A software runtime memory fingerprint watermarking protection method and system

Abstract

The application relates to a software runtime memory fingerprint watermark protection method and system, and belongs to the field of computer software security protection.The method comprises the following steps: collecting various hardware characteristic information of a target device to generate a device fingerprint, selecting a predetermined position segment as a deterministic random seed, driving a pseudo-random number generator by the seed, constructing a hierarchical object tree, recursively traversing the object tree to calculate final hash values of each node, collecting node identification, the number of child nodes, the final hash value of the node and the address difference between the parent node and the child node, and obtaining a comprehensive topology hash value through a cryptographic hash operation, repeatedly executing comparison of the comprehensive topology hash value at random time intervals during operation, and identifying debugging behavior in multiple dimensions by using different detection methods, and executing a hierarchical threat response according to the comparison result and the anti-debugging detection result.The application closely binds the device fingerprint and the runtime memory layout, realizes strong association protection of a software running environment and a memory topology, and effectively resists copying, tampering and dynamic debugging attacks.

Description

Technical Field

[0001] This invention relates to the field of computer software security protection, and in particular to a method and system for protecting software runtime memory fingerprint watermarks. Background Technology

[0002] As software products are increasingly distributed and deployed via the internet, unauthorized copying, illegal tampering, and dynamic debugging and analysis of commercial and security-sensitive software are on the rise. Attackers migrate software originally authorized to run on specific devices to other devices by copying installation packages or memory images, or they disrupt the normal operation of software by modifying critical logic, bypassing authorization checks, or injecting malicious code, thereby gaining illicit profits or launching deeper attacks. Therefore, how to effectively prevent copying, tampering, and debugging analysis while ensuring software availability has become one of the core issues in the field of software protection.

[0003] In existing technologies, a common approach is a hardware-based authorization control mechanism. This type of mechanism typically reads parameters such as the physical address identifier of the network interface, the identification information of the processing unit, and the serial number of the storage medium during software startup. These parameters are then combined or hashed to form a device identifier, which is recorded on the authorization server. During software runtime, the current device identifier is compared with the authorization record; if they do not match, execution is refused. While this approach could initially limit copying and installation to some extent, because the hardware parameters it relies on are mostly static information, attackers can forge these parameters by emulating drivers, modifying system configurations, or constructing virtualized environments. This allows the software to mistakenly believe it is running on a legitimate device, rendering hardware binding ineffective.

[0004] Another widely adopted technique is protection based on code signing and static integrity verification. A typical approach involves calculating a digest of the executable file or critical modules before software release and generating a digital signature using a key. This signature is then verified during the loading or startup phase. If the file content is found to have been modified or the signature verification fails, the software refuses to continue running. This type of technique is effective in preventing tampering of the distribution medium during storage and transmission, and it is somewhat effective against static tampering. However, attackers can bypass static verification by directly modifying instructions and data in runtime memory using debuggers or injection tools after the software has passed signature verification and been loaded into storage. Since static verification is typically only performed during the loading phase and cannot cover memory tampering that occurs during runtime, a significant "window of opportunity" exists.

[0005] To address data integrity issues, existing technologies have proposed tree-structure-based verification mechanisms. For example, data blocks are organized into multi-level tree structures, and hash operations are performed on each level's nodes from bottom to top to obtain a root hash value representing the overall data content. Under this mechanism, any modification to a data block will change its corresponding hash value, which will propagate through the tree structure to the root node and be detected. However, such tree-structure integrity verification typically only targets the data content itself, neglecting the spatial relationships of the data in storage space and failing to record the address structure between adjacent data units. Attackers can adjust the memory layout or copy an entire data tree to another device's storage space without altering the tree structure and data content. As long as the data within the tree remains consistent, the root hash value will not change. This characteristic makes it difficult to defend against attacks based on memory copying and layout replay in software protection scenarios.

[0006] In terms of countermeasures against dynamic analysis, common anti-debugging techniques mainly focus on single detection methods. For example, during software runtime, the field used to identify debugging control relationships in the current process state information is read, and a response is made if a debugger is found to be attached; or the software attempts to put itself into a controlled state through the debugging control interface, and if the request fails due to existing debugging control, it is determined that external debugging behavior exists; or the execution speed is judged to be abnormal through simple time measurement. However, in actual countermeasures, attackers can circumvent a single detection method, such as modifying process state information, hooking debugging control interface calls, or interfering with time measurement by adjusting the system clock or inserting idle instructions, thereby reducing the reliability of a single anti-debugging method.

[0007] In summary, existing technologies have the following four main pain points in terms of software runtime protection: First, the protection measures focus too much on the static phase. Traditional hardware binding and code signing technologies mostly complete checks during the installation or loading phase, primarily protecting static files and the installation environment, while lacking continuous monitoring of the memory state during the long-term operation of the software. Once the software successfully passes the initial checks and enters the runtime phase, attackers can modify runtime memory without triggering static protection. This "static protection - dynamic exposure" model is insufficient to meet the needs of high-security scenarios.

[0008] Second, device fingerprints are inherently vulnerable. Existing hardware binding schemes typically use a set of static parameters as device identifiers, but these parameters can be emulated by virtualization platforms or modified by intermediate layers. For example, specific network interface identifiers and processing unit characteristics can be simulated in a virtual machine to bypass checks; in some operating systems, these identifiers can also be directly changed by modifying relevant configuration files. Since there is no close correlation between device fingerprints and the runtime memory layout of software, attackers who can successfully forge fingerprints can copy and replay protected software in any environment.

[0009] Third, the timing of detection is highly predictable. While some existing runtime verification mechanisms introduce periodic checks, they typically use fixed time intervals, such as performing integrity checks every few seconds or minutes. Once an attacker understands the detection cycle, they can tamper with the data between checks and restore it to its original state before the next detection—a so-called "tamper-restore" round-trip attack. In this scenario, even with runtime detection mechanisms, their actual deterrent effect is significantly reduced.

[0010] Fourth, the response strategy lacks hierarchy. Traditional software protection mechanisms often only offer two extreme options after detecting anomalies: "continue running" or "immediate termination." On the one hand, immediately terminating the program upon receiving a false alarm can severely impact the user experience for normal users; on the other hand, simply logging without taking further action is insufficient to effectively suppress persistent attacks. In some scenarios, developers want to mitigate risks while they are still manageable by downgrading services or rebuilding the protection structure, and only completely lock down the application when a significant threat is confirmed. Existing simple response mechanisms cannot meet this need.

[0011] Therefore, there is an urgent need for a method and system for protecting software runtime memory fingerprint watermarks to solve the above problems. Summary of the Invention

[0012] To address the aforementioned problems, this invention provides a method and system for protecting software runtime memory fingerprint watermarks.

