Securing accessible systems using dynamic data mangling
Systems and techniques for securing accessible computer-executable program code and systems are provided. One or more base functions may be generated and blended with existing program code, such that it may be difficult or impossible for a potential attacker to distinguish the base functions from the existing code. The systems and code also may be protected using a variety of other blending and protection techniques, such as fractures, variable dependent coding, dynamic data mangling, and cross-linking, which may be used individually or in combination, and/or may be blended with the base functions.
1. A method, implemented by one or more processors, comprising:
receiving computer executable code for an existing application;
identifying at least a portion of the computer executable code that stores at least one value in a first memory location; and
modifying the at least a portion of the computer executable code to store the at least one value in an array of size M having a plurality of M-register locations, wherein each M-register location is a respective constant c i of a series of constants c 1 , . . . , c n , with n≦M, where the series of constants c 1 , . . . , c n is defined by a permutation polynomial p, an input-based 1×n vector mapping matrix A yielding z from an input of the existing application such that c i p(z+i), instead of the first memory location.
2. The method of claim 1 , further comprising a step of modifying the computer executable code to apply an encoding to an intermediate result prior to storing the intermediate result in the corresponding M-register for each intermediate result stored in an M-register.
3. The method of claim 1 , further comprising, for each intermediate result retrieved from an M-register, applying a decoding to the intermediate result subsequent to retrieving the intermediate result from the corresponding M-register.
4. The method of claim 1 , further comprising a step of modifying the computer executable code to store a value required by at least one operation in the computer executable code, other than an intermediate result of the operation, in an M-register selected randomly from among the plurality of M-registers.
5. A method, implemented by one or more processors, comprising:
receiving an input from an application;
defining an array of size M having a plurality of M-register locations, wherein each M-register location is a respective constant c i of a series of constants c 1 , . . . , c n , with n≦M;
defining a permutation polynomial p, an input-based 1×n vector mapping matrix A yielding z from the input, and a series of constants c i =p(z+i);
performing a series of operations, each operation providing an intermediate result;
storing each intermediate result in an M-register selected randomly from the plurality of M-registers; and
providing a final result based upon the series of intermediate results to the application from a final M-register storing the final result.
6. The method of claim 5 , further comprising, for each intermediate result stored in an M-register, applying an encoding to the intermediate result prior to storing the intermediate result in the corresponding M-register.
7. The method of claim 6 , wherein each encoding applied to an intermediate result is randomly chosen from among a plurality of encodings.
8. The method of claim 5 , further comprising, for each intermediate result retrieved from an M-register, applying a decoding to the intermediate result subsequent to retrieving the intermediate result from the corresponding M-register.
9. The method of claim 8 , wherein each decoding is randomly chosen from among a plurality of decodings.
10. The method of claim 8 , wherein each decoding applied to an intermediate result retrieved from an M-register is an inverse of an encoding applied to the intermediate result prior to the intermediate result being stored in the corresponding M-register.
11. The method of claim 8 , wherein at least one decoding applied to an intermediate result retrieved from an M-register is not an inverse of an encoding applied to the intermediate result prior to the intermediate result being stored in the corresponding M-register.
12. The method of claim 5 , further comprising:
storing a value required by at least one operation of the series of operations, other than an intermediate result, in an M-register selected randomly from among the plurality of M-registers.
13. The method of claim 12 , further comprising:
applying an encoding to the value required by the at least one of the operations, the encoding selected randomly from among a plurality of encodings.
14. The method of claim 5 , wherein each operation in the series of operations is from a source selected from the group consisting of: a base function; and computer-executable program code with which at least one base function is integrated.
15. The method of claim 5 , wherein the permutation polynomial p is a permutation polynomial over a mod-M ring.
16. The method of claim 5 , wherein, for 1≦i≦M, each c i value is distinct.
17. The method of claim 5 , wherein a new M-register is allocated only when required according to a graph-coloring allocation algorithm.
18. The method of claim 5 , wherein the array M is stored in a computer readable medium selected from the group consisting of all computer readable media used during execution of the application.
19. A system comprising:
one or more & processors; and
a computer-readable storage medium storing instructions which cause the one or more processors to:
receive an input from an application;
define an array of size M having a plurality of M-register locations, wherein each M-register location is a respective constant of a series of constants c 1 , . . . , c n , with n≦M;
define a permutation polynomial p, an input-based 1×n vector mapping matrix A yielding z from the input, and the series of constants c 1 , . . . , c n , such that the series of constants c 1 , . . . , c n is defined by c i =p(z+i);
perform a series of operations, each operation providing an intermediate result;
store each intermediate result in an M-register selected randomly from the plurality of M-registers; and
provide a final result based upon the series of intermediate results to the application from a final M-register storing the final result.
20. A system comprising:
one or more processors; and
a computer-readable storage medium storing instructions which cause the one or more processors to:
receive computer executable code for an existing application;
identify at least a portion of the computer executable code that stores at least one value in a first memory location; and
modify the at least a portion of the computer executable code to store the at least one value in an array of size M having a plurality of M-register locations, wherein each M-register location is a respective constant c i of a series of constants c 1 , . . . , c i , with n≦M, where the series of constants c 1 , . . . , c n are defined by a permutation polynomial p, an input-based 1×n vector mapping matrix A yielding z from an input of the existing application such that c i =p(z+i), instead of the first memory location.
21. The method of claim 2 , wherein each encoding applied to an intermediate result is randomly chosen from among a plurality of encodings.
22. The method of claim 21 , further comprising, for each intermediate result retrieved from an M-register, applying a decoding to the intermediate result subsequent to retrieving the intermediate result from the corresponding M-register.
23. The method of claim 1 , wherein each decoding is randomly chosen from among a plurality of decodings.
24. The method of claim 22 , wherein each decoding applied to an intermediate result retrieved from an M-register is an inverse of an encoding applied to the intermediate result prior to the intermediate result being stored in the corresponding M-register.
25. The method of claim 22 , wherein at least one decoding applied to an intermediate result retrieved from an M-register is not an inverse of an encoding applied to the intermediate result prior to the intermediate result being stored in the corresponding M-register.
26. The method of claim 4 , further comprising:
applying an encoding to the value required by the at least one of the operations, the encoding selected randomly from among a plurality of encodings.
27. The method of claim 1 , wherein the permutation polynomial p is a permutation polynomial over a mod-M ring.
28. The method of claim 1 , wherein, for 1≦i≦M, each c i value is distinct.
29. The method of claim 1 , wherein a new M-register is allocated only when required according to a graph-coloring allocation algorithm.
30. The method of claim 1 , wherein the array M is stored in a computer readable medium selected from the group consisting of all computer readable media used during execution of the application.