Steganographic Firmware Authentication via Op Code Replacement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firmware authentication methods are inefficient due to overhead costs and the inability to add authentication information to binary encodings without altering offsets, making it difficult to verify code authenticity, especially in modular firmware environments like EFI.
Innovation Solution
A steganographic technique that replaces original op code sequences with equivalent ones in binary drivers, allowing hidden information like authentication and versioning data to be embedded without changing the code's functionality or size, using a replacement map of equivalent op code sequences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication information is embedded in a header of a binary file, then versioning and authentication data can be stored, but space overhead increases and offsets change making code inoperable
Solution Approach 1:
The patent merges authentication and versioning information directly into the existing binary code structure by replacing equivalent op code sequences, rather than adding separate header data. This combines multiple functions (authentication, versioning, execution) into a single integrated binary structure, eliminating the need for additional space overhead while maintaining code operability.
Solution Approach 2:
The patent nests authentication and versioning data within the existing binary code structure by embedding them in replaceable op code sequences. The authentication information is hidden within the code itself, like a nested doll, allowing the binary to maintain its original size and offset structure while containing embedded authentication data.
2Reliability
If new header information is added to binary encodings, then authentication data can be included, but offsets change making the code inoperable
Solution Approach 1:
The patent changes the parameters of existing op code sequences by replacing them with equivalent sequences that embed authentication data. Instead of adding new header information that would change offsets, the method modifies existing code parameters (op code sequences) to incorporate authentication data, maintaining the original binary structure and offset relationships.
Solution Approach 2:
The patent uses equivalent op code sequences as copies that perform the same function as the original sequences. These equivalent sequences serve as substitutes that embed authentication information while maintaining the same operational behavior, thus preserving code operability without changing offsets.
3Reliability
If authentication information is embedded in binary drivers, then code authenticity can be verified, but the process becomes complex
Solution Approach 1:
The patent implements self-service authentication where the binary code contains its own authentication information embedded within its structure. The code authenticates itself by containing equivalent op code sequences that encode authentication data, eliminating the need for external authentication mechanisms and reducing process complexity.
Data Source
AI summary
Methods for providing and extracting hidden information in firmware images using steganographic processes. Information is hidden in binary firmware images, such as drivers, using a steganographic process in which the functionality of the binaries do not change, and the size is not increased. During a pre-boot phase of a computer system, binary firmware drivers containing hidden steganographic data are identified, and a steganographic extraction process is performed to extract the hidden data. In one embodiment, a hash is employed on an authentic binary image to uniquely identify the op code content. The digest from the hash is stored in the steganographic data. In one embodiment, a vendor's private key and optional signature is used to encrypt the hash. A similar hash is performed on the binary image of a discovered binary firmware driver, and the authentic hash digest is extracted from the steganographic data. The hash digests are compared to authenticate the binary firmware driver.