Tamper Detection Module for Executable Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for protecting software applications against tampering are primarily proactive and fail to detect unauthorized modifications after the application has been deployed, leaving users and vendors unaware of tampering until it manifests in unanticipated behavior.
Innovation Solution
Incorporating a tamper detection module within the executable application that computes a checksum at runtime and compares it to a pre-determined hash value computed at build time, allowing for real-time detection of tampering and generating alerts or mitigation actions, such as disabling the application or offering a replacement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proactive hardening techniques are used to prevent tampering, then application security is improved, but the ability to detect tampering after deployment deteriorates
Solution Approach 1:
The patent embeds a tamper detection module within the application at build time, along with a predetermined hash value calculated from the application's binary content. This preliminary setup enables automatic detection of any modifications to the application code or data segments after deployment, resolving the contradiction by providing both proactive protection and post-deployment detection capability
2Difficulty of detecting and measuring
If external processes are used for tamper detection, then detection functionality is added, but vulnerability to tampering and interference increases
Solution Approach 1:
The patent merges the tamper detection functionality directly into the application binary by embedding the detection module and hash value within the application itself. This integration ensures that the detection mechanism cannot be easily separated or tampered with independently, as any modification to the application will be detected by the embedded module, thus reducing susceptibility to external tampering attempts
3Ease of manufacture
If checksum computation is performed at build time only, then hash value can be predetermined, but real-time tamper detection after deployment is not possible
Solution Approach 1:
The patent performs preliminary computation of the hash value from the application's binary content at build time and embeds this predetermined hash value within the application. At runtime, the embedded detection module automatically computes the checksum of the current application state and compares it with the predetermined hash value, enabling real-time tamper detection without delaying the detection process
Data Source
AI summary
Techniques are provided for detecting executable application that is subjected to tampering or unauthorized modification. A checksum for a portion of the executable application is computed at a run time of the executable application by a tamper detection module encoded in the executable application. The tamper detection module compares the checksum to a pre-determined hash value for the portion of the executable application. If the checksum is different from the hash value, the executable application has been tampered with or otherwise modified. The tamper detection module can then cause an alert to be sent to the user and/or the software vendor indicating that the executable application is not genuine.