Application Code Integrity Verification via Runtime Fingerprint Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure electronic devices face challenges in maintaining the integrity of application code throughout their lifespan, as existing security measures do not guarantee the integrity of executable code after installation, making them vulnerable to unauthorized modifications and potential security breaches.
Innovation Solution
A method is implemented within an electronic device with a processing processor and secure memory to continuously verify the validity of an application code by comparing current and reference fingerprints, ensuring that only authorized modifications are made, and taking protective measures if unauthorized changes are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic signatures are used to verify application installation packages, then application trustworthiness is improved, but code integrity cannot be guaranteed throughout the application's lifespan
Solution Approach 1:
The patent establishes a baseline fingerprint of the application code at installation time before any modifications occur. This preliminary action creates a reference point that enables future integrity checks without requiring continuous re-signing, thus extending the duration of integrity guarantee throughout the application's lifespan.
Solution Approach 2:
The patent implements continuous monitoring of application code by calculating fingerprints at runtime and comparing them against the stored baseline. This feedback mechanism detects any deviations from the original code, enabling the system to respond to potential tampering or unauthorized modifications throughout the application's execution lifecycle.
2Productivity
If application code optimization is performed continuously, then application performance is improved, but code integrity verification becomes complicated
Solution Approach 1:
The patent distinguishes between different types of code modifications by implementing a dynamic verification approach. It allows the system to differentiate between authorized optimizations (which may be permitted to modify the code) and unauthorized tampering (which must be detected), thus enabling continuous optimization while maintaining security through adaptive verification rules.
Solution Approach 2:
The patent applies different verification strictness to different parts of the application lifecycle. During installation, strict cryptographic verification is applied. During runtime optimization, the system uses fingerprint comparison with potentially more flexible policies, allowing legitimate performance improvements while still detecting malicious modifications through the baseline comparison mechanism.
3Reliability
If secure processors are used for certified applications, then security level is improved, but flexibility for running third-party applications is reduced
Solution Approach 1:
The patent introduces fingerprint-based verification as an intermediary mechanism between the secure processor and third-party applications. Instead of requiring all applications to undergo lengthy certification processes, the system uses cryptographic fingerprints as a mediator to provide lightweight, automated integrity verification that maintains security while enabling broader application compatibility and flexibility.
Data Source
Figure 1
Figure 2
AI summary
The proposed technique relates to a method for determining the validity of application code (App), the method being implemented within an electronic device comprising a processing unit, unsecured memory, and secure memory. This method comprises at least one iteration of the following steps: - a step of loading the application into unsecured memory, delivering a current application code (CAC); - a step of determining (12) a hash of said current application code, delivering a current hash (Emp_C) associated with the application; - a step of obtaining (13), within secure memory, a reference hash (Emp_Rf) associated with the application; - a step of comparing (14) the current hash (Emp_C) with the reference hash (Emp_Rf);and - when said current fingerprint (Emp_C) is identical to said reference fingerprint (Emp_Rf), a validation step (15) of the current application code, comprising: - a step of executing an optimization process (151) of the current application code of said application, delivering optimized application code (CAO); - a step of determining (152) a fingerprint of said optimized application code (CAO), delivering a post-optimization fingerprint (Emp_PO) associated with said application; - a step of recording (153) said post-optimization fingerprint (Emp_PO) in said secure memory, as a new reference fingerprint associated with said application.;