Securing accessible systems using base function encoding
Systems and techniques for securing accessible computer-executable program code and systems are provided. One or more base functions may be generated and blended with existing program code, such that it may be difficult or impossible for a potential attacker to distinguish the base functions from the existing code. The systems and code also may be protected using a variety of other blending and protection techniques, such as fractures, variable dependent coding, dynamic data mangling, and cross-linking, which may be used individually or in combination, and/or may be blended with the base functions.
1. A method, implemented by one or more processors, for creating a secured software program from an existing computer-executable program, the method comprising:
selecting a word size w;
selecting a vector length N;
generating an invertible state-vector function configured to operate on an N-vector of w-element words, the invertible state-vector function comprising a concatenation of a plurality of invertible steps, wherein one or more steps of the plurality of invertible steps perform linear or affine computations over Z/(2 w );
indexing a first portion of steps of the plurality of invertible steps using a first indexing technique;
indexing a second portion of steps of the plurality of invertible steps using a second indexing technique;
selecting at least one operation in an existing computer-executable program to modify; and
modifying the at least one operation in the existing computer-executable program to execute the state-vector function.
2. The method of claim 1 , wherein each of the first and second indexing techniques controls an operation type independently selected from the group consisting of: an if-then-else construct; a switch construct, an element-permutation selection, an iteration count, an element rotation count, and a function-indexed key index.
3. The method of claim 1 , wherein each step in a third portion of steps of the plurality of invertible steps comprises a non-T-function operation.
4. The method of claim 3 , wherein each of the steps in the third portion of steps is an operation type selected from the group consisting of: a function-indexed keyed element-wise rotation, and a function-indexed keyed sub-vector permutation.
5. The method of claim 1 , wherein w is selected from the group consisting of: 16 bits, 32 bits, and 64 bits.
6. The method of claim 1 , wherein w is selected as a default integer size of a host computing platform.
7. The method of claim 1 , wherein the word size w is twice the internal word size of the N-vector.
8. The method of claim 1 , further comprising:
generating an inverse of the invertible state-vector function, the inverse of the invertible state-vector function comprising a concatenation of an inverse of each of the plurality of invertible steps.
9. The method of claim 1 , further comprising:
selecting a key type for the invertible state-vector function from the group consisting of: a run-time key, a generation-time key, and a function-indexed key.
10. The method of claim 9 , wherein the selected key type is a run-time key, said method further comprising:
modifying the state-vector function to accept a run-time input providing a key k.
11. The method of claim 9 , wherein the selected key type is a generation-time key, said method further comprising partially evaluating the state-vector function with respect to a key K.
12. The method of claim 9 , wherein the selected key type is a function-indexed key, said method further comprising, for each of the plurality of invertible steps A, providing a key R A for the associated inverse of the invertible step.
13. The method of claim 1 , wherein the state-vector function is implemented at least in part by a plurality of matrix operations.
14. The method of claim 1 , wherein at least one of the first and second indexing techniques controls a plurality of operations comprising random swaps performed according to a sorting-network topology.
15. The method of claim 14 , wherein the sorting-network topology is selected from the group consisting of: a Batcher network, a Banyan network, a perfect-shuffle network, and an Omega network.
16. The method of claim 1 , further comprising:
encoding an input to the state-vector function with a first encoding mechanism; wherein each step in the state-vector function is adapted and configured to operate when the input to the state-vector function encoded with a second encoding mechanism different from the first encoding mechanism.
17. The method of claim 16 , wherein the first encoding mechanism encodes the input as aM+b, wherein a and b are constants and wherein M is an invertible matrix.
18. The method of claim 17 , wherein the second encoding mechanism, when applied to the input, encodes the input as cP+d, wherein c and d are constants different than a and b, respectively and wherein P is an invertible Matrix.
19. The method of claim 1 , wherein the at least one operation in the existing computer-executable program and the state-vector function use computationally-similar operations.
20. The method of claim 1 , wherein the step of modifying the existing computer program further comprises applying, to a combination of the state-vector function and the existing computer program, at least one technique selected from the group consisting of: a fracture, and dynamic data mangling.
21. The method of claim 20 , wherein each of the state-vector function and code implementing the at least one technique uses operations computationally similar to those present in the existing computer program.