-neutral program. The program execution computer has a signature verification means that verifies the digital signature of the compiling party and an architecture when the compiling party's signature is verified and the compiling party is a member of a limited set of trusted compiling parties. Achieved by a computer network that includes an execution means that executes an architecture-specific program code written in a specific language.

【0008】

In the computer network of the present invention, the signature generating means generates a digital signature of the compiler that verifies that the architecture-specific program was generated by the compiler at the time of verification, and the compiler further digitally signs the architecture-specific program code of the compiler. By adding to, an architecture-specific program is also generated, the signature verification means of the executing computer verifies the digital signature of the compiler, and the execution means verifies the digital signature of the compiler, and the compiler is a trusted limited set of compilers. It may be configured to execute architecture-specific program code only after it has been determined to be a member of. In the computer network of the present invention, for outgoing and compiling parties, the network includes a corresponding private encryption key, a public encryption key, and a corresponding hashing function, and the outgoing party's digital signature is an architecture-neutral program. The message digest of the architecture-neutral program is encrypted with the corresponding private key of the outgoing party, including the message digest of the architecture-neutral program generated by performing the corresponding hash function of the outgoing party. The sign verification means of the program compiling computer is (A) decrypting the message digest of the architecture-neutral program using the public encryption key of the outgoing party, and (B) hashing the outgoing party against the architecture-neutral program code. Generate the corresponding test message digest of the architecture-neutral program by performing, and (C) have the outgoing party's digital signature verified by comparing the decrypted message digest with the test message digest of the architecture-neutral program. The means of sign generation, including instructions, is (A) by performing the corresponding hashing function of the compiling party on the architecture-specific program code.

【0009】

In the computer network of the present invention, the program execution computer further verifies the integrity of the architecture-neutral program code by verifying that the architecture-neutral program code meets a predetermined program integrity criterion. The means of execution, including the means, may be configured to execute the architecture-specific program code only after the integrity of the architecture-neutral program code has been verified. The computer network of the present invention further comprises a program-transmitting computer that supplies an architecture-neutral program, the program-transmitting computer including a signature-generating means that generates a digital signature of the calling party that is attached to the architecture-neutral program code. It is further equipped with a program compiling computer that receives an architecture-neutral program from the program-transmitting computer and supplies an architecture-specific program to the program-transmitting computer. Upon receiving the program and architecture-specific program, the sign verification means of the program execution computer also verifies the digital signature of the outgoing party, and the program execution computer executes the architecture-specific program only after the digital signature of the outgoing party is verified. It may be configured to do so.

【0010】

Further, the above object of the present invention is a method of operating a computer network, in which a program compiling computer operated by a compiling party has an architecture-neutral program code generated by the outgoing party and an architecture-neutral program at the time of verification. The stage of receiving an architecture-neutral program containing the outgoing party's digital signature to verify that it was signed by the outgoing party, the stage of verifying the outgoing party's digital signature, and the stage of compiling the architecture-neutral program with a compiler and the outgoing party. The execution party, including the step of generating an architecture-specific program when the digital signature of the computer is verified, and adding the computer-specific signature of the compiling party to verify that the architecture-specific program was generated by the compiling party at the time of verification. In a program execution computer operated by, the stage of receiving an architecture-specific program and receiving or transmitting an architecture-neutral program, the stage of verifying the digital signature of the compiling party, and the stage of verifying the digital signature of the compiler, the compiler trusts. Achieved by methods including the step of executing architecture-specific program code when determined to be a member of a limited set of computers.

【0011】

In the method of the present invention, in a program compiling computer, a stage of generating a digital signature of a compiler that verifies that an architecture-specific program was generated by using a compiler at the time of verification, and a stage of adding a digital signature of the compiler to the architecture-specific program code. Only after the compiler's digital signature has been verified and the compiler has been determined to be a member of a limited set of trusted compilers, including the stage of verifying the compiler's digital signature on the program execution computer. , The stage of executing the architecture-specific program code, and so on.

【0012】

In the methods of the invention, for outgoing and compiling parties, the network includes the corresponding private encryption key, public encryption key, and corresponding hashing capabilities, and the outgoing party's digital signature is in an architecture-neutral program. The message digest of the architecture-neutral program, including the message digest of the architecture-neutral program generated by performing the corresponding hash function of the outgoing party, is encrypted using the corresponding private key of the outgoing party. The method is to (A) decrypt the message digest of the architecture-neutral program using the outgoing party's public encryption key on the program compiling computer, and (B) perform the outgoing party's hashing function against the architecture-neutral program code. By generating the corresponding test message digest of the architecture-neutral program, and (C) verifying the outgoing party's digital signature by comparing the decrypted message digest with the test message digest of the architecture-neutral program. , (A) generate a message digest of the architecture-neutral program by performing the corresponding hashing function of the compiling party for the architecture-specific program code, and (B) use the corresponding private key of the compiling party. Including the stage of generating the digital signature of the compiling party by encrypting the message digest of the architecture-specific program, (A) the message digest of the architecture-specific program using the public key of the compiling party on the program execution computer. And (B) generate the corresponding test message digest of the architecture-specific program by performing the computing party hashing function against the architecture-specific program code, and (C) decrypt it.It may be configured to include a step of verifying the digital signature of the compiling party by comparing the message digest with the test message digest of the architecture specific program.

