Software Intrusion Detection via Bait Code and License Container
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting computer software from intrusions are inefficient in detecting and preventing unauthorized access and attacks, particularly by intruding programs that manipulate the execution environment and communication links between protection hardware and controlling software.
Innovation Solution
The method involves embedding additional code, such as bait code, and using a license container with cryptographic keys to analyze behavior patterns and detect intrusions, combined with a monitoring component that signals intrusion events and blocks further access, employing advanced debugger detection and communication protocol protection mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional monitoring processes are used to analyze access procedures, then server security is provided, but the system is vulnerable to intruding programs that manipulate execution environments and communication links
Solution Approach 1:
The patent embeds additional code (bait code, monitoring code) directly within the protected software application, creating nested layers of protection inside the application itself rather than relying on external monitoring systems. This nested structure allows the protection mechanisms to operate within the execution environment of the protected software, detecting intrusions at the code level.
Solution Approach 2:
The patent introduces a license container as an intermediary component that mediates between the protected software and the execution environment. The license container contains cryptographic keys and additional code that act as intermediaries to detect and respond to intrusions, providing a layered defense mechanism that bridges the gap between application code and system-level protection.
2Reliability
If encryption and obfuscation techniques are applied to protect software, then software integrity is improved, but detection of intrusions becomes more difficult
Solution Approach 1:
The patent converts the harm caused by encryption and obfuscation (making intrusion detection difficult) into a benefit by embedding bait code within the encrypted/obfuscated application code. The bait code is designed to be executed along with the protected code, and when an intruder attempts to decrypt or deobfuscate the code, the bait code triggers detection mechanisms, turning the encryption process itself into a detection opportunity.
Solution Approach 2:
The patent performs preliminary actions by embedding monitoring and bait code within the protected software before it is encrypted or obfuscated. These preliminary embedded codes are positioned to execute during normal operation and during decryption attempts, allowing the system to detect intrusions before the intruder can successfully compromise the software, rather than attempting to detect intrusions after the fact.
3Reliability
If attack prevention measures are activated to block intrusions, then security is improved, but traces are left for intruders to detect
Solution Approach 1:
The license container acts as an intermediary that handles attack prevention measures in a concealed manner. When intrusions are detected, the license container mediates the response by blocking access or terminating execution through mechanisms that do not generate obvious traces. The cryptographic key management within the license container allows for silent revocation of access rights without leaving detectable traces in the execution environment.
Solution Approach 2:
The patent extracts the attack prevention and response mechanisms from the main application code and places them within the separate license container structure. This extraction allows the prevention measures to operate independently and concealably, with the ability to block intrusions and terminate compromised executions without leaving traces within the protected application itself. The separation isolates the trace-generating activities from the protected code.
Data Source
Figure 1(a)
Figure 1(b)
Figure 2
AI summary
Method for protecting computer software by detecting an attack of an intruding program interfering with the execution of said protected software on a computer system with a processor and at least a processor memory, wherein the computer software to be protected communicates with a license container containing a license for using and executing the protected computer software and containing at least one cryptographic key, wherein the license container provides licenses and cryptographic keys for the protected software to protect its usage and its integrity, and wherein the protected computer software is at least partly encrypted and uses the associated cryptographic keys to decrypt said protected software for executing comprises the following steps: during execution of the protected software, analyzing the behavior of the protected software and/or the execution environment of the protected software on the computer system, and searching for patterns of an intrusion or an intruding program, detecting an intrusion into the protected software during the execution of the protected software, wherein the intruding program uses a monitoring component for gaining unauthorized access, and creating a signal on detection of an attack.