DE102018005102A1 - Adaptive security updates for applications - Google Patents

Abstract

The present invention is directed to a method for iterative and attack-specific concealment of control commands, which enables control commands to be protected against security-critical accesses as soon as they are executed. The method is carried out continuously in such a way that new attacks can always be reacted to and the control commands can be iteratively secured. The present invention is also directed to a correspondingly configured computer arrangement and to a computer program product with control commands which execute the method or operate the computer arrangement.

Description

The present invention is directed to a method for iterative and attack-specific concealment of control commands, which enables control commands to be protected against security-critical accesses as soon as they are executed. The method is carried out continuously in such a way that new attacks can always be reacted to and the control commands can be iteratively secured. The present invention is also directed to a correspondingly configured computer arrangement and to a computer program product with control commands which execute the method or operate the computer arrangement.

US 2012 0284791 A1 shows a method for prioritizing anomalies in data and an automatic execution of the method on a computer system. Here tests are carried out iteratively.

US 2005 0004863 A1 shows a method for assessing and managing security risks in a computer system and averting the risks accordingly.

US 2006 0031686 A1 shows a method for securing application code, whereby obfuscation of a source code is used. In general, obscuring source code is known as obfuscating.

According to known application scenarios of the present invention, applications, so-called “apps”, are developed for mobile devices and then made available on a central server, also called “app store”. It is possible that the applications or apps have security-critical features, such as. B. a cryptographic key that is used to authenticate the app to a server. For example, the application can be a banking app in which security-critical data is exchanged with a central server via a network interface. Different biometric data and passwords can also be stored on a mobile device.

Applications are in their original condition, i.e. H. as source code, very easy to attack, and it is possible, for example, to create the Java source code from an .apk, ie an application file, from the existing Java byte code. Method and variable names are then generic, but algorithms and data used can be viewed again. Such an approach is generally referred to as decompiling. Here, a compiled machine-readable file is restored to its original state, and the corresponding control commands become human-readable. As a result, attackers can read security-critical information from these control commands.

To secure control commands, it is known to protect security-critical components of the control commands or a selection of the control commands by suitable measures, such as the use of cryptographic keys or the so-called code obfuscation, whereby different techniques can be used. Other digital content, such as images or texts, can be encrypted by a certain coding or can also be cryptographically encrypted.

In general, the prior art has the disadvantage that applications are created once by a developer and can then be made available for download in encrypted or secured form in a so-called AppStore. As a result, it is missed to react to security-critical accesses that occur, for example, during the runtime of the corresponding application. There are often security gaps here, since the compiled source code is called up from a server and then executed in exactly this form by the end customer. After installation of the compiled control commands, unauthorized accesses or attacks can take place, which must first be recognized manually, and then the developer is manually commissioned to provide a new version of the control commands, which is appropriately protected.

In particular, it is particularly disadvantageous that, in accordance with conventional methods, security updates often take a very long time and that further unauthorized access can take place in the time from the detection of an attack to the rectification of the security gap. In addition, such a procedure weakens user acceptance, since security gaps often become public and users are therefore unwilling to deploy and use appropriate security-critical applications.

It is therefore an object of the present invention to provide a method which enables control commands to be protected as well as possible and no unauthorized access to them can be granted. In particular, the proposed method should be executable with little technical effort and close security gaps as soon as possible. Furthermore, it is an object of the present invention to provide a corresponding computer arrangement and a computer program product with control commands, which the implement the proposed method or operate the computer arrangement.

The object is achieved with the features of the independent claims. Further advantageous configurations are specified in the dependent claims.

Accordingly, a method for iterative and attack-specific concealment of control commands is proposed, comprising transmitting control commands to a security unit, which changes the control commands depending on a security configuration in such a way that unauthorized access to the control commands is made difficult, automatic detection of unauthorized access to the control commands Control commands together with the creation of an attack documentation, with the security configuration being adapted as a function of the attack documentation and the control commands being changed again.

The person skilled in the art recognizes here that individual method steps can be carried out iteratively and in particular can have substeps. The transmission of control commands can thus be carried out several times, and the automatic detection of the unauthorized access takes place in such a way that the control commands can be continuously monitored. The present method can be carried out iteratively in such a way that after the control commands are changed again, they are checked again and the unauthorized access is thus automatically recognized.

