System, method and computer program product for protecting software via continuous anti-tampering and obfuscation transforms

Patent metadata

Field	Value
Publication number	US-10176324-B2
Application number	US-201615215994-A
Country	US
Kind code	B2
Filing date	Jul 21, 2016
Priority date	Dec 21, 2007
Publication date	Jan 8, 2019
Grant date	Jan 8, 2019

Abstract

Method, system and computer program product for applying existing anti-tampering and obfuscation techniques to virtual machine technology and offers several distinct advantages. The anti-tampering and obfuscation transforms can be applied continuously to prevent adversaries from gaining information about the program through emulation or dynamic analysis. In addition, the encryption can be used to prevent hackers from gaining information using static attacks. The use of a virtual machine also allows for low overhead execution of the obfuscated binaries as well as finer adjustment of the amount of overhead that can be tolerated. In addition, more protection can be applied to specific portions of the application that can tolerate slowdown. The in-corporation of a virtual machine also makes it easy to extend the technology to integrate new developments and resistance mechanisms, leading to less development time, increased savings, and quicker deployment.

First claim

The invention claimed is:

1. A computer method of increasing the tamper-resistance and/or obscurity of computer software code, said method comprising:
one or more first preparation transformations;
preparing, by a computer processor, designated computer software code for execution in a designated execution environment by applying the one or more first preparation transformations, wherein said preparation makes it difficult to execute the designated computer software code independently from the designated execution environment, the designated software code being inextricably tied to the designated execution environment;
one or more second preparation transformations;
preparing, by the computer processor, the designated execution environment by applying the one or more second preparation transformations, wherein the one or more second preparation transformations allow only the designated computer software code to execute within the designated execution environment;
one or more execution transformations; and
applying, by the computer processor, the one or more execution transformations during execution of the designated computer software code, wherein the one or more execution transformations are applied to the designated computer software code and to the designated execution environment,
wherein said designated execution environment comprises at least one of: software dynamic translation (SDT), virtual machine (VM), Java VM, Strata VM, program simulators, program emulators, and virtualization systems.

2. The method of claim 1 , where the one or more first preparation transformations comprise at least one of:
encrypting the designated computer software code, wherein the encryption uses a plurality of hidden keys that are hidden within the designated execution environment and/or the designated computer software code;
adding additional codes and/or data to the computer software to verify the integrity of the designated execution environment;
providing additional codes and/or data to the computer software to verify the integrity of the prepared software code; and
altering the designated computer software code such that proper execution is difficult without undoing the alterations.

3. The method of claim 1 , wherein the one or more first preparation transformations comprise altering the designated computer software code such that proper execution is difficult without undoing the alterations, and the altering comprises at least one of:
altering constant operands, program control flow, program data layout, data initialization information, instruction encoding, file format, or any combination thereof.

4. The method of claim 1 , wherein the one or more execution transformations comprise at least one of:
changing the layout of the designated computer software code data;
conditions generated during execution and used by the designated execution environment, wherein the conditions are difficult to programmatically decipher;
relocating operational locations to increase the difficulty of determining operation locations;
inserting additional software code and/or data;
rearranging, eliminating, or adding execution flow;
creating software code that has operations that are difficult to determine;
inserting operations that cannot be feasibly executed, but appear as though execution is possible;
inserting incorrect codes that are intentionally similar to other correct software codes;
randomizing operation order; and
insert operations to verify the integrity of software code and/or software data.

5. The method of claim 4 , wherein the one or more execution transformations further comprise at least one of:
control flow flattening,
guards,
disassembly resistance,
self-check summing codes,
dynamic disassembly resistance,
control flow obfuscations,
ABI transforms,
API transforms,
sequence transforms,
calling convention transforms or data transform, or
any combination thereof.

6. The method of claim 5 , further comprising applying the one or more execution transformations continuously throughout the execution of the designated computer software code.

7. The method of claim 4 , wherein the one or more execution transformations undoes the one or more first preparation transformations on the prepared designated software code.

8. A system that increasing the tamper-resistance and/or obscurity of computer software code, comprising:
a processor in communication with one or more memory devices;
one or more first preparation transformations;
preparation means for preparing a designated computer software code for execution in a designated execution environment by applying the one or more first preparation transformations, wherein said preparation makes it difficult to execute the designated computer software code independently from the designated execution environment, the designated software code being inextricably tied to the designated execution environment;
one or more second preparation transformations;
preparation means for preparing the designated execution environment by applying the one or more second preparation transformations, wherein the one or more second preparation transformations allow only the designated computer software code to execute within the designated execution environment;
one or more execution transformations; and
an execution transformer that applies, the one or more execution transformations during execution of the designated computer software code, wherein the one or more execution transformations are applied to the designated computer software code and to the designated execution environment,
wherein said designated execution environment comprises at least one of: software dynamic translation (SDT), virtual machine (VM), Java VM, Strata VM, program simulators, program emulators, and virtualization systems.

9. The system of claim 8 , where the one or more first preparation transformations comprise at least one of:
encrypting the designated computer software code, wherein the encryption uses a plurality of hidden keys that are hidden within the designated execution environment and/or the designated computer software code;
adding additional codes and/or data to the computer software to verify the integrity of the designated execution environment;
providing additional codes and/or data to the computer software to verify the integrity of the prepared software code; and
altering the designated computer software code such that proper execution is difficult without undoing the alterations.

10. The system of claim 9 , wherein the one or more first preparation transformations comprise altering the designated computer software code such that proper execution is difficult without undoing the alterations, and the altering comprises at least one of:
altering constant operands, program control flow, program data layout, data initialization information, instruction encoding, file format, or any combination thereof.

11. The system of claim 8 , wherein the one or more execution transformations comprises at least one of:
changing the layout of the designated computer software code data;
conditions generated during execution and used by the designated execution environment, wherein the conditions are difficult to programmatically decipher;
relocating operational locations to increase the difficulty of determining operation locations;
inserting additional software code and/or data; rearranging, eliminating, or adding execution flow;
creating software code that has operations that are difficult to determine;
inserting operations that cannot be feasibly executed, but appear as though execution is possible;
inserting incorrect codes that are inten

Assignees

• Univ Of Virgina Patent Foundation
• Univ Virginia Patent Foundation

Inventors

• Davidson Jack W
• Hiser Jason D

Classifications

• G06F2221/033

  Test or assess software · CPC title

• G06F21/562 Primary

  Static detection · CPC title

• G06F21/572

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title