Securing accessible systems using variable dependent coding
Systems and techniques for securing accessible computer-executable program code and systems are provided. One or more base functions may be generated and blended with existing program code, such that it may be difficult or impossible for a potential attacker to distinguish the base functions from the existing code. The systems and code also may be protected using a variety of other blending and protection techniques, such as fractures, variable dependent coding, dynamic data mangling, and cross-linking, which may be used individually or in combination, and/or may be blended with the base functions.
1. A method, implemented by one or more processors, comprising:
receiving computer-executable program code comprising instructions to execute a first operation ƒ(x) for x encoded as aX+b and a second operation g(y), wherein a and b have constant values during execution of ƒ(x), and g(y) produces at least a first value c when executed;
storing the computer-executable program code on a computer readable storage medium; and
modifying, by the one or more processors, the computer-executable program code stored on the computer readable storage medium to encode x as cX+d, to execute f(cX+d), wherein c and d have constant values during execution of
ƒ(cX+d) and to
discard c and d.
2. The method of claim 1 , wherein the computer-executable program code further comprises instructions to execute a third operation h(z) that produces a value d when executed.
3. The method of claim 1 , further comprising:
selecting c based upon the length of time that c is stored in a computer-readable memory.
4. The method of claim 1 , further comprising:
modifying the computer-executable program code to accept a different value for c upon each execution of ƒ(cX+d).
5. The method of claim 1 , wherein at least one of a, b, c, or d is a value obtained from a portion of code present in the computer-executable program prior to the computer-executable program code being modified.
6. The method of claim 5 , wherein the at least one of a, b, c, or d is an output of a function present in the computer-executable program prior to the computer-executable program code being modified.
7. The method of claim 1 , wherein ƒ(x) is an operation in a code segment selected from the group consisting of: a base function; and the computer-executable program code.
8. The method of claim 1 , wherein ƒ(x) is a base function.
9. A method, implemented by one or more processors executing instructions stored on a computer readable medium, comprising:
executing, by the one or more processors, a first operation g(y) that produces at least a first constant a as an output and recording the output on a computer readable storage medium;
encoding, by the one or more processors, a first variable x as aX+b, wherein b is a second constant;
executing, by the one or more processors, a second operation ƒ(aX+b) using aX+b as an input;
performing, by the one or more processors, a decoding operation using a and b; and
discarding, by the one or more processors, a and b.
10. The method of claim 9 , further comprising:
executing a third operation h(z) that produces at least b as an output.
11. The method of claim 9 , further comprising:
encoding a plurality of input values as aX+b, each input value encoded using a value of a based upon a different execution instance of g(y), and upon a value of b based upon a different execution instance of h(z).
12. The method of claim 9 , further comprising:
encoding an input as aX+b a plurality of times, each time using a value of a based upon a different execution instance of g(y).
13. The method of claim 9 , further comprising:
selecting a from a plurality of constants stored in a computer-readable memory based upon the expected duration of storage of a in the computer-readable memory and upon the execution time of ƒ(aX+b).
14. The method of claim 9 , further comprising:
selecting a from a plurality of constants stored in a computer-readable memory based upon the expected duration of storage of a in the computer-readable memory and upon the combined execution time of ƒ(aX+b) and the decoding operation.
15. The method of claim 9 , further comprising:
for each execution of ƒ(aX+b), encoding x using a value for at least one of a and b different from at least one previous value used for the at least one of a and b, respectively.
16. The method of claim 9 , wherein ƒ(x) is a base function.
17. A system comprising:
one or more processors; and
a computer-readable storage medium storing instructions which cause the one or more processors to:
receive computer-executable program code comprising instructions to execute a first operation ƒ(x) for x encoded as aX+b and a second operation g(y), wherein a and b have constant values during execution of ƒ(x), and g(y) produces at least a first value c when executed; and
modify the computer-executable program code to encode x as cX+d wherein c and d have constant values during execution of ƒ(x), to
execute ƒ(cX+d), and to
discard c and d.
18. A system comprising:
one or more processors; and
a computer-readable storage medium storing instructions which cause the one or more processors to:
execute a first operation g(y) that produces at least a first constant a as an output;
encode a first variable x as aX+b, wherein b is a second constant;
execute a second operation ƒ(aX+b) using aX+b as an input;
perform a decoding operation using a and b;and discard a and b.