Techniques for Detecting Program Modifications

• US 20130347109A1
• Filed: 06/21/2012
• Published: 12/26/2013
• Est. Priority Date: 06/21/2012
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Fluhrer, Scott
• Application Number:
  US13/529,068
• Publication Number:
  US 20130347109A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

Techniques are provided for detecting modifications to software instructions. At a computing apparatus configured to execute a software program comprising a plurality of instructions, at least a first check point having a first check value and a second check point having a second check value are assigned within the instructions. At least first and second portions of the instructions are identified. The first portion of the instructions comprises one or more check points other than the first check point. The second portion of the instructions comprises one or more check points other than the second check point. A first hashing operation is performed over the first portion resulting in a first equation and a second hashing operation is performed over the second portion resulting in a second equation. The first check value and the second check value are computed based on the first equation and the second equation.

Claims

1. A method comprising:

at a computing apparatus configured to execute a software program comprising a plurality of instructions, assigning at least a first check point having a first check value and a second check point having a second check value within the instructions;

identifying at least first and second portions of the instructions such that the first portion of the instructions comprises one or more check points other than the first check point and such that the second portion of the instructions comprises one or more check points other than the second check point;

performing a first hashing operation over the first portion resulting in a first equation and performing a second hashing operation over the second portion resulting in a second equation; and

computing the first check value and the second check value based on the first equation and the second equation.

2. The method of claim 1, further comprising:

comparing the first check value with a predetermined stored first check value and comparing the second check value with a predetermined stored second check value to generate comparison results; and

determining that the instructions have been tampered with when the comparison results indicate that either the first check value does not match the predetermined stored first check value or the second check value does not match the predetermined stored second check value.

3. The method of claim 2, further comprising determining the first predetermined stored check value based on an initial acceptable first checksum value and the second predetermined stored check value based on an initial acceptable second checksum value.

4. The method of claim 1, wherein performing the first hashing operation and the second hashing operation comprises performing the first hashing operation and the second hashing operation such that a change in the first check value results in a corresponding change in the second check value and a change in the second check value results in a corresponding change in the first check value.

5. The method of claim 1, wherein computing the first check value and the second check value comprises computing the first check value and the second check value by solving a set of linear equations comprising the first equation and the second equation.

6. The method of claim 5, wherein computing comprises computing the first check value and the second check value by solving the set of linear equations, wherein the first equation and the second equation are dependent upon one another.

7. The method of claim 5, wherein computing comprises computing the first check value and the second check value by solving the set of linear equations that are generated according to one of the following techniques:

linear over addition in a Galois field of two elements (GF(2)), linear over addition modulo N, and linear over arithmetic in a Galois field with pⁿ elements (GF(pⁿ)).

8. The method of claim 1, further comprising repeating the computing of the first check value and the second check value after a predetermined amount of time to produce an updated first check value and an updated second check value.

9. The method of claim 1, wherein identifying comprises identifying the first portion of the instructions that is nonconsecutive with the second portion of the instructions.

10. One or more computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

assign at least a first check point having a first check value and a second check point having a second check value within a plurality of instructions of a computing apparatus configured to execute a software program;

identify at least first and second portions of the instructions such that the first portion of the instructions comprises one or more check points other than the first check point and such that the second portion of the instructions comprises one or more check points other than the second check point;

perform a first hashing operation over the first portion resulting in a first equation and perform a second hashing operation over the second portion resulting in a second equation; and

compute the first check value and the second check value based on the first equation and the second equation.

11. The computer readable storage media of claim 10, further comprising instructions operable to:

compare the first check value with a predetermined stored first check value and compare the second check value with a predetermined stored second check value to generate comparison results; and

determine that the instructions have been tampered with when the comparison results indicate that either the first check value does not match the predetermined stored first check value or the second check value does not match the predetermined stored second check value.

12. The computer readable storage media of claim 11, further comprising instructions operable to determine the first predetermined stored check value based on an initial acceptable checksum value and the second predetermined stored check value based on an initial acceptable second checksum value.

13. The computer readable storage media of claim 10, wherein the instructions operable to perform the first hashing operation and the second hashing operation comprise instructions operable to perform the first hashing operation and the second hashing operation such that a change in the first check value results in a corresponding change in the second check value and a change in the second check value results in a corresponding change in the first check value.

14. The computer readable storage media of claim 10, wherein the instructions operable to compute the first check value and the second check value comprise instructions operable to compute the first check value and the second check value by solving a set of linear equations comprising the first equation and the second equation.

15. The computer readable storage media of claim 14, wherein computing the first check value and the second check value by solving the set of linear equations comprises computing the first check value and the second check value by solving the set of linear equations, wherein the first equation and the second equation are dependent upon one another.

16. The computer readable storage media of claim 14, wherein the instructions operable to compute comprise instructions operable to compute the first check value and the second check value by solving the set of linear equations that are generated according to one of the following techniques:

linear over addition in a Galois field of two elements (GF(2)), linear over addition modulo N, and linear over arithmetic in a Galois field with pⁿ elements (GF(pⁿ)).

17. The computer readable storage media of claim 10, further comprising instructions operable to repeat the computing of the first check value and the second check value after a predetermined amount of time to produce an updated first check value and an updated second check value.

18. The computer readable storage media of claim 10, further comprising instructions operable to identify the first portion of the instructions that is nonconsecutive with the second portion of the instructions.

19. An apparatus comprising:

a network interface unit;

a memory; and

a processor coupled to the network interface unit and the memory and configured to;

assign at least a first check point having a first check value and a second check point having a second check value within a plurality of instructions of a software program;

identify at least first and second portions of the instructions such that the first portion of the instructions comprises one or more check points other than the first check point and such that the second portion of the instructions comprises one or more check points other than the second check point;

perform a first hashing operation over the first portion resulting in a first equation and perform a second hashing operation over the second portion resulting in a second equation; and

compute the first check value and the second check value based on the first equation and the second equation.

20. The apparatus of claim 19, wherein the processor is further configured to compare the first check value with a predetermined stored first check value and compare the second check value with a predetermined stored second check value to generate comparison results;

and

determine that the instructions have been tampered with when the comparison results indicate that either the first check value does not match the predetermined stored first check value or the second check value does not match the predetermined stored second check value.

21. The apparatus of claim 20, wherein the processor is further configured to determine the first predetermined stored check value based on an initial acceptable checksum value and the second predetermined stored check value based on an initial acceptable second checksum value.

22. The apparatus of claim 19, wherein the processor is further configured to perform the first hashing operation and the second hashing operation such that a change in the first check value results in a corresponding change in the second check value and a change in the second check value results in a corresponding change in the first check value.

23. The apparatus of claim 19, wherein the processor is further configured to compute the first check value and the second check value by solving a set of linear equations comprising the first equation and the second equation.