Software Application Verification via Function-Level Integrity Prologues
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for verifying the integrity of software applications are complex, resource-intensive, and inefficient, especially on devices with limited resources, and they struggle with flexibility and security when distributed through platforms that limit access to the final compiled binary.
Innovation Solution
An automated application verification system that adds a verification prologue to the entry point of software functions, which includes instructions that do not alter the control flow, allowing for efficient integrity checks during runtime without requiring complex checksum calculations or dual-step build operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If checksum verification routines are added to verify software application integrity, then code integrity is improved, but device complexity and runtime overhead increase
Solution Approach 1:
The patent segments the software application into functions and verifies integrity at the function level rather than requiring verification of the entire application. Each function has an associated verification prologue that can be independently verified, reducing the complexity and overhead of integrity checking while maintaining comprehensive code integrity protection.
2Reliability
If checksum verification routines are executed frequently during runtime, then code integrity verification is improved, but productivity decreases due to overhead
Solution Approach 1:
The verification prologue is executed automatically at the entry point of each function during the normal execution flow, performing integrity verification as a preliminary action before the function body executes. This ensures that if a function has been tampered with, the verification will detect it immediately upon entry, without requiring additional separate verification steps that would reduce productivity.
3Reliability
If compile time checksums are calculated and patched into the application binary, then code integrity is improved, but ease of manufacture decreases due to complex build steps
Solution Approach 1:
The patent merges the integrity verification functionality directly into the application binary by embedding verification prologues within the function code during the compilation process. This integration eliminates the need for separate post-compilation patching steps and complex build procedures, while still providing robust code integrity verification through the embedded verification mechanisms.
4Reliability
If embedded compile time checksum values are strictly bound to protected code, then code integrity verification is improved, but adaptability decreases due to limited flexibility
Solution Approach 1:
The verification prologue uses dynamic verification mechanisms that can adapt to different execution contexts. The verification prologue check instruction dynamically determines whether to perform verification based on the execution environment, allowing the system to maintain code integrity verification while adapting to different deployment scenarios and platforms without requiring strict binding of checksum values to specific protected code locations.
Data Source
AI summary
An automated application verification module is provided to identify one or more functions of a software application. There is added, for at least one of the identified functions, a verification prologue at the entry point of the function which does not alter the control flow of the original set of instructions of the function and/or does not change the semantics of the function when the verification prologue is executed in its entirety. There is added at least one corresponding verification prologue check to the software application, such that the verification prologue check is configured to automatically check the integrity of the corresponding verification prologue during execution of the software application.