Shared Library HMAC Verification for Correct Dynamic Loading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing shared library systems lack a scalable mechanism for ensuring the correct version is dynamically loaded by an application, leading to potential errors or malicious behavior without requiring the application to manage and verify the integrity of each library.
Innovation Solution
A shared library performs self-version verification through a build-time workflow that computes and deploys a hash-based message authentication code (HMAC) at predefined paths, and a runtime workflow that compares this HMAC with a stored value to ensure the correct version is loaded, eliminating the need for the application to manage these checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the application manually verifies library versions, then version accuracy improves, but system complexity and overhead increase
Solution Approach 1:
The shared library performs self-version verification autonomously by computing its own HMAC and comparing it against the stored expected HMAC value. This eliminates the need for application-level verification logic, transferring the verification responsibility to the library itself and reducing overall system complexity while maintaining reliability
Solution Approach 2:
The expected HMAC value is pre-computed and stored in the application executable during the build process. This preliminary preparation enables rapid verification at runtime without requiring complex version management logic in the application, resolving the contradiction between reliability and complexity
2Reliability
If the application manages library verification, then version control improves, but development and maintenance overhead increase
Solution Approach 1:
The shared library autonomously performs version verification by computing its own HMAC and comparing it with the expected value stored in the application. This self-service mechanism eliminates the need for application developers to implement and maintain verification logic, reducing development overhead while ensuring version control reliability
Solution Approach 2:
The version verification logic is extracted from the application and embedded within the shared library itself. This separation allows the application to remain simple while the library handles verification independently, reducing development and maintenance overhead for the application team
3Device complexity
If no verification mechanism is used, then system simplicity is maintained, but security and correctness deteriorate
Solution Approach 1:
An HMAC (hash-based message authentication code) is introduced as an intermediary verification mechanism. The HMAC is computed from the library binary and compared against a pre-stored expected value, providing cryptographic verification without adding complex verification logic to the application. This intermediary mechanism enhances security while maintaining system simplicity
Solution Approach 2:
The expected HMAC value is pre-computed and embedded in the application executable during the build process. This preliminary action enables secure verification at runtime without requiring complex runtime logic, balancing security requirements with system simplicity
Data Source
AI summary
Techniques that enable a shared library to perform self-version verification at the time of being dynamically loaded by a software application are provided. Self-version verification in this context refers to the process of verifying by the shared library that it is the library version the software application intends to use, without any intervention or involvement by the application.