Securing accessible systems using dynamic data mangling

Patent metadata

Field	Value
Publication number	US-9698973-B2
Application number	US-201314388743-A
Country	US
Kind code	B2
Filing date	Mar 28, 2013
Priority date	Mar 30, 2012
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

Systems and techniques for securing accessible computer-executable program code and systems are provided. One or more base functions may be generated and blended with existing program code, such that it may be difficult or impossible for a potential attacker to distinguish the base functions from the existing code. The systems and code also may be protected using a variety of other blending and protection techniques, such as fractures, variable dependent coding, dynamic data mangling, and cross-linking, which may be used individually or in combination, and/or may be blended with the base functions.

First claim

The invention claimed is:

1. A method, implemented by one or more processors, comprising:
receiving computer executable code for an existing application;
identifying at least a portion of the computer executable code that stores at least one value in a first memory location; and
modifying the at least a portion of the computer executable code to store the at least one value in an array of size M having a plurality of M-register locations, wherein each M-register location is a respective constant c i of a series of constants c 1 , . . . , c n , with n≦M, where the series of constants c 1 , . . . , c n is defined by a permutation polynomial p, an input-based 1×n vector mapping matrix A yielding z from an input of the existing application such that c i p(z+i), instead of the first memory location.

2. The method of claim 1 , further comprising a step of modifying the computer executable code to apply an encoding to an intermediate result prior to storing the intermediate result in the corresponding M-register for each intermediate result stored in an M-register.

3. The method of claim 1 , further comprising, for each intermediate result retrieved from an M-register, applying a decoding to the intermediate result subsequent to retrieving the intermediate result from the corresponding M-register.

4. The method of claim 1 , further comprising a step of modifying the computer executable code to store a value required by at least one operation in the computer executable code, other than an intermediate result of the operation, in an M-register selected randomly from among the plurality of M-registers.

5. A method, implemented by one or more processors, comprising:
receiving an input from an application;
defining an array of size M having a plurality of M-register locations, wherein each M-register location is a respective constant c i of a series of constants c 1 , . . . , c n , with n≦M;
defining a permutation polynomial p, an input-based 1×n vector mapping matrix A yielding z from the input, and a series of constants c i =p(z+i);
performing a series of operations, each operation providing an intermediate result;
storing each intermediate result in an M-register selected randomly from the plurality of M-registers; and
providing a final result based upon the series of intermediate results to the application from a final M-register storing the final result.

6. The method of claim 5 , further comprising, for each intermediate result stored in an M-register, applying an encoding to the intermediate result prior to storing the intermediate result in the corresponding M-register.

7. The method of claim 6 , wherein each encoding applied to an intermediate result is randomly chosen from among a plurality of encodings.

8. The method of claim 5 , further comprising, for each intermediate result retrieved from an M-register, applying a decoding to the intermediate result subsequent to retrieving the intermediate result from the corresponding M-register.

9. The method of claim 8 , wherein each decoding is randomly chosen from among a plurality of decodings.

10. The method of claim 8 , wherein each decoding applied to an intermediate result retrieved from an M-register is an inverse of an encoding applied to the intermediate result prior to the intermediate result being stored in the corresponding M-register.

11. The method of claim 8 , wherein at least one decoding applied to an intermediate result retrieved from an M-register is not an inverse of an encoding applied to the intermediate result prior to the intermediate result being stored in the corresponding M-register.

12. The method of claim 5 , further comprising:
storing a value required by at least one operation of the series of operations, other than an intermediate result, in an M-register selected randomly from among the plurality of M-registers.

13. The method of claim 12 , further comprising:
applying an encoding to the value required by the at least one of the operations, the encoding selected randomly from among a plurality of encodings.

14. The method of claim 5 , wherein each operation in the series of operations is from a source selected from the group consisting of: a base function; and computer-executable program code with which at least one base function is integrated.

15. The method of claim 5 , wherein the permutation polynomial p is a permutation polynomial over a mod-M ring.

16. The method of claim 5 , wherein, for 1≦i≦M, each c i value is distinct.

17. The method of claim 5 , wherein a new M-register is allocated only when required according to a graph-coloring allocation algorithm.

18. The method of claim 5 , wherein the array M is stored in a computer readable medium selected from the group consisting of all computer readable media used during execution of the application.

19. A system comprising:
one or more & processors; and
a computer-readable storage medium storing instructions which cause the one or more processors to:
receive an input from an application;
define an array of size M having a plurality of M-register locations, wherein each M-register location is a respective constant of a series of constants c 1 , . . . , c n , with n≦M;
define a permutation polynomial p, an input-based 1×n vector mapping matrix A yielding z from the input, and the series of constants c 1 , . . . , c n , such that the series of constants c 1 , . . . , c n is defined by c i =p(z+i);
perform a series of operations, each operation providing an intermediate result;
store each intermediate result in an M-register selected randomly from the plurality of M-registers; and
provide a final result based upon the series of intermediate results to the application from a final M-register storing the final result.

20. A system comprising:
one or more processors; and
a computer-readable storage medium storing instructions which cause the one or more processors to:
receive computer executable code for an existing application;
identify at least a portion of the computer executable code that stores at least one value in a first memory location; and
modify the at least a portion of the computer executable code to store the at least one value in an array of size M having a plurality of M-register locations, wherein each M-register location is a respective constant c i of a series of constants c 1 , . . . , c i , with n≦M, where the series of constants c 1 , . . . , c n are defined by a permutation polynomial p, an input-based 1×n vector mapping matrix A yielding z from an input of the existing application such that c i =p(z+i), instead of the first memory location.

21. The method of claim 2 , wherein each encoding applied to an intermediate result is randomly chosen from among a plurality of encodings.

22. The method of claim 21 , further comprising, for each intermediate result retrieved from an M-register, applying a decoding to the intermediate result subsequent to retrieving the intermediate result from the corresponding M-register.

23. The method of claim 1 , wherein each decoding is randomly chosen from among a plurality of decodings.

24. The method of claim 22 , wherein each decoding applied to an intermediate result retrieved from an M-register is an inverse of an encoding applied to the intermediate result prior to the intermediate result being stored in the corresponding M-register.

25. The method of claim 22 , wherein at least one decoding applied to

Assignees

• Irdeto Canada Corp
• Irdeto Bv

Inventors

• Johnson Harold
• Gu Yuan Xiang
• Wiener Michael

Classifications

• H04L2209/04

  Masking or blinding · CPC title

• H04L2209/16

  Obfuscation or hiding, e.g. involving white box · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• G06F21/60

  Protecting data · CPC title

• G06F21/54 Primary

  by adding security routines or objects to programs · CPC title