Patents by Inventor Yuan Xiang Gu
Yuan Xiang Gu has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Patent number: 11675880Abstract: A method for securing a webpage or a webapp processed by a browser executing on a client system, the method comprising the browser executing an instance of white-box protected code, wherein execution of the instance of white-box protected code causes the client system to: generate a message comprising message data for use by a control system to perform one or more security tests, the control system communicably connected to the client system via a network; send the message to the control system to enable the control system to perform the one or more security tests using the message data; receive a response from the control system based, at least in part, on the message; and process the response.Type: GrantFiled: November 5, 2020Date of Patent: June 13, 2023Assignee: Irdeto B.V.Inventors: Benjamin Geoffrey Gidley, Catherine Chambers, Yaser Eftekhari Roozbehani, Yegui Cai, Yuan Xiang Gu
-
Patent number: 11354410Abstract: There is described a method of protecting an item of software so as to obfuscate a condition which causes a variation in control flow through a portion of the item of software dependent on whether the condition is satisfied, wherein satisfaction of the condition is based on evaluation of one or more condition variables. The method comprises: (i) modifying the item of software such that the control flow through said portion is not dependent on whether the condition is satisfied; and (ii) inserting a plurality of identity transformations into expressions in said portion of the modified item of software, wherein the identity transformations are defined and inserted such that, in the absence of tampering, they maintain the results of the expressions if the condition is satisfied and such that they alter the results of the expressions if the condition is not satisfied, wherein each identity transformation is directly or indirectly dependent on at least one of the one or more condition variables.Type: GrantFiled: March 30, 2015Date of Patent: June 7, 2022Assignee: IRDETO B.V.Inventors: Yuan Xiang Gu, Harold Johnson
-
Patent number: 11281769Abstract: A method comprising, during runtime of an item of software that comprises one or more portions of code and verification code: the verification code generating verification data using (a) runtime data generated by the one or more portions of code and (b) one or more predetermined parameters, the verification data representing an element of a predetermined first set of data elements; and providing the verification data to an integrity checker arranged to (i) identify that a modification relating to the verification code has not occurred if the verification data represents an element of a predetermined second set of data elements, wherein the second set is a subset of the first set, and (ii) identify that a modification relating to the verification code has occurred if the verification data does not represent an element of the second set; wherein it is computationally infeasible to determine an element of the second set without knowledge of the one or more predetermined parameters or data related to the one or mType: GrantFiled: December 15, 2016Date of Patent: March 22, 2022Assignee: IRDETO B.V.Inventors: Yuan Xiang Gu, Harold Johnson
-
Publication number: 20210049248Abstract: A method for securing a webpage or a webapp processed by a browser executing on a client system, the method comprising the browser executing an instance of white-box protected code, wherein execution of the instance of white-box protected code causes the client system to: generate a message comprising message data for use by a control system to perform one or more security tests, the control system communicably connected to the client system via a network; send the message to the control system to enable the control system to perform the one or more security tests using the message data; receive a response from the control system based, at least in part, on the message; and process the response.Type: ApplicationFiled: November 5, 2020Publication date: February 18, 2021Applicant: IRDETO B.V.Inventors: Benjamin Geoffrey GIDLEY, Catherine Chambers, Yaser EFTEKHARI ROOZBEHANI, Yegui CAI, Yuan Xiang GU
-
Patent number: 10867016Abstract: A method for securing a webpage or a webapp processed by a browser executing on a client system, the method comprising the browser executing an instance of white-box protected code, wherein execution of the instance of white-box protected code causes the client system to: generate a message comprising message data for use by a control system to perform one or more security tests, the control system communicably connected to the client system via a network; send the message to the control system to enable the control system to perform the one or more security tests using the message data; receive a response from the control system based, at least in part, on the message; and process the response.Type: GrantFiled: December 14, 2016Date of Patent: December 15, 2020Assignee: IRDETO B.V.Inventors: Benjamin Geoffrey Gidley, Catherine Chambers, Yaser Eftekhari Roozbehani, Yegui Cai, Yuan Xiang Gu
-
Publication number: 20200065480Abstract: A method comprising, during runtime of an item of software that comprises one or more portions of code and verification code: the verification code generating verification data using (a) runtime data generated by the one or more portions of code and (b) one or more predetermined parameters, the verification data representing an element of a predetermined first set of data elements; and providing the verification data to an integrity checker arranged to (i) identify that a modification relating to the verification code has not occurred if the verification data represents an element of a predetermined second set of data elements, wherein the second set is a subset of the first set, and (ii) identify that a modification relating to the verification code has occurred if the verification data does not represent an element of the second set; wherein it is computationally infeasible to determine an element of the second set without knowledge of the one or more predetermined parameters or data related to the one or mType: ApplicationFiled: December 15, 2016Publication date: February 27, 2020Inventors: Yuan Xiang Gu, Harold Johnson
-