[0013] In a first aspect of the present invention, a method for protecting software runtime memory fingerprint watermarks is provided. The method includes: Collect various hardware feature information of the target device, encode the various hardware feature information and perform cryptographic hash operation to generate device fingerprint, and select a pre-position segment from the device fingerprint as a deterministic random seed; A pseudo-random number generator driven by a deterministic random seed is used to construct a target device-specific hierarchical object tree in the storage space during software runtime. The hierarchical depth of the object tree and the number of child nodes of each non-leaf node are determined by the deterministic random seed. A bottom-up recursive traversal is performed on the object tree to calculate the final hash value of each node. At the same time, the node identifier information, number of child nodes, final hash value of the node, and address difference between the node and its parent node are collected in the traversal order. After connecting them in a predetermined format to form a topology description sequence, cryptographic hash operation is performed to obtain the comprehensive topology hash value. The final hash value of the root node is used as the memory fingerprint of the object tree at this level. During software operation, integrity checks are repeatedly performed at random time intervals. The calculated comprehensive topology hash value is compared with the expected value to obtain the comparison result. At the same time, various detection methods are used to identify debugging behavior from multiple dimensions to obtain anti-debugging detection results. A tiered threat response will be implemented based on the comparison results and anti-debugging detection results.

[0014] Optionally, the various hardware feature information of the target device to be collected includes: Iterate through all network interfaces configured on the device, excluding loopback interfaces, inactive network interfaces, and network interfaces without configured physical addresses. Select the first network interface that meets the conditions from the remaining valid network interfaces and obtain its physical address identifier. The system information file maintained by the operating system reads the model name, feature list, and number of physical cores of the processing unit, and concatenates the model name, feature list, and number of physical cores of the processing unit to form a comprehensive feature description of the processing unit. Obtain the hostname of the current device through the network interface provided by the operating system; The physical address identifier, comprehensive feature description, and hostname are encoded into byte sequences and concatenated in a first predetermined order to form feature description data. The feature description data is then input into a cryptographic hash algorithm to generate a device fingerprint.

[0015] Optionally, the construction of the object tree includes: Use a pseudo-random number generator to determine the maximum depth of the object tree within a preset depth range; Create a root node in the storage space and set formatted identification information including hierarchy and index; Starting from the root node, child nodes are generated recursively. For the parent node of each child node to be generated, a pseudo-random number generator is used to determine the number of its child nodes within a preset range. For each child node, a node entity is created in the storage space, formatted identification information including the current level, the current level index, and the parent node index is set, a deterministic random value is generated as the node fingerprint attribute, and the child node generation process is recursively called with the current child node as the new parent node until the maximum depth is reached.

[0016] Optionally, performing a bottom-up recursive traversal of the object tree and calculating the final hash value of each node includes: A node with no children is called a leaf node, and its final hash value is calculated through the following steps: Convert the starting address of the leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the address value of the starting address to obtain the node address hash value of the leaf node; Convert the starting address of the parent node of the leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the starting address value to obtain the hash value of the parent node address of the leaf node; Obtain the node identifier information of the leaf node; The node address hash value, parent node address hash value, and node identifier information of the leaf node are combined in a second predetermined order and input into a cryptographic hash algorithm for calculation to obtain the final hash value of the leaf node. The final hash value is stored as a secondary attribute of the node for use by the parent node in its calculations. A node with child nodes is called a non-leaf node, and its final hash value is calculated through the following steps: Convert the starting address of the non-leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the address value of the starting address to obtain the node address hash value of the non-leaf node; Convert the starting address of the parent node of the non-leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the starting address value to obtain the hash value of the parent node address of the non-leaf node; Collect the hash values ​​of all child nodes of the non-leaf node, and concatenate all the child node hash values ​​into a continuous data block according to the third predetermined order of the child nodes; The data blocks containing the hash values ​​of the non-leaf node's address, parent node's address, and child node's address are combined in a fourth predetermined order and input into a cryptographic hash algorithm for computation to obtain the final hash value of the non-leaf node.

[0017] Optionally, the calculation method for the comprehensive topological hash value includes: The entire object tree is traversed using a depth-first traversal method. Four-dimensional information is collected for each visited node. The four-dimensional information includes node identification information, number of child nodes, final hash value of the node, and address difference information between adjacent nodes. Following the depth-first traversal order, the four-dimensional information of each node is connected sequentially according to a preset format: After the entire object tree has been traversed, the encoded information of all nodes is concatenated into a large topological description sequence. Cryptographic hashing is then performed on this topological description sequence to obtain the comprehensive topological hash value.

[0018] Optionally, the preset format is: Node identifier + "|" + number of child nodes + "|" + final hash value of the node + "|" + address difference; The "|" symbol is used as a separator.

[0019] Optionally, the method utilizes various detection techniques to identify debugging behavior from multiple dimensions, including: Process status detection: Obtain a field used to indicate whether there is an external debug control relationship. If the value of this field is zero, it means that there is no external debugger attached at present; if the value of this field is non-zero, it means that there is an external debugger controlling the current process. Self-tracing detection: Create a child process; in the child process, call the system interface related to debugging control and request to attach to the parent process in debug mode; if the attachment request is successful, it means that the parent process is not currently controlled by other debuggers, the child process performs cleanup operations and exits, returning the conclusion that no debugger exists; if the attachment request fails, the child process exits immediately and returns the conclusion that a debugger exists; the parent process waits for the child process to end and obtains its return result, and determines whether there is external debugging behavior based on this. Timing analysis and detection: During system initialization, the same cryptographic operation code snippet is executed multiple times, and the execution time of each execution is measured using a high-precision time base. The average value is taken as the baseline value of the normal execution time. During detection, the same code snippet as during calibration is executed, and the actual execution time is measured. If the actual execution time exceeds 10 times the baseline value, it is determined that there is an abnormal delay, which may be caused by single-step execution or breakpoint pause. Based on this, it is determined that there is external debugging behavior.

[0020] Optionally, the method also includes constructing a memory obfuscation structure in the storage space using the following method: A pseudo-random number generator is initialized with a deterministic random seed. Multiple nodes are created in the storage space, and three types of reference relationships—forward references, backward references, and cross-references—are established between the nodes to form an irregular mesh structure. Some nodes communicate and verify each other through a challenge-response mechanism, which includes: the source node generating a challenge value and sending it to the target node; the target node returning a response value according to a response value calculation formula, which is: Response value = (Sender ID XOR Challenge value XOR Receiver ID) × Constant coefficient + Receiver ID; The source node independently calculates the expected response value and compares it with the response value returned by the target node. If they are inconsistent, the memory obfuscation structure is determined to be abnormal. When a memory obfuscation structure is determined to be abnormal, the level of the tiered threat response is increased.

[0021] Optionally, the step of performing a graded threat response based on the comparison results and anti-debugging detection results includes: Log security information and report to higher management when a low-level threat is detected; In the event of a medium-level threat, switch the protected functions to degraded mode and rebuild the protection structure; In the event of an advanced threat, perform a security wipe of pre-registered sensitive data, performing multiple random overwrites followed by a complete erasure. In the event of a serious threat, the system will enter a locked state and cease providing normal services.