【0013】

In the method of the present invention, in a program execution computer, a step of verifying the integrity of the architecture-neutral program code by verifying that the architecture-neutral program code satisfies a predetermined program integrity criterion and the completeness of the architecture-neutral program code. It may be configured to include the stage of executing the architecture-specific program code only after the sex has been verified. The method of the present invention includes the step of generating a digital signature of a calling party in a program sending computer that supplies an architecture-neutral program and adding it to the architecture-neutral program code, and contacts the program sending computer in the program compiling computer. Including the step of receiving the architecture-neutral program from the program-sending computer and supplying the architecture-specific program to the program-sending computer, the program-executing computer contacts the program-sending computer and the architecture-neutral program and the architecture-specific program from the program-sending computer It may be configured to include a step of receiving the computer, a step of verifying the outgoing party's digital signature, and a step of executing the architecture-specific program only after the outgoing party's digital signature has been verified.

【0014】

The method of the present invention includes, in a program execution computer, a step of supplying an architecture-neutral program and a step of generating a outgoing party digital signature that signs the architecture-neutral program and adding it to the architecture-neutral program code. The program compiling computer may be configured to include a step of contacting the program execution computer, receiving an architecture-neutral program from the program execution computer, and supplying the architecture-specific program to the program execution computer.

【0015】

Further, an object of the present invention is a system that is stored on a computer-readable medium and distributes code that can be executed by a computer, in which each code performs at least one function performed by one of the computers. The system includes a first module that is configured to be operated by a compiling party and is configured to be used with a program compiling computer, and the compiling party is an outgoing party. Receives the architecture-neutral program generated by, the architecture-neutral program contains the architecture-neutral program code and the outgoing party's digital signature, and the digital signature now verifies that the architecture-neutral program was signed by the outgoing party at validation. The first module is a signature verification means that verifies the outgoing party's digital signature, and when the outgoing party's digital signature is verified, (A) transforms the architecture-neutral program code into architecture-specific program code in the architecture-specific language. Compile and (B) verify that the architecture-specific program was generated by the compiling party at validation. The compiler that generates the architecture-specific program by adding the computer-specific signature of the compiling party, and the digital signature of the compiling party. It further comprises a second module, including a sign generator to generate, operated by the execution party and used with the program execution computer, which receives the architecture-specific program and receives or originates the architecture-neutral program. The second module provides signature verification means to verify the digital signature of the compiling party and architecture identification when the compiling party's signature is verified and the compiling party is a member of a trusted limited set of compiling parties. Architect written in languageAchieved by a system that includes, and an execution means, that executes the Cha-specific program code.

【0016】

In the system of the present invention, the signature generating means generates a digital signature of the compiler that verifies that the architecture-specific program was generated by the compiler at the time of verification, and the first module converts the architecture-specific program code into the digital of the compiler. In addition to the signature, the signature verification means of the second module verifies the digital signature of the compiler, and the execution means of the second module verifies the digital signature of the compiler and is a member of a limited set of compilers trusted by the compiler. It may be configured to execute the architecture-specific program code only after it has been determined to be.

【0017】

In the system of the present invention, for outgoing and compiling parties, the system includes a corresponding private encryption key, a public encryption key, and a corresponding hashing function, and the outgoing party's digital signature is in an architecture-neutral program. The message digest of the architecture-neutral program, including the message digest of the architecture-neutral program generated by performing the corresponding hash function of the outgoing party, is encrypted using the corresponding private key of the outgoing party. The sign verification means of the first module is (A) decrypting the message digest of the architecture-neutral program using the outgoing party's public encryption key, and (B) providing the outgoing party's hash function to the architecture-neutral program code. Instructions to generate the corresponding test message digest of the architecture-neutral program by performing, and (C) have the outgoing party's digital signature verified by comparing the decrypted message digest with the test message digest of the architecture-neutral program. The signing means of the first module, including (A), generate a message digest of the architecture-neutral program by performing the corresponding hashing function of the compiling party against the architecture-specific program code, and (B). The signature verification means of the second module, including instructions for generating a digital signature of the compiling party by encrypting the message digest of the architecture-specific program with the corresponding private key of the compiling party, A) Architecture-specific program support by decrypting the architecture-specific program's message digest using the corresponding public key of the compiling party, and (B) performing the compiling party's hashing function against the architecture-specific program code. Live test message digestIt may be configured to include instructions to verify the digital signature of the compiling party by (C) comparing the decrypted message digest with the test message digest of the architecture-specific program.

【0018】

[Action]

In summary, the present invention is a computer network comprising a program compiling computer and a program executing computer. The program compiling computer includes a storage system that is operated by the compiling party and stores the architecture-neutral program generated by the outgoing party. The architecture-neutral program includes the architecture-neutral program code and the digital signature of the sending party. The program compiling computer verifies the outgoing party's digital signature so that the outgoing party's digital signature matches the architecture-neutral program (that signature is associated with) with the outgoing party's signature (ie, uses that signature). It also includes a signature verification means to verify that it was generated).

【0019】

The program compiling computer further includes a compiler. The compiler compiles architecture-neutral program code into architecture-specific program code in the architecture-specific language identified by compiling the information when the outgoing party's digital signature is verified. The compiler uses signature generators to add the digital signature of the compiler program to the architecture-specific program code (this compiler signature signs a set of information, including the compiled architecture-specific program code + the signature on the architecture-neutral program. To do). In a preferred embodiment, the compiler also uses signature generators to add a compiling party digital signature to the architecture-specific program code (this compiling party signature is the compiled architecture-specific program code and the architecture-neutral program. Sign a set of information, including the above signature and the compiler signature).

