Software Authentication via Execution Trace Fingerprinting

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current security systems fail to detect abnormal software behavior originating from within a controlled operating environment, allowing malware to spread undetected until anti-virus updates are performed.

Innovation Solution

A method for authenticating software by creating and comparing 'fingerprints' of software functionality using trace mapping, which involves defining a set of parameters to generate trusted and operating fingerprints, and initiating actions if differences are detected, such as terminating software execution or notifying users.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security systems monitor only communication traffic between controlled operating environment and external environment, then security resources are focused on external threats, but abnormal behavior of software originating from inside the controlled operating environment cannot be detected

Engineering Contradiction:

Improvedetection capabilityVSAvoidmonitoring system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

Instead of monitoring external communication traffic to detect malware, the patent inverts the approach by monitoring the software's own execution behavior and fingerprint. The system creates a reference fingerprint of legitimate software behavior and compares it against actual execution traces, enabling detection of abnormalities originating from within the controlled environment without requiring complex external monitoring infrastructure.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent replaces the mechanical approach of monitoring communication traffic with a computational approach using trace mapping and fingerprint comparison. By substituting network traffic analysis with software execution trace analysis, the system detects malware behavior through computational pattern recognition rather than traditional network security mechanisms.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If anti-virus programs perform scans only after updates are released, then resource consumption is minimized, but malware spreads within the controlled operating environment until updates are performed

Engineering Contradiction:

Improvemalware detectionVSAvoidtime for malware spread

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent creates a reference fingerprint of legitimate software behavior in advance during a trusted environment. This preliminary action establishes a baseline for comparison that enables real-time detection of malware-infected software executions, eliminating the time delay associated with waiting for anti-virus updates and scans.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements continuous feedback by comparing the current execution fingerprint against the reference fingerprint during software operation. This real-time feedback mechanism immediately identifies deviations caused by malware, enabling prompt response actions without waiting for periodic scans or updates.

Inventive Principle:

Principle #23Feedback

3Measurement precision

If trace mapping is used to investigate software functionality, then software behavior can be analyzed, but the result only reveals functionality in the current environment which may be the root cause of abnormal behavior

Engineering Contradiction:

Improvesoftware functionality measurementVSAvoidenvironmental adaptability

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent introduces an intermediary reference fingerprint created in a controlled trusted environment that mediates between the software's inherent functionality and the potentially compromised operating environment. This reference fingerprint serves as a neutral baseline that enables accurate measurement of software behavior independent of the hosting environment's influence.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10896251B2Method for authenticating software

Publication Date: 2021.01.19 SAAB AB

AI summary

The present invention relates to a method for authenticating software. The method comprises defining a set of parameters to use for trace mapping the software, wherein the set of parameters represents the software functionality when executed. The method further comprises: a) creating a trusted fingerprint that is created by trace mapping the software using the set of parameters when executed in a trusted environment; b) creating an operating fingerprint that is created by trace mapping the software using the set of parameters when executed in an operating environment; c) comparing the operating fingerprint with the trusted fingerprint, and identifying any difference between the trusted fingerprint and the operating fingerprint; and d) when said operating fingerprint is non-identical with the trusted fingerprint, initiating predefined action(s) in response to the identified differences between the trusted fingerprint and the operating fingerprint.