[0022] In a second aspect of the invention, a software runtime memory fingerprint watermark protection system is provided. The system includes: a hardware fingerprint acquisition module, an object tree generation module, a hash chain construction module, a topology verification module, an integrity monitoring module, and a threat response module that communicate sequentially; and an anti-debugging detection module and a memory obfuscation structure module that communicate with the integrity monitoring module. The threat response module communicates with the object tree generation module, wherein: The hardware fingerprint acquisition module is used to collect various hardware feature information of the target device, encode the various hardware feature information and perform cryptographic hash operation to generate device fingerprint, and select a pre-position segment from the device fingerprint as a deterministic random seed; The object tree generation module is used to drive a pseudo-random number generator with a deterministic random seed to build a target device-specific hierarchical object tree in the storage space during software runtime. The hierarchical depth of the object tree and the number of child nodes of each non-leaf node are determined by the deterministic random seed. The hash chain building module is used to perform bottom-up recursive traversal of the object tree, calculate the final hash value of each node, and use the final hash value of the root node as the memory fingerprint of the object tree at that level. The topology verification module is used to collect the node identification information, number of child nodes, final hash value of the node, and address difference between the node and its parent node for each node in traversal order. After connecting them in a predetermined format to form a topology description sequence, cryptographic hash operation is performed to obtain the comprehensive topology hash value. The integrity monitoring module is used to repeatedly perform integrity checks at random time intervals during software operation. It compares the currently calculated comprehensive topology hash value with the expected value to obtain the comparison result. At the same time, it uses a variety of different detection methods to identify debugging behavior from multiple dimensions and obtain anti-debugging detection results. The threat response module is used to perform tiered threat responses based on the comparison results and anti-debugging detection results; The memory obfuscation structure module is used to create multiple interconnected nodes in the storage space using deterministic random seeds, establish forward references, backward references and cross references to form a mesh structure, and verify the integrity of communication between nodes through a challenge-response mechanism; The anti-debugging detection module is used to identify external debugging behavior through at least one of three methods: process state detection, self-tracing detection, and timing analysis detection.

[0023] In summary, the present invention has at least one of the following beneficial technical effects: 1. By mapping various hardware characteristics to deterministic random seeds through cryptographic hashing, and using these seeds to drive the generation of object trees in runtime memory, a unique memory topology is achieved for each device, thus realizing a tight binding between the software runtime environment and memory layout. The memory fingerprints of the same software are completely different on different devices, significantly improving the ability to prevent copying and cloning.

[0024] 2. By explicitly incorporating node address information and parent-child address relationships into the node hash value calculation, the memory fingerprint becomes sensitive to changes in location within the storage space. Any adjustment to the node address or hierarchical relationship will cause a change in the root hash value. Compared to traditional tree-based verification that only targets data content, this invention provides stronger runtime memory integrity protection capabilities.

[0025] 3. Through a multi-dimensional topological hashing mechanism, information such as node identifier, number of child nodes, final hash value of the node, and address difference between adjacent nodes are uniformly incorporated into the hash operation to form a comprehensive topological value that simultaneously represents the logical structure and physical layout. Even if an attacker copies the data content of the entire object tree and attempts to replay it in other environments, it will be difficult to construct a completely consistent topological fingerprint, thus effectively preventing simple data copying from bypassing the verification.

[0026] 4. By randomly selecting the integrity verification interval within a preset time range and randomly determining the next detection time after each verification, the predictability of the time window brought about by the fixed period mechanism is eliminated. Attackers find it difficult to accurately grasp the detection timing, significantly increasing the difficulty of implementing "tamper-recovery" attacks, thereby improving the actual effectiveness of runtime protection.

[0027] 5. By introducing a tiered response mechanism based on threat level, the system primarily logs and issues alerts during low-level threats; mitigates risks during medium-level threats through functional degradation and protection architecture reconstruction; and performs sensitive data security erasure and application locking during high- and severe threats. This achieves a progressive approach from "observation—mitigation—isolation" to "lockdown." This mechanism maximizes system availability while ensuring security, avoiding service interruptions caused by false alarms.

[0028] 6. By constructing a mesh-like memory obfuscation structure with forward, backward, and cross-references in the storage space, and combining it with an internal communication verification mechanism, the complexity of the memory structure is significantly increased without significantly increasing resource consumption. Attackers need to handle a large number of mutually referencing nodes when performing static analysis or dynamic debugging, significantly increasing the number of analysis paths and greatly increasing the time and resource costs required for reverse engineering, thus playing an effective deterrent and delaying role. Attached Figure Description

[0029] Figure 1 This is a system diagram of a software runtime memory fingerprint watermark protection system according to an embodiment of this application.

[0030] Figure 2 This is a flowchart of a software runtime memory fingerprint watermark protection method according to an embodiment of this application.

[0031] Figure 3 This is a flowchart of device fingerprint generation in an embodiment of this application.

[0032] Figure 4 This is a flowchart of the object tree construction in an embodiment of this application.

[0033] Figure 5 This is a flowchart illustrating the construction of an address-sensitive hash chain in an embodiment of this application.

[0034] Figure 6 This is a flowchart of the comprehensive topological hash value calculation in an embodiment of this application.

[0035] Figure 7 This is a schematic diagram of the memory obfuscation structure in an embodiment of this application.

[0036] Figure 8 This is a flowchart of the anti-debugging detection method in an embodiment of this application.

[0037] Figure 9 This is a schematic diagram of the random interval integrity monitoring process in an embodiment of this application.

[0038] Figure 10 This is a flowchart of the graded threat response in an embodiment of this application. Detailed Implementation

[0039] The present invention will be further described in detail below with reference to the accompanying drawings.

[0040] This specific embodiment is merely an explanation of the present invention and is not intended to limit the invention. After reading this specification, those skilled in the art can make modifications to this embodiment without contributing any inventive step, but such modifications are protected by patent law as long as they fall within the scope of the claims of the present invention.

[0041] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] The embodiments of the present invention will now be described in further detail with reference to the accompanying drawings.

[0043] like Figure 1 As shown, a software runtime memory fingerprint watermark protection system includes a hardware fingerprint acquisition module, an object tree generation module, a hash chain construction module, a topology verification module, an integrity monitoring module, and a threat response module that communicate sequentially with each other. It also includes an anti-debugging detection module and a memory obfuscation structure module that communicate with the integrity monitoring module. The threat response module communicates with the object tree generation module. Wherein: The hardware fingerprint acquisition module is used to collect various hardware feature information of the target device, encode the various hardware feature information and perform cryptographic hash operation to generate device fingerprint, and select a pre-position segment from the device fingerprint as a deterministic random seed; The object tree generation module is used to drive a pseudo-random number generator with a deterministic random seed to build a target device-specific hierarchical object tree in the storage space during software runtime. The hierarchical depth of the object tree and the number of child nodes of each non-leaf node are determined by the deterministic random seed. The hash chain building module is used to perform bottom-up recursive traversal of the object tree, calculate the final hash value of each node, and use the final hash value of the root node as the memory fingerprint of the object tree at that level. The topology verification module is used to collect the node identification information, number of child nodes, final hash value of the node, and address difference between the node and its parent node for each node in traversal order. After connecting them in a predetermined format to form a topology description sequence, cryptographic hash operation is performed to obtain the comprehensive topology hash value.

