Monitoring Program for Software Protection Against Debugger Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for protecting programs from analysis and tampering, such as software tamper-resistant techniques and obfuscation, are inadequate in preventing monitoring by debuggers, which can lead to theft of secret information.

Innovation Solution

Implementing a monitoring program that only monitors the protection target program, allowing it to check if the monitoring program is started and preventing other programs from monitoring, thereby ensuring the protection target program's integrity and secrecy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Difficulty of detecting and measuring

If software tamper-resistant techniques and obfuscation are used to protect programs, then program analysis difficulty is improved, but debugger monitoring capability cannot be prevented

Engineering Contradiction:
Improveprogram analysis difficultyVSAvoidprotection against debugger monitoring
Core Design Contradiction:
Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The patent applies preliminary action by embedding a monitoring program that starts before the protected program executes and establishes monitoring capabilities in advance. The monitoring program is launched first, sets up its monitoring infrastructure, and then the protected program is started under its supervision. This ensures that when the protected program runs, the monitoring program is already in position to detect debugger activity, preventing the reliability gap left by post-hoc protection methods.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent uses an intermediary approach by introducing a monitoring program as a mediator between the debugger and the protected program. The monitoring program intercepts communications and monitoring attempts between debuggers and the protected program, acting as a barrier that can detect and respond to debugger activity. This intermediary layer provides the missing protection against debugger monitoring while maintaining the benefits of tamper-resistant techniques.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Loss of information

If program encryption and relocation processing are implemented, then data security is improved, but program execution complexity increases

Engineering Contradiction:
Improvedata securityVSAvoidprogram execution complexity
Core Design Contradiction:
Loss of informationVSDevice complexity

Solution Approach 1:

The patent applies the taking out principle by extracting the decryption and execution logic from the protected program itself and placing it in the monitoring program. The protected program is stored in encrypted form, and the monitoring program is responsible for decrypting and executing it. This separation reduces the complexity burden on the protected program while maintaining data security, as the complex decryption and monitoring functions are handled by a dedicated external program.

Inventive Principle:
Principle #2Taking out (Extraction)

3Difficulty of detecting and measuring

If function pointers and obfuscation techniques are used, then control structure analysis is improved, but system resource consumption increases

Engineering Contradiction:
Improvecontrol structure analysisVSAvoidsystem resource consumption
Core Design Contradiction:
Difficulty of detecting and measuringVSUse of energy by moving object

Solution Approach 1:

The patent applies partial action by implementing obfuscation and monitoring only for critical sections of the program rather than the entire program. The monitoring program focuses on detecting debugger activity and protecting sensitive operations, while allowing non-critical portions to execute with minimal overhead. This selective approach maintains control structure protection while reducing the overall resource consumption compared to comprehensive obfuscation of the entire program.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP2420950B1Information processing system, information processing method, information processing program, computer readable medium and computer data signal
Publication Date: 2013.06.19 FUJIFILM BUSINESS INNOVATION CORP
  • EP2420950B1 patent drawingFigure 1~2
  • EP2420950B1 patent drawingFigure 3
  • EP2420950B1 patent drawingFigure 4~5

AI summary

An information processing system includes a monitoring program starting unit and a protection target program monitoring unit. When a protection target program to be protected is started, the monitoring program starting unit starts a monitoring program that monitors the protection target program. The protection target program monitoring unit monitors the protection target program by the monitoring program.