Software Protection via Identity Transformations and Condition Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection methods are inadequate in preventing attackers from modifying execution flow and accessing sensitive information, as they rely on explicit conditions that can be easily tampered with.
Innovation Solution
The method involves modifying the software to make control flow independent of explicit conditions by introducing identity transformations that depend on condition variables, spreading condition values across new variables, and altering results if the condition is not satisfied, thereby making it harder for attackers to manipulate the code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If explicit conditions are used to control software execution flow, then the code is easy to understand and modify, but attackers can easily tamper with the condition to bypass security checks
Solution Approach 1:
The patent segments the condition evaluation into multiple independent components by introducing several new variables (v1, v2, v3, etc.) that each represent a portion of the original condition. Instead of a single explicit condition, the software now evaluates multiple segmented conditions that collectively represent the same logical constraint, making it difficult for attackers to tamper with all segments simultaneously.
Solution Approach 2:
The patent introduces intermediary variables that act as mediators between the original condition and the execution flow. These new variables (v1, v2, v3, etc.) serve as intermediate representations of the condition, transforming the direct condition-check into a multi-step evaluation process that passes through multiple intermediary states, thereby obfuscating the original condition while maintaining its logical integrity.
2Reliability
If multiple identity transformations are inserted into expressions, then the condition becomes obfuscated and harder to attack, but the code complexity increases
Solution Approach 1:
The patent applies parameter changes by transforming the original condition variables into multiple new variables with different names and representations (v1, v2, v3, etc.). Each transformation changes the parameter representation while maintaining the underlying logical relationship, thereby obfuscating the condition without altering its fundamental meaning or security properties.
Solution Approach 2:
The patent adds another dimension to the condition evaluation by introducing multiple variables that represent the same logical condition from different perspectives. Instead of a single-dimensional condition check, the system now operates in a multi-dimensional space of variables, where the condition must be satisfied across multiple dimensions simultaneously, increasing complexity for attackers while preserving the original logic.
3Reliability
If control flow is made independent of explicit conditions, then attackers cannot easily modify execution flow, but the natural control flow structure is lost
Solution Approach 1:
The patent performs preliminary action by pre-evaluating the condition and storing the result in multiple new variables before the actual execution flow decision is made. This preliminary evaluation phase separates the condition checking from the control flow branching, allowing the control flow to appear independent of explicit conditions while still being governed by the pre-computed variable values, thereby protecting against execution flow modification.
Data Source
AI summary
There is described a method of protecting an item of software so as to obfuscate a condition which causes a variation in control flow through a portion of the item of software dependent on whether the condition is satisfied, wherein satisfaction of the condition is based on evaluation of one or more condition variables. The method comprises: (i) modifying the item of software such that the control flow through said portion is not dependent on whether the condition is satisfied; and (ii) inserting a plurality of identity transformations into expressions in said portion of the modified item of software, wherein the identity transformations are defined and inserted such that, in the absence of tampering, they maintain the results of the expressions if the condition is satisfied and such that they alter the results of the expressions if the condition is not satisfied, wherein each identity transformation is directly or indirectly dependent on at least one of the one or more condition variables. New variables may be defined as part of this method. There are also described associated apparatuses, computer programs and the like.