[0044] The integrity monitoring module is used to repeatedly perform integrity checks at random time intervals during software operation. It compares the currently calculated comprehensive topology hash value with the expected value to obtain the comparison result. At the same time, it uses a variety of different detection methods to identify debugging behavior from multiple dimensions and obtain anti-debugging detection results.

[0045] The threat response module is used to perform tiered threat responses based on comparison results and anti-debugging detection results.

[0046] The memory obfuscation structure module is used to create multiple interconnected nodes in the storage space using deterministic random seeds, establish forward references, backward references and cross references to form a mesh structure, and verify the integrity of communication between nodes through a challenge-response mechanism.

[0047] The anti-debugging detection module is used to identify external debugging behavior through at least one of three methods: process state detection, self-tracing detection, and timing analysis detection.

[0048] like Figure 2The flowchart of a software runtime memory fingerprint watermark protection method is shown below: Example 1: Generating Device Fingerprints like Figure 3 As shown, the core idea of ​​device fingerprint generation is to extract hardware feature information from multiple dimensions of the device, combine these feature information and generate a fixed-length device fingerprint through cryptographic hashing, and then extract some bits from the device fingerprint as a deterministic random seed.

[0049] First, this invention collects the following three types of hardware feature information: The first type of hardware characteristic information: the physical address identifier of the network interface.

[0050] The system iterates through all network interfaces configured on the device and checks the validity of each network interface in turn.

[0051] First, exclude loopback interfaces (i.e., virtual interfaces used for local communication). Second, exclude network interfaces that are inactive. Finally, exclude network interfaces without configured physical addresses. From the remaining valid network interfaces, select the first valid network interface that meets the conditions and obtain its physical address identifier (usually a 48-bit hardware address). This physical address identifier is fixed by the device manufacturer during production, is globally unique, and is an important basis for identifying the device's network identity.

[0052] The second type of hardware characteristic information: the model and characteristic marking information of the processing unit.

[0053] The system reads detailed parameters of the processing unit from the system information file maintained by the operating system.

[0054] First, the processor's model name (e.g., Intel Core i7-9700K) is extracted. This model name reflects the processor's architecture generation and performance level. Second, a list of characteristic markers for the processor is extracted. This list contains various functional features supported by the processor (e.g., floating-point unit, security extensions, advanced vector extensions, etc.). This invention selects markers starting with a specific prefix (e.g., markers starting with f, s, a) from these functional features as representative features. Finally, the number of physical cores of the processor is extracted. The number of physical cores reflects the processor's parallel computing capability. The above model name, representative features, and number of physical cores are connected with separators to form a comprehensive characteristic description of the processing unit.

[0055] The third type of hardware characteristic information: operating system host identifier.

[0056] The system obtains the hostname of the current device through the network interface provided by the operating system. The hostname is a logical identifier of the device set by the administrator during system configuration, which serves to distinguish different devices in the same network environment.

[0057] Then, after the above three types of hardware feature information are collected, the three types of hardware feature information are encoded into byte sequences respectively, and connected in a first predetermined order (such as network interface first, then processing unit, and finally host identifier) ​​to form complete feature description data. The feature description data is then input into a cryptographic hash operation (such as the secure hash algorithm SHA-256, with an output length of 256 bits). After multiple rounds of compression operations, a fixed-length device fingerprint of 32 bytes is obtained.

[0058] Finally, the first four bytes are extracted from the generated device fingerprint and converted into a 32-bit unsigned integer according to little-endian byte order (i.e., least significant byte first), serving as a deterministic random seed. This deterministic random seed has the following characteristics: the same device will obtain the same seed value each time the above process is executed; different devices will obtain significantly different seed values ​​due to differences in hardware characteristics. This characteristic provides a device-level distinguishing basis for subsequent object tree generation.

[0059] Example 2: Generating an Object Tree like Figure 4 As shown, the core idea of ​​object tree generation is to use a pseudo-random number generator with a deterministic random seed (hereinafter referred to as the "device seed value") as the initial state to recursively generate a hierarchical node tree in memory. Due to the determinism of the pseudo-random number generator, the topology of the object tree generated on the same device is completely consistent each time; however, due to different deterministic random seeds on different devices, the topology of the object tree generated is also completely different.

[0060] This invention employs the Mason tween algorithm as a pseudo-random number generator. This algorithm features a long period, excellent statistical properties, and high computational efficiency, making it highly suitable for generating deterministic random structures. The pseudo-random number generator is initialized with the derived 32-bit seed value, bringing it to a deterministic initial state.

[0061] First, a pseudo-random number generator is used to randomly select the maximum depth of the object tree within a first preset range. In this invention, the depth range is limited to between 5 and 8 layers, meaning the generated object tree may have a hierarchical structure of 5, 6, 7, or 8 layers. This depth is uniquely determined by the seed value, and the depth of the object tree generated each time on the same device remains consistent.

[0062] Secondly, a root node is created in the storage space, and a unique identifier (including formatted encoding of level and index) is set for the root node. The seed value of the deterministic random seed is stored as an auxiliary attribute of the root node. The root node is the starting point of the entire tree, and all other nodes are direct or indirect descendants of the root node.

[0063] Then, starting from the root node, child nodes are generated recursively layer by layer. For the parent node of each child node to be generated, the number of its child nodes is first determined using a pseudo-random number generator within a second preset range. In this invention, the number of child nodes for each non-leaf node is limited to between 2 and 6, and then the following operations are performed for each child node in sequence: Create child node entities in the storage space; Set formatted node identification information for child nodes, which includes the current level, the index at the current level, and the encoding of the parent node's index; A deterministic random value is generated using a pseudo-random number generator and used as the fingerprint attribute of the child node. Using the current child node as the new parent node, recursively call the child node generation process until the maximum depth of the object tree is reached.

[0064] Finally, through the above recursive process, the final generated object tree contains 200 to 500 nodes. At this point, the size of the object tree's nodes provides a sufficiently complex topology to resist analysis and replication attacks while also controlling storage space overhead and avoiding significant impact on system performance.

[0065] Example 3: Constructing an Address-Sensitive Hash Chain The core idea of ​​address-sensitive hash chain construction is to explicitly introduce the address information of nodes in the storage space and the address relationship between parent and child nodes on the basis of traditional tree hash verification. This allows any change in the address of a node to propagate to the root node through the diffusion effect (avalanche effect) of hash operation, thereby changing the root hash value of the entire object tree.

