Secure method and system for computer protection
Attacks by computer viruses, worm programs, and other hostile software (‘malware’), have become very serious problems for computer systems connected to large communication networks such as the Internet. One potential defence against such attacks is to employ diversity—that is, making each copy of the attacked software different. However, existing diversity techniques do not offer sufficient levels of protection. The invention provides an effective diversity solution by applying tamper resistant software (TRS) encoding techniques, to the communications that take place between software components, with corresponding changes to the code handling those communications. These communications may include, for example, data passed between software routines via parameters or mutually accessible variables, light-weight messages, signals and semaphores passed between threads, and messages passed between software processes. Effective TRS encoding techniques include data-flow encoding and mass-data encoding techniques.
1. A method for converting a software program, or a software system including multiple programs or applications, to a form in which it is resistant to malware and/or remote hacker protocol attacks, said method comprising the steps of:
identifying a communication between two software components within said software program or software system which is potentially vulnerable to such an attack;
randomly selecting a tamper-resistant software (TRS) encoding;
modifying data representations used in the identified communication by employing the randomly selected TRS encoding, the modification creating a dialect by which the two software components communicate resulting in a second communication actually made between the two software components being ineffectual as a receiving component will not be able to decode said second communication received from a sending component if data representations used in the second communication are in disagreement with the dialect created by the TRS encoding;
determining if the identified communication has limited vulnerability to attacks or is vulnerable only to attacks of limited security concern;
determining if the identified communication has a high degree of vulnerability to attacks or is vulnerable to attacks of serious security concern;
selecting a light-weight, low-overhead TRS encoding if the identified communication has limited vulnerability to attacks or is vulnerable only to attacks of limited security concern; and
selecting a heavy-weight, higher-overhead TRS encoding if the identified communication has a high degree of vulnerability to attacks or is vulnerable to attacks of serious security concern.
2. The method of claim 1 and further comprising repeating the steps of claim 1 whereby multiple communications vulnerable to malware or remote hacker protocol attacks are identified and each such identified communication is protected by means of randomly selected TRS encoding.
3. The method of claim 2 whereby at least one identified communication which is of limited security concern is left unprotected without TRS-encoding.
4. The method of claim 1 whereby the identified communication communicates a word of data being a scalar value communicated in a register or a variable, said scalar value being based on a randomly generated constant.
5. The method of claim 1 wherein the identified communication has limited vulnerability to attacks or is vulnerable only to attacks of limited security concern and the dialect is created by applying the selected TRS encoding only to data representations in selected registers or variables to reduce overhead.
6. The method of claim 1 performed to convert multiple instances of a software program or a software system to a form resistant to malware and/or remote hacker protocol attacks, whereby the method of claim 1 is applied independently to each instance of the software program or software system, with the random selection of TRS encoding for each identified communication rendering an attack that is successful on one such instance ineffectual for other such instances of the same software program or software system.
7. The method of claim 6 , whereby the multiple instances of the software program or software system are distributed through space, with distinct instances of the software program residing on different computers, or distinct instances of the software system residing on distinct computers or distinct networks of computers, such that an attack which succeeds on one computer or one network, will fail on other computers or other networks.
8. The method of claim 6 whereby the multiple instances of the software program or software system are distributed through time with distinct instances being deployed successively, such that an attack which succeeds at one time, will fail at a later time after a new instance of the software program or software system has been deployed.
9. The method of claim 1 whereby the identified communication communicates a large body of data.
10. The method of claim 9 , whereby the body of data is one of a record with multiple fields, an array, an input/output buffer and a file.