Bidirectional data obfuscation and atomization within unsecured fragmented runtime environments

1 . A method performed at an analysis server, the method comprising:

identifying data objects used by logic configured to produce alternative outcomes depending on first values of the data objects;

obfuscating the data objects to produce obfuscated data objects that are related to, but do not identify, the data objects;

creating individual mappings that map the data objects to individual requests for second values of the obfuscated data objects;

sending the individual requests to a target device;

receiving, from the target device, individual responses to the individual requests, wherein the individual responses include obfuscated second values that are related to but do not identify the second values;

linking the obfuscated second values to the data objects using the individual mappings; and

evaluating the logic using the obfuscated second values that are linked to the first values in place of the first values, and without de-obfuscating the obfuscated second values, to produce one of the alternative outcomes.

2 . The method of claim 1 , wherein:

the analysis server and the target device collectively implement an analysis runtime environment that employs intellectual capital.

3 . The method of claim 1 , wherein:

sending includes sending the individual requests to include the individual mappings; and

receiving includes receiving the individual responses to include the individual mappings.

4 . The method of claim 1 , wherein the second values are obfuscated deterministically, not randomly, such that different second values produce different obfuscated values, but multiple instances of a given second value produce a same obfuscated value.

5 . The method of claim 4 , wherein the second values are obfuscated deterministically by one of (i) adding an offset to the second values, (ii) when the second values include Internet Protocol (IP) addresses (IP addresses), translating the IP addresses to different IP addresses, and (iii) replacing each second value with mapped versions of the second values that are consistent.

6 . The method of claim 4 , wherein sending includes sending each individual request to indicate an obfuscation method to be used by the target device to obfuscate a corresponding second value.

7 . The method of claim 6 , further comprising, at the analysis server:

selecting the obfuscation method from multiple obfuscation methods including deterministic obfuscation, random obfuscation, and null obfuscation.

8 . The method of claim 6 , wherein the obfuscation method includes deterministic obfuscation, not random obfuscation.

9 . The method of claim 1 , further comprising, at the analysis server:

generating an individual spurious request for a spurious value of a spurious object that is not used by the logic;

sending the individual spurious request to the target device; and

upon receiving, from the target device, an individual spurious response that includes the spurious value, ignoring the spurious value.

10 . An apparatus comprising:

one or more network processor units to communicate over one or more networks; and

a processor coupled to the one or more network processor units and configured to perform:

identifying data objects used by logic configured to produce alternative outcomes depending on first values of the data objects;

obfuscating the data objects to produce obfuscated data objects that are related to, but do not identify, the data objects;

creating individual mappings that map the data objects to individual requests for second values of the obfuscated data objects;

sending the individual requests to a target device;

receiving, from the target device, individual responses to the individual requests, wherein the individual responses include obfuscated second values that are related to but do not identify the second values;

linking the obfuscated second values to the data objects using the individual mappings; and

evaluating the logic using the obfuscated second values that are linked to the first values in place of the first values, and without de-obfuscating the obfuscated second values, to produce one of the alternative outcomes.

11 . The apparatus of claim 10 , wherein:

the processor operates as an analysis server, and the analysis server and the target device collectively implement an analysis runtime environment that employs intellectual capital.

12 . The apparatus of claim 10 , wherein:

the individual requests include the individual mappings; and

the individual responses include the individual mappings.

13 . The apparatus of claim 10 , wherein the second values are obfuscated deterministically, not randomly, such that different second values produce different obfuscated values, but multiple instances of a given second value produce a same obfuscated value.

14 . The apparatus of claim 13 , wherein each individual request is configured to indicate an obfuscation method to be used by the target device to obfuscate a corresponding second value.

15 . The apparatus of claim 14 , wherein the processor is further configured to perform:

selecting the obfuscation method from multiple obfuscation methods including deterministic obfuscation, random obfuscation, and null obfuscation.

16 . The apparatus of claim 10 , wherein the processor is further configured to perform:

generating an individual spurious request for a spurious value of a spurious object that is not used by the logic;

sending the individual spurious request to the target device; and

upon receiving, from the target device, an individual spurious response that includes the spurious value, ignoring the spurious value.

17 . A non-transitory computer readable medium encoded with instructions that, when executed by a processor, causes the processor to perform:

identifying data objects used by logic configured to produce alternative outcomes depending on first values of the data objects;

obfuscating the data objects to produce obfuscated data objects that are related to, but do not identify, the data objects;

creating individual mappings that map the data objects to individual requests for second values of the obfuscated data objects;

sending the individual requests to a target device;

receiving, from the target device, individual responses to the individual requests, wherein the individual responses include obfuscated second values that are related to but do not identify the second values;

linking the obfuscated second values to the data objects using the individual mappings; and

evaluating the logic using the obfuscated second values that are linked to the first values in place of the first values, and without de-obfuscating the obfuscated second values, to produce one of the alternative outcomes.

18 . The non-transitory computer readable medium of claim 17 , wherein:

the processor is part of an analysis server, and the analysis server and the target device collectively implement an analysis runtime environment that employs intellectual capital.

19 . The non-transitory computer readable medium of claim 17 , wherein:

the individual requests include the individual mappings; and

the individual responses include the individual mappings.

20 . The non-transitory computer readable medium of claim 17 , wherein the second values are obfuscated deterministically, not randomly, such that different second values produce different obfuscated values, but multiple instances of a given second value produce a same obfuscated value.