The present method is attack-specific since, depending on the detected attacks, there is a reaction which is based on the individual attacks and then implements suitable protective measures. Concealing control commands is a way of protecting control commands against unauthorized access. This can be done in such a way that a cryptographic function is used or so-called code obfuscation. Due to the obfuscation it is no longer possible for an attacker to read out or change the control commands. The control commands are still available, but they are expanded with security mechanisms or adapted themselves. For example, the control commands can be changed by adding a further signature or by encrypting the control commands. In the present method, it is also possible to combine different safeguards and thus to disguise or safeguard the control commands.

The control commands are transmitted from a developer or his computer system to a security unit, which can be present, for example, as a server. This corresponds to a common scenario in which the developer creates an application and transmits it to a central instance for protection. For this purpose, the developer provides a protection configuration that specifies how the control commands are to be protected exactly. This can be done in such a way that a so-called seed is provided, which is the starting point for a cryptographic method. It is also possible for the developer to identify control commands that are particularly critical to safety and to indicate them to the security unit by means of the security configuration. It is thus possible for less safety-critical control commands to be safeguarded more efficiently and for safety-critical control commands to be safeguarded with complex arithmetic operations. The developer can also be offered a choice of protection options. He can choose cryptographic methods or choose code obfuscation. As already mentioned, it is possible to combine several security mechanisms.

In general, it is advantageous that, according to the present invention, unauthorized access to the control commands is made more difficult, which is particularly based on the fact that unauthorized access is avoided. However, since this is typically not possible in practice, it is assumed that the control commands are at least safeguarded in such a way that their access to an unauthorized third party is restricted compared to unchanged control commands. This means that unauthorized access is made more difficult, since it is typically not possible to prevent unauthorized access.

An unauthorized access can be an access by an unauthorized third party who tries to read security-critical information from the control commands or even manipulate the control commands. Thus there are techniques which make it possible to identify whether a control command or a plurality of control commands has been changed. If, for example, an unauthorized third party tries to change the control commands in such a way that data can be written without authorization, this is recognized and a reaction is given to this attack being documented and a corresponding security configuration being modified. The control command or the relevant control commands can then be adapted in such a way that such writing is no longer possible.

Automatic detection of the unauthorized access to the control commands can take place in such a way that it is specified in advance which operations on the control commands are possible. So can Permissions are set that make it possible to execute or overwrite the control commands.

If an unauthorized third party does not have such access rights, it is assumed that an attack has occurred. This can then be prevented since the control commands are adjusted again. If an unauthorized access is recognized, an error routine can be started and access can be denied. However, this could also be noticed by an attacker, and it is therefore also possible to output falsified data, thereby ensuring that the attacker suspects that the control commands have been executed correctly.

In general, it is possible to identify unauthorized access by setting up a corresponding monitor function, which, for example, calculates checksums via the control commands, or compares the control commands with reference control commands. This makes it possible to upload the control commands to a mobile device and occasionally compare them with expected, valid control commands. Test routines can also be started which transfer parameters to the control commands and then check whether the returned calculated value corresponds to an expected value.

If an attack is detected, an attack documentation is created which provides information about which operations were carried out and in particular which control commands were manipulated. So-called logging can generally be carried out, which logs documentation of the execution and modification of control commands and then, in the event of an attack, determines which operations are to be assigned to the attack.

Consequently, it is also possible to recognize certain attack patterns and then react in such a way that an error handling routine is started which changes the control commands again in such a way that they are protected against such an attack. A simple error handling is that the documented attack is simply reversed. Additively, it is advantageous to add a changed signature to the majority of the control commands or to secure the control commands again cryptographically. It is advantageous to use a new seed value, also called a seed. As a result, it can be recognized that an attacker has decrypted the control commands, and then a different encryption is carried out using a different start value or a different encryption technique, and the changed control commands are then loaded onto the mobile terminal in the now secure version. Thus, the attacker only cracked an old version of the control commands and has no access to the new version of the control commands. As a result, the old version of the control commands can be deactivated so that no more damage can be done.

According to one aspect of the present invention, the protection configuration has a starting value, a limitation of the control commands to be protected, a type of protection, one or more protection levels and / or a protection instruction. This has the advantage that the user or the developer can influence the change in the control commands, so that particularly security-critical control commands can be encrypted differently than non-critical control commands. In this way, the duration of the change or concealment can be influenced, and in particular control commands can be selected which are concealed with a particularly high security level. It is also possible for the developer to indicate which method of obfuscation, e.g. B. a cryptographic function is used. Corresponding start values can also be initialized and thus, for example, a random generator can always be executed with a different seed.

