Method and apparatus for protection of a program against monitoring flow manipulation and against incorrect program running

1. A method of protecting a program against control flow manipulation, comprising:

defining a control flow flag sequence using more than two checkpoints inserted randomly into the program;

inserting protect program commands for generating and checking the control flow flag sequence into at least one program command sequence of program commands of the program;

forming a control flow flag of the control flow flag sequence by a command address of a program command;

calculating a check value in a protect program command as a function of the control flow flag sequence; and

verifying that all loops, jumps and subroutine calls in the control flow flag sequence have been executed properly based on the check value.

2. The method as claimed in claim 1 , wherein said calculating of the check value is based on a part of constant length of the control flow flag sequence generated prior to said calculating.

3. The method as claimed in claim 1 , wherein said calculating of the check value is based on all of the control flow flag sequence generated prior to said calculating.

4. The method as claimed in claim 1 , wherein said calculating of the check value produces a hash value.

5. The method as claimed in claim 1 , further comprising comparing in a protect program command, the calculated check value with a reference value of a reference control flow sequence or whether the calculated check value is contained in a set of reference values.

6. The method as claimed in claim 5 , wherein the reference value is a reference hash value.

7. An apparatus for protecting a program against control flow manipulation, comprising:

a device automatically inserting protect program commands, generating and checking a control flow flag sequence, where the checking is dependent upon preceding checkpoints inserted randomly into the program, into at least one program command sequence of program commands of the program; and

a device forming a control flow flag of the control flow flag sequence based on a command address of a program command, calculating a check value in a protect program command as a function of the control flow flag sequence, and verifying that all loops, jumps and subroutine calls in the control flow a sequence have been executed properly based on the check value.

8. A method of detecting incorrect program flow of a program, comprising:

generating a control flow flag sequence, using more than two checkpoints inserted randomly into the program, during program flow of the program, a control flow flag of the control flow flag sequence being formed by a command address of a program command;

detecting incorrect program flow if the control flow flag sequence generated does not match a stored reference control flow flag sequence or if the control flow flag sequence generated is not contained in a set of stored reference control flow flag sequences;

calculating a check value as a function of the generated control flow flag sequence; and

verifying that all loops, jumps and subroutine calls in the control flow flag sequence have been executed properly based on the check value.

9. The method as claimed in claim 8 , wherein the check value is formed by a hash value.

10. The method as claimed in claim 8 , further comprising calculating a reference value as a function of a reference control flow flag sequence.

11. The method as claimed in claim 10 , wherein the reference value is formed by a reference hash value.

12. The method as claimed in claim 10 , wherein said detecting of the incorrect program flow occurs if the check value calculated does not match the reference value calculated or if the check value calculated is not contained in a set of calculated reference values.

13. An apparatus for detecting incorrect program flow of a program, comprising:

a device generating a control flow flag sequence, using more than two checkpoints inserted randomly into the program, during a program flow of the program, a control flow flag of the control flow flag sequence being formed by a command address of a program command; and

a device detecting an incorrect program flow of the program if the control flow flag sequence generated does not match a stored reference control flow flag sequence or if the control flow flag sequence generated is not contained in a set of stored reference control flow flag sequences, calculating a check value as a function of the generated control flow flag sequence, and verifying that all loops, jumps and subroutine calls in the control flow flag sequence have been executed properly based on the check value.

14. A non-transitory computer readable medium embodying a computer program protecting against control flow manipulation, comprising:

inserting protect program commands provided for generating and checking a control flow flag sequence using more than two checkpoints inserted randomly into the computer program, a control flow flag of the control flow flag sequence being formed by a command address of a program command, and a reference check value, calculated as a function of the control flow flag sequence, that is compared with a calculated check value to verify all loops, jumps and subroutine calls in the control flow flag sequence have been executed properly.