Steganographic Executable Code Integrity via Call Graph Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting executable software during execution are inadequate, as encryption and code signatures are removed prior to execution and cannot prevent unauthorized modification or execution of foreign code.
Innovation Solution
A steganographic method that encodes information by determining a call graph of an executable entity, identifying invariant sequences, and mapping nodes to a cipher table to create an obscured instruction sequence that maintains the integrity of the executable code, ensuring it matches a predetermined order for acceptable operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption and code signatures are used to protect executable software, then security is improved during transport and storage, but these protections are removed prior to execution and cannot protect the executable during actual execution
Solution Approach 1:
The patent embeds a monitoring program within the executable code itself during the compilation process, preparing the protection mechanism in advance so that it becomes active automatically when the code is executed, eliminating the gap where no protection exists during runtime
2Reliability
If a monitoring program is implemented to detect unauthorized modification during execution, then reliability is improved, but the monitoring program may be detected and circumvented by malicious code
Solution Approach 1:
The monitoring program is merged with the executable code itself, forming a unified binary where the monitor and monitored code are inseparable. This integration makes it difficult for malware to distinguish and target the monitoring component separately
Solution Approach 2:
The patent uses an invariant sequence derived from the call graph as an intermediary that the monitoring program verifies against actual execution. This indirect verification method allows the monitor to detect deviations without directly exposing its detection logic to potential attackers
3Reliability
If the monitoring program is made more sophisticated to prevent circumvention, then security is improved, but the complexity of the executable code increases
Solution Approach 1:
The executable code contains its own monitoring capabilities through the embedded monitoring program that uses the call graph and invariant sequences. The code monitors itself without requiring external protection mechanisms, achieving robust security without adding separate complex protection layers
Data Source
AI summary
A method for digital immunity includes identifying a call graph of an executable entity, and mapping nodes of the call graph to a cipher table of obscured information, such that each node based on invariants in the executable entity. A cipher table maintains associations between the invariants and the obscured information. Construction of an obscured information item, such as a executable set of instructions or a program, involves extracting, from the cipher table, ordered portions of the obscured information, in which the ordered portions have a sequence based on the ordering of the invariants, and ensuring that the obscured information matches a predetermined ordering corresponding to acceptable operation, such as by execution of the instructions represented by the obscured information, or steganographic target program (to distinguish from the executable entity being evaluated). The unmodified nature of the executable entity is assured by successful execution of the steganographic target program.