Scientists create tool to improve software security

July 23, 2012: A new tool, developed by a team of Harvard researchers, could improve security and ensure enhanced performance for popularly used mobile and web apps. The code, named RockSalt, can check whether native computer programming languages conform to a certain security policy.

According to Greg Morrisett, professor of computer science at the Harvard School of Engineering and Applied Sciences (SEAS), when a user opens an external app, like Angry Birds or Gmail, browsers like Google Chrome usually run the programme's code in a safer and intermediate language like JavaScript. But, the use of native code, particularly in an online environment, creates security vulnerabilities.

According to a Harvard statement, an early solution to this issue was given over a decade ago by computer scientists who developed software fault isolation (SFI) at the University of California, Berkeley.

SFI forces native code to "behave" by rewriting machine code to restrict itself to functions that follow specific parameters. This "sandbox process" sets up a contained environment for running native code. A separate "checker" programme can then see that the executable code adheres to regulations before running the program.

Although a key innovation, the solution was restricted to devices using RISC chips, a processor mostly employed in research than for consumer computing.

In 2006, Morrisett came up with a method to implement SFI on the more popular CISC-based chips. Google adapted the routine for Google Chrome, ultimately developing it into NaCl (Google Native Client).

When bugs were found in the checker for NaCl, Morrissett took on the challenge yet another time, turning it into an opportunity for his students. The result was RockSalt -- an enhanced NaCl achieved through the use of Coq, a proof development system.

Via - IANS