Securing accessible systems using base function encoding

Patent metadata

Field	Value
Publication number	US-9965623-B2
Application number	US-201314389361-A
Country	US
Kind code	B2
Filing date	Mar 28, 2013
Priority date	Mar 30, 2012
Publication date	May 8, 2018
Grant date	May 8, 2018

Abstract

Systems and techniques for securing accessible computer-executable program code and systems are provided. One or more base functions may be generated and blended with existing program code, such that it may be difficult or impossible for a potential attacker to distinguish the base functions from the existing code. The systems and code also may be protected using a variety of other blending and protection techniques, such as fractures, variable dependent coding, dynamic data mangling, and cross-linking, which may be used individually or in combination, and/or may be blended with the base functions.

First claim

The invention claimed is:

1. A method, implemented by one or more processors, for creating a secured software program from an existing computer-executable program, the method comprising:
selecting a word size w;
selecting a vector length N;
generating an invertible state-vector function configured to operate on an N-vector of w-element words, the invertible state-vector function comprising a concatenation of a plurality of invertible steps, wherein one or more steps of the plurality of invertible steps perform linear or affine computations over Z/(2 w );
indexing a first portion of steps of the plurality of invertible steps using a first indexing technique;
indexing a second portion of steps of the plurality of invertible steps using a second indexing technique;
selecting at least one operation in an existing computer-executable program to modify; and
modifying the at least one operation in the existing computer-executable program to execute the state-vector function.

2. The method of claim 1 , wherein each of the first and second indexing techniques controls an operation type independently selected from the group consisting of: an if-then-else construct; a switch construct, an element-permutation selection, an iteration count, an element rotation count, and a function-indexed key index.

3. The method of claim 1 , wherein each step in a third portion of steps of the plurality of invertible steps comprises a non-T-function operation.

4. The method of claim 3 , wherein each of the steps in the third portion of steps is an operation type selected from the group consisting of: a function-indexed keyed element-wise rotation, and a function-indexed keyed sub-vector permutation.

5. The method of claim 1 , wherein w is selected from the group consisting of: 16 bits, 32 bits, and 64 bits.

6. The method of claim 1 , wherein w is selected as a default integer size of a host computing platform.

7. The method of claim 1 , wherein the word size w is twice the internal word size of the N-vector.

8. The method of claim 1 , further comprising:
generating an inverse of the invertible state-vector function, the inverse of the invertible state-vector function comprising a concatenation of an inverse of each of the plurality of invertible steps.

9. The method of claim 1 , further comprising:
selecting a key type for the invertible state-vector function from the group consisting of: a run-time key, a generation-time key, and a function-indexed key.

10. The method of claim 9 , wherein the selected key type is a run-time key, said method further comprising:
modifying the state-vector function to accept a run-time input providing a key k.

11. The method of claim 9 , wherein the selected key type is a generation-time key, said method further comprising partially evaluating the state-vector function with respect to a key K.

12. The method of claim 9 , wherein the selected key type is a function-indexed key, said method further comprising, for each of the plurality of invertible steps A, providing a key R A for the associated inverse of the invertible step.

13. The method of claim 1 , wherein the state-vector function is implemented at least in part by a plurality of matrix operations.

14. The method of claim 1 , wherein at least one of the first and second indexing techniques controls a plurality of operations comprising random swaps performed according to a sorting-network topology.

15. The method of claim 14 , wherein the sorting-network topology is selected from the group consisting of: a Batcher network, a Banyan network, a perfect-shuffle network, and an Omega network.

16. The method of claim 1 , further comprising:
encoding an input to the state-vector function with a first encoding mechanism; wherein each step in the state-vector function is adapted and configured to operate when the input to the state-vector function encoded with a second encoding mechanism different from the first encoding mechanism.

17. The method of claim 16 , wherein the first encoding mechanism encodes the input as aM+b, wherein a and b are constants and wherein M is an invertible matrix.

18. The method of claim 17 , wherein the second encoding mechanism, when applied to the input, encodes the input as cP+d, wherein c and d are constants different than a and b, respectively and wherein P is an invertible Matrix.

19. The method of claim 1 , wherein the at least one operation in the existing computer-executable program and the state-vector function use computationally-similar operations.

20. The method of claim 1 , wherein the step of modifying the existing computer program further comprises applying, to a combination of the state-vector function and the existing computer program, at least one technique selected from the group consisting of: a fracture, and dynamic data mangling.

21. The method of claim 20 , wherein each of the state-vector function and code implementing the at least one technique uses operations computationally similar to those present in the existing computer program.

Assignees

• Irdeto Canada Corp
• Irdeto Bv

Inventors

• Johnson Harold
• Gu Yuan Xiang
• Wiener Michael
• Zhou Yongxin

Classifications

• H04L9/0618

  Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation · CPC title

• G06F21/54 Primary

  by adding security routines or objects to programs · CPC title

• H04L2209/04

  Masking or blinding · CPC title

• G06F21/14 Primary

  against software analysis or reverse engineering, e.g. by obfuscation · CPC title

• H04L2209/16

  Obfuscation or hiding, e.g. involving white box · CPC title