【0020】

The program execution computer is operated by an execution party and includes a storage means for storing an architecture-neutral program and an architecture-specific program. The program execution computer further verifies (A) the digital signature of the outgoing party in the architecture-neutral program, (B) the digital signature of the compiler in the architecture-specific program, and / or the digital signature of the compiling party in the architecture-specific program. It also includes a signature verification means to verify. "Verifying a signature" means that a procedure is performed to determine that the signature matches (ie, is actually generated from) the set of information signed by the signature. The program execution computer also includes an architecture-specific program execution means. This architecture-specific program execution means executes the architecture-specific program code of the architecture-specific program when the digital signature in the architecture-specific program is verified.

【0021】

In a preferred embodiment, the architecture-neutral program is implemented within an object that contains a digital signature that contains a message digest that is uniquely associated with it. The architecture-specific program generated by the compiler * Compiled, architecture-specific code, * Digital signature of the corresponding architecture-neutral program, signed by the party that supplied the architecture-neutral program. * A digital signature by the compiler itself, which contains a message digest of the compiled program and information identifying the compiler used to compile the program, and is signed using the compiler's private encryption key. * Includes a message digest of the compiled program and information identifying the trusted party, including digital signatures by the trusted party performing the compilation signed using the compiling party's private encryption key. ..

【0022】

A trusted storage means of widely used public encryption keys, sometimes referred to as naming services, holds public keys for compilers and trusted compiling parties. Using these public keys, all receiving means of the compiled program decrypt the digital signature in the compiled program, and the compiled program is instructed by the indicated trusted party and instructed. It can verify that it was compiled by a compiled compiler and the identity of the corresponding architecture-neutral program. Additional objects and features of the present invention will be more easily apparent from the detailed description based on the accompanying drawings below.

【0023】

[Example]

FIG. 1 shows a computer network 100 with many customer computers 102, server computers 104, and trusted key storage means 106. The customer computers 102 are connected to each other and to the server computer 104 and the trusted key storage means 106 via a network communication connection 108. The network communication connection 108 may be a local or wide area network, the Internet, a combination of these networks, or any other type of network communication connection. Most customer computers 102 are Sun Desktop computers such as workstations, IBM compatible computers, and Macintosh computers, but virtually any type of computer can be a customer computer. Each of these customer computers includes a CPU 110, a user interface 112, a memory 114, and a network communication interface 116. The network communication interface allows the customer computer to communicate with each other via the network communication connection 106 with the server computer 104 and with the trusted key storage means 108.

【0024】

The memory 114 of each customer computer 102 includes an operating system 118, a network communication management means 120, an AN program (architecture-neutral program) execution means 122, an AS program (architecture-specific program) execution means 124, an AN program integrity verification means 126, and AN. Program compiling preparation means (prepar) 128, signature generation means 130, signature verification means 132, compiling information verification means 134, object class loader 136, user address space 138, trusted object class storage means 140, untrusted object class It contains storage means 142, a list of known trusted compiling parties and trusted compilers 144. The operating system runs on the CPU 110 and controls and coordinates programs 120-136 on the CPU in response to commands issued by the user using the user interface 112.

【0025】

The AN program execution means 122 of each customer computer 102 executes the AN program in the object class stored in the trusted object class storage means 140 and the untrusted object class storage means 142. In addition, the AN program is written in the AN language, which allows the user to establish predetermined integrity criteria such as stacks and data usage restrictions, so the AN program does not perform unreasonable tasks. Therefore, the integrity of an AN program can be verified directly by the AN program integrity verification means 126 by determining whether the program meets certain integrity criteria prior to execution. Therefore, these AN programs are considered to be integrity verifiable AN programs.

【0026】

In a preferred embodiment, the integrity verifiable AN program is written in the Java bytecode language. Further, the AN program execution means 122 and the AN program verification means 124 are a Java bytecode program interpreter that executes a Java bytecode program and a Java bytecode program verification means that verifies a Java bytecode program, respectively. Java bytecode program verification means and interpreters are available from Sun Microsystems, Inc. It is a product of Inc. However, each customer computer 102 has a relevant specific architecture that allows the program to be written in the corresponding AS language and executed by the AS program execution means 124. The AS language does not require AS programs written in the AS language to meet certain integrity standards of the AN language. As a result, AS programs can perform tasks that cannot be performed by AN programs (because they are not plagued by the limitations imposed by the prescribed integrity standards of the AN language). Unfortunately, however, this also means that their integrity cannot be verified directly by the AN Program Integrity Verification Means 126 and therefore cannot be verified.