[0066] This invention uses a post-order traversal method (i.e., processing all child nodes first, then processing the parent node) to calculate the hash value of each node sequentially from bottom to top.

[0067] A node with no child nodes is called a leaf node, and its hash value is calculated through the following steps: Convert the starting address of the leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the address value of the starting address to obtain the node address hash value of the leaf node; Convert the starting address of the parent node of the leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the starting address value to obtain the hash value of the parent node address of the leaf node; Obtain the node identifier information of the leaf node; The node address hash value, parent node address hash value, and node identifier information of the leaf node are combined in a second predetermined order and input into a cryptographic hash algorithm for calculation to obtain the final hash value of the leaf node. The final hash value is stored as a secondary attribute of the node for use by the parent node in calculations.

[0068] A node with child nodes is called a non-leaf node, and its hash value is calculated through the following steps: Convert the starting address of the non-leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the address value of the starting address to obtain the node address hash value of the non-leaf node; Convert the starting address of the parent node of the non-leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the starting address value to obtain the hash value of the parent node address of the non-leaf node; Collect the hash values ​​of all child nodes of the non-leaf node (since post-order traversal is used, the hash values ​​of all child nodes have been calculated at this time), and concatenate all child node hash values ​​into a continuous data block according to the third predetermined order of child nodes (such as ascending index). The data blocks containing the hash values ​​of the non-leaf node's address, parent node's address, and child node's address are combined in a fourth predetermined order and input into a cryptographic hash algorithm for computation to obtain the final hash value of the non-leaf node. The final hash value is stored as an auxiliary attribute of the node.

[0069] For ease of understanding, such as Figure 5 As shown below, the construction process of an address-sensitive hash chain is illustrated using a 3-level, 5-node object tree as an example: The object tree includes nodes A, B, C, D, and E. Node A is the root node, and nodes B and C are children of node A, meaning node A is the parent node of nodes B and C. Nodes D and E are children of node B, meaning node B is the parent node of nodes D and E. From another perspective, nodes C, D, and E are leaf nodes, while nodes A and B are non-leaf nodes.

[0070] First, calculate the final hash value of node D and node E. Then, calculate the final hash value of node B (merging the final hash values ​​of node D and node E). Next, calculate the final hash value of node C. Finally, calculate the final hash value of node A (merging the final hash values ​​of node B and node C).

[0071] Wherein, the final hash value of node D = Hash(address of D, address of B, identifier of D); The final hash value of node E = Hash(address of E, address of B, identifier of E); The final hash value of node C = Hash(address of C, address of A, identifier of C); The final hash value of node B = Hash(address of B, address of A, hash value of D || hash value of E); The final hash value of node A = Hash(address of A, null, hash value of B || hash value of C); The symbol "||" represents a data concatenation operation. The final hash value of node A is the memory fingerprint of the entire object tree.

[0072] Since the final hash value of each node depends on its actual address in storage, when the object tree is copied to the storage space of another device, even if the logical relationship between all nodes remains unchanged, the actual addresses of each node will change, resulting in a change in the address hash value of each node. Based on the avalanche effect of cryptographic hash functions (i.e., a small change in input leads to a significant change in output), the address change will propagate through layers of hash operations to the root node, making the hash value of the copied root node completely different from the original value, thus effectively detecting memory copying attacks.

[0073] Example 4: Calculating Multidimensional Topological Hash like Figure 6 As shown, the core idea of ​​multidimensional topological hash calculation is to focus not only on the independent characteristics of each node in the object tree, but also on the relative positional relationship between nodes and the overall topological structure, and to integrate logical structure information and physical layout information into a comprehensive hash value.

[0074] First, the entire object tree is traversed using a depth-first search approach, and the following four-dimensional information is collected for each visited node: First dimension: Node identification information Collect node identification information, which includes the current level, the index at the current level, and the encoding of the parent node index. The node identification information is used to represent the logical identity of the node in the object tree.

[0075] Second dimension: Number of child nodes The number of direct child nodes of a node is counted and recorded to characterize the branching structure of the object tree at that location.

[0076] Third dimension: Node's final hash value information The final hash value of the node is collected. This final hash value has encoded the address information of the node and the final hash values ​​of its child nodes, and is a representation of the node's local memory fingerprint.

[0077] Fourth dimension: Address difference information between adjacent nodes Calculate the address difference between the node and its parent node in the storage space (i.e., the integer value of the child node address minus the parent node address). This address difference reflects the relative positional relationship of adjacent nodes in the physical storage space and is an important indicator for detecting changes in memory layout.

[0078] Subsequently, after collecting the four-dimensional information of the nodes, each node is processed sequentially according to a depth-first traversal. For each node, the aforementioned four-dimensional information is concatenated in the following format: Node identifier + "|" + number of child nodes + "|" + final hash value of the node + "|" + address difference.

[0079] The "|" symbol is used as a separator. After encoding the information of a single node, a semicolon (;) is appended as the node end marker, and then all child nodes of that node are processed recursively.

[0080] After the entire object tree has been traversed, the encoded information of all nodes is concatenated into a large topological description sequence. Cryptographic hashing (such as SHA-256) is then performed on this topological description sequence, and the resulting hash value is the comprehensive topological hash value.

[0081] This comprehensive topological hash value has the following characteristics: it simultaneously reflects the logical topological structure of the object tree (node ​​identifiers, number of child nodes) and the physical memory layout (address information encoded by node hash values, address differences between adjacent nodes). Even if an attacker copies the entire object tree's data content, the comprehensive topological hash value will change as long as the memory layout changes (such as changes in node addresses or distances between adjacent nodes), thus effectively defending against memory copying-based attacks.

[0082] Example 5: Memory Obfuscation Structure like Figure 7 As shown, the core idea of ​​memory obfuscation structure is to create multiple interconnected nodes in the storage space and form an irregular network structure by setting various types of reference relationships, making it difficult for analysts to understand the true relationship between the nodes.

[0083] First, a pseudo-random number generator is initialized with a deterministic random seed. Fifty independent nodes are created in the storage space, each assigned a unique number (from 0 to 49). Each node has the ability to store attribute values ​​and can record relationship information with other nodes.

[0084] Then, for each node, establish linear links with its neighboring nodes: Forward reference: Except for the last node, each node establishes a reference to the next node (numbered 1 higher); Backreference: Except for the first node, each node establishes a reference to the previous node (number minus 1).

[0085] These references are stored in numerical form (that is, the storage address of the target node is converted into an integer and then stored in the attribute of the current node), rather than directly storing the address pointer, to increase the difficulty of analysis.

[0086] Based on the established linear link relationship, a cross-reference is added to each node. For each node, a pseudo-random number generator is used to randomly select another node (ensuring that it does not select itself and its adjacent nodes), and a cross-reference is established pointing to that random node. The cross-reference is also stored in numerical form. Through the cross-reference, the original linear node sequence is transformed into a mesh structure with random jump characteristics.

