Software self-checking systems and methods

• US 10,423,779 B2
• Filed: 03/14/2018
• Issued: 09/24/2019
• Est. Priority Date: 06/13/2001
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Horne, William G., Matheson, Lesley R., Sheehan, Casey, Tarjan, Robert E.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US15/921,476
• Publication Number:
  US 20180336340A1
• Time in Patent Office: 559 Days
• Field of Search: 713176, 713181, 713187, 726 22, 726 26, 726 27, 714 37
• CPC Class Codes: G06F 11/3624 by performing operations on the source code, e.g. via a compiler
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

Software self-checking mechanisms are described for improving software tamper resistance and/or reliability. Redundant tests are performed to detect modifications to a program while it is running. Modifications are recorded or reported. Embodiments of the software self-checking mechanisms can be implemented such that they are relatively stealthy and robust, and so that they are compatible with copy-specific static watermarking and other tamper-resistance techniques.

Claims

1. A non-transitory computer-readable storage medium storing programming instructions that, if executed by a processor of a computer system, are operable to cause the computer system to perform a method of determining an integrity of a program, the method comprising:

performing, using a first self-checking code sequence included in the program during execution of the program, a check of the integrity of a first portion of the program;

determining, based on the check of the integrity of the first portion of the program by the first self-checking code sequence, that the first portion of the program has been modified;

performing, using a second self-checking code sequence included in the program during execution of the program, a check of the integrity of a second portion of the program, the second portion of the program comprising a tamper response mechanism;

determining, based on the check of the integrity of the second portion of the program by the second self-checking code sequence, that the second portion of the program has not been modified; and

triggering the tamper response mechanism based on determining that the first portion of the program has been modified and that the second portion of the program has not been modified.

2. The non-transitory computer-readable storage medium of claim 1, wherein each of the first portion of the program and the second portion of the program comprises at least one corrector value.

3. The non-transitory computer-readable storage medium of claim 1, wherein the first self-checking code sequence is included in the first portion of the program.

4. The non-transitory computer-readable storage medium of claim 1, wherein the first self-checking code sequence is included in a portion of the program different, at least in part, than the first portion of the program.

5. The non-transitory computer-readable storage medium of claim 1, wherein the program further includes a third self-checking code sequence configured to check the integrity of at least the first self-checking code sequence.

6. The non-transitory computer-readable storage medium of claim 1, wherein the program further includes a third self-checking code sequence configured to check the integrity of at least the second self-checking code sequence.

7. The non-transitory computer-readable storage medium of claim 1, wherein performing the check of the integrity of the first portion of the program comprises calculating a result of a function based on the first portion of the program and wherein determining that the first portion of the program has been modified comprises determining that the result is different that a predefined result.

8. The non-transitory computer-readable storage medium of claim 7, wherein the function comprises a hash function.

9. The non-transitory computer-readable storage medium of claim 8, wherein the hash function is invertible.

10. The non-transitory computer-readable storage medium of claim 8, wherein the hash function is relatively lightweight.

11. The non-transitory computer-readable storage medium of claim 1, wherein performing the check of the integrity of the second portion of the program comprises calculating a result of a function based on the second portion of the program and wherein determining that the second portion of the program has not been modified comprises determining that the result is the same as a predefined result.

12. The non-transitory computer-readable storage medium of claim 11, wherein the function comprises a hash function.

13. The non-transitory computer-readable storage medium of claim 12, wherein the hash function is invertible.

14. The non-transitory computer-readable storage medium of claim 12, wherein the hash function is relatively lightweight.

15. The non-transitory computer-readable storage medium of claim 1, wherein triggering the tamper response mechanism comprises triggering at least one protective action via one of a plurality of alternative access paths.

16. The non-transitory computer-readable storage medium of claim 1, wherein triggering the tamper response mechanism comprises trigging the tamper response mechanism after the expiration of a variable time period following determining that the first portion of the program has been modified and determining that the second portion of the program has not been modified.

17. The non-transitory computer-readable storage medium of claim 1, wherein triggering the tamper response mechanism comprises terminating execution of the program.

18. The non-transitory computer-readable storage medium of claim 1, wherein trigging the tamper response mechanism comprises disabling a function of the program.

19. The non-transitory computer-readable storage medium of claim 1, wherein triggering the tamper response mechanism comprises terminating a system administrator ability of the program to access protected data.

20. The non-transitory computer-readable storage medium of claim 1, wherein triggering the tamper response mechanism comprises erasing protected data.

21. The non-transitory computer-readable storage medium of claim 1, wherein triggering the tamper response mechanism comprises generating and transmitting a message to a system administrator.