Application Integrity Protection via Runtime Cryptographic Measurement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial devices in IoT environments face challenges in protecting their computer-implemented applications from manipulation and reverse engineering, as existing integrity protection methods are complex and not always effective, especially in exposed networks.
Innovation Solution
A method that modifies the application by adding a check code, which executes a cryptographic measurement function during runtime to verify code integrity, ensuring only correct codes are executed by comparing the measurement result with a reference value, and includes replacement actions for detected manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital signatures and hardware-based key stores are used for integrity protection, then protection effectiveness is improved, but device complexity increases
Solution Approach 1:
The patent extracts the integrity verification functionality from complex hardware-based key stores and digital signature mechanisms, implementing it instead through lightweight cryptographic measurement functions that can be executed directly within the application code. This separates the verification logic from dedicated hardware components, reducing overall system complexity while maintaining protection effectiveness.
Solution Approach 2:
The application performs its own integrity verification through self-checks using cryptographic measurement functions. The application code includes embedded verification logic that automatically measures and validates its own integrity state, eliminating the need for external hardware-based key management systems and reducing dependency on complex protective infrastructure.
2Reliability
If cryptographic measurement functions are executed during runtime, then manipulation detection capability is improved, but processing time increases
Solution Approach 1:
Instead of verifying the entire application codebase, the patent implements selective verification of critical code sections and functions. The cryptographic measurement functions target specific important routines and data structures, performing partial verification that provides adequate manipulation detection while significantly reducing the computational overhead compared to full-code verification.
Solution Approach 2:
The integrity verification is implemented as periodic checks at strategic runtime points rather than continuous monitoring. The measurement functions are executed at predefined intervals and at critical decision points in the application flow, providing timely manipulation detection while allowing normal processing to proceed uninterrupted between verification points.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A method for protecting a computer-implemented application (A) from manipulation, comprising the following steps: - Providing (S1) a modified application (A') which, compared to the application (A) which has a plurality of individual code digits (C1,..,Ci,..,Cn), additionally includes at least one check code (Pi), - Executing (S2) the modified application (A'), wherein the at least one check code (Pi) performs the following steps during the runtime of the modified application (A'): - Executing (S21) a cryptographic measurement function (Hi) on at least one predetermined code digit (Cj) of the modified application (A') to be measured, and - Checking (S22) the result of the measurement function (Hi) against at least one predetermined reference value (Hrefi), and - Executing (S3) the code digits (Ci) that are correct in the sense of the application (A) if the result of the measurement function (Hi) matches the reference value (Hrefi).