Method of protecting computer program code

Patent metadata

Field	Value
Publication number	US-10803151-B2
Application number	US-201715610092-A
Country	US
Kind code	B2
Filing date	May 31, 2017
Priority date	Jun 12, 2008
Publication date	Oct 13, 2020
Grant date	Oct 13, 2020

Abstract

In a general aspect, a computer implemented method can include identifying, in a program code stored in computer memory, a location of a dynamic repair target code section for an assignment to a program variable, a value of which is known only at runtime. The method can also include modifying the program code at the identified location of the dynamic repair target code section to assign an immediate value different from a correct runtime value to the program variable. The method can further include inserting, into the program code in the computer memory, a dynamic repair probe code section that is executed before the dynamic repair target code and, at runtime, modifies the immediate value in the code to contain the correct runtime value when an attack has not occurred.

First claim

The invention claimed is:

1. A computer implemented method of protecting a computer program executable on a computer comprising a memory management unit configured to route data and code accesses/fetches to a same logical address either to different or to identical physical addresses in computer memory when executing a program, the method comprising:
locating, in a program code stored in computer memory, a dynamic repair target code section in which a program variable is assigned, at runtime, to a value which is known only at runtime;
modifying the program code at the dynamic repair target code section to assign a first immediate value different from a correct runtime value to the program variable; and
inserting, into the program code in the computer memory, a dynamic repair probe code section that is executed before the dynamic repair target code section, the dynamic repair probe code section being configured, at runtime, to:
if an attack routing data and code accesses/fetches to a same logical address to different physical addresses in the computer memory has not occurred, modify the program code at the dynamic repair target code section to assign the correct runtime value to the program variable; and
if an attack routing data and code accesses/fetches to a same logical address to different physical addresses in the computer memory has occurred, retain the first immediate value assigned to the program variable.

2. The method of claim 1 , further comprising:
modifying the program code such that at least one repair target code section of the program code is deliberately broken, so that the at least one repair target code section will not execute correctly; and
inserting, into the program code in computer memory, at least one repair probe code section which is configured to replace the at least one repair target code section, at runtime, with correct code, before the at least one repair target code section is executed, only if the data and code accesses/fetches to the same logical address are routed to identical physical addresses in computer memory.

3. The method of claim 1 , further comprising inserting a damage probe code section into the program code, the damage probe code section being executed after the dynamic repair target code and being configured to modify, at runtime, the program code at the dynamic repair target code section to assign an immediate incorrect value to the program variable.

4. The method of claim 1 , further comprising:
modifying a repair target code section of program code stored in computer memory such that the program code of the repair target code section will not execute correctly; and
inserting into the program code in the computer memory a plurality of repair probe code sections, each of the repair probe code sections being configured to, at runtime:
replace the repair target code section with a respective distinct correct code portion only if the memory management unit routes the data and code accesses/fetches to the same logical address to identical physical addresses in computer memory; and
call the respective distinct correct code portion at the repair target code section, each of the respective distinct correct code portions performing, at runtime, a respective distinct action, and a return to continue program execution at the repair probe code section calling the respective distinct correct code portion.

5. The method of claim 1 , further comprising inserting, into the program code, a plurality of repair nodes to make manual detection and removal of the repair nodes by a human time consuming, each repair node comprising a repair target code section, at least one repair probe code section and a damage probe code section, the repair target code section being configured to be not correctly executable, the repair probe code section being configured to fix, at runtime, the repair target code section of the repair node, before the repair target code section of the repair node is executed, and the damage probe code section being configured to write data that will not execute correctly into the repair target code section of the repair probe, at runtime, after the repair target code section of the repair probe is executed.

6. The method of claim 5 , wherein at least one of the repair probe code sections:
performs first writes of data to the repair target code section as code;
reads back at least some of the data that was written; and
performs second writes of the data that was read to the repair target code section as data.

7. The method of claim 5 , further comprising inserting, into the program code, a proxy repair probe code section that is configured to write code and/or data to the repair target code section such that the repair target code section, at runtime, proxies actions of the program code at some other location, and such that resultant code is made to execute at the repair target code section in place of that at the other location is only consistent if data writes and instruction reads are all routed to the same physical locations.

8. The method of claim 5 , further comprising generating the repair nodes to be unique.

9. The method of claim 5 , further comprising separating the repair target code section, the repair probe code section, and the damage probe code section of a repair node from each other in at least one of execution time, separation in units of code, and/or by called functions.

10. The method of claim 5 , further comprising placing repair nodes in infrequently executed code.

11. The method of claim 1 , further comprising inserting, into the program code, another repair target code section that is configured, when executed, to cause a response mechanism to provide an indication that an attack has occurred.

12. The method of claim 1 , wherein the program variable is a parameter passed to a function selected to contain a repair node, the parameter being passed-by-value, of a trivial data type, and used within the code of the function.

13. The method of claim 1 , further including separating the dynamic repair target code and the dynamic repair probe code sections into separate functions.

14. The method of claim 1 , further comprising injecting new dynamic damage probe code sections into the program code, the new dynamic damage probe code sections being configured to write incorrect values into previously repaired dynamic repair targets after the dynamic repair targets are executed.

15. A computer implemented system for protecting computer program code, comprising a computer configured to:
locate, in a program code stored in computer memory, a dynamic repair target code section in which a program variable is assigned, at runtime, to a value which is known only at runtime;
modify the program code at the dynamic repair target code section to assign a first immediate value different from a correct runtime value to the program variable; and
insert, into the program code in the computer memory, a dynamic repair probe code section that is executed before the dynamic repair target code, the dynamic repair probe code section being configured, at runtime, to:
if an attack routing data and code accesses/fetches to a same logical address to different physical addresses in the computer memory has not occurred, modify the program code at the dynamic repair target code section to assign the correct runtime value to the program variable; and
if an attack routing data and code accesses/fetches to a same logical address to different physical addresses in the computer memory has occurred, retain the first immediate value assigned to the program variable.

Assignees

• Inside Secure
• Verimatrix

Inventors

• Stewart Neil William
• Harkness Graeme Kerr
• Little Douglas Mcpherson

Classifications

• G06F12/14 Primary

  Protection against unauthorised use of memory {or access to memory} · CPC title

• G06F21/125 Primary

  by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code · CPC title

• G06F21/14

  against software analysis or reverse engineering, e.g. by obfuscation · CPC title

• G06F2009/45583

  Memory management, e.g. access or allocation · CPC title

• G06F12/0246

  in block erasable memory, e.g. flash memory · CPC title