News

Google Addressing Web App Security With 'Native Client'

• By Jim Barthold
• December 11, 2008

Google is exploring a way to run code fast and natively in a Web browser without worrying about security issues. To that end, the search giant unveiled its new Native Client open source project on Monday.

Native Client, abbreviated by Google as "NaCl," is currently available for testing as research release version 0.1. The solution promises to reduce data transfers between Web servers and the browser client to better run Web applications in x86-based machines.

"With the ability to seamlessly run native code on the user's machine, you could instead perform…actual image processing on the desktop CPU, resulting in a much more responsive application by minimizing data transfer and latency," according to Brad Chen, a member of the Google Native Client team, writing on the Google Code Blog.

Chen pointed out that these tasks can be performed today using "a combination of JavaScript and server side processing." However, that approach is "painfully slow" because of the data chunks that must be transferred.

On the other hand, local CPU processing of data using Web applications poses security issues, which is the main question that Google is trying to address with the release of Native Client.

"To help protect users from malware and maintain portability, we have defined strict rules for valid modules," Chen wrote. "Our approach is built around a software containment system called the inner-sandbox [that] uses static analysis to detect security defects in untrusted x86 code."

These security measures specify a set of structural criteria for all modules. For instance, "modules may not contain certain instruction sequences," according to Chen. The goal is to help developers to create "safer and more dynamic applications that can run on any OS and any browser," Chen wrote. 

The initial release of Native Client is a hefty download that includes compilation tools and runtime. It also has a software development kit to write portable code modules that will work in Firefox, Safari, Opera and Google Chrome.

Currently, Native Client is not supported in Internet Explorer. While Microsoft's ActiveX technology allows code to run natively, a Google white paper (PDF) explains that it requires the "manual establishment of trust relationships through pop-up dialog boxes…[that] have been inadequate to prevent execution of malicious native code."

The white paper asserts that in contrast to ActiveX, "NaCl is designed to prevent such exploitation, even for flawed NaCl modules."

Some readers of the Google Code Blog have compared the Native Client technology with an Adobe solution code-named "Alchemy." The Alchemy solution lets developers run C and C++ code via the Adobe Flash platform.

Native Client will run on any Windows, Mac or Linux system with an x86 processor. Chen explained that Google is "working on supporting other CPU architectures (such as ARM and PCC) to make this technology work on the many types of devices that connect to the Web today."

The test software can be downloaded at the Google Native Client Web page here.