According to a further aspect of the present invention, the change comprises encryption, a renaming of names of the control commands and / or parameters, a changing of an order of control commands, an addition of control commands and / or a concealment of control commands. This has the advantage that the change can be carried out in a variety of ways, and in particular techniques can be combined here. For example, designations can be renamed as part of the so-called code obfuscation. These can be method names or parameter names. So-called descriptive names are typically used during programming, so that the semantics of a method can be derived from its method designation. This can be prevented in the present case, and thus the control commands are obscured. The control commands are often logically grouped or implemented in a logical order. This can also be changed by means of the so-called code obfuscation and the order of the control commands is chosen arbitrarily, whereby it is only ensured that the corresponding correct methods are always called. At which point the control commands are encoded within the source code is typically irrelevant. In addition, it is possible to add control commands and thus add them that have no function. This is only for confusion and thus obfuscation, which makes it difficult for a human user to Understand control commands and thus start unauthorized access.

According to a further aspect of the present invention, the automatic detection of the unauthorized access comprises calculating at least one checksum, an access check on the control commands, a detection of decompiling the control commands, a detection of an access of a predetermined entity, a detection of an access of a debugger Analyze an entity that executes the control commands and / or detect an unexpected output value. This has the advantage that automatic detection can be carried out using one or more methods and, for example, an automated calculation can be made as to whether the actual checksum of control commands corresponds to the expected checksum. Consequently, a memory can be read out and addresses can also be evaluated and it can then be determined whether the correct control commands or parameters are actually stored in the memory. Changes can occur here if the control commands or the parameters are falsified. The automatic detection of unauthorized access can also take place by starting a test routine and returning the control commands for test results, which are compared with the expected results. Entities can also be evaluated and it can be determined whether they can get access to the control commands. This can be done in such a way that the IP addresses of the computing units are checked for their authorization. It is also possible to determine how often an entity accesses a control command, which can be called a brute force attack if it is accessed too frequently. Control commands are often requested very often in order to provoke server utilization and trigger a so-called denial of service error. In addition, it is possible to recognize a decryption of the compiled control commands or an access by a debugger. In addition, entities can generally be blocked and a so-called blacklist can be introduced, which excludes entities from accessing the control commands.

According to a further aspect of the present invention, before the automatic detection, the changed control commands are stored on a mobile terminal. This has the advantage that errors can already be dealt with by the end customer during operation, and errors can be remedied from the end customer's so-called deployment. It does not matter whether the control commands are actually executed or whether they are just installed. This means that control commands can also be manipulated if they are only installed without having already been executed.

According to a further aspect of the present invention, unauthorized access is monitored regardless of whether it is read and / or write. This has the advantage that both reading and writing operations can be recognized, and thus access to safety-critical information can be prevented, as well as overwriting of safety-critical information. In the case of unauthorized access, it is not absolutely necessary to differentiate between whether static information is being accessed or whether it is actually a control command. For example, a parameter assignment can also be treated as a control command.

According to a further aspect of the present invention, the attack documentation describes which parts of the control commands are accessed without authorization. This has the advantage that continuous documentation can be created, which means that precisely the control commands that were accessed without authorization can be disguised. This has the technical effect that not all control commands have to be disguised, but only that part of the control commands that has been requested without authorization has to be disguised.

According to a further aspect of the present invention, the security configuration is adapted on the basis of stored rules which make predetermined attacks more difficult. This has the advantage that a so-called library can be created that specifies which attacks are treated and how. In this way, the concealment or modification of the control commands can always be carried out as a function of an actually occurring attack.

According to a further aspect of the present invention, the security configuration is adjusted on the basis of empirically communicated bypasses of attacks. This has the advantage that attacks can be simulated, and it can be determined here how such an attack can be prevented or avoided. In particular, these attacks have already been recognized, and it can thus be stored in the security configuration how exactly the control commands are to be changed or expanded so that such attacks are warded off. Such a database of bypasses can be stored and the control commands can always be obscured using new bypasses.

According to a further aspect of the present invention, the renewed change already takes place during the unauthorized access. This has the Advantage that the control commands can be deactivated and either remain unchanged or else return randomized values to the attacker so that he does not notice that the attack process has been recognized. Furthermore, it is possible to continue executing a part of the control commands that is not critical and to deactivate safety-critical control commands or to abort their execution and then to have them changed in such a way that a further attack is no longer possible. This has the advantage that an attack can be reacted to automatically at runtime.

According to a further aspect of the present invention, the changed control commands are made available to a plurality of mobile terminals. This has the advantage that the newly adapted control commands can be stored on a central server, for example an AppStore, and then the control commands which have already been veiled can in turn be made available for download to further terminal devices. Thus, an attack that was already past has been ruled out for the future in such a way that the new control commands are already secured with regard to this attack.

