Software Execution Path Diversity via Dynamic Memory State
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional whitebox software protection methods face limitations in creating effective path diversity due to reliance on easily discoverable decision values from known APIs, leading to limited scalability and predictability, making it difficult to maintain security against attackers.
Innovation Solution
The implementation leverages dynamic analysis to identify frequently updated memory locations within the program state, using these as decision values for selecting between multiple execution paths during runtime, thereby creating secured code that is harder to attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional path diversity techniques use known APIs (CPUID, RDTSC, GetSystemTime) as decision values, then path diversity can be implemented, but the decision values become easily discoverable and linkable to the control flow by attackers
Solution Approach 1:
The patent extracts the decision value selection from known APIs and system functions, instead using internal program state variables and memory locations. This removes the easily discoverable external decision mechanisms and replaces them with internal state that is not readily accessible to attackers through standard debugging or monitoring techniques.
Solution Approach 2:
The patent introduces an intermediary mechanism using memory locations and program state variables as decision values. These intermediaries are not directly exposed to the attacker but are used to control execution paths, creating a layer of indirectness that obscures the control flow decision logic.
2Adaptability or versatility
If external decision values from known APIs are used for path diversity, then execution paths can be diversified, but the number of potential decision values is limited and can be predicted relatively easily
Solution Approach 1:
The patent creates multiple copies of program state variables and memory locations that can serve as decision values. By duplicating and varying the internal state indicators, the system creates numerous potential decision values that are not predetermined and cannot be easily predicted, as each depends on the specific runtime state of the program.
Solution Approach 2:
The patent makes the decision values dynamic by using program state variables and memory locations that change during execution. Instead of static external decision values, the system uses internal state that evolves over time, ensuring that decision values are unique to each execution context and cannot be predicted from static analysis.
3Ease of manufacture
If static program analysis is used to find decision values, then limited information about program state can be obtained, but this makes it difficult to find suitable data for path diversity
Solution Approach 1:
The patent performs preliminary dynamic profiling of the program to collect information about memory access patterns and state variable usage before finalizing the path diversity implementation. This preliminary analysis identifies suitable decision values based on actual runtime behavior, ensuring that the selected variables provide sufficient entropy and variability for secure path diversity.
Solution Approach 2:
The patent replaces static program analysis with dynamic profiling techniques to identify decision values. Instead of analyzing program state through static methods, the system uses dynamic monitoring of memory accesses and variable updates to identify state indicators that provide the necessary variability and unpredictability for secure execution path diversification.
Data Source
AI summary
A system and method for creating secure software code. Original code is processed to determine memory states, which are dynamic during execution of the code. Selected functions of the code are duplicated and placed in parallel alternative control paths in order to create protected code with increased path diversity. The state of the memory, or a variable derived therefrom is used to select one of the alternative paths during execution of the protected code.