Method and system for generating and auditing a signature for a computer

Abstract

A method and system for generating and auditing a signature for executable modules are provided. A signature is a means that uniquely identifies an authorized copy of the executable module. The signature of each authorized copy is encoded within the order of instructions of the executable module. Each executable module is made up of multiple blocks of instructions. To place a signature within the executable module, a group of blocks having a flow of execution is selected from the executable module. The group of blocks is then reordered to form a signature for the executable module. To ensure that the reordered group of blocks has the same flow of execution, the blocks within the reordered group of blocks are modified to maintain the flow of execution. The reordered group of modified blocks replaces the unmodified group of blocks within the authorized copy of the executable module. The modified copy of the executable module executes in a manner that is functionally equivalent to the unmodified executable module. However, the reordered blocks provide a signature that is unique to each authorized copy. By inspecting the order of the group of blocks in a copy of the executable module, the signature can be determined, and thus it can be determined from which authorized copy the executable module derives.