Method for effective tamper resistance

Abstract

A system, method, and computer program product for preventing a malicious user from analyzing and modifying software content. The one-way functions used in prior art systems using dynamically evolving audit logs or self-modifying applications are replaced with a one-way function based on group theory. With this modification, untampered key evolution will occur inside a defined mathematical group such that all valid key values form a subgroup. However, if the program is altered, the key will evolve incorrectly and will no longer be a member of the subgroup. Once the key value is outside of the subgroup, it is not possible to return it to the subgroup. The present invention provides a limited total number of valid keys. The key evolution points are not restricted to locations along the deterministic path, so the key can be used in various novel ways to regulate the program's behavior, including in non-deterministic execution paths.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS [0001]This invention is related to commonly-owned pending U.S. patent applications, each of which is hereby incorporated by reference:[0002]U.S. Ser. No. 10 / 249,130, filed Dec. 19, 2002, entitled “System and Method to Proactive! y Detect Software Tampering”, published Jun. 24, 2004 as USPA. 2004 / 0123116A1 and referred to hereafter as the '130 invention or the Event-Log Based invention.[0003]U.S. Ser. No. 11 / 066,934, filed Feb. 26, 2005, entitled “System, Method, and Service for Detecting Improper Manipulation of an Application”, referred to hereafter as the '934 invention or the Branch-Based invention.FIELD OF THE INVENTION [0004]This invention relates generally to the field of software security and more specifically to preventing a malicious user from analyzing and modifying software content,BACKGROUND OF THE INVENTION [0005]Whenever software is sold, there is the possibility that a malicious user will tamper with the software to extract secr...

AI Technical Summary

Benefits of technology

[0116]It is an object of this invention to provide a method, system, and program product for preventing a malicious user from analyzing and modifying software content.

[0119]The invention also solves the initial key weakness in the Branch-Based scheme of [10] by using the subgroup extension. Now, like the Branch-Based technique, any key in the subgroup can be used to start the program. This eliminates the need for any special protection on the initial key.

[0120]As with the original techniques, some performance and size impact was to be expected. However, evaluation shows that through careful implementation the impact incurred can be tolerable. Overall, the subgroup extension improves the strength of both the Event fog-Based and the Branch-Based tamper resistance techniques without significantly impacting the size or performance of the applications.

Problems solved by technology

Because of this, they both suffer from a common limitation associated with the placement of either the integrity checks or the call to the branch function.

Restricting these placements to points along a deterministic path can limit the usefulness and weaken the overall strength of the tamper resistance capabilities.

Images