Patent number: 10402547Abstract: A method for rendering a software program resistant to reverse engineering analysis. At least one first expression in a computational expression or statement of the software program is replaced with a second expression. The first expression being simpler than said second expression and the second expression being based on a value or variables found in said first expression. The second expression produces a value which preserves the value of said first expression. The conversion of the first expression is performed according to a mathematical identity of the form ?i=1k ai ei=E, where ai, are coefficients, ei, are bitwise expressions, whether simple or complex, and E is said first expression.Type: GrantFiled: April 8, 2015Date of Patent: September 3, 2019Assignee: IRDETO B.V.Inventors: Harold Joseph Johnson, Yuan Xiang Gu, Yongxin Zhou
-
Patent number: 10318271Abstract: A method and system for renewing software at the component-level is provided. A client program includes a base component for loading a software component into at least one loadable region of the program to update the program. Code in the software component is for writing state data associating the state of the update in storage, upon execution of the software component, and testing the state data to verify condition of the updated program and disallowing rollback and roll-forward attacks, the state data comprising hash chain values. The state data for verifying the correctness of the updated program is entangled with application data used for the program functionality. A server includes: an update pool having a plurality of software updates deployed in each client, and a policy control for monitoring and controlling at least one of: the length of time the client runs until the software update is invoked, a chain of the updates; and the granularity of the update.Type: GrantFiled: February 7, 2017Date of Patent: June 11, 2019Assignee: IRDETO CANADA CORPORATIONInventors: Clifford Liem, Hongrui Dong, Sam Martin, Yuan Xiang Gu, Michael Wiener
-
Publication number: 20180373849Abstract: A method for securing a webpage or a webapp processed by a browser executing on a client system, the method comprising the browser executing an instance of white-box protected code, wherein execution of the instance of white-box protected code causes the client system to: generate a message comprising message data for use by a control system to perform one or more security tests, the control system communicably connected to the client system via a network; send the message to the control system to enable the control system to perform the one or more security tests using the message data; receive a response from the control system based, at least in part, on the message; and process the response.Type: ApplicationFiled: December 14, 2016Publication date: December 27, 2018Applicant: IRDETO B.V.Inventors: Benjamin Geoffrey GIDLEY, Catherine Chambers, Yaser EFTEKHARI ROOZBEHANI, Yegui CAI, Yuan Xiang GU
-
Patent number: 9965623Abstract: Systems and techniques for securing accessible computer-executable program code and systems are provided. One or more base functions may be generated and blended with existing program code, such that it may be difficult or impossible for a potential attacker to distinguish the base functions from the existing code. The systems and code also may be protected using a variety of other blending and protection techniques, such as fractures, variable dependent coding, dynamic data mangling, and cross-linking, which may be used individually or in combination, and/or may be blended with the base functions.Type: GrantFiled: March 28, 2013Date of Patent: May 8, 2018Assignee: IRDETO B.V.Inventors: Harold Johnson, Yuan Xiang Gu, Michael Wiener, Yongxin Zhou
-
Patent number: 9934375Abstract: Methods and nodes for securing execution of a web application by determining that a call dependency from a first to a second function needs to be protected, adding a Partial Execution Stub (PES) function comprising code to establish a communication connection with a trusted module. Methods and nodes for secured execution of a web application by invoking a function of the web application, invoking a Partial Execution Stub (PES) function during execution of the function of the web application, sending, from the PES function, a message call with current execution information to a trusted module and receiving, a verification result from the trusted module.Type: GrantFiled: September 20, 2016Date of Patent: April 3, 2018Assignee: IRDETO B.V.Inventors: Yuan Xiang Gu, Garney David Adams
-
Patent number: 9910971Abstract: Methods and devices for thwarting code and control flow based attacks on software. The source code of a subject piece of software is automatically divided into basic blocks of logic. Selected basic blocks are amended so that their outputs are extended. Similarly, other basic blocks are amended such that their inputs are correspondingly extended. The amendments increase or create dependencies between basic blocks such that tampering with one basic block's code causes other basic blocks to malfunction when executed.Type: GrantFiled: January 12, 2016Date of Patent: March 6, 2018Assignee: IRDETO B.V.Inventors: Harold Joseph Johnson, Yuan Xiang Gu, Yongxin Zhou
-
Patent number: 9906360Abstract: Systems and techniques for securing accessible computer-executable program code and systems are provided. One or more base functions may be generated and blended with existing program code, such that it may be difficult or impossible for a potential attacker to distinguish the base functions from the existing code. The systems and code also may be protected using a variety of other blending and protection techniques, such as fractures, variable dependent coding, dynamic data mangling, and cross-linking, which may be used individually or in combination, and/or may be blended with the base functions.Type: GrantFiled: March 28, 2013Date of Patent: February 27, 2018Assignee: IRDETO B.V.Inventors: Harold Johnson, Yuan Xiang Gu, Michael Wiener, Yongxin Zhou
-