【0027】

Nevertheless, as mentioned above, AN programs run less efficiently than the same program compiled in the AS language. Thus, the user of the customer computer 102 has an AN program compiled by the server computer 104 for the AS language associated with the user's customer computer so that the AS program compiled thereby can be executed by the AS program execution means 124. You may wish. Alternatively, if the compiled AS program is distributed and will be executed by the AS program execution means 124 of the other customer computer, the user will be able to use the AN program compiled for the AS language associated with the other computer. You may want to have one. Preparing an architecture-neutral program for compilation See Figures 1 and 2. If the outgoing party wishes to have an AN program 200 compiled by the server computer 104, the outgoing party issues a command using user interface 112 to call the AN program compiling preparation means 128 and AN for compilation. Instruct it to prepare the program. The AN program can be in an object class contained within either the trusted object class storage means 140 or the untrusted object class storage means 142. Table 1 contains pseudo-code representations of the procedures used by AN program compiling preparation means 128 to prepare AN programs compiled by server computer 104. The pseudocode used in Table 1-3 uses the Universal Computer Language Agreement. The pseudo-code used here was developed solely for the purpose of this explanation, but can be easily understood by computer programmers familiar with this technique.

【0028】

See Figures 1 and 2 and Table 1. The AN program compiling preparation means 128 first calls the AN program integrity verification means 126 and instructs it to verify the integrity of the AN program code 202 of the AN program 200. This is done to ensure that the AN program code meets certain integrity standards of the AN language before being sent to the server computer 104 for compilation. If the AN program code does not meet the prescribed integrity criteria, the AN program integrity verification means sends a fail result back to the AN program compiling preparation means. In response, the AN program compiling preparation means terminates the compiling preparation procedure and generates an appropriate message instructing this.

【0029】

However, if the AN program code 202 meets the predetermined integrity criteria, the AN program integrity verification means 126 sends a pass result back to the AN program compiling preparation means 128. The AN program compiling preparatory means 128 then calls the signature generating means 130 and orders it to generate a digital signature OP210 for the calling party. This digital signature can be verified to ensure that the AN Program 200 was generated by a trusted calling party. The signature generating means first generates a digital signature OP by generating a message digest OP 212 of AN program code 202. This is done by calculating the hash function OP for the data bits in the AN program code. The hash function used may be a predetermined hash function or a hash function selected by the calling party. For the purpose of explanation, the hash function OP corresponds to the outgoing party because the hash function was used for the digital signature OP of the outgoing party.

【0030】

The signature generating means 130 then encrypts the generated message digest OP212 and hash function OPID214 using the private encryption key of the sending party. The signature generating means then explicitly adds the calling party ID 216 to the end of the encrypted items 212 and 214 to form a digital signature OP. The calling party private key and ID are supplied to the user interface 112 by the calling party. After generating the digital signature OP210, the AN program compiling preparation means 128 adds it to the AN program code 202. The AN program compiling preparation means 128 then generates a message indicating that the AN program 200 has been prepared for compilation by the server computer 104.

【0031】

The calling party then issues a command to the network communication management means 120 using the user interface 112 and uses the AN program 200 with an argument (AS language ID) that specifies the architecture-specific language in which the program is compiled. It is transmitted to the server computer 104 together with the compiler (compiler ID). The network communication management means searches for an AN program located in the trusted object class storage means 140 or the untrusted object class storage means 142 and supplies it to the network communication interface 116. The network communication management means then commands the network communication interface to transmit the AN program to the server computer with a specific argument.

【0032】

Architecture-neutral program compiling The transmitted AN program 200 is received by the server computer 104. The server computer includes a CPU 150, a user interface 152, a memory 154, and a network communication interface 156. The network communication interface allows the server computer to communicate with the customer computer 102 and the trusted key storage means 106 via the network communication connection 108. The memory 154 of the server computer 104 includes an operating system 158, a network communication management means 160, an AN program compiler 162, a signature verification means 164, an AN program integrity verification means 166, a signature generation means 168, an AN program storage means 170, and an AS program. Stores storage means 172. The operating system runs on the CPU 150 and controls and coordinates the running of programs 160-168 on the CPU in response to commands issued by the compiling party using user interface 152.

【0033】

The network communication interface 156 receives the AN program and instructs the network communication management means 160 that this has been done. In response, the network communication management means arranges the received AN program in the AN program storage means 170. If server 104 is set up as an automatic compiler service, this is done automatically by network communication management means 160. Otherwise, when the compiling party issues a command using the user interface, it is moved into the storage means 170 by the network communication management means. Then, automatically or when the compiling party issues a command using user interface 252, the AN program compiler 162 is called to compile the AN program 200. Table 2 contains pseudo-code representations of the compilation procedures used by the AN program compiler to compile AN programs.

【0034】

See Figure 1-2 and Table 2. The AN program compiler 162 first calls the signature verification means 164 to verify the digital signature OP210 in the received AN program 200 and confirm that the digital signature OP210 is the signature of the outgoing party for the AN program (eg,). To find out that it is a forged signature or outgoing party signature on another version of the AN program). Specifically, the signature verification means obtains the calling party's private key from the trusted key storage means 106 using the "clear text sending party ID" 216 in the received AN program. The signature verification means then decrypts the message digest OP212 and the hash function OPID214 that are encrypted in the digital signature OP using the outgoing party's encrypted public key.

【0035】

Next, the signature verification means 164 generates a test message digest OP that is matched with the decrypted message digest OP 212 by calculating the corresponding hash function OP for the AN program code 202 of the received AN program 200. The decrypted digitally signed OP is used to identify the appropriate hash function OP to use. The decrypted message digest OP is then compared to the generated test message digest OP to verify the digital signature OP210. If the message digest OP212 and the test message digest OP do not match, the signature verification means 164 sends a fail result back to the AN program compiler 162. In response, the AN program compiler terminates the compiling procedure and generates the appropriate message.

