Function-Level Countermeasure Activation for Secure Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software execution methods on electronic devices suffer from high overhead costs and execution time due to permanent activation of countermeasures, which are cumbersome to implement and do not account for the execution environment, leading to inefficient protection against attacks.
Innovation Solution
An electronic system and method that dynamically activates security countermeasures only when specific code parts are executed, using hardware registers to store function start addresses and associated configurations, and a detection system to identify attacks, enabling efficient protection with minimal code footprint and execution time overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If countermeasures are permanently activated to protect code execution, then security protection is improved, but execution time and system performance deteriorate
Solution Approach 1:
The patent implements dynamic activation of countermeasures based on runtime detection of attack conditions. The system transitions from static permanent activation to dynamic conditional activation, where countermeasures are enabled only when specific attack patterns are detected through monitoring execution flow, memory access patterns, and other security-relevant parameters.
Solution Approach 2:
The system changes the operational parameters of countermeasure activation from a fixed state to a variable state based on detected attack conditions. Different countermeasure configurations are applied depending on the type and severity of detected attacks, allowing optimization of protection levels according to actual threat conditions.
2Reliability
If multiple countermeasures are activated against different attack types, then security coverage is improved, but system complexity and overhead increase
Solution Approach 1:
The patent segments the code base into critical and non-critical sections, and segments countermeasures into different types and levels. This allows selective application of appropriate countermeasures to specific code sections based on their security requirements, rather than applying all countermeasures uniformly across the entire system.
Solution Approach 2:
The system applies partial countermeasure activation based on detected attack conditions, enabling only the necessary subset of countermeasures required to address the specific threat. This avoids the overhead of activating all possible countermeasures when only certain types of attacks are detected or when no attacks are present.
3Manufacturing precision
If manual modification is performed to add activation commands for each code part, then protection precision is improved, but implementation complexity and code size increase
Solution Approach 1:
The patent implements self-service mechanisms where the system automatically identifies critical code sections and applies appropriate countermeasures without requiring manual annotation or modification of the code. The detection system autonomously monitors execution and determines which countermeasures should be activated based on observed attack patterns and pre-configured security policies.
Solution Approach 2:
The system performs preliminary configuration of countermeasure associations with code sections during system initialization or compilation, storing this mapping information in data structures that enable rapid runtime lookup. This preliminary action eliminates the need for manual modification while maintaining precise protection targeting.
Data Source
AI summary
Provided is a method for configuring an electronic system for a secure execution of a code comprising a plurality of functions. The electronic system is configured for applying during an execution of a function a security countermeasure configuration among a plurality of security countermeasure configurations. The method is performed by said electronic system comprising a hardware processor, security hardware registers configured for storing start addresses of functions among said plurality of functions and associated security countermeasure configurations to be applied during an execution of said functions. A detection system is configured to detect an attack on said electronic system during an execution of a function among said plurality of functions.