Method for executing a polymorphic machine code of a predetermined function by a microprocessor

Patent metadata

Field	Value
Publication number	US-11157659-B2
Application number	US-201716470067-A
Country	US
Kind code	B2
Filing date	Dec 14, 2017
Priority date	Dec 19, 2016
Publication date	Oct 26, 2021
Grant date	Oct 26, 2021

Abstract

A method for executing a polymorphic machine code, wherein: for each branching address at which a base block of a flow of generated instructions starts, the microprocessor automatically adds, in the generated flow of instructions, a renewal instruction suitable, when it is executed, for triggering the renewal of an initialization vector of a module for decryption by flow with a specific value associated with this branching address, then a flow encryption module encrypts the flow of instructions as it is generated and, during this encryption, each base block is encrypted using a specific value associated with the branching address at which it starts. Only the instruction flow encrypted in this way is recorded in the main memory. During execution of the encrypted instruction flow, the added renewal instructions are executed as they are encountered.

First claim

The invention claimed is:

1. A method for executing a polymorphic machine code of a predetermined function using a microprocessor, comprising:
a) acquiring a numerical value capable of varying, from one execution to another of the same polymorphic machine code, then
b) generating, according to the numerical value acquired, a first and, alternately, a second instruction stream, the first and second instruction streams each being capable of performing the predetermined function when they are executed by the microprocessor, each of the instruction streams being formed of a succession of basic blocks, each basic block starting at a branch address and ending with a branch instruction to a branch address of another basic block, and the first and second instruction streams being distinguished from each other by at least one instruction opcode or a different operand or a different literal value or a different number of instructions,
c) recording a generated instruction stream in a main memory, then
d) executing the generated instruction stream that has just been recorded,
wherein:
before step c):
for each branch address at which a basic block starts, automatically adding into the generated instruction stream a renewal instruction capable, when executed by the microprocessor, of triggering, immediately after a branching to the branch address, renewal of an initialization vector of a stream decryption module with a specific value associated with the branch address, then
a stream encryption module, parameterized by an initialization vector, encrypts the instruction stream as it is generated, in the course of the encryption each basic block is encrypted using the specific value of the initialization vector associated with the branch address at which it starts,
during step c), only the instruction stream thus encrypted is recorded in the main memory, and
during step d), each time an encrypted instruction of the instruction stream is loaded from the main memory for being executed, the encrypted instruction is first decrypted by the decryption module, then transferred, without passing through the main memory, to an arithmetic and logic unit of the microprocessor, then executed by the arithmetic and logic unit, and in the course of step d), the added renewal instructions are executed as they are encountered in the instruction stream.

2. The method as claimed in claim 1 , comprising, during step b), executing a group of instructions of the polymorphic machine code, termed a generator, which generates the instruction streams, the instructions of the generator being recorded in the main memory only in encrypted form so that step b) comprises loading of an encrypted instruction of the generator from the main memory, then its decryption by the microprocessor, followed by its transfer, without passing through the main memory, to the arithmetic and logic unit of the microprocessor and execution of the decrypted instruction of the generator by the arithmetic and logic unit.

3. The method as claimed in claim 1 , comprising adding the renewal instruction at the start of each basic block so that the execution of the basic block starts with the execution of the renewal instruction.

4. The method as claimed in claim 1 , wherein:
the renewal instruction of the value of the initialization vector of a next basic block to be executed is added into a preceding basic block to be executed immediately before the next basic block, and
during the encryption, the renewal instruction added into the preceding basic block is encrypted by using the same value of the initialization vector as that used for encrypting all the other instructions of the preceding basic block.

5. The method as claimed in claim 1 , wherein:
during the encryption, the instruction stream is only encrypted by combining it bitwise, using a predetermined function, with a pseudo-random sequence generated by a pseudo-random sequence generator initialized, at the start of each basic block, with the specific value associated with the branch address at which the basic block starts, and
during the decryption, the instruction stream is decrypted by combining it bitwise, using the inverse of said predetermined function, with a pseudo-random sequence generated by an identical pseudo-random sequence generator initialized, at the start of each basic block, with the specific value associated with the branch address at which the basic block starts.

6. The method as claimed in claim 5 , wherein:
during step b), one of the basic blocks of the generated instruction stream comprises a downstream branch instruction to a downstream branch address the numerical value of which is not immediately determinable by the microprocessor since it depends on a number of instructions contained in a future part of the instruction stream that has not yet been generated at this time,
during the encryption of the instruction stream as it is generated, when the downstream branch instruction is encountered in the basic block in the course of encryption:
a space of a same size or larger than a size of the encrypted downstream branch instruction is reserved in the main memory, at a location where the encrypted downstream branch instruction has to be recorded, and
a recall function is associated with a label corresponding to the downstream branch address, the recall function being parameterized by the specific value of the initialization vector associated with the branch address at which the basic block in the course of encryption starts and an order number identifying the position of the downstream branch instruction with respect to the start of the basic block in the course of encryption, then

the encryption of the instruction stream continues without, at this stage, having encrypted the downstream branch instruction and recorded it in the main memory,
when said future part of the instruction stream has been generated, executing the recall function associated with the label corresponding to the downstream branch address, the execution of the recall function causing:
replacement of the label with the numerical value of the downstream branch address in the downstream branch instruction,
initialization of the encryption module with the value of the initialization vector which parameterizes the recall function,
generation by the encryption module thus initialized of a pseudo-random sequence until generating the succession of bits of the pseudo-random sequence corresponding to the order number which parameterizes the recall function, then
bitwise combination of the generated succession of bits with the downstream branch instruction in which the label has been replaced by the numerical value of the downstream branch address, then
recording of the downstream branch instruction thus encrypted in the space reserved for this purpose in the main memory.

7. The method as claimed in claim 1 , wherein:
during step b), one of the basic blocks of the instruction stream comprises a downstream branch instruction to a downstream branch address the numerical value of which is not immediately determinable by the microprocessor since it depends on a number of instructions contained in a future part of the one instruction stream that has not yet been generated at this time,
during the encryption of the instruction stream as it is generated, when the downstream branch instruction is encountered in the basic block in the course of encryption:
inserting into the instruction stream, a downstream basic block located immediately after the basic block in the course of encryption, a size of the downstream basic block being known and the downstream basic block ending with a copy of the downstream branch instruction,
replacing the downstream branch instruction in the basic block in the course

Assignees

• Commissariat Energie Atomique

Inventors

• Courousse Damien
• Hiscock Thomas
• Savry Olivier

Classifications

• G06F21/75 Primary

  by inhibiting the analysis of circuitry or operation · CPC title

• G06F21/755

  with measures against power attack · CPC title

• G09C1/00

  Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) · CPC title

• H04L9/0662

  with particular pseudorandom sequence generator · CPC title

• G06F21/556 Primary

  involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755) · CPC title