Java Native Library Entry Hiding via Dummy JNI Registration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Java compiled code is vulnerable to static and dynamic analysis, particularly due to the visibility of native library entry points through JNI_OnLoad, making it susceptible to attacks like Man-In-The-Middle and symbolic execution.
Innovation Solution
Implement a unique JNI_OnLoad entry point in the native library that registers useless methods, triggering a zJNI thread to unregister these methods and register the actual ones, hidden via a zJNI thread, ensuring only the actual methods are called by the Java code while deceiving attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a unique JNI_OnLoad entry point is used to register native methods, then the interface between Java code and native library is simplified, but attackers can still perform static and dynamic analysis to reveal the entry points
Solution Approach 1:
The patent applies preliminary action by registering dummy native methods in advance through the JNI_OnLoad entry point before the actual native methods are registered. This creates a false trail that misleads attackers performing static or dynamic analysis, while the real methods are registered later through a hidden mechanism that attackers cannot detect.
Solution Approach 2:
The patent uses an intermediary mechanism by introducing a dummy registration layer between the JNI_OnLoad entry point and the actual native methods. This intermediary hides the real methods from attackers by presenting fake method signatures and implementations, allowing the system to maintain a simple interface while protecting against analysis.
2Ease of operation
If all entry points of the native library are made visible to the Java code, then the Java code can call native functions, but attackers can perform Man-In-The-Middle attacks or symbolic execution on these visible entry points
Solution Approach 1:
The patent applies preliminary action by pre-registering dummy native methods that appear to be the actual entry points. These dummy methods are registered before the real methods, creating a deceptive interface that allows normal Java code operation while protecting the real entry points from attacks like Man-In-The-Middle or symbolic execution.
Solution Approach 2:
The patent applies local quality by creating different qualities of method entries: dummy methods with fake implementations for public visibility, and real methods with actual functionality hidden from direct access. This local differentiation allows the system to maintain operational ease while reducing attack susceptibility on critical functions.
Data Source
AI summary
Method of securing a java software code to be run by a Java Virtual Machine including at least one call to a native method of a native language library, to the Java Virtual Machine, native methods of the native language library, and generating a secure native language library, the method performed by a processor having steps including defining in the native language library a method which when executed at runtime, when the native language library is loaded by the Java Virtual Machine, is configured for registering useless native methods of the native language library, and inserting in the native language library calls to a plurality of constructors, one of them being configured to trigger a thread, which is configured for unregistering said useless native methods and registering said at least one native method of the native language library to be called by the java software code.