Software Installation Fingerprinting for Clone-Resistant Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods fail to provide comprehensive integrity protection for software installations, particularly in IoT devices and SCADA systems, as they lack unique identification and are vulnerable to cyberattacks, especially during software instance installations outside protected environments.

Innovation Solution

Generate a key pair for software installations using random numbers enriched with installation-specific data to create a unique fingerprint, securely store the private key, and use this fingerprint for cryptographic authentication, enabling trusted communication and licensing without hardware-based second factors.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manufacturer certificates (MDCs) or Initial Device Identifiers (IDevIDs) are used for hardware identification, then unique identification and cryptographic security are achieved, but this approach is not applicable to software instance installations installed outside protected device production environments

Engineering Contradiction:

Improveintegrity protectionVSAvoidapplicability to software installations

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent creates a virtual copy of the hardware certificate concept by generating a software-specific private key that mimics the functionality of manufacturer certificates. This software-generated key pair serves as a copy of the security mechanism, allowing software installations to achieve the same level of identification and cryptographic security as hardware devices without requiring protected production environments

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent replaces the mechanical/hardware-based certificate system with a software-based cryptographic system. Instead of relying on physical secure memory in hardware devices, the invention uses software-generated key pairs with installation-specific data, substituting the mechanical security approach with a software-based cryptographic approach that works in unprotected environments

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Ease of operation

If standard software installation methods are used without installation-specific identification, then ease of installation is maintained, but cloning becomes easy and comprehensive integrity protection is lacking

Engineering Contradiction:

Improveinstallation processVSAvoidintegrity protection

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The software installation performs self-identification by automatically generating a private key enriched with its own installation-specific data. The system serves itself by creating its own unique cryptographic identity without requiring external hardware security modules or protected production environments, maintaining ease of installation while achieving integrity protection

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent changes the parameters of software installation by incorporating installation-specific data (such as installation path, version, hostname) into the private key generation process. This parameter enrichment transforms identical software copies into uniquely identifiable installations, preventing cloning while maintaining the standard installation process

Inventive Principle:

Principle #35Parameter changes

3Productivity

If random numbers are used to generate key pairs without installation-specific data, then key generation is simple and fast, but the software installation lacks unique identification and cloning remains possible

Engineering Contradiction:

Improvekey generation speedVSAvoidunique identification

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent performs preliminary action by collecting installation-specific data before key generation and incorporating it into the private key creation process. By preparing the enrichment data in advance and combining it with random numbers during key generation, the system achieves both speed and uniqueness without requiring post-installation configuration

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The private key is created as a composite of two elements: random numbers (providing entropy and speed) and installation-specific data (providing uniqueness). This composite approach combines the advantages of both methods, maintaining fast key generation while ensuring unique identification that prevents cloning

Inventive Principle:

Principle #40Composite materials

Data Source

PatentEP4183097B1Method and systems for generating uniquely identifiable software installations

Publication Date: 2026.01.07 SIEMENS AG

Figure 1~2
Figure 3
Figure 4

AI summary

The invention relates to methods for generating a uniquely identifiable software installation (3, 103), wherein a key pair consisting of a private (4) and a public key (5) is generated (S1) for a software installation installed on a machine-readable medium (2), random numbers (S2) supplemented (S3) with installation-specific data of the software installation (3, 103) are used to generate the key pair (4, 5), and the generated private key (4) is securely stored (S4).