Method, computer program and device for providing security for intermediate programming code for its execution by a virtual machine
The invention in particular relates to provide security for intermediate programming code for its execution by a virtual machine. After having received ( 200 ) a plurality of pseudo-instructions of the intermediate programming code, the plurality of bytecode instructions is converted ( 230, 235 ), the conversion including a step of inserting at least one bytecode instruction relative to a function for execution checking of at least one bytecode instruction of the plurality of bytecode instructions. A following step is directed to generating bytecode, the generated bytecode including the plurality of converted bytecode instructions.
1. A computer method for providing security for intermediate programming code for execution by a virtual machine, the method comprising:
receiving ( 200 ) a plurality of bytecode instructions of said intermediate programming code;
converting ( 230 , 235 ) said plurality of bytecode instructions, said conversion comprising a step of inserting at least one bytecode instruction relative to a function for execution checking of at least one bytecode instruction of said plurality of bytecode instructions; and
generating bytecode, the generated bytecode comprising said plurality of converted bytecode instructions.
2. The method according to claim 1 , wherein said inserting step comprises a step of inserting a bytecode instruction representing a command for said virtual machine.
3. The method according to claim 2 , wherein said command for said virtual machine is directed to the verification of an execution stack of said virtual machine in order to check that said execution stack of said virtual machine is empty.
4. The method according to claim 1 , wherein said converting step comprises, for each of said received bytecode instructions, the following steps:
if said bytecode instruction is directed to predetermined processing of at least one first predetermined value, deleting said bytecode instruction and inserting ( 230 ) a bytecode instruction concerning said predetermined processing for at least one second predetermined value, distinct from said at least one first predetermined value; and
if said bytecode instruction is directed to the comparison of said at least one first value with another value, deleting said bytecode instruction and inserting ( 230 ) a bytecode instruction directed to comparing said at least one second value with said other value.
5. The method according to claim 4 , wherein said bytecode instruction directed to predetermined processing of at least one first predetermined value is directed to the initialization or attribution of a local variable whose value is, after execution of the initializing or attributing step, equal to said first value.
6. The method according to claim 5 , further comprising:
a step of defining ( 225 ) or computing said at least one second value.
7. The method according to claim 5 , further comprising:
analyzing ( 315 , 320 ) at least one set of said plurality of bytecode instructions, said steps of deleting said bytecode instruction, directed to predetermined processing of at least one first predetermined value; and
inserting said bytecode instruction directed to said predetermined processing for at least one second predetermined value, being attributed in response to said analyzing step.
8. The method according to claim 4 , further comprising:
defining ( 225 ) or computing said at least one second value.
9. The method according to claim 8 , further comprising:
analyzing ( 315 , 320 ) at least one set of said plurality of bytecode instructions, said steps of deleting said bytecode instruction, directed to predetermined processing of at least one first predetermined value; and
inserting said bytecode instruction directed to said predetermined processing for at least one second predetermined value, being attributed in response to said analyzing step.
10. The method according to claim 4 , further comprising:
analyzing ( 315 , 320 ) at least one set of said plurality of bytecode instructions, said steps of deleting said bytecode instruction, directed to predetermined processing of at least one first predetermined value; and
inserting said bytecode instruction directed to said predetermined processing for at least one second predetermined value, being attributed in response to said analyzing step.
11. The method according to claim 1 claims, the method further comprising a prior step of code compiling ( 110 ), the result of said compiling step comprising said plurality of bytecode instructions.
12. A non-transitory computer-readable medium having stored thereon computer-readable code in the form of a computer program comprising instructions sufficient for causing a CPU of a computer device to carry out each of the steps of the method according to claim 1 when said program is executed on the computer device.
13. A device comprising means adapted for implementation of each of the steps of the method according to claim 1 .