Runtime Integrity Checks Hidden by Distributed FSM Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection techniques are vulnerable to malicious identification and analysis, as security functions are often called frequently, leading to reduced efficacy due to potential disabling or impeding by attackers.
Innovation Solution
Implementing a finite state machine (FSM) to distribute and flatten the primary function across the code, inlining sub-functions, converting local variables to global, and distributing partial FSMs throughout the code to obscure the primary function's location and reduce external dependencies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security functions are implemented to verify code integrity at run-time, then software protection capability is improved, but these functions become vulnerable to malicious identification and analysis
Solution Approach 1:
The patent applies segmentation by dividing the security verification functionality into multiple distributed code snippets scattered throughout the program. Instead of a centralized security function, the integrity verification is broken into smaller segments that are interspersed with regular code, making it difficult for attackers to identify and analyze the security mechanisms while maintaining continuous verification capability.
Solution Approach 2:
The patent implements local quality by embedding security verification operations directly within local code regions where they perform integrity checks on specific data or code segments. Each local snippet performs a focused verification task rather than a comprehensive security function, allowing the security mechanism to blend in with regular code operations and evade detection while maintaining protection effectiveness.
2Difficulty of detecting and measuring
If control flow obfuscation is used to disguise security functions, then security function identification difficulty is improved, but system complexity and run-time overhead increase significantly
Solution Approach 1:
The patent merges security verification operations with regular code operations by interspersing integrity check snippets among normal code. This combining approach allows security functions to execute alongside regular operations without requiring separate control flow paths or obfuscation mechanisms, thereby reducing system complexity while maintaining the difficulty of identifying security functions.
Solution Approach 2:
The patent implements self-service by having the code itself perform integrity verification through embedded snippets that check their own or adjacent code segments. This self-verification approach eliminates the need for separate security management infrastructure or complex obfuscation systems, reducing overall system complexity while maintaining security function identification difficulty.
Data Source
Figure 1a
Figure 1b
Figure 2~3
AI summary
The present disclosure relates to software tampering resistance. In one aspect, a method for generating protected code is provided, comprising identifying a primary function in code to be obscured, the primary function being a function used to verify the integrity of the code run-time. The method then comprises generating a finite state machine from the primary function, wherein a state of the finite state machine at a given instance defines an element of the primary function to be executed. The method then comprises distributing the finite state machine throughout the code to obscure one or more areas of the code.