Server Application Attestation via Random Executable Code

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for attesting the integrity of applications in smart devices are vulnerable to reverse engineering-based hacking attacks, allowing malicious applications to be predicted and validated, which can lead to the disclosure of personal information.

Innovation Solution

A server and method that generates and transmits unpredictable random executable codes to smart devices for attestation, analyzing the execution results to detect malicious applications and differentiate between original and altered applications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If deterministic attestation codes are used, then the attestation process is simple and resource-efficient, but the system becomes vulnerable to reverse engineering attacks where hackers can predict and extract valid attestation values

Engineering Contradiction:

Improvesecurity against reverse engineeringVSAvoidcomplexity of attestation mechanism

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies dynamics by transitioning from static deterministic attestation codes to dynamic random executable codes. The server generates and transmits different random executable codes for each attestation request, making the attestation process adaptive and unpredictable. This resolves the contradiction by enhancing security against reverse engineering while maintaining manageable complexity through centralized code generation.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent changes the parameter of attestation codes from fixed deterministic values to variable random values. By introducing randomness as a parameter change, the system becomes unpredictable to attackers while the server manages the complexity of generating and verifying these random codes, thus resolving the security-complexity contradiction.

Inventive Principle:

Principle #35Parameter changes

2Reliability

If random executable codes are generated and verified on the device, then security against reverse engineering improves, but resource consumption and device load increase

Engineering Contradiction:

Improveintegrity verification securityVSAvoiddevice energy consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent introduces a server as an intermediary that handles the complex tasks of generating random executable codes and verifying their results. The mobile device only needs to execute the received codes and return results, significantly reducing its computational burden and energy consumption while maintaining high security through the server's verification process.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical/computational burden of generating and verifying complex attestation codes on the device with a remote server system. The server performs the intensive computational work of code generation and result verification, substituting the device's mechanical resources with remote computational power, thus reducing device energy consumption while maintaining security.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If multiple attestation functions are executed to detect malicious applications, then detection accuracy improves, but the processing time and user experience deteriorate

Engineering Contradiction:

Improvemalicious application detection accuracyVSAvoidattestation processing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies partial action by selecting and executing only the necessary random executable codes relevant to the specific attestation request, rather than running all possible attestation functions. This partial execution approach maintains detection accuracy for the required security checks while reducing overall processing time and improving user experience.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS9569618B2Server and method for attesting application in smart device using random executable code

Publication Date: 2017.02.14 KOREA UNIV RES & BUSINESS FOUND

AI summary

The present invention discloses an application attestation server and an application attestation method. Specially, there is provided an application attestation server that attests a certain application in a smart device, the application attestation server comprising: an executable code generation unit configured to generate executable codes for attestation with respect to the application; a transceiver configured to transmit an executable code randomly selected from the generated executable codes to the smart device, and receive a result of execution of the selected executable code with respect to the application from the smart device; a malicious application analysis unit configured to analyze whether the application is a malicious application based on the received result; and an analysis result providing unit configured to provide an analysis result of the malicious application analysis unit to a user. Herein, the executable code generation unit configures to generate the executable codes by randomly combining information relevant to the application.