Virtual Machine Fault Injection Protection via Selective Variable Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively protect applications compiled in intermediate language from fault injection attacks, particularly on electronic devices with virtual machines, as they require extensive memory usage and are not suitable for generic applications with unknown security levels.
Innovation Solution
A method is implemented on an electronic device with a virtual machine to identify generic applications, apply a secure execution mode by using a volatile memory pool with integrity functions for variable storage and retrieval, and compare calculated integrity data to detect potential attacks, thereby securing the execution without needing to protect the entire volatile memory content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If integrity protection is applied to all variables in volatile memory, then security against fault injection attacks is improved, but memory consumption increases significantly
Solution Approach 1:
The patent applies integrity protection selectively only to sensitive variables identified through static analysis of the application code, rather than protecting all variables in volatile memory. This localized approach maintains security for critical data while avoiding the memory overhead of protecting entire memory spaces.
Solution Approach 2:
The volatile memory is segmented into protected and unprotected regions based on variable sensitivity. The system divides memory management into multiple zones, with integrity protection applied only to specific segments containing sensitive data, thereby reducing overall memory consumption while maintaining security.
2Measurement precision
If static analysis is used to identify sensitive variables, then protection accuracy is improved, but analysis time increases
Solution Approach 1:
The static analysis of application code to identify sensitive variables is performed in advance during the application loading phase, before the application executes. This preliminary identification allows the system to establish protection rules ahead of time, ensuring accurate protection without delaying the actual application execution.
Solution Approach 2:
The patent implements efficient static analysis algorithms that quickly scan and identify sensitive variables without exhaustive analysis. By using targeted analysis techniques rather than comprehensive code examination, the system achieves adequate protection accuracy while minimizing the time spent on analysis.
3Reliability
If integrity functions are calculated and stored for each variable, then detection capability is improved, but computational overhead increases
Solution Approach 1:
Integrity functions are calculated and stored only for sensitive variables identified through static analysis, rather than for all variables in the application. This selective approach maintains strong detection capability for critical data while reducing the computational overhead associated with calculating and managing integrity checks across the entire variable space.
Data Source
Figure 1~2
Figure 3~5
AI summary
The invention relates to a method of protecting an electronic device, executing an application via a virtual machine, against fault injection attacks, the execution of the application implementing a volatile memory pool in which variables used by the program are read and/or stored, the electronic device comprising non-volatile memory in which a plurality of applications are stored, the method comprising the following steps: - determination of at least one so-called generic application among the stored applications; - application of a secure execution mode on said generic application, including securing the variables read(s)/stored(s) in the volatile memory pool.