According to a further aspect of the present invention, the protection unit persistently stores the protection configuration. This has the advantage that the protection unit can fall back on the original protection configuration at any time and can therefore appropriately disguise the control commands. Using this security configuration, it is possible, for example, to decrypt the control commands and then to encrypt them again in a changed manner.

According to a further aspect of the present invention, the protection unit carries out version management of the protection configuration. This has the advantage that it is always clear during several iterations of the proposed method when which version of control commands was present and how this was then adapted. This means that an attack can always be responded to and the control commands can be disguised depending on their current version.

The object is also achieved by a computer arrangement for iterative and attack-specific concealment of control commands, comprising an interface unit set up for transmitting control commands to a security unit, which is set up to change the control commands depending on a security configuration in such a way that unauthorized access to the control commands is made more difficult a monitor unit is set up for automatic detection of the unauthorized access to the control commands together with the creation of an attack documentation, the security unit being set up to adapt the security configuration depending on the attack documentation and a renewed change of the control commands.

The security unit can then be present, for example, as a central server and the monitor unit can be located both on the mobile terminal and on a remote server.

The object is also achieved by a computer program with control commands which execute the method or operate the proposed computer arrangement.

According to the invention, it is particularly advantageous that the proposed method has method steps which can also be structurally simulated within the framework of the computer arrangement. The computer arrangement is also suitable for carrying out the method. Process steps can thus be structurally simulated with regard to their function, and structural features of the computer arrangement can be designed as process steps with the same functionality.

• 1: eine Rechneranordnung gemäß einem bekannten Verfahren als Ausgangspunkt für die vorliegende Erfindung;
• 2: die erfindungsgemäße Rechneranordnung, wobei weitere Server vorgesehen sind;
• 3: ein schematisches Diagramm der Rechneranordnung mitsamt der erfindungsgemäßen Datenkommunikation; und
• 4: ein schematisches Ablaufdiagramm des vorgeschlagenen Verfahrens zum iterativen und angriffsspezifischen Verschleiern von Steuerbefehlen.

Further advantageous configurations are explained in more detail with reference to the attached figures. Show it:

• 1 a computer arrangement according to a known method as a starting point for the present invention;
• 2 : the computer arrangement according to the invention, further servers being provided;
• 3 : a schematic diagram of the computer arrangement together with the data communication according to the invention; and
• 4 : A schematic flow diagram of the proposed method for iterative and attack-specific concealment of control commands.

1 shows a known method and a known arrangement, wherein web-based tools for concealing control commands are provided.

The tools / tools used to secure apps can be classified into two categories depending on the type of use:

1. Stand-alone tools (also: local tools)

• - Vorteil: Keine kritischen Daten verlassen den gesicherten Zuständigkeitsbereich.
• - Vorteil: Das erreichte Sicherheitsniveau ist höher, da sich das Werkzeug direkt in den Compiler der Entwicklungsumgebung einklinken kann.
• - Nachteil: Derartige Werkzeuge sind häufig sehr teuer und lohnen sich nur für größere Unternehmen.

The developer or the developing company installs these within their own Area of responsibility, for example in the company network or on the PC of the developer.

• - Advantage: No critical data leave the secured area of responsibility.
• - Advantage: The level of security achieved is higher because the tool can latch directly into the compiler of the development environment.
• - Disadvantage: Such tools are often very expensive and only worthwhile for larger companies.

2. Online tools (also: web-based tools) - see 1 Here the developer uploads the unsecured .apk file to a server over a network. This server disassembles the .apk file, backs it up and makes the new, secured .apk file available for download. This can in turn be uploaded by the developer to an app store (e.g. Google Play Store, Apple App Store, Amazon App Store) and thus made available to the public. Here, too, the developer can usually influence the secured code and data areas and adjust the desired level of security.

• - Vorteil: Sehr einfache Verfügbarkeit und Nutzbarkeit, dadurch von praktisch allen App-Entwicklern nutzbar - sehr hohe Reichweite im Markt.
• - Vorteil: Das Werkzeug kann nicht vom Entwickler/ entwickelnden Unternehmen analysiert werden, d.h. das Know-How, das im Werkzeug steckt, wird sehr gut geschützt.
• - Nachteil: Unter Umständen kritische Daten verlassen den gesicherten Zuständigkeitsbereich des Entwicklers/ entwickelnden Unternehmens.

