Compiler-Driven Code Obfuscation for Side-Channel Leakage Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting computer program code against side-channel attacks and reverse engineering are inadequate, as they often result in performance degradation, high overhead, and vulnerability to side-channel leakage, especially in unforeseen adversarial settings.
Innovation Solution
A compiler-driven method that performs side-channel-aware code obfuscation combined with dynamic hardware diversification, using a co-processor to generate random execution characteristics for security-critical instructions, optimizing for performance, obscurity, and low side-channel leakage without altering the base processor architecture.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If program transformations are applied to protect against side-channel attacks, then security against side-channel attacks is improved, but performance degradation increases due to additional instructions
Solution Approach 1:
The patent applies dynamic compilation techniques where the code is transformed and optimized at runtime rather than static compilation. The JIT compiler dynamically generates optimized code that maintains security properties while reducing performance overhead by eliminating redundant instructions and optimizing control flow based on actual execution patterns.
Solution Approach 2:
The patent changes compilation parameters and optimization levels dynamically. Different optimization passes are applied selectively to different code regions, and compilation flags are adjusted to balance security and performance. The system explores different parameter configurations to find optimal trade-offs between security hardening and execution speed.
2Reliability
If code obfuscation is applied to prevent reverse engineering, then security against reverse engineering is improved, but code complexity increases making optimization difficult
Solution Approach 1:
The patent segments the code into different regions with different obfuscation levels. Critical security-sensitive code paths receive stronger obfuscation while non-critical paths use lighter transformations. This selective segmentation allows the system to maintain high security where needed while keeping overall code complexity manageable for optimization.
Solution Approach 2:
The patent applies partial obfuscation only to necessary code regions rather than transforming the entire program. By applying obfuscation selectively to critical paths and leaving other regions in a more optimized state, the system achieves adequate security protection without excessive code complexity that would prevent effective optimization.
3Productivity
If compiler optimizations are applied to improve performance, then productivity is improved, but effectiveness of side-channel countermeasures is reduced
Solution Approach 1:
The patent implements a feedback mechanism where the system monitors execution patterns and side-channel leakage characteristics, then adjusts optimization strategies accordingly. The JIT compiler uses runtime feedback to identify which optimizations are safe to apply without compromising security, and dynamically modifies code to maintain both performance and security properties.
Solution Approach 2:
The patent performs preliminary analysis of code paths to identify security-critical regions before applying optimizations. By pre-identifying which code segments require strong side-channel protection, the system can selectively apply or exclude certain optimizations in those regions, ensuring that performance improvements do not undermine security countermeasures.
4Reliability
If diverse components are generated at compile time to increase security, then security against side-channel attacks is improved, but code size increases causing storage requirements and performance degradation
Solution Approach 1:
The patent uses copying techniques where a single optimized code version is generated at compile time, and runtime diversity is achieved through dynamic interpretation and transformation rather than having multiple complete code copies. This approach provides security through diversity while avoiding the storage overhead of maintaining multiple full code versions.
Solution Approach 2:
The patent introduces an intermediary JIT compilation layer that sits between the compiled binary and execution. This intermediary dynamically transforms and diversifies the code at runtime, providing security benefits without requiring large amounts of pre-generated diverse code to be stored in memory or on disk.
Data Source
AI summary
Methods and systems for obfuscating computer program code are disclosed. In an embodiment, a method of generating obfuscated binary code from input source code for execution on a target processor comprises: generating a set of random obfuscation transform selections; and iteratively optimizing the obfuscation transform selections until a termination criterion is met. The obfuscation transformation selections may comprise indications of custom instructions which are executable on the co-processor in order to reduce side channel leakage.