Dynamic Encryption of Binary Executables to Limit Code Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing binary obfuscation techniques, such as encryption at rest, leave executable code vulnerable to analysis and attack by allowing it to be inspected in decrypted form in temporary storage.
Innovation Solution
Implement a dynamic encryption technique where each module of the binary is wrapped in a separate encryption envelope with a unique encryption key, ensuring that no part of the code is in an unencrypted state simultaneously, and utilize hardware-supported security modules to manage encryption keys and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption at rest is used to wrap the entire target binary, then security is improved, but the code becomes vulnerable to analysis when decrypted to temporary storage
Solution Approach 1:
The binary is divided into multiple modules, each wrapped in a separate encryption envelope with its own unique encryption key. This segmentation prevents the entire program from being decrypted simultaneously, as each module must be individually decrypted and loaded only when needed for execution.
Solution Approach 2:
The encryption approach transitions from static (entire binary encrypted at rest) to dynamic (individual modules encrypted and decrypted on-demand during execution). The system dynamically decrypts only the necessary modules at the moments they are needed, rather than maintaining a static decrypted state in temporary storage.
2Speed
If the entire binary is decrypted to temporary storage for execution, then execution speed is improved, but all code is exposed in unencrypted form simultaneously
Solution Approach 1:
The binary is segmented into multiple independently encrypted modules. Each module can be decrypted and loaded into memory separately and simultaneously, allowing parallel processing and execution without requiring the entire binary to be decrypted at once. This maintains execution speed while limiting code exposure to only the currently active modules.
Solution Approach 2:
Modules are pre-encrypted with their own unique keys before execution. This preliminary encryption setup allows the system to quickly decrypt and load individual modules on-demand during runtime without compromising security, as the encryption infrastructure is already in place.
3Reliability
If multiple encryption envelopes with unique keys are used for each module, then security against analysis is improved, but device complexity increases
Solution Approach 1:
Each module contains its own encryption key embedded within its encryption envelope. This self-service approach allows modules to be decrypted independently without requiring external key management infrastructure, reducing the complexity of the overall system while maintaining strong security through individual module protection.
Data Source
AI summary
A facility for securely executing a program is described. The facility stores a number of encoded modules, each including an encoded block and a type field that contains a resource indicator that in turn identifies an encoding resource. The encoding resource has contents specifying details of a process for decoding the encoded block to obtain a working module containing executable code for a portion of the program.