Tamper Response Mechanism Using Delayed Pointer Corruption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing tamper-resistant software systems are vulnerable due to inadequate emphasis on the tamper response component, making them susceptible to hacking, as they often apply responses immediately after detection, which can be easily patched or detected.
Innovation Solution
Implementing a tamper response system that introduces delayed, probabilistic failures in a program by corrupting global pointers, blending the response into the program's internal state, and separating detection and response in space and time to evade detection, using principles of stealth and predictability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the tamper response component is applied immediately after tamper detection, then the response is swift and effective, but the system becomes easily detectable and patchable by hackers
Solution Approach 1:
The patent applies preliminary action by pre-corrupting global pointers before the actual tamper response is needed. When tampering is detected, the system activates pre-positioned corrupted pointers that immediately cause program failure without requiring complex real-time response logic, making the response both swift and difficult to detect
Solution Approach 2:
The patent implements periodic action by introducing random delays and probabilistic activation of tamper responses. Instead of immediate deterministic responses, the system uses periodic/random timing to activate corrupted pointers, making the response pattern unpredictable and difficult for hackers to analyze or patch
2Difficulty of detecting and measuring
If the tamper response system is separated from the tamper detection component, then the system becomes more difficult to detect and patch, but the system complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the tamper response system into separate functional modules: tamper detection component, response selection component, and response implementation component. Each module operates independently with defined interfaces, reducing detectability while managing complexity through modular design
Solution Approach 2:
The patent uses an intermediary mechanism in the form of a response selection component that sits between detection and execution. This intermediary randomly selects and delays response activation, adding complexity management layers that obscure the direct connection between detection and response while maintaining system functionality
3Difficulty of detecting and measuring
If delayed and probabilistic failures are introduced, then the system becomes harder to detect, but the response time is extended
Solution Approach 1:
The patent applies dynamics by making the response timing flexible and adaptive rather than fixed. The system uses probabilistic delay mechanisms that can adjust response timing based on various factors, making the delay pattern dynamic and unpredictable while still ensuring eventual response activation
Data Source
AI summary
A tamper response mechanism introduces a delayed failure into a program in response to detected tampering with the program. The mechanism determines a manner of responding to the detected tampering. The manner of responding may include corrupting a global pointer or using other techniques. The mechanism also determines when to respond to the tampering and implements the response at the determined time.