Hardware security for software processes
View Patent ↗A system and method for secure processing is provided, wherein a monitor application is injected into a secure application binary within the security perimeter of a secure processor. The components of the monitor application are injected into different portions of the application binary utilizing a seed value. In this manner, the positioning of the monitor application in the application binary is altered each time the application binary is booted. After the monitor application is inserted into the application binary, the secure process is passed to the host processor for execution. During execution of the secure process, a system and method is provided for the monitor application to communicate, to the secure processor, attempts to tamper with or attack the secure process.
1. A method of ensuring the integrity of an application comprising:
receiving, at a secure processing system, a request to launch an application binary associated with the application;
receiving, at the secure processing system and from a secure storage, the application binary;
receiving secure monitor code;
in response to receiving the request, integrating the secure monitor code into the application binary to generate a secure application process, wherein the secure monitor code is integrated at a different position in the application binary each time the request to launch the application binary is received;
communicating the secure application process to a host memory; and
executing the secure application process on a host processor.
2. The method of claim 1 , further comprising:
prior to integrating the secure monitor code, disassembling the application binary.
3. The method of claim 1 , wherein receiving the application binary includes receiving a disassembled application binary.
4. The method of claim 1 , wherein if the received application binary is encrypted, the method further comprises:
decrypting the application binary prior to disassembly of the application binary.
5. The method of claim 1 , wherein the integrating the secure monitor code into the application binary does not adversely impact the execution of the application binary.
6. The method of claim 1 , further comprising:
disassembling the application binary using a pseudo-random disassembly technique whereby the disassembly is altered for each subsequent launch of the application binary.
7. The method of claim 1 , further comprising:
disassembling the application binary using a random disassembly technique whereby the disassembly is altered for each subsequent launch of the application binary.
8. The method of claim 7 , further comprising:
identifying an anomalous condition; and
initiating remedial procedures to address the anomalous condition.
9. The method of claim 1 , wherein integrating the secure monitor code comprises:
integrating the secure monitor code using a pseudo-random technique.
10. The method of claim 1 , further comprising:
communicating to the secure processing system, using the secure monitor code integrated into the application binary, events occurring during execution of the secure application process.
11. The method of claim 1 , further comprising:
authenticating the application binary before it is stored in the secure storage using authentication data for the application binary stored in a credential vault.
12. The method of claim 1 , wherein the secure monitor code is integrated into the application binary using a seed value, and wherein the seed value determines the position of the secure monitor code in the application binary.
13. A system comprising:
a secure storage configured to store an application binary;
a secure processing system configured to:
receive a request to launch the application binary, and
in response to receiving the request, integrate the application binary with secure monitor code associated with a secure monitor application to generate a secure application binary, wherein the secure processing system integrates the secure monitor code at a different position in the application binary each time the secure processing system receives the request to launch the application binary;
a host processor configured to:
execute the secure application binary, and
send data from the secure monitor application, wherein the data includes events monitored by the secure monitor application; and
a host memory configured to store the secure application binary.
14. The system of claim 13 , wherein the application binary is enterprise software.
15. The system of claim 13 , wherein the application binary is a Hypervisor.
16. The system of claim 13 , wherein the application binary is an operating system.
17. The system of claim 13 , wherein the application binary is a browser.
18. The system of claim 13 , wherein the secure processing system further comprises:
a credential vault;
a secure process generation unit; and
a secure process monitoring unit,
wherein the credential vault, the secure process generation unit, and the secure process monitoring unit are coupled to the secure processor.
19. The system of claim 18 , wherein the secure process monitoring unit is configured to receive and analyze the data from the secure monitor application.
20. The system of claim 19 , wherein the secure process monitoring unit is configured to remediate an identified situation based on analysis of the received data.
21. The system of claim 13 , wherein the secure processing system is implemented using a Unified Security Hub (USH).
22. The system of claim 13 , wherein the secure processing system is configured to integrate the application binary with the secure monitor code using a seed value, and wherein the seed value determines the position of the secure monitor code in the application binary.
23. The system of claim 13 , wherein the secure processing system is configured to inject an encryption key into the application binary.
24. The system of claim 13 , wherein the application binary is application binary for a web browser.
25. The system of claim 13 , wherein the secure processing system is further configured to:
receive the application binary; and
authenticate the application binary before it is stored in the secure storage using authentication data for the application binary stored in a credential vault.
26. A system comprising:
a secure storage configured to store an application binary;
a credential vault configured to store authentication data for the application binary;
a secure processing system configured to:
receive the application binary;
authenticate the application binary using the authentication data;
store the authenticated application binary in the secure storage;
receive a request to launch the application binary;
retrieve the application binary from the secure storage;
in response to receiving the request, integrate the application binary with secure monitor code associated with a secure monitor application to generate a secure application binary, wherein the secure processing system integrates the secure monitor code at a different position in the application binary each time the secure processing system receives the request to launch the application binary;
a host processor configured to:
execute the secure application binary, and
send data from the secure monitor application, wherein the data includes events monitored by the secure monitor application; and
a host memory configured to store the secure application binary.