Method, a device and a computer program support for execution of encrypted computer code
View Patent ↗A device stores program code in a plurality of slots in its memory. When a processor of the device receives a call to an encrypted function, it uses a slot table to find the location of the cipher function and the cipher module and the key to decrypt the encrypted module. The encrypted module is decrypted, executed, re-encrypted and moved to a new memory slot. The cipher function used is moved to a further new slot and the slot table is updated. Also provided is a method and a computer program support. The invention can make it more difficult to analyse execution traces of the program code.
1. A method of executing program code located in a memory having a plurality of memory slots, the program code having an encrypted function in a first memory slot, the method comprising:
decrypting, by a processor, the encrypted function using a first cipher module located in a second memory slot to obtain a decrypted function;
executing, by the processor, the decrypted function;
re-encrypting, by the processor, the decrypted function using a second cipher module located in a third memory slot to obtain a re-encrypted function;
storing, by the processor, the re-encrypted function in a fourth memory slot, different from the first memory slot; and
moving, by the processor, the second cipher module from the third memory slot to a fifth memory slot after the re-encryption step, the fifth memory slot being different than the third memory slot.
2. The method of claim 1 , wherein the second cipher module is different from the first cipher module.
3. The method of claim 1 , wherein the first cipher module further comprises a first key and the second cipher module comprises a second key, wherein the second key is different from the first key.
4. The method of claim 1 , further comprising:
maintaining, by the processor, a memory slot list having information on contents of the plurality memory slots; and
updating, by the processor, the memory slot list after the storing step.
5. The method of claim 1 , further comprising selecting at least one of the first cipher module and the second cipher module from a plurality of cipher modules implementing the same cipher algorithm.
6. The method of claim 5 , wherein at least two of the plurality of cipher modules implementing the same cipher algorithm are implemented in different ways.
7. The method of claim 1 , further comprising deleting, by the processor, the decrypted function after its execution.
8. A device for executing program code having an encrypted function, the device comprising:
a memory having a plurality of memory slots, the encrypted function being stored in a first memory slot, and
a processor configured to:
decrypt an encrypted function using a first cipher module located in a second memory slot to obtain a decrypted function;
execute the decrypted function;
re-encrypt the decrypted function using a second cipher module located in a third memory slot to obtain a re-encrypted function;
store the re-encrypted function in a fourth memory slot, different from the first memory slot; and
move the second cipher module from the third memory slot to a fifth memory slot after re-encryption, the fifth memory slot being different than the third memory slot.
9. The device of claim 8 , wherein the second cipher module is different from the first cipher module.
10. The device of claim 8 , wherein the processor is further configured to:
maintain a memory slot list having information on contents of the plurality of memory slots; and
update the memory slot list after the storing the re-encrypted function.
11. The device of claim 8 , wherein the processor is further configured to select at least one of the first cipher module and the second cipher module from a plurality of cipher modules implementing the same cipher algorithm.
12. The device of claim 8 , wherein the processor is further configured to delete the decrypted function after its execution.
13. A non-transitory computer readable storage medium having stored therein instructions enabling executing program code located in a memory having a plurality of memory slots, the program code having an encrypted function in a first memory slot, such that when the instructions are executed by a computer, the instructions cause the computer to:
decrypt, by a processor, the encrypted function using a first cipher module located in a second memory slot to obtain a decrypted function;
execute, by the processor, the decrypted function;
re-encrypt, by the processor, the decrypted function using a second cipher module located in a third memory slot to obtain a re-encrypted function;
store, by the processor, the re-encrypted function in a fourth memory slot, different from the first memory slot; and
move, by the processor, the second cipher module from the third a memory slot to a fifth memory slot after the re-encryption step, the fifth memory slot being different than the third memory slot.
14. The device of claim 8 , wherein the first cipher module further comprises a first key and the second cipher module comprises a second key, wherein the second key is different from the first key.
15. The computer readable storage medium according to claim 13 , wherein the second cipher module is different from the first cipher module.
16. The computer readable storage medium according to claim 13 , wherein the first cipher module further comprises a first key and the second cipher module comprises a second key, wherein the second key is different from the first key.
17. The computer readable storage medium according to claim 13 , wherein the instructions further cause the computer to:
maintain, by the processor, a memory slot list having information on contents of the plurality memory slots; and
update, by the processor, the memory slot list after the storing step.
18. The computer readable storage medium according to claim 13 , wherein the instructions further cause the computer to select at least one of the first cipher module and the second cipher module from a plurality of cipher modules implementing the same cipher algorithm.
19. The computer readable storage medium according to claim 18 , wherein at least two of the plurality of cipher modules implementing the same cipher algorithm are implemented in different ways.
20. The computer readable storage medium according to claim 13 , wherein the instructions further cause the computer to delete, by the processor, the decrypted function after its execution.