Secure Remote Execution Jail for Software Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection methods fail to prevent reverse engineering, even from legitimate users, as they can obtain and analyze executable software, either statically or dynamically, which compromises the software's security and know-how.
Innovation Solution
A secure remote computer system with a loader module that executes executable software within its memory, creating a 'jail' in the file system where the software is never copied, and uses encryption, authentication, and modified operating system primitives to prevent access and debugging, ensuring the software runs without being stored in the file system or visible as a running process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If executable software is distributed to users, then users can access and use the software, but users can obtain copies and perform reverse engineering analysis
Solution Approach 1:
The patent introduces a secure remote computer as an intermediary between the software and the user. The software is executed on the remote computer rather than being installed locally, and users access it through a terminal. This mediator prevents users from obtaining copies of the executable while still allowing them to use the software's functionality through encrypted communication channels.
Solution Approach 2:
The patent extracts the executable software from the user's local environment and places it in a controlled execution environment on the remote computer. By separating the software from the user's file system and process space, the patent prevents static analysis and reverse engineering while maintaining software functionality for authorized users.
2Ease of operation
If software is executed locally on user computers, then users can run the software, but the executable becomes visible in the file system and process list
Solution Approach 1:
The terminal acts as an intermediary that redirects user interactions to the remotely executed software. Users interact with the software through the terminal interface, while the actual execution occurs on the secure remote computer. This hides the software from the user's local file system and process list, making it undetectable through standard system monitoring.
Solution Approach 2:
The patent moves software execution from the user's local dimension (file system and process space) to a remote dimension (secure server environment). By changing the spatial dimension of execution from local to remote, the software becomes invisible to local system monitoring tools while remaining accessible to users through the terminal interface.
3Adaptability or versatility
If debugging capabilities are provided for legitimate use, then users can troubleshoot software, but reverse engineers can use them to analyze and reverse engineer the software
Solution Approach 1:
The patent modifies the operating system to have different capabilities in different contexts. For authorized users accessing through the terminal, the system provides necessary functionality while preventing debugging. The OS is configured to prohibit write-authorized memory segments from being executable and removes debugging primitives, creating localized security policies that prevent reverse engineering while maintaining software operation.
Solution Approach 2:
The patent changes the parameters of the operating system environment to prevent reverse engineering. By modifying the OS to remove debugging capabilities and implementing memory execution restrictions, the patent alters the execution parameters in a way that maintains software functionality for authorized users while blocking reverse engineering activities. This is achieved through access control lists and modified OS primitives that detect and prevent debugging attempts.
Data Source
Figure 1~2
Figure 3a~3c
Figure 4
AI summary
The method involves starting a load module in a file system, and creating a prison constituted of a sub-assembly of the file system as an execution environment of the load module, using a creation unit. A software executable within a memory of a process executing the load module, is loaded using a load unit. An execution control is passed to the executable software, by executing the software within the memory of the process executing the load module and in the environment of the file system constituted by the prison. An independent claim is also included for a secure device for executing the executable software.