Method to Securely Validate Dynamic Libraries
Original Publication Date: 2004-Mar-15
Included in the Prior Art Database: 2004-Mar-15
In byte-compiled programming languages, the source code can be reverse engineered into machine instructions using disassemblers. In Python, such a disassembler is even shipped with the core library set. The problem is, how can the integrity of the source code be protected while maintaining the dynamic nature of the interpreted language. Such protection is necessary to preserve intellectual property and fulfill contractual obligations to ensure that reasonable efforts are made to secure the code from piracy. Current code hardening techniques which employ a randomizing time-based algorithm to prevent code inspection are difficult to implement, because they require many man months to develop per application. Other implementations that use gating functions, are easy to defeated by examining the assembly code and bypassing the gate with a jump. Our method is easier to implement and faster to load than the first method. Our method is more secure than the second method. The idea involves encrypting the byte-compiled libraries and signing them. The libraries are then validated and decrypted dynamically during the import process. The standard language import mechanism is modified to detect both standard and encrypted libraries and handle them appropriately.