[0087] Subsequently, to further enhance the complexity and self-verification capabilities of the structure, covert communication channels are established between some nodes. Specifically, for each node, the number of communication channels to be established is randomly determined within the range of 1 to 3 using pseudo-random numbers. Then, a corresponding number of other nodes are randomly selected as communication targets, establishing an event listening relationship. When a specific state change occurs in the source node, the target node can receive a notification and respond.

[0088] Finally, nodes communicate and verify each other through a challenge-response mechanism. When node 1 needs to verify the legitimacy of node 2, node 1 generates a challenge value (such as a value based on node number and random factor) and sends it to node 2. Node 2 calculates the response value according to the following rules: Response value = (Sender ID XOR Challenge value XOR Receiver ID) × Constant coefficient + Receiver ID The XOR operation is a bitwise XOR operation with a constant coefficient that is a preset fixed value. Node 2 returns the calculated response value to Node 1. Node 1 independently calculates the expected response value using the same rules and verifies the integrity of the communication and the legitimacy of the other node by comparing whether the two are consistent.

[0089] When it is necessary to verify the integrity of the memory obfuscated structure, perform the following checks: Traverse all nodes and check the validity of each node's three types of reference pointers (forward, backward, and cross). For each non-null pointer, verify whether the address it points to belongs to a valid node within the memory obfuscation structure (rather than an illegal region outside the memory obfuscation structure). Perform communication verification on each node to ensure that the node can respond correctly to the challenge and return the expected response value; If any reference is found to point to an area outside the memory obfuscation structure, or if any node cannot be verified through communication, then the memory obfuscation structure is determined to be corrupted.

[0090] When a memory obfuscation structure anomaly is detected, the system uses this event as one of the criteria for threat assessment and triggers the corresponding security response.

[0091] Example 6: Anti-debugging detection like Figure 8 As shown, the core idea of ​​anti-debugging detection is to comprehensively utilize various detection methods to identify debugging behavior from multiple dimensions, avoid being bypassed by a single detection method, and determine that the current state is being debugged when any detection method indicates the existence of debugging behavior.

[0092] This invention employs the following three detection methods: Method 1: Process Status Detection The operating system maintains state information for each running process, including fields indicating the presence of external debug control relationships. This invention reads the current process's state information file and checks the current value of this field. If the current value is zero, it indicates that no external debugger is currently attached; if the current value is non-zero, it indicates that a debugger is controlling the current process. When a non-zero value is detected, the result is used as one of the criteria for determining whether debugging behavior has been detected.

[0093] Method 2: Self-tracking detection This invention detects debugging behavior by creating a child process and attempting to attach the child process to the parent process in debug mode. The specific steps are as follows: Create a child process; Call the system interfaces related to debug control in the child process and request to attach to the parent process in debug mode; If the attach request is successful, it means that the parent process is not currently controlled by other debuggers. The child process will exit after performing cleanup operations, and the conclusion that there is no debugger will be returned. If the attach request fails (the system returns an error indicating that the parent process is already occupied by another debugger), the child process immediately exits and returns the conclusion that a debugger exists; The parent process waits for the child process to finish and retrieves its return result, thereby determining whether external debugging behavior exists.

[0094] Method 3: Time Series Analysis and Detection Debuggers typically control program execution by stepping through code or setting breakpoints, which can cause the execution time of the code being debugged to be significantly longer than the normal execution time. This embodiment identifies such abnormal timing through high-precision time measurement.

[0095] The first step is the calibration phase: During system initialization, the same cryptographic operation code snippet is executed 5 times (e.g., 1000 hash operations are performed). The time taken for each execution is measured using a high-precision time base, and the average value is taken as the baseline value for normal execution time.

[0096] During the testing phase, the same code snippet as during calibration is executed, and the actual execution time is measured. If the actual execution time exceeds 10 times the baseline value, an abnormal delay is identified, which may be due to single-step execution or breakpoint pauses, thus indicating debugging behavior.

[0097] It is important to note that the three detection methods described above are independent and complementary. Process status detection directly queries system records, self-tracing detection judges based on system call behavior, and timing analysis detection identifies execution features. During each anti-debugging detection, the three detection methods are executed sequentially. If any method detects an anomaly, a report of debugging behavior is sent to the threat response module, along with the identification information of the detection method for subsequent processing.

[0098] Example 7: Random Interval Integrity Monitoring like Figure 9 As shown, the core idea of ​​random interval integrity monitoring is to avoid using a fixed-period detection method, but instead randomly select the interval of each detection within a preset time range, so that attackers cannot predict the specific time of the next detection, making it difficult for them to complete the tampering operation and restore the original state within the detection interval.

[0099] The first integrity check is triggered immediately after the software starts and initializes. This ensures that the integrity of the software in its initial state is verified in a timely manner.

[0100] Each integrity check performs the following steps: Calculate the overall topological hash value of the current object tree; The calculated comprehensive topological hash value is compared with the pre-recorded expected value (calculated and saved during the initialization phase); If the two match, a signal indicating that the integrity check has passed is issued; if they do not match, a signal indicating that the integrity check has failed is issued, and the combined topology hash value and the expected value are reported as part of the alarm information. At the same time, anti-debugging detection is triggered (detailed below) to check for external debugging behavior.

[0101] After completing one integrity check, the system needs to determine the time point for the next check. The specific steps are as follows: A pseudo-random number generator is used to randomly select a value between a preset minimum time interval and a maximum time interval as the waiting time for the next verification. In this invention, the minimum time interval is set to 3000 milliseconds (3 seconds), and the maximum time interval is set to 15000 milliseconds (15 seconds), so the actual interval is randomly distributed between 3 seconds and 15 seconds; Set a timer to expire after a selected interval; When the timer expires, the next integrity check is triggered, and the above process is repeated.

[0102] In summary, compared with fixed-period detection, random-interval detection has the following security advantages: Suppose an attacker needs to tamper with the memory structure between two detections and restore it to its original state before the next detection. Under a fixed 5-second detection cycle, once the attacker knows the detection cycle, they can accurately calculate the timing of each detection, start tampering immediately after the detection ends, and restore it 5 milliseconds before the next detection, thus always avoiding detection.

[0103] In a detection mode with random intervals of 3 to 15 seconds, even if an attacker knows that a detection will occur within a certain time window, they cannot determine the exact moment. Suppose an attacker attempts to wait a fixed 5 seconds after each detection before initiating tampering; the following situations may occur: If the next detection interval is exactly 3 seconds, the attacker's tampering operation will be detected before it even begins; If the next detection interval is 15 seconds, the attacker has ample time to complete the tampering, but must maintain the restored state for an uncertain remaining time. Attackers cannot establish a stable "tamper-restore" rhythm, which greatly increases the risk of being detected.

