VM Integrity Self-Check for Secure Code

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional approaches to implementing self-validating cryptographic algorithms on Android mobile devices either risk crashing the system or require platform-specific compilation and costly certification due to their implementation in non-native machine code or hardware modules, respectively.

Innovation Solution

Implementing FIPS 140-2 certified self-validating cryptographic libraries in native DALVIK VM code, using a dynamically-linked module with an integrity self-check feature, allowing the libraries to run within a single code file and ensuring integrity without platform-specific re-compilation or re-certification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If self-validating cryptographic algorithms are implemented in machine code libraries, then cryptographic functionality is achieved, but system stability deteriorates due to crash risks

Engineering Contradiction:

Improvesystem stabilityVSAvoidcrash risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a virtual machine (VM) environment as an intermediary layer between the cryptographic code and the underlying system. The VM executes cryptographic algorithms in a protected environment that isolates potential crashes from the host system, thereby maintaining system stability while enabling cryptographic functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent creates a virtual copy of the execution environment through the VM. Instead of executing cryptographic code directly on the host system, the code runs in a virtualized copy of the environment, which can fail without affecting the original system.

Inventive Principle:

Principle #26Copying

2Adaptability or versatility

If self-validating cryptographic algorithms are implemented in machine code for wide platform support, then portability improves, but device complexity and certification costs increase due to multiple compiled versions

Engineering Contradiction:

Improveplatform compatibilityVSAvoiddistribution complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent makes the cryptographic code platform-independent by compiling it to run on a universal virtual machine environment rather than specific hardware platforms. A single version of the cryptographic library can execute across multiple platforms through the VM abstraction layer, eliminating the need for separate compiled versions for each platform.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The virtual machine serves as an intermediary that abstracts away platform-specific details. The cryptographic code interacts with the VM interface rather than direct hardware, allowing the same code to run on diverse platforms without modification.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If self-validating cryptographic algorithms are implemented in machine code for wide platform support, then portability improves, but certification costs increase due to separate FIPS 140-2 certification for each platform

Engineering Contradiction:

Improveplatform compatibilityVSAvoidcertification cost

Core Design Contradiction:

Adaptability or versatilityVSEase of manufacture

Solution Approach 1:

By implementing cryptographic algorithms in a universal virtual machine environment, the patent enables a single FIPS 140-2 certification to cover multiple platforms. The VM layer becomes part of the certified system, allowing the same cryptographic implementation to be deployed across diverse hardware without requiring separate certifications for each platform combination.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If cryptographic algorithms are implemented on specialized hardware modules, then security improves, but device portability deteriorates due to extra hardware requirements

Engineering Contradiction:

Improvecryptographic securityVSAvoiddevice portability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent replaces specialized hardware modules with software-based cryptographic implementations running in a virtual machine environment. This substitution eliminates the need for physical hardware additions while maintaining cryptographic functionality through software execution in a protected environment.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS8707050B1Integrity self-check of secure code within a VM environment using native VM code

Publication Date: 2014.04.22 EMC IP HLDG CO LLC

AI summary

A method of running an application in a process virtual machine (PVM) on a computing device using a dynamically-linked module (DLM) with an integrity self-check feature is provided. The DLM is written in PVM-native bytecode, and the PVM is configured to execute applications stored as PVM-native bytecode within a single code file associated with that application. The method includes (a) dynamically linking the application to the DLM by loading the PVM-native bytecode of the DLM from a resource file separate from the single code file of the application, (b) performing the integrity self-check feature on the DLM to ensure the integrity of the PVM-native bytecode of the DLM, and (c) in response to the DLM passing the integrity self-check, calling functions of the DLM from within the application. Embodiments directed to analogous computer program products and apparatuses are also provided.