Processor Software Integrity via Instruction Hash Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection methods are vulnerable to tampering through reverse engineering and dynamic/static analysis, with current encryption schemes requiring significant overhead and being limited to tree-like structures, and lacking flexibility across different software architectures.
Innovation Solution
A processor-implemented method for ensuring software integrity by decrypting and executing instructions on an instruction-by-instruction basis, using an initialized instruction key updated based on the current and previous instructions, allowing for flexible application across various software structures and eliminating the need for software overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-block encryption is used to protect software, then software integrity is improved, but device complexity and execution overhead increase significantly
Solution Approach 1:
The software program is divided into multiple sequential blocks, where each block is encrypted with a unique key derived from the previous block's hash value. This segmentation allows integrity protection while managing complexity through structured division of the encryption process into manageable blocks with clear dependencies.
Solution Approach 2:
A program controller is pre-added to the end of the program during compilation, which automatically performs integrity checking by verifying hash values of blocks during execution. This preliminary action ensures that integrity verification is built-in without requiring complex runtime decisions about whether to check integrity.
2Reliability
If multi-block encryption with program controller is added to ensure software integrity, then tamper-proof capability is improved, but productivity and execution speed deteriorate
Solution Approach 1:
The encryption and integrity verification process is designed to be self-service, where the program controller automatically verifies block integrity using pre-computed hash values without requiring external intervention or complex verification logic during execution. The first block is executed in clear text to initialize the process, and subsequent blocks are automatically decrypted and verified in sequence.
3Reliability
If block-by-block encryption is used, then software integrity is improved, but the method is limited to tree-like structures and lacks adaptability
Solution Approach 1:
The encryption scheme is designed with universal applicability to work with any software structure type, not just tree-like structures. The block division and hash-based key derivation mechanism can be applied to sequential, hierarchical, or other software organization patterns, making the integrity protection method versatile across different programming paradigms and software architectures.
4Ease of manufacture
If security module is implemented in software, then flexibility and lower cost are achieved, but vulnerability to reverse engineering and analysis increases
Solution Approach 1:
The security-critical components, specifically the program controller and hash verification logic, are extracted and implemented in hardware rather than software. This extraction removes the vulnerable parts from the software domain, making them resistant to reverse engineering and dynamic analysis while keeping the overall system flexible and cost-effective.
Data Source
AI summary
The present invention provides a solution to the problem of guaranteeing the integrity of software programs by encrypting all or part of each instruction of a program using a key based on all or part of one or a plurality of previous instructions, thus resulting in a different encryption key per instruction. The invention is applicable to software programs whose structures are not necessarily tree-like in nature and is also applicable when the program includes loops, jumps, calls or breaks etc. The invention allows for an exception to be flagged when an encrypted instruction is wrongly decrypted. There is no need for the first instruction to be in clear, since the instruction key may be appropriately initialized as required. The invention can be realized in software or entirely in hardware thereby eliminating the possibility of a third party intercepting a decrypted instruction or a decryption key.