[0104] By randomizing the detection interval, this invention effectively eliminates the predictable time window for attackers, significantly increasing the difficulty of implementing "tamper-recovery" type attacks.

[0105] Example 8: Tiered Threat Response like Figure 10 As shown, the core idea of ​​graded threat response is to avoid a simplistic "all or nothing" approach, but instead to take differentiated response measures based on the severity of the threat, so as to maintain system availability to the maximum extent while ensuring security.

[0106] This embodiment classifies threats into four levels: low-level threat response, medium-level threat response, high-level threat response, and severe threat response, and executes the following response strategies for each level: When a low-level threat is identified (such as the first detection of a minor memory anomaly or suspicious behavior), the system performs the following actions: Output security logs, recording the source of threats (such as "integrity monitoring module", "anti-debugging detection module", etc.), the time of occurrence (time stamp accurate to milliseconds), and the cumulative number of detections; It can selectively send alarm notifications to upper-layer applications without changing the normal functionality of the current software; Continue with the normal monitoring process and maintain the current protection structure.

[0107] Low-level threat response is suitable for scenarios with a high probability of false alarms or low level of harm, avoiding overreaction that could negatively impact the user experience of normal users.

[0108] When a threat is identified as medium-level (e.g., multiple memory anomalies or memory obfuscation structure corruption are detected), the system performs the following operations: Set a degrade flag to indicate that the current system is in a degraded operating state; Triggering the protective structure reconstruction process: Regenerate the object tree: Using the same deterministic random seed, recreate the object tree in the storage space. Due to memory reallocation, the node addresses of the new object tree are different from the previous one; Reconstruct the address-sensitive hash chain: recalculate the final hash value of each node based on the new node addresses; Reconstruct the memory obfuscation structure: Recreate the nodes of the memory obfuscation structure and establish reference relationships; Recalculate the overall topological hash value: Calculate a new overall topological hash value based on the new object tree structure; Update monitoring expectation value: Set the newly calculated comprehensive topology hash value as the expected comparison value for integrity monitoring.

[0109] By rebuilding the protective structure, the system negates any localized damage that may have occurred and continues to provide protection with a new memory layout.

[0110] When a high-level threat is identified (such as confirmed debugging behavior or serious integrity breach), the system performs the following operations: Iterate through all pre-registered sensitive data areas (such as keys, user credentials, business-sensitive information, etc.). Perform a secure erase operation on each piece of sensitive data: First overwrite: Generate encrypted and secure random numbers and fill the entire sensitive data area with the random numbers; Second overwrite: Generate new random numbers again and refill the data area; Third pass: Generate random numbers and fill them in for the third time; Final clearing: Overwrite the entire data area with zero bytes; Clear data area: Releases the storage space occupied by the data area, so that the pointer no longer points to valid data.

[0111] By repeatedly overwriting and finally clearing the data with random data, the possibility of recovering sensitive information is greatly reduced. Even if an attacker obtains the physical storage medium, it is difficult to restore the original data.

[0112] When a threat is identified as a serious threat (such as the accumulation of multiple advanced threats or confirmation of an active attack), the system performs the following operations: Send an application lock signal to notify the upper-layer application that the current security state is irrecoverable and recommend that it stop providing normal services. Perform a full security wipe of sensitive data as part of the advanced threat response, ensuring no sensitive information remains. Set a downgrade flag to indicate that the system is locked; We will refuse to continue providing normal services and will only retain essential security response capabilities.

[0113] Critical threat response is the highest level of response measure, applicable to scenarios where a severe attack has been confirmed or the security status is beyond recovery. It prevents further spread of the attack by proactively locking down applications.

[0114] In this invention, the technical parameters described above (such as object tree depth of 5-8 layers, total number of nodes of 200-500, number of nodes in the memory obfuscation structure of 50, random detection interval of 3000-15000 milliseconds, time-series detection threshold multiplier of 10, and sensitive data coverage times of 3 times, etc.) are all preferred implementation values. Those skilled in the art should understand that these technical parameters can be adjusted according to actual application requirements. For scenarios with higher security requirements, the depth and number of nodes of the object tree can be increased, the detection frequency can be increased, and the number of times sensitive data is covered can be increased. For resource-constrained devices, the size of the object tree can be reduced, the detection frequency can be lowered, and the memory obfuscation structure can be simplified. The detection thresholds and judgment criteria can be calibrated and optimized according to the characteristics of the actual operating environment.

[0115] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A software runtime memory fingerprint watermarking protection method, characterized in that, include: Collect various hardware feature information of the target device, encode the various hardware feature information and perform cryptographic hash operation to generate device fingerprint, and select a pre-position segment from the device fingerprint as a deterministic random seed; A pseudo-random number generator driven by a deterministic random seed is used to construct a target device-specific hierarchical object tree in the storage space during software runtime. The hierarchical depth of the object tree and the number of child nodes of each non-leaf node are determined by the deterministic random seed. A bottom-up recursive traversal is performed on the object tree to calculate the final hash value of each node. At the same time, the node identifier information, number of child nodes, final hash value of the node, and address difference between the node and its parent node are collected in the traversal order. After connecting them in a predetermined format to form a topology description sequence, cryptographic hash operation is performed to obtain the comprehensive topology hash value. The final hash value of the root node is used as the memory fingerprint of the object tree at this level. During software operation, integrity checks are repeatedly performed at random time intervals. The currently calculated comprehensive topological hash value is compared with the expected value to obtain the comparison result. At the same time, various detection methods are used to identify debugging behavior from multiple dimensions to obtain anti-debugging detection results. A tiered threat response will be implemented based on the comparison results and anti-debugging detection results.

2. The method of claim 1, wherein, The various hardware feature information of the target device to be collected includes: Iterate through all network interfaces configured on the device, excluding loopback interfaces, inactive network interfaces, and network interfaces without configured physical addresses. Select the first network interface that meets the conditions from the remaining valid network interfaces and obtain its physical address identifier. The system information file maintained by the operating system reads the model name, characteristic flag list, and number of physical cores of the processing unit, and concatenates the model name, characteristic flag list, and number of physical cores of the processing unit to form a comprehensive characteristic description of the processing unit. Obtain the hostname of the current device through the network interface provided by the operating system; The physical address identifier, comprehensive feature description, and hostname are encoded into byte sequences and concatenated in a first predetermined order to form feature description data. The feature description data is then input into a cryptographic hash algorithm to generate a device fingerprint.

3. The method of claim 1, wherein, The construction of the object tree includes: Use a pseudo-random number generator to determine the maximum depth of the object tree within a preset depth range; Create a root node in the storage space and set formatted identification information including hierarchy and index; Starting from the root node, child nodes are generated recursively. For the parent node of each child node to be generated, a pseudo-random number generator is used to determine the number of its child nodes within a preset range. For each child node, a node entity is created in the storage space, formatted identification information including the current level, the current level index, and the parent node index is set, a deterministic random value is generated as the node fingerprint attribute, and the child node generation process is recursively called with the current child node as the new parent node until the maximum depth is reached.