【0036】

On the other hand, if the message digest OP and the test message digest OP match, the signature verification means 164 sends the pass result back to the AN program compiler 162, and the AN program compiler calls the AN program integrity verification means 166. The AN program compiler instructs the AN program integrity verification means to verify the integrity of the AN program code 202 of the received AN program 200. This is done in the same way and for the same purpose as described in Preparing the AN Program for Compiling above. Therefore, if the AN program code does not meet the predetermined integrity criteria, the AN program integrity verification means sends a fail result back to the AN program compiler. In response, the AN program compiler terminates the compiling procedure and generates an appropriate message instructing it.

【0037】

However, if the AN program code 202 of the received AN program 200 satisfies a predetermined integrity criterion, the AN program integrity verification means 166 sends a pass result back to the AN program compiler 162. The AN program compiler then compiles the AN program code into the AS language identified by the AS language ID specified by the calling party. See Figure 1-3 and Table 2. The compiler places the AN program code 202, the digital signature OP210, and the compiled AS program code 302 in the AS program 300 stored in the AS program storage means 172. The AN program compiler 162 then calls the signature generating means 168 and the digital signature C of the AN program compiler. (This digital signature can be verified to verify that AS Program 300 was compiled by a trusted AN program compiler). This can be done in the same way as generating the digital signature OP described above. However, in this case, the set of signed information is the AS program code and the digitally signed OP. Another given hash function, along with the corresponding hash function C ID 324, can be used to generate a message digest C 322 of a set of information signed by digital signature C, which can be used to generate a private encryption key for the AN program compiler. This message digest C and hash function CID are encrypted using, and the ID of the AN program compiler is explicitly added to the end of the encrypted message digest C and hash function C. The compiler's private keys and IDs are provided by the AN program compiler.

【0038】

The AN program compiler 162 calls the signature generator 168 again to generate the digital signature CP312 of the compiling party (this digital signature ends to ensure that the AS program 300 was compiled by the trusted compiling party). Can be verified by the user). This can be done in the same way as the technique for generating a digital signature CP (discussed in the compiling section of the AN program) described above. However, in this case, the message digest CP314 generated for the digital signature CP is calculated by calculating the given or selected hash function CP for the data bits of the AS program code, digital signature OP, and digital signature C. Will be generated. Like the hash function OP, for the purposes of this explanation, the hash function CP is associated with the compiling party (because it was used for the digital signature CP of the compiling party).

【0039】

The signature generating means 168 then encrypts the message digest CP314 and the hash function CP ID316 using the private encryption key of the compiling party. The signature generating means then explicitly adds the compiling party ID 318 to the end of the encrypted items 314 and 316 to form a digital signature CP. The private key and ID of the compiling party are supplied by the compiling party using user interface 152. After generating the digital signature C 320 and the digital signature CP 312, the AN program compiler 162 adds them to the AS program code 302, so that the resulting compiled AS program file or object has the following components in it: doing.

【0040】

AN program code, digital signature OP, AS program code, digital signature C, and digital signature CP. The AN program compiler then generates a message indicating that the AN program 200 has been compiled to form the AS program 300 and is ready to be sent to the calling party. The calling party then uses the network communication management means 160 to transmit the AS program 300 to the calling party's customer computer 102. The network communication management means does this by searching for the AS program located in the AS program storage means 172 and supplying it to the network communication interface 156. Next, the network communication management means instructs the network communication interface to transmit the AS program to the customer computer of the calling party.

【0041】

Object and object class creation and distribution The transmitted AS program 300 is then received by the communication interface 116 of the calling party's customer computer and instructs the network communication management means 120 to do so. In response, the calling party issues a command using user interface 252, instructing the network communication management means to search for the AS program received from the network communication interface. The network management means thereby placing the received AS program in the untrusted object class storage means 142 of the calling party's customer computer. After this is done, the calling party can generally treat the received AS program as a new object class in one way (ie, compiled program code), or AS program 300 and other AN programs and You can create an object class that contains an AS program.

【0042】

FIG. 4 shows a typical object class 400 according to the present invention. The object class can include one or more AS programs 402 and / or one or more AN programs 404, as well as a virtual function table 410. For each AS program, the virtual function table has a corresponding ID (native AS program ID) 412 that indicates that it is an AS program that is not in the AN language (that is, a native program), and a corresponding pointer 414 that points to the native program. And is included. Similarly, for each AN program, the virtual function table includes a corresponding ID (AN program ID) 416 and a corresponding pointer 418 pointing to the AN program. Each object 420 of this object class contains an object header 422 pointing to object class 400.

【0043】

As a result, the outgoing party can create the object 420 and the object class 400 by using the AS program 300 received from the server computer 104 as one of the AS programs 402 in the object class. If the calling party wishes to distribute the object, and the object class containing the AS program 300 and the AN program, to the various executing parties, the calling party issues commands using user interface 112 and executes these items. Instruct the network communication management means to transmit to the customer computer 102 of. Network communication management means do so by searching for the untrusted object class storage means 142 in which they are located and feeding them to network communication interface 116 with the appropriate transmission instructions. Alternatively, the calling party's network communication management means may respond to a request dictated by the executing party for a copy of the specified object class 400.

