Implementing portable content protection to secure secrets

• US 8,875,112 B2
• Filed: 03/22/2012
• Issued: 10/28/2014
• Est. Priority Date: 01/31/2003
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Graunke, Gary L.
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US13/426,708
• Publication Number:
  US 20120180032A1
• Time in Patent Office: 950 Days
• Field of Search: 717/170, 717/144, 713/193
• US Class Current: 717/144
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation

Abstract

A source-level compiler may randomly select compilation conventions to implement portable content protection, securing the secrets embedded in a program by shuffling associated data. The program may be developed using a source language that is applicative on the associated data. To obscure the embedded secrets, in one embodiment, pre-compiler software may be deployed for compiling the program in a random-execution-order based on a random seed indication that randomly selects compilation conventions and a shuffling algorithm that moves the associated data across the program during execution.

Claims

1. An article comprising a non-transitory computer readable medium storing instructions that, when executed by a computer processor-based system, result in:

developing for a program including one or more data variables, blocks of code, jumps and a secret in a control flow graph indicative of at least one unique variable layout for said one or more data variables;

compiling the program based on said at least one unique variable layout to obscure said secret while shuffling data across the program during execution;

identifying said one or more blocks of code as nodes and said one or more jumps as arcs of the control flow graph;

adding exactly one dummy entry and one dummy exit node to the control flow graph to assign permutations to non-dummy nodes in the control graph; and

assigning permutations to said dummy entry and dummy exit nodes and marking said nodes as assigned.

2. The article of claim 1, comprising a medium storing instructions that, if executed, enable a processor-based system to perform steps including:

finding on the control flow graph a shortest connecting walk connecting two marked nodes of said one or more dummy entry and exit nodes;

traversing the shortest connecting walk marking all arcs and nodes;

determining whether all arcs have been marked; and

if not, finding another shortest connecting walk connecting two different marked nodes.

3. The article of claim 2, comprising a medium storing instructions that, if executed, enable a processor-based system to perform steps including responsive to all arcs being marked, generating code using node permutations to determine said different variable offsets in at least one block of said one or more blocks and generating additional code for at least one arc of said one or more arcs of the control flow graph.