4. The method of claim 1, wherein, The bottom-up recursive traversal of the object tree, and the calculation of the final hash value of each node, includes: A node with no children is called a leaf node, and its final hash value is calculated through the following steps: Convert the starting address of the leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the address value of the starting address to obtain the node address hash value of the leaf node; Convert the starting address of the parent node of the leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the starting address value to obtain the hash value of the parent node address of the leaf node; Obtain the node identifier information of the leaf node; The node address hash value, parent node address hash value, and node identifier information of the leaf node are combined in a second predetermined order and input into a cryptographic hash algorithm for calculation to obtain the final hash value of the leaf node. The final hash value is stored as a secondary attribute of the node for use by the parent node in its calculations. A node with child nodes is called a non-leaf node, and its final hash value is calculated through the following steps: Convert the starting address of the non-leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the address value of the starting address to obtain the node address hash value of the non-leaf node; Convert the starting address of the parent node of the non-leaf node in the storage space to an integer form, and perform a cryptographic hash operation on the starting address value to obtain the hash value of the parent node address of the non-leaf node; Collect the hash values ​​of all child nodes of the non-leaf node, and concatenate all the child node hash values ​​into a continuous data block according to the third predetermined order of the child nodes; The data blocks containing the hash values ​​of the non-leaf node's address, parent node's address, and child node's address are combined in a fourth predetermined order and input into a cryptographic hash algorithm for computation to obtain the final hash value of the non-leaf node.

5. The method of claim 1, wherein, The calculation method for the comprehensive topology hash value includes: The entire object tree is traversed using a depth-first traversal method. Four-dimensional information is collected for each visited node. The four-dimensional information includes node identification information, number of child nodes, final hash value of the node, and address difference information between adjacent nodes. Following the depth-first traversal order, the four-dimensional information of each node is connected sequentially according to a preset format: After the entire object tree has been traversed, the encoded information of all nodes is concatenated into a large topological description sequence. Cryptographic hashing is then performed on this topological description sequence to obtain the comprehensive topological hash value.

6. The method of claim 5, wherein, The preset format is: Node identifier + "|" + number of child nodes + "|" + final hash value of node + "|" + address difference; The "|" symbol is used as a separator.

7. The method of claim 1, wherein, The method utilizes various detection techniques to identify debugging behavior from multiple dimensions, including: Process status detection: Obtain a field used to indicate whether there is an external debug control relationship. If the value of this field is zero, it means that no external debugger is currently attached; if the value of this field is non-zero, it means that an external debugger is controlling the current process. Self-tracing detection: Create a child process; in the child process, call the system interface related to debugging control and request to attach to the parent process in debug mode; if the attachment request is successful, it means that the parent process is not currently controlled by other debuggers, the child process performs cleanup operations and exits, returning the conclusion that no debugger exists; if the attachment request fails, the child process exits immediately and returns the conclusion that a debugger exists; the parent process waits for the child process to end and obtains its return result, and determines whether there is external debugging behavior based on this. Timing analysis and detection: During system initialization, the same cryptographic operation code snippet is executed multiple times, and the execution time of each execution is measured using a high-precision time base. The average value is taken as the baseline value of the normal execution time. During detection, the same code snippet as during calibration is executed, and the actual execution time is measured. If the actual execution time exceeds 10 times the baseline value, it is determined that there is an abnormal delay, which may be caused by single-step execution or breakpoint pause. Based on this, it is determined that there is external debugging behavior.

8. The method of claim 1, wherein, It also includes constructing a memory obfuscation structure in the storage space using the following methods: The pseudo-random number generator is initialized with a deterministic random seed. Multiple nodes are created in the storage space, and three types of reference relationships are established between the nodes: forward reference, backward reference, and cross reference, forming an irregular network structure. Some nodes communicate and verify each other through a challenge-response mechanism, which includes: a source node generating a challenge value and sending it to a target node; the target node returning a response value according to a response value calculation formula, wherein the response value calculation formula is: Response value = (Sender ID XOR Challenge value XOR Receiver ID) × Constant coefficient + Receiver ID; The source node independently calculates the expected response value and compares it with the response value returned by the target node. If they are inconsistent, the memory obfuscation structure is determined to be abnormal. When a memory obfuscation structure is determined to be abnormal, the level of the tiered threat response is increased.

9. The method of claim 1, wherein, The step of performing a graded threat response based on the comparison results and anti-debugging detection results includes: Log security information and report to higher management when a low-level threat is detected; In the event of a medium-level threat, switch the protected functions to degraded mode and rebuild the protection structure; In the event of an advanced threat, perform a security wipe of pre-registered sensitive data, performing multiple random overwrites followed by a complete erasure. In the event of a serious threat, the system will enter a locked state and cease providing normal services.

10. A software runtime memory fingerprint watermarking protection system, characterized in that, include: The hardware fingerprint acquisition module, object tree generation module, hash chain construction module, topology verification module, integrity monitoring module, and threat response module communicate sequentially. The integrity monitoring module communicates with the anti-debugging detection module and the memory obfuscation structure module. The threat response module communicates with the object tree generation module. The hardware fingerprint acquisition module is used to collect various hardware feature information of the target device, encode the various hardware feature information and perform cryptographic hash operation to generate device fingerprint, and select a pre-position segment from the device fingerprint as a deterministic random seed; The object tree generation module is used to drive a pseudo-random number generator with a deterministic random seed to build a target device-specific hierarchical object tree in the storage space during software runtime. The hierarchical depth of the object tree and the number of child nodes of each non-leaf node are determined by the deterministic random seed. The hash chain building module is used to perform bottom-up recursive traversal of the object tree, calculate the final hash value of each node, and use the final hash value of the root node as the memory fingerprint of the object tree at that level. The topology verification module is used to collect the node identification information, number of child nodes, final hash value of the node, and address difference between the node and its parent node for each node in traversal order. After connecting them in a predetermined format to form a topology description sequence, cryptographic hash operation is performed to obtain the comprehensive topology hash value. The integrity monitoring module is used to repeatedly perform integrity checks at random time intervals during software operation. It compares the currently calculated comprehensive topology hash value with the expected value to obtain the comparison result. At the same time, it uses a variety of different detection methods to identify debugging behavior from multiple dimensions and obtain anti-debugging detection results. The threat response module is used to perform tiered threat responses based on the comparison results and anti-debugging detection results; The memory obfuscation structure module is used to create multiple interconnected nodes in the storage space using deterministic random seeds, establish forward references, backward references and cross references to form a mesh structure, and verify the integrity of communication between nodes through a challenge-response mechanism; The anti-debugging detection module is used to identify external debugging behavior through at least one of three methods: process state detection, self-tracing detection, and timing analysis detection.

Images