# US 10,503,931 B2 · Method and apparatus for dynamic executable verification

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,503,931 B2
- Document ID: US10503931B2
- Status: Granted
- Kind: B2
- Application number: 15/589,976
- Filed: 2017-05-08
- Published: 2017-11-09
- Granted: 2019-12-10
- Earliest claimed: 2016-05-09
- Assignees: ARRIS Enterprises LLC
- Applicants: ARRIS Enterprises LLC
- Inventors: Lex Aaron Anderson
- Web page: https://patentgrep.com/patent/US10503931B2

## CPC

- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F 9/44521: {Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading}
- G06F 16/2255: {Hash tables}
- G06F 21/121: {Restricting unauthorised execution of programs}
- G06F 21/125: {by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code}
- G06F 21/44: Program or device authentication
- G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
- G06F 21/54: by adding security routines or objects to programs
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method and apparatus for Dynamic Executable Verification (DEV) is disclosed that includes a random prefix of functions of a binary application, a check function for at least a subset of the functions and a jump table for at least a subset of the functions. DEV provides low-impact dynamic integrity protection to applications that is compatible with standard code signing and verification methods, and ensures that software cannot be tampered with either statically or dynamically without detection.

## Claims

### Claim 1

A method of generating a dynamically verifiable application executable having a plurality of functions, comprising:
at build time:
prepending a random prefix to at least a subset of the plurality of functions ƒ of a binary of the application;
generating a check function for each function of the at least a subset of the plurality of functions;
injecting each of the generated check functions into random locations in the binary of the application;
generating a jump table J, the jump table J having, for each function in the subset of the plurality of functions:
a mapping between the respective function and the generated check function;
wherein the mapping between the respective function and generated check function is associated with a identifier o and is randomly injected into the jump table J; and
injecting a call to the jump table having the identifier into a bootstrap of the binary of the application to generate a protected binary of the application;
at link time:
linking the protected binary of the application to generate the application executable; and
at activation time:
generating hash table data using the bootstrap.

### Claim 2 (depends on 1)

The method of claim 1, wherein generating the hash table data using the bootstrap comprises:
receiving a certificate;
validating the certificate; and
generating the hash table data only if the certificate is valid.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
at build time, automatically injecting a call to the bootstrap into the dynamically verifiable application executable.

### Claim 4 (depends on 2)

The method of claim 2, further comprising:
at activation time, calling by a developer of the dynamically verifiable application executable bootstrap at activation time.

### Claim 5 (depends on 1)

The method of claim 1, wherein generating the hash table data only if the certificate is valid comprises:
calling each checking function ƒc via the jump table to generate hash table data.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
at runtime:
verifying the protected binary of the application according to the hash table data.

### Claim 7

A method of generating a dynamically verifiable application executable having a plurality of functions, comprising:
at build time:
prepending a random prefix to at least a subset of the plurality of functions ƒ of a binary of the application;
generating a check function for each function of the at least a subset of the plurality of functions;
injecting each of the generated check functions into random locations in the binary of the application;
generating a jump table J, the jump table J having, for each function in the subset of the plurality of functions:
a mapping between the respective function and the generated check function;
wherein the mapping between the respective function and generated check function is associated with a identifier o and is randomly injected into the jump table J; and
injecting a call to the jump table having the identifier into a bootstrap of the binary of the application to generate a protected binary of the application,
wherein generating a check function for at least one function of the at least a subset of the plurality of functions comprises automatically generating a check function for each function of a selected group of the at least a subset of the plurality of functions, and wherein each of the check functions are randomly selected.

### Claim 8 (depends on 7)

The method of claim 7, wherein the selected group of the at least a subset of the plurality of functions is randomly selected.

### Claim 9 (depends on 8)

The method of claim 8, wherein the selected group of the at least a subset of the plurality of functions is randomly selected according to a percentage parameter.

### Claim 10

An apparatus for generating a dynamically verifiable application executable having a plurality of functions, comprising:
a processor;
a memory, communicatively coupled to the processor, the memory storing processor instructions including processor instructions for, at build time:
prepending a random prefix to at least a subset of the plurality of functions ƒ of a binary of the application;
generating a check function for at least one function of the at least a subset of the plurality of functions;
injecting each of the generated check functions into random locations in the binary of the application;
generating a jump table J, the jump table J having, for each function in the subset of the plurality of functions:
a mapping between the respective function and the generated check function;
wherein the mapping between the respective function and generated check function is associated with a random opaque identifier o and is randomly injected into the jump table J; and
injecting a call to the jump table having the identifier into a bootstrap of the binary of the application to generate a protected binary of the application,
wherein the application executable is activated by generating hash table data using the bootstrap.

### Claim 11 (depends on 10)

The apparatus of claim 10, further comprising:
a second processor;
a second memory, storing instructions including second processor instructions for: generating the hash table data using the bootstrap, comprising second processor instructions for:
receiving a certificate;
validating the certificate; and
generating the hash table data only if the certificate is valid.

### Claim 12 (depends on 11)

The apparatus of claim 11, wherein the second processor instructions for generating the hash table only if the certificate is valid comprises second processor instructions for calling each checking function ƒc via the jump table to generate hash table data.

### Claim 13 (depends on 11)

The apparatus of claim 11, further comprising:
a third processor;
a third memory, storing instructions including third processor instructions for:
verifying the protected binary of the application according to the hash table data.

### Claim 14 (depends on 10)

The apparatus of claim 10, wherein the instructions for generating a check function for at least one function of the at least a subset of the plurality of functions comprises instructions for:
automatically generating a check function for each function of a selected group of the at least a subset of the plurality of functions.

### Claim 15 (depends on 14)

The apparatus of claim 14, wherein the selected group of the at least a subset of the plurality of functions is randomly selected.

### Claim 16 (depends on 15)

The apparatus of claim 15, wherein the selected group of the at least a subset of the plurality of functions is randomly selected according to a percentage parameter.