【0044】

Execution of architecture-neutral programs and architecture-specific programs in object classes The network communication interface 156 of the customer computer 102 receives the transmitted object and the object class, and instructs the network communication management means 160 that this reception has been performed. In response, the executing party issues a command using the user interface 112, instructing the network communication management means to search for the object and object class received from the network communication interface. The network communication management means then stores the received object and object class in the untrusted object class storage means 142.

【0045】

The untrusted object class storage means 142 of each customer computer 102 includes objects and their untrusted related object classes. These object classes have not yet been verified for their integrity by any AN program, nor have their sources verified for any AS program, or have been compiled from a valid AN program. It is not trusted because it has not been verified. The trusted object class storage means 140 of each customer computer includes objects and their trusted object classes. Because these object classes are trusted because any AN program they contain has already been verified for integrity by AN program integrity verification means 136, and any AS program they contain has been confirmed to be reliable. is there. In fact, these object classes are trusted, and therefore there is no reason to perform integrity verification on these object classes, so some or all of the object classes in the trusted object class storage means 140. Does not have to have a digital signature.

【0046】

As suggested earlier, it is desirable to have an object class that primarily contains AN programs but can also contain AS programs so that essentially all legitimate tasks can be performed using object classes. Therefore, the AN program execution means 122 executes the completeness-verifiable AN program and also calls the AS program execution means, (1) is in the trusted object class in the trusted object class storage means 140, or is it in the trusted object class? Or (2) run an unverifiable AS program in the untrusted object class in the untrusted object class storage means 142 that has verifiable digital signature OP, digital signature CP, and digital signature C information. Is possible, so that essentially all legitimate tasks can be performed. In this way, Digital Signature OP, Digital Signature CP, and Digital Signature C It prevents the execution of AS programs of untrusted object classes that have no information or their digital signatures are unverifiable. Table 3 contains pseudo-code representations of the execution procedures used by the AN program execution means.

【0047】

See Figure 1-4 and Table 3. On the customer computer 102 of the executing party (eg, the outgoing party or another party), the AN program execution means 122 can execute an AN program that seeks to call a method within the specified object class. This method call is initially handled by the object class loader 136, which determines if the object class is already loaded. If the object class is already loaded in the user address space 138 of the executing party, and the called method is an AN program, the AN program execution means 122 executes the called method and the called method. If is an AS program, the AS program execution means 124 executes the called method.

【0048】

However, if the object class is not yet loaded in the executing party's user address space 138, the object class loader 136 loads the object class into the executing party's address space and allows execution of its called method. Determine if it has been done. For example, if the object class is loaded from the trusted object class storage means 140, execution of the called method is allowed and the execution procedure is called. The execution procedure (see Table 3) calls the AN program execution means 122 if the called method is an AN program, and calls the AS program execution means 124 otherwise to execute the called method. However, if the object class is loaded from untrusted object class storage means 142, class loader 136 examines the object header of the object to determine if the object class contains an AS program. This is done by determining if the native AS program ID exists in the object's virtual function table.

【0049】

If the AS program does not exist in the object class, the class loader 136 calls the AN program integrity verification means 126 to verify the integrity of the AN program in the object class. This is done in the same way as the method for verifying the integrity of the AN program 200 described above (the method described for compiling the AN program). Therefore, if the integrity of any of the AN programs is not verified, the AN program integrity verification means will send the fail result back to the class loader, which will abort the class loading procedure and give an appropriate message to that effect. To generate. On the other hand, if AN program integrity sends back a pass result indicating that all AN programs of the object class have passed the validation, the class loader allows the called method to be executed.

【0050】

If the AS program exists in the object class, the class loader 136 calls the signature verification means 132 to verify the compiler signature "digital signature C" and the compiling party signature "digital signature CP". If none of the AS programs contain a "digital signature CP" and a "digital signature C", the integrity of the source of the AS program is not verified and therefore the signature verification means fails the AN program execution means. Is sent back. In response, the class loader aborts the loading procedure for the object class and generates an appropriate message instructing it. Furthermore, if all AS programs in the object class are "digitally signed CP" and "digitally signed C" If included, the identities of the compiling party and compiler are indicated in these two digital signatures and compared to the list 144 of known trusted compiling parties and trusted compilers (see Figure 1). To. If any AS program in the object class is compiled by a compiling party or compiler that is not part of a known trusted compiling party and set of trusted compilers, the class loading procedure is aborted. The execution of the method called by it is blocked. Similarly, if the AS language identified in any AS program does not match the AS language used by the AS program execution means 124, the class loading procedure is aborted.

【0051】

However, if all AS programs in the object class contain "digital signature CP" and "digital signature C", the identified compiling party and compiler for all AS programs are trusted compiling. If the AS language is a party and trusted compiler, and the AS language used by all AS programs is the language used by the AS program execution means, the signature verification means is the aforementioned digital signature OP verification (AN). Validate these signatures in the same way as described for programming program 200). However, in this case, the private key of the compiler and the public key of the compiling party are retrieved from the trusted key storage means 106, and the message digest C and hash function C ID in the digital signature C, and the digital signature CP. The message digest CP and the hash function CPID are used to decrypt respectively. In addition, the test message digest (test message digest C) corresponding to the decrypted message digest CP and message digest C. And the test message digest CP) is generated. This follows the hash function C and hash function CP identified by the decrypted hash function C ID and hash function CP ID, respectively, and in the case of test message digest C, the data bits of the AS program code + digital signature OP, as well. In the case of test message digest CP, it is generated by comparing the hash code for the same data bit + digital signature C.

