COMPUTER PROTOCOL GENERATION AND OBFUSCATION

• US 20130014267A1
• Filed: 07/07/2011
• Published: 01/10/2013
• Est. Priority Date: 07/07/2011
• Status: Abandoned Application

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: FARRUGIA, Augustin J., CIET, Mathieu, BETOUIN, Pierre
• Application Number:
  US13/178,383
• Publication Number:
  US 20130014267A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 69/03 Protocol definition or specification protocol conformance testing H04L1/244

Abstract

In the field of computer science, communications protocols (such as computer network protocols) are hardened (secured) against reverse engineering attacks by hackers using a software tool which is applied to a high level definition of the protocol. The tool converts the definition to executable form, such as computer source code, and also applies reverse-engineering countermeasures to the protocol definition as now expressed in source code, to prevent hackers from recovering useful details of the protocol. This conversion process also allows preservation of backwards version compatibility of the protocol definition.

Claims

1. A method of obfuscating a computer protocol including at least one data structure, comprising the acts of:

receiving a definition of the protocol at a port;

storing the received definition in a first computer readable storage coupled to the port;

at a processor coupled to the first computer readable storage, converting the definition to a computer source code file which includes the data structure;

obfuscating the source code file; and

storing the obfuscated source code file in a second computer readable storage.

2. The method of claim 1, further comprising compiling the source code file into object code.

3. The method of claim 1, wherein the obfuscating includes at least one of:

partitioning a predetermined data field of the data structure into two or more data fields; and

scrambling an order of data fields of the data structure.

4. The method of claim 1, wherein the definition includes for the protocol a name, a seed value, a version identifier;

data fields of the data structure, and a security indicator.

5. The method of claim 4, wherein the security indicator designates at least one of:

a timestamp, a variable length, encryption, scrambling, fake fields, or a checksum or hash.

6. The method of claim 1, wherein the converting includes:

converting the data structure in the definition to computer instructions;

serializing any complexity in the data structure;

parsing the serialized data structure to extract there from the data; and

storing the extracted data in a third computer readable storage.

7. The method of claim 6, wherein the parsing is performed by an extractor function.

8. The method of claim 1, wherein a subsequent version of the protocol is provided, and further comprising the acts of:

determining if the subsequent version of the protocol in its data structure includes an additional data field not present in the first version; and

providing the additional data field in a source code file for the subsequent version, wherein the additional data field is appended to the data fields also present in the first version.

9. The method of claim 8, wherein the two source code files are compatible.

10. The method of claim 1, wherein the source code file includes a type, length, and value format.

11. A computing apparatus programmed to carry out the method of claim 1.

12. A non-volatile computer readable memory carrying instructions to carry out the method of claim 1.

13. Apparatus for obfuscating a computer protocol including at least one data structure, comprising:

a port adapted to receive a definition of the protocol;

a first computer readable storage coupled to the port and adapted to store the received definition;

a processor coupled to the first computer readable storage, and which converts the definition to a computer source code file which includes the data structure;

wherein the processor obfuscates the source code file; and

a second computer readable storage adapted to store the obfuscated source code file.

14. The apparatus of claim 13, further wherein the processor compiles the source code file into object code.

15. The apparatus of claim 13, wherein the obfuscating includes at least one of:

partitioning a predetermined data field of the data structure into two or more data fields; and

scrambling an order of data fields of the data structure.

16. The apparatus of claim 13, wherein the definition includes for the protocol a name, a seed value, a version identifier;

data fields of the data structure, and a security indicator.

17. The apparatus of claim 16, wherein the security indicator designates at least one of:

a timestamp, a variable length, encryption, scrambling, fake fields, or a checksum or hash.

18. The apparatus of claim 13, wherein the converting includes:

converting the data structure in the file to computer instructions;

serializing any complexity in the data structure;

parsing the serialized data structure to extract there from the data; and

storing the extracted data in a third computer readable storage.

19. The apparatus of claim 18, wherein the parsing is performed by an extractor function.

20. The apparatus of claim 13, wherein a subsequent version of the protocol is provided, and further comprising the processor:

determining if the subsequent version of the protocol in its data structure includes an additional data field not present in the first version; and

providing the additional data field in a source code file for the subsequent version, wherein the additional data field is appended to the data fields also present in the first version.

21. The apparatus of claim 20, wherein the two source code files are compatible.

22. The apparatus of claim 13, wherein the source code file includes a type, length, and value format.