Secure application distribution systems and methods
Systems and methods are described that use software diversification techniques to improve the security of mobile applications. Embodiments of the disclosed systems and methods may, among other things, facilitate secure application distribution through deployment of diverse of applications in an application distribution channel. Software diversification consistent with certain disclosed embodiments may mitigate large-scale automated circumvention of security protections by presenting attacking malware moving and/or otherwise unpredictable diverse targets.
1. A method for generating and distributing diverse application instances performed by an application store system comprising a processor and a non-transitory computer-readable storage medium storing instructions that, when executed, cause the application store system to perform the method, the method comprising:
receiving an intermediate representation of an application from an application developer system;
receiving a request from a user device to download the application from the application store system, the request comprising unique information provisioned to the user device by a personalization service;
generating an instance of the application, wherein generating the instance of the application comprises:
embedding data in the intermediate representation of the application, the embedded data being unique to the instance of the application and being generated by the application store system based, at least in part, on the unique information provisioned to the user device, and
performing a backend compilation of the intermediate representation of the application with the embedded data by the application store system to generate the instance of the application; and
transmitting the instance of the application to the user device in response to the request.
2. The method of claim 1 , wherein generating the instance of the application further comprises embedding code in the application unique to the instance of the application.
3. The method of claim 2 , wherein the code is embedded in a subcomponent of the application.
4. The method of claim 1 , wherein the embedded data is embedded in a subcomponent of the application.
5. The method of claim 1 , wherein the embedded data comprises at least one of a key, a nonce, and random salt data.
6. The method of claim 1 , wherein the intermediate representation of the application comprises first obfuscated bitcode of the application.
7. The method of claim 1 , wherein the unique information provisioned to the user device comprises a key.
8. The method of claim 1 , wherein the unique information provisioned to the user device comprises at least one of user account, registration, and authentication data.
9. The method of claim 1 , wherein generating the instance of the application is performed in response to receiving the request.
10. The method of claim 1 , wherein the unique information provisioned to the user device comprises device identification information unique to the user device.