【0052】

If the hash function C and / or the hash function CP for each AS program fails the inspection (ie, message digest C test message digest C and / or message digest CP test message digest CP), signature verification means 132 Sends a fail result back to class loader 136. In response, the class loader aborts the class loading procedure and generates an appropriate message instructing it. However, if both the digital signature C and the digital signature CP for each AS program pass the check, the AN program execution means 122 calls the signature verification means 132 again and the outgoing party for the AN program that compiles the AS program. Verify the signature (digital signature OP) of. To verify the outgoing party's digital signature, each digital signature OP is validated in the same manner as described in Compiling AN Program 200.

【0053】

If the digital signature OP of each AN program that compiles the AS program passes the check, the class loader calls the AN program integrity verification means for each AN program in its object class and the AN program that compiles the AS program. Verify completeness. This is done in the same way as the method described above. If the integrity of any of these AN programs fails the check, the AN program integrity verification means sends the fail result back to the class loader to abort the class loading and generate the appropriate message. However, if the integrity of each AN program passes the inspection, the AN program integrity verification means 126 sends the pass result back to the class loader 136. In response, the class loader calls the AN program execution means or the AS program execution means to properly execute the called method.

【0054】

As is clear from the above description, the execution party is only an untrusted object class in the untrusted storage means 142 that has an AN program and an AS program that can verify their authenticity (their digital signatures can be verified). Are guaranteed to load and run those programs. Alternative example Some of the features of the invention described above are optional. Therefore, those skilled in the art will understand that there are alternative examples that do not include these characteristics. For example, the AN program compiler has been described as generating a digital signature CP and a digital signature C for the compiling party and the AN program compiler, respectively. However, the AN program compiler may be configured to generate only one of these digital signatures and allow verification of either the compiler used to compile the AS program, or the compiling party. it can.

【0055】

Similarly, regarding the program execution means, the digital signature CP and the digital signature C It was explained that verification of both of them is necessary. However, the program execution means is configured so that only one of these digital signatures needs to be verified, and if the AS program being verified contains it, the other digital signature is optionally verified. be able to. In addition, each program execution means assumes that the compiling party is trusted and that it is the compiling party's duty to verify each AN program that is compiled into the AS program before performing the compilation. It can be configured to skip the step of verifying the integrity of the AN program corresponding to the AS program. If the calling party is the executing party, the executing party knows that it has actually sent the AN program 200, which is compiled into the AS program 300, to the server computer 104 of the compiling party. In this case, the class loader 136 does not call the signature verification means to verify the digital signature OP in the AN program. The execution party simply compares the digitally signed OP in the local copy of the AN program with the digitally signed OP in the compiled AS program. Also, the class loader can be configured not to call the AN program integrity verification means 126 to verify the integrity of the AN program corresponding to the called AS program (because the compiling server. The integrity of the AN program has been verified during preparation for the compiling procedure before being sent to the computer). Alternatively, the AN program compiling preparation means 128 can be configured not to call the AN program integrity verification means during preparation for the compiling procedure (because its integrity is determined by the compiler. And when the class loader calls the AN program integrity verification means before executing the corresponding AS program).

【0056】

Although the present invention has been described above with respect to some specific examples, this description merely illustrates the present invention and has no intention of limiting the present invention. One of ordinary skill in the art will be able to devise many modifications without departing from the true ideas and scope of the invention described in the claims.

【0057】

[table 1]

<img file="JPH1069382A_D0001.tif" />【0058】

[Table 2]

<img file="JPH1069382A_D0002.tif" />【0059】

[Table 3]

<img file="JPH1069382A_D0003.tif" />【0060】

[Table 4]

<img file="JPH1069382A_D0004.tif" />【0061】

[Table 5]

<img file="JPH1069382A_D0005.tif" />【0062】

[Table 6]

<img file="JPH1069382A_D0006.tif" />【0063】

[Table 7]

<img file="JPH1069382A_D0007.tif" />【0064】

[Effect of the invention]

The computer network of the present invention comprises a program compiling computer operated by a compiling party and receiving an architecture-neutral program generated by the calling party, the architecture-neutral program including an architecture-neutral program code and a digital signature of the calling party. Digital signatures are designed to verify that the architecture-neutral program was signed by the outgoing party at the time of verification, and the program compiling computer provides a signature verification means to verify the outgoing party's digital signature and the outgoing party's digital signature. When is verified, (A) Ah Architecture identification by compiling texture-neutral program code into architecture-specific program code in an architecture-specific language and (B) adding a digital signature of the compiling party that verifies that the architecture-specific program was generated by the compiling party during validation. A program execution computer that includes a compiler that generates a program and a signature generator that generates a digital signature of a compiling party, is operated by an execution party, receives an architecture-specific program, and receives or executes an architecture-neutral program. The program execution computer has a signature verification means for verifying the digital signature of the compiling party and an architecture when the signature of the compiling party is verified and the compiling party is a member of a limited set of trusted compiling parties. Architecture written in a specific language Includes an execution means to execute specific program code, so that the user of an AS program compiled from a corresponding AN program can identify who compiled the AN program and the corresponding AN. An AN program that can authenticate the identity of the program and the AS language that compiles the AS program and that can be verified for completeness cannot be executed and verified for completeness, but it is trusted or verified. Try to call an AS program that has possible sources and compilation information, thereby performing essentially all good tasks while preventing calls to AS programs that cannot verify source, compilation information, and completeness. can do.

