Steganographic Executable Authentication via Call Graph Invariants
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity methods fail to protect executable software from unauthorized modification or execution during runtime, as encryption and code signatures are removed prior to execution and do not effectively prevent the execution of foreign or malicious code.
Innovation Solution
A steganographic method that encodes information by determining a call graph of an executable entity, identifying invariant sequences, and associating them with ordered information segments, creating a credential for authentication, ensuring that the obscured information is executed in a predetermined order to maintain integrity and detect unauthorized modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption and code signatures are used to protect executable software, then security during transport and storage is improved, but these protections are removed prior to execution and cannot protect the executable during actual execution
Solution Approach 1:
The patent embeds security credentials and invariant sequences into the executable code during compilation, preparing protection mechanisms in advance that remain active throughout execution. The call graph is analyzed and credentials are embedded beforehand, so protection is already in place when execution begins, rather than being applied and then removed.
Solution Approach 2:
The executable code performs self-verification during execution by using its embedded credentials to authenticate itself and verify its own integrity. The invariant sequences are executed as part of the normal code flow, allowing the program to self-monitor and self-protect without external intervention throughout its runtime.
2Reliability
If steganographic techniques embed signatures in digital media, then intellectual property protection is improved, but the techniques do not draw attention and therefore cannot prevent execution of malicious code
Solution Approach 1:
The patent merges the steganographic credential embedding with the executable code structure itself. Rather than separately embedding signatures in media files, the credentials are integrated into the code's call graph and invariant sequences, combining protection with functionality. The credentials become part of the code's natural execution flow rather than external additions.
Solution Approach 2:
The patent implements feedback mechanisms where the embedded credentials continuously verify code integrity during execution. The invariant sequences provide ongoing feedback about the code's state, allowing real-time detection of tampering or malicious modifications rather than just post-hoc verification.
3Reliability
If code authentication is performed during execution, then protection against foreign code is improved, but the authentication process may slow down execution speed
Solution Approach 1:
The patent makes authentication continuous by integrating verification into the normal execution flow through invariant sequences. Rather than performing separate authentication steps that interrupt execution, the verification happens continuously as part of the code's natural operation, maintaining both security and performance.
Solution Approach 2:
The patent uses selective verification of invariant sequences rather than authenticating every single instruction. By focusing on key invariant points in the execution flow, the system achieves adequate authentication without the overhead of verifying every operation, balancing security with performance.
Data Source
AI summary
A method for digital immunity includes identifying a call graph of an executable entity, and mapping nodes of the call graph to a cipher table of obscured information, such that each node based on invariants in the executable entity. A cipher table maintains associations between the invariants and the obscured information. Construction of an obscured information item, such as a executable set of instructions or a program, involves extracting, from the cipher table, ordered portions of the obscured information, in which the ordered portions have a sequence based on the ordering of the invariants, and ensuring that the obscured information matches a predetermined ordering corresponding to acceptable operation, such as by execution of the instructions represented by the obscured information, or steganographic target program (to distinguish from the executable entity being evaluated). The unmodified nature of the executable entity is assured by successful execution of the steganographic target program.