Trusted Address Server Dynamic Control Flow Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional software systems have static control flow mechanisms that make them vulnerable to reverse engineering and exploitation, limiting their updatability and security, as attackers can easily determine and manipulate the program flow, leading to potential subversion of intended behavior.
Innovation Solution
The introduction of a Trusted Address Server (TAS) that dynamically controls function call interconnections at runtime, using source and target tokens to obscure control flow information and allow for orthogonal protection, enabling runtime updates and diversification, thereby making it harder for attackers to reverse engineer the program.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If static control flow mechanisms are used in traditional software systems, then the program structure is simple and deterministic, but the software becomes vulnerable to reverse engineering and exploitation
Solution Approach 1:
The patent implements dynamic control flow by replacing static jump tables with runtime-resolved indirect calls. Function pointers are selected and resolved during execution based on input parameters, making the control flow path unpredictable and difficult to reverse engineer. The system dynamically determines which function implementation to execute, changing the control flow structure from static to dynamic.
Solution Approach 2:
The patent introduces an intermediary layer between the control flow logic and function implementations. Instead of direct jumps to fixed addresses, the system uses function pointer tables and indirect call mechanisms that act as mediators. This intermediary layer obscures the actual control flow paths and makes reverse engineering significantly more difficult.
2Difficulty of detecting and measuring
If indirect jump tables are used to mitigate control flow exposure, then reverse engineering becomes slightly harder, but the control flow information remains deterministic and predictable
Solution Approach 1:
The system employs dynamic function pointer resolution where the actual function called is determined at runtime based on input parameters. This dynamic behavior makes the control flow unpredictable and difficult to analyze statically, while still maintaining deterministic execution for identical inputs.
Solution Approach 2:
The patent changes the parameters used in control flow decisions from direct address calculations to function pointer selections based on input data. By using input-dependent parameter selection for function pointers, the system creates variable control flow paths that are harder to predict and analyze.
3Reliability
If the control flow is made dynamic and unpredictable, then security against reverse engineering improves, but the program complexity and execution overhead increase
Solution Approach 1:
The patent segments the function implementations into separate, independently compilable units with well-defined interfaces. Each function can be developed, tested, and updated independently. The function pointer tables organize these segments in a structured manner, managing complexity through systematic segmentation rather than monolithic control flow.
Solution Approach 2:
The system uses a universal indirect call mechanism that works for all function calls throughout the program. The same function pointer resolution and indirect call infrastructure is used universally, rather than implementing separate obfuscation mechanisms for each function, thereby reducing overall complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure provides a description of a computer implemented method and system for protecting a software program from attack during runtime. The system comprises a plurality of software blocks for providing desired functions during execution of a software program and a trusted address server having a table for mapping predetermined source tokens to destination tokens. The trusted address server couples each of the plurality of software blocks for receipt of predetermined source tokens from any one of the plurality of software blocks, while returning a mapped destination token from the predetermined destination tokens to said any one of the plurality of software blocks in dependence upon the table for mapping predetermined source tokens to destination tokens.