Patent number: 9811666Abstract: A method and system is provided to automatically propagate dependencies from one part of a software application to another previously unrelated part. Propagation of essential code functionality and data to other parts of the program serves to augment common arithmetic functions with Mixed Boolean Arithmetic (MBA) formulae that are bound to pre-existing parts of the program. A software application is first analyzed on a compiler level to determine the program properties which hold in the program. Thereafter, conditions are constructed based on these properties and encoded in formulae that encode the condition in data and operations. Real dependencies throughout the application are therefore created such that if a dependency is broken the program will no longer function correctly.Type: GrantFiled: March 24, 2011Date of Patent: November 7, 2017Assignee: IRDETO B.V.Inventors: Clifford Liem, Yongxin Zhou, Yuan Xiang Gu
-
Publication number: 20170213027Abstract: There is described a method of protecting an item of software so as to obfuscate a condition which causes a variation in control flow through a portion of the item of software dependent on whether the condition is satisfied, wherein satisfaction of the condition is based on evaluation of one or more condition variables. The method comprises: (i) modifying the item of software such that the control flow through said portion is not dependent on whether the condition is satisfied; and (ii) inserting a plurality of identity transformations into expressions in said portion of the modified item of software, wherein the identity transformations are defined and inserted such that, in the absence of tampering, they maintain the results of the expressions if the condition is satisfied and such that they alter the results of the expressions if the condition is not satisfied, wherein each identity transformation is directly or indirectly dependent on at least one of the one or more condition variables.Type: ApplicationFiled: March 30, 2015Publication date: July 27, 2017Inventors: Yuan Xiang Gu, Harold Johnson
-
Patent number: 9698973Abstract: Systems and techniques for securing accessible computer-executable program code and systems are provided. One or more base functions may be generated and blended with existing program code, such that it may be difficult or impossible for a potential attacker to distinguish the base functions from the existing code. The systems and code also may be protected using a variety of other blending and protection techniques, such as fractures, variable dependent coding, dynamic data mangling, and cross-linking, which may be used individually or in combination, and/or may be blended with the base functions.Type: GrantFiled: March 28, 2013Date of Patent: July 4, 2017Assignee: IRDETO B.V.Inventors: Harold Johnson, Yuan Xiang Gu, Michael Wiener
-
Publication number: 20170147331Abstract: A method and system for renewing software at the component-level is provided. A client program includes a base component for loading a software component into at least one loadable region of the program to update the program. Code in the software component is for writing state data associating the state of the update in storage, upon execution of the software component, and testing the state data to verify condition of the updated program and disallowing rollback and roll-forward attacks, the state data comprising hash chain values. The state data for verifying the correctness of the updated program is entangled with application data used for the program functionality. A server includes: an update pool having a plurality of software updates deployed in each client, and a policy control for monitoring and controlling at least one of: the length of time the client runs until the software update is invoked, a chain of the updates; and the granularity of the update.Type: ApplicationFiled: February 7, 2017Publication date: May 25, 2017Applicant: IRDETO B.V.Inventors: Clifford LIEM, Hongrui DONG, Sam MARTIN, Yuan Xiang GU, Michael WIENER
-
Patent number: 9588756Abstract: A method and system for renewing software at the component-level is provided. A client program includes a base component for loading a software component into at least one loadable region of the program to update the program. Code in the software component is for writing state data associating the state of the update in storage, upon execution of the software component, and testing the state data to verify condition of the updated program and disallowing rollback and roll-forward attacks, the state data comprising hash chain values. The state data for verifying the correctness of the updated program is entangled with application data used for the program functionality. A server includes: an update pool having a plurality of software updates deployed in each client, and a policy control for monitoring and controlling at least one of: the length of time the client runs until the software update is invoked, a chain of the updates; and the granularity of the update.Type: GrantFiled: March 22, 2012Date of Patent: March 7, 2017Assignee: Irdeto B.V.Inventors: Clifford Liem, Hongrui Dong, Sam Martin, Yuan Xiang Gu, Michael Weiner
-
Publication number: 20170011216Abstract: Methods and nodes for securing execution of a web application by determining that a call dependency from a first to a second function needs to be protected, adding a Partial Execution Stub (PES) function comprising code to establish a communication connection with a trusted module. Methods and nodes for secured execution of a web application by invoking a function of the web application, invoking a Partial Execution Stub (PES) function during execution of the function of the web application, sending, from the PES function, a message call with current execution information to a trusted module and receiving, a verification result from the trusted module.Type: ApplicationFiled: September 20, 2016Publication date: January 12, 2017Inventors: Yuan Xiang Gu, Garney David Adams
-
Publication number: 20160335431Abstract: A method to secure a non-native application. The non-native application is processed to obtain an application stub to be triggered within a virtual machine. The processing of the non-native application also provide a native code function upon which the application stub depends. The non-native function is part of a trusted module that extends application security services from the trusted module to the virtual machine. The trusted module is a native code application that creates a trusted zone as a root of trustiness extending to the virtual machine by an execution-enabling mechanism between the application tab and the non-native function.Type: ApplicationFiled: July 28, 2016Publication date: November 17, 2016Inventors: Garney David Adams, Yuan Xiang Gu, Jack Jiequn Rong