Encoded Function Execution for Secure Distributed Code Running
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security mechanisms for distributed systems fail to authenticate program executions on clients or servers, particularly in scenarios where user terminals execute sensitive operations, and existing remote code execution solutions are risky, slow, or require software updates.
Innovation Solution
A method for controlling the execution of code on an electronic device by receiving an execution data structure with encoded function names, decoding and searching for existing functions, and executing them with optional parameters, while ensuring secure execution flow and result transmission to a calling device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If native code is executed on the execution device, then execution speed is improved, but security risks increase allowing attackers to execute arbitrary programs
Solution Approach 1:
The patent introduces an intermediary layer (interpreter or virtual machine) between the downloaded code and the execution device's native code executor. This intermediary translates and executes code in a controlled environment, maintaining execution speed while preventing arbitrary program execution and security breaches.
Solution Approach 2:
The patent creates a virtual copy of the execution environment through a virtual machine or sandbox. Code is executed in this isolated copy rather than directly on the host system, enabling fast native code execution while containing security risks within the virtual environment.
2Reliability
If code validation is performed statically before execution, then security verification is improved, but runtime code injection vulnerabilities remain undetected
Solution Approach 1:
The patent performs preliminary static validation of code before execution to establish a baseline security state. Additionally, it implements runtime monitoring that continuously verifies code integrity during execution, detecting injections that occur after the preliminary check.
Solution Approach 2:
The patent implements a feedback mechanism where the execution monitor continuously checks code integrity during runtime and provides feedback to the security system. When code injection is detected, the system can terminate execution or alert the user, addressing the limitation of static validation alone.
3Object-affected harmful factors
If interpreters are used to execute code, then security is improved, but execution speed decreases
Solution Approach 1:
The patent implements a dynamic execution system that adapts the interpretation method based on code characteristics and security requirements. For trusted code, it uses faster execution methods, while for untrusted code, it applies stricter interpretation, optimizing both security and performance.
Solution Approach 2:
The patent segments code execution into different phases with different interpretation strictness. Critical security-related code is executed with full interpretation and validation, while non-critical code can use optimized execution paths, balancing security requirements with performance needs.
4Reliability
If static root trust mechanisms are used, then authentication is improved, but runtime vulnerabilities in complex software systems remain unaddressed
Solution Approach 1:
The patent establishes static root trust mechanisms beforehand to authenticate code sources and create a baseline security state. It then layers runtime monitoring on top of this foundation, continuously verifying code integrity during execution to address vulnerabilities that static authentication cannot detect.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for controlling the running of an application AppO, the method being implemented within the application AppO, the application AppO running on an electronic device referred to as the running device (B), the running device (B) being connected to a calling device (A) via a communication network, the method comprising the following steps: - Receiving (10), from the calling device (A), a runtime data structure (StrExec), comprising at least one recording, each recording comprising at least one data field including a coded function name (CFN_x); - Saving (20) the runtime data structure (StrExec) in a specific memory zone (MZone); - For each current recording (CUEnr) of the runtime data structure (StrExec), implementing (30) a function bearing a decoded function name (UCFN_x) corresponding to the coded function name (CFN_x), when the function bearing a decoded function name (UCFN_x) of the application AppO can be associated with the coded function name (CFN_x).