Digital Immunity LLC

Other

Stegosystems, Inc.

Probert, Thomas H.

Syniad, LLC

Thomas H. Probert

Thomas H Probert

Henry R Tumblin

A method for digital immunity includes identifying a call graph of an executable entity, and mapping nodes of the call graph to a cipher table of obscured information, such that each node based on invariants in the executable entity. A cipher table maintains associations between the invariants and the obscured information. Construction of an obscured information item, such as a executable set of instructions or a program, involves extracting, from the cipher table, ordered portions of the obscured information, in which the ordered portions have a sequence based on the ordering of the invariants, and ensuring that the obscured information matches a predetermined ordering corresponding to acceptable operation, such as by execution of the instructions represented by the obscured information, or steganographic target program (to distinguish from the executable entity being evaluated). The unmodified nature of the executable entity is assured by successful execution of the steganographic target program.

Steganographic embedding of hidden payload

Steganographic embedding of executable code

A steganographic method to prevent the execution of malicious code and mitigate software piracy. The method uses invariant portions of machine instructions to create an executable watermark within unmodified code. This watermark can be verified at any stage of the software lifecycle, including dynamically and continuously during execution, to detect foreign code by verifying the integrity of the watermark prior to execution. In addition, the watermark may serve as a steganographic covert channel concealing additional information. Code invariants are not altered by binding operations such as loading and linking on different machines, and thus may be employed to consistently and repeatedly identify an unmodified instantiation of a particular program. The use of opcodes and register references as invariants avoids trivial register substitution as a means of program differentiation that eludes detection. The split key structure of the resulting cipher implies that knowledge of only the code (first key) or the cipher table (second key) alone is insufficient to derive the message.

Steganographic messaging system using code invariants

Techniques used in coding software are described. An encoder encodes a machine executable program or portions of a machine executable program. The encoding process uses a cipher table, a unique key for encoding, and an agreement between the encoder and decoder as to what portions of a machine executable will be encoded. By using the decoder on a computer system which may execute the encoded machine executable, the decoder may serve as a recognizer to only execute those machine executable programs which have been encoded and are recognized by the recognizer. If a machine executable is not recognized or rejected, appropriate actions may be taken other than the machine executable.

Techniques for encoding information in computer code

Growing community of inventors

Holden, MA, United States of America

Thomas H Probert