Input-Driven Code Execution Randomization Against Side-Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer programs are vulnerable to side-channel attacks that exploit synchronized ordering and repeatability of execution, allowing attackers to extract secret information.
Innovation Solution
Transform the source code into a graph structure where nodes can be traversed in arbitrary orders and function definitions are randomized, ensuring each input value results in a unique execution path, misaligning datasets and thwarting side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the computer program executes code instructions in a fixed sequential order, then the execution is predictable and easy to analyze, but this predictability enables side-channel attacks that rely on synchronized ordering and repeatability
Solution Approach 1:
The patent transforms the static, fixed sequential execution order into a dynamic execution model where the order of code instruction execution varies based on input values. The graph structure allows nodes (code portions) to be traversed in different orders without invalidating dependencies, making the execution unpredictable to attackers while maintaining correctness.
Solution Approach 2:
The patent divides the computer program into discrete nodes representing portions of code instructions, organized in a graph structure with links representing dependencies. This segmentation allows the execution path to be reorganized and randomized while preserving the logical dependencies between code portions, thereby preventing synchronized execution patterns.
2Object-affected harmful factors
If the source code is transformed into a graph structure with randomized node traversal, then execution paths become unique for each input value, but this increases the complexity of the code structure
Solution Approach 1:
The patent creates a universal graph structure that can represent any computer program's control flow and data dependencies. This graph-based representation serves multiple functions: it preserves program semantics, enables randomized execution, and maintains dependency constraints. The same graph structure handles both correctness verification and security randomization.
Solution Approach 2:
The patent changes the structural parameters of the code representation from a fixed sequential list to a flexible graph structure with nodes and links. This parameter change allows the execution order to vary while maintaining dependency constraints, achieving security through structural transformation rather than adding complex protective layers.
3Object-affected harmful factors
If multiple function definitions are constructed to execute different nodes, then execution variability increases to prevent attack dataset synchronization, but the number of function definitions and execution paths increases
Solution Approach 1:
The patent creates multiple function definitions that are essentially copies or variations of the same underlying logic, each capable of executing different nodes in the graph. These function copies enable the same computational logic to be expressed in multiple execution paths, achieving variability without duplicating the entire program multiple times.
Data Source
AI summary
Embodiments of systems, devices and methods for protecting computer programs against analysis and/or attacks that rely on synchronized ordering and repeatability are provided herein. Embodiments disclosed herein include receiving input source code, the source code comprising code instructions of a computer program; generating a graph structure representative of the code instructions comprising nodes representative of portions of the code instructions and links representative of dependencies between the portions of the code instructions, wherein the nodes can be traversed in a plurality of orders without invalidating the dependencies between the portions of the code instructions; constructing a plurality of function definitions based on the graph structure, each function definition configured to execute one or more nodes of the graph structure and each node of the graph structure is executable by one or more function definitions; transforming the input source code into transformed source code based on combining the graph structure and the plurality of function.