Memory Fractionation for Software Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection systems face challenges in ensuring the security and robustness of critical software components due to potential untrusted hardware components, making it difficult to completely move software and data out-of-band, and there is no silver bullet solution to mitigate the risks of hardware-based threats.
Innovation Solution
Implementing memory fractionation by dividing application software into fractions, ensuring that at any given time, at least one fraction is not accessible from the user or kernel space, thereby protecting critical program information and hindering reverse engineering and malicious alterations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software is moved out-of-band to secure hardware or hypervisor, then software protection is improved, but the assumption of trusted hardware is violated due to supply chain threats
Solution Approach 1:
The software is divided into multiple fractions, each stored in separate memory locations. At any given time, only a subset of fractions is accessible from user or kernel space, while at least one fraction remains inaccessible. This segmentation prevents attackers from obtaining complete software even if they compromise hardware or operating system, directly resolving the contradiction between software protection and hardware trust assumptions.
2Ease of operation
If complete software is made accessible for execution, then system functionality is maintained, but attackers can access and modify all software components
Solution Approach 1:
Software is fractionated into multiple parts with selective accessibility. The system maintains full functionality by loading and executing necessary fractions while keeping others inaccessible. This reduces the attack surface because attackers cannot access or modify the complete software, even if they compromise the operating system or hardware, while still allowing the software to function properly.
Solution Approach 2:
The system dynamically manages software accessibility by loading different fractions into accessible memory spaces only when needed for execution. At any point in time, at least one fraction remains inaccessible, creating a dynamic protection mechanism that adapts to execution requirements while maintaining security. This resolves the contradiction between maintaining full software accessibility for functionality and limiting access to reduce attack surface.
Data Source
AI summary
A method of protecting software in a computer system includes defining a memory fractionation configuration for an application software program in the computer system, fractionating at least one page of the application software program into fractions according to the memory fractionation configuration, and running the application in such a manner that, at any particular point in time when the application is running, at least a first one of the fractions is stored in a manner that is not accessible from a user space or a kernel space of the computer system.