【0065】

The method of the present invention is a method of operating a computer network, in a program compiling computer operated by a compiling party, generated by the calling party, the architecture-neutral program code, and the architecture-neutral program at the time of verification by the calling party. The stage of receiving an architecture-neutral program containing the outgoing party's digital signature to verify that it was signed, the stage of verifying the outgoing party's digital signature, and the stage of compiling the architecture-neutral program with a compiler and the outgoing party's digital signature. Activated by the executing party, including the step of generating an architecture-specific program when it is verified, and adding a digital signature of the compiling party to verify that the architecture-specific program was generated by the compiling party at verification. A compiler that receives an architecture-specific program and receives or sends an architecture-neutral program, verifies the digital signature of the compiling party, verifies the digital signature of the compiler, and trusts the compiler. Who compiled the AN program by the user of the AS program compiled from the corresponding AN program, including the stage of executing the architecture-specific program code when determined to be a member of the limited set of Identification, the identity of the corresponding AN program, and the AS language that compiles the AS program can be authenticated, and the AN program that can be verified for completeness cannot be executed and verified for completeness, but trust Essentially everything, while ensuring that AS programs that are or have verifiable sources and compilation information are called, thereby preventing calls for AS programs that cannot be verified for source, compilation information, and integrity. Can perform the proper tasks of.

【0066】

The system of the present invention is a system that is stored on a computer-readable medium and distributes code that can be executed by a computer so that each code performs at least one function performed by one of the computers. The system is operated by a compiling party and includes a first module that is configured for use with a program compiling computer, the compiling party being generated by the outgoing party. The architecture-neutral program is to receive the architecture-neutral program, which includes the architecture-neutral program code and the outgoing party's digital signature, which at the time of verification verifies that the architecture-neutral program was signed by the outgoing party. The first module is a signature verification means that verifies the outgoing party's digital signature, and when the outgoing party's digital signature is verified, (A) compiles the architecture-neutral program code into the architecture-specific program code in the architecture-specific language. , (B) A compiler that generates an architecture-specific program by adding a compiling party's digital signature that verifies that the architecture-specific program was generated by the compiling party at the time of verification, and a compiler that generates a compiling party's digital signature. It further comprises a second module, including a sign generator, operated by the execution party and used with the program execution computer, the execution party receiving the architecture-specific program, receiving or transmitting the architecture-neutral program, and the second. The module is an architecture-specific language when the compiling party's signature is verified and the compiling party is a member of a trusted limited set of compiling parties. Written architectureIt includes an execution means to execute specific program code, so that the user of the AS program compiled from the corresponding AN program can identify who compiled the AN program, the identity of the corresponding AN program, and the AS. An AN program that can authenticate with the AS language in which the program was compiled and that can be verified for completeness cannot be executed and verified for completeness, but with a trusted or verifiable source and compilation information. It is possible to call an AS program that has, thereby performing essentially all proper tasks, while preventing calls to an AS program whose source, compilation information, and integrity cannot be verified.

[Simple explanation of drawings]

[Figure 1]

FIG. 6 is a block diagram of a distribution computer system incorporating a preferred embodiment of the present invention.

[Figure 2]

It is a figure which shows the structure of the architecture neutral program by a preferable embodiment of this invention.

[Fig. 3]

It is a figure which shows the structure of the compiled architecture-specific program generated by the preferable embodiment of this invention.

[Fig. 4]

It is a figure which shows the object and the related object class by a preferable embodiment of this invention.

[Explanation of symbols]

100 computer network 102 Customer computer 104 server computer 106 Trusted key storage means 108 Network communication connection 110 CPU 112 User interface 114 memory 116 Network communication interface 118 Operating system 120 Network communication management means 122 Architecture Neutral (AN) Program Execution Means 124 Architecture Identification (AS) Program Execution Means 126 Architecture-neutral program integrity verification means 128 Architecture Neutral Program Compiling Preparation Measures 130 Signature generation method 132 Signature verification means 134 Compiling information verification means 136 Object class loader 138 User address space 140 Trusted object storage means 142 Untrusted object storage means 144 List of trusted compiling parties and trusted compilers 150 CPU 152 User interface 154 memory 156 Network communication interface 158 Operating system 160 Network communication management means 162 Architecture Neutral Program Compiler 164 Signature verification means 166 Architecture Neutral Program Integrity Verification Means 168 Signature generation means 170 Architecture Neutral Program Storage Means 172 Architecture specific program storage means 200 Architecture Neutral Program 202 Architecture Neutral Program Code 210 Digital signature 212 Memory Digest OP 214 Hash function OPID 216 Outgoing party ID 300 Architecture Specific Program 302 Architecture-specific program code 312 Digital signature CP 314 Message Digest CP 316 Hash Function CPID 318 Outgoing party ID 320 Digital Signature C 322 Message Digest C 324 Hash Function C ID 400 object class 402 Architecture-specific program 404 Architecture Neutral Program 410 Virtual function table 412 Native Architecture Specific Program ID 414 pointer 416 Architecture Neutral Program ID 418 pointer 420 object 422 object header