The server is usually located on the Internet (web-based tool). However, installations within the secure network of the developing company or even on the PC of the developer are also conceivable - these are, however, rather unusual variants, since in these cases stand-alone installations are used that achieve a higher level of security.

• - Advantage: Very easy availability and usability, so it can be used by practically all app developers - very high reach in the market.
• - Advantage: The tool cannot be analyzed by the developer / developing company, ie the know-how that is in the tool is very well protected.
• - Disadvantage: Critical data may leave the secured area of responsibility of the developer / developing company.

In 1 , Step 1 the app to be backed up is manually uploaded to the Safeguard server.

• - welche Teile der App
• - ggf. mit welchen Methoden
• - wie stark geschützt werden sollen.

Also in step 1 the so-called Safeguard Preferences (security settings) are transferred to the Safeguard server. These indicate

• - what parts of the app
• - if necessary, with which methods
• - how much protection should be provided.

It is necessary to sweep these settings down, since hiding code has so far always been associated with a slower execution speed of the corresponding app components. Good coordination is therefore necessary, especially for time-critical parts of the app, which is usually done manually, for example by the developer himself.

step 1 reproduces this manual tuning only in a very simplified way: in practice, an app is repeatedly uploaded to the online tool and secured with changed Safeguard preferences, after which the developer tests whether the runtime behavior of the app is still within the permissible range (response behavior on User input, adherence to time-outs, etc.).

step 1 only shows the transfer of the "final" Safeguard preferences that are applied to the later version of the app.

In step 2 of 1 the Safeguard server secures the uploaded app as specified in the Safeguard Preferences.

It should be noted here that one or more so-called “seeds” (initial values) are used when disguising an app in order to determine the exact form of the disguise. This is absolutely necessary; otherwise the same app would always be obfuscated in exactly the same way and the same result app would always be created.

The seeds used can be set manually, by a random number, as a consecutive number or similar, in order to guarantee that the app is disguised differently. The seeds can therefore be part of the Safeguard preferences as well as generated and managed internally in the Safeguard server.

In step 3 of 1 the saved app is downloaded back to the developer PC.

The steps 4 and 5 correspond to the standard procedure for the provision of apps. The developer uploads them to the App Store, from where they are either downloaded for the first time by users or distributed as an update to the user devices (smartphones, etc.).

It is well known that all obfuscation measures to protect data and software against third party access only offer protection for a limited time. An attacker who invests enough time and effort will sooner or later be able to remove any obfuscation.

It is therefore advantageous to renew an app that contains veiled components from time to time, ie to veil it again with changed parameters. This is then set as a new version in the App Store, which then - mostly automatically - distributes it to the users. Depending on the desired level of security, this can range from weekly (very secure) to monthly (relatively secure) to yearly (rather uncertain).

Up to now, the re-creation and upload has been done manually and therefore causes unnecessary, repetitive effort.

As mentioned before, it depends on the amount of time and the efforts of the attacker how quickly a veiled app - or at least the parts that the attacker is targeting - is hacked. The previously mentioned time intervals between re-obfuscation of the app are therefore only rough guidelines, which may also differ significantly in both directions.

If - for whatever reason - there is a very great interest in an attack, intervals of one week may be too short, conversely, a monthly renewal may also be superfluous if there is no interest in an attack.

So far, the app has been obfuscated and made available “by feel”. Although it is known (manually) to check hacker forums on the Internet to determine whether an app has been hacked, this creates long-term effort and does not provide a reliable statement.

2 now shows an adapted computer arrangement, as proposed according to the invention. For the method according to the invention, it is advantageous for the Safeguard server to save both the originally uploaded, unsafe app and the associated Safeguard preferences and (if not part of the Safeguard Preferences anyway) the seeds (start values) of the specific form of the obfuscation, in order to be able to access it later without the developer or the developing company having to do anything.

As in the present 2 It can be seen that a so-called attack analysis server is arranged on the right-hand side as well as an application server. This computing arrangement is operated by means of data communication, as exemplified in 3 is shown.

The start of the sequence according to the invention is in 3 , Step 1 shown. The veiled app is already installed on the end device of the user (user device) and is being executed.

• - Prüfsummen über Codebereiche, die immer wieder nachgerechnet werden,
• - die Kontrolle, ob ein Debugger auf die Applikation zugreift oder
• - die Prüfung, ob die App auf einem gerooteten Gerät ausgeführt wird.

The app is equipped with various security measures to detect tampering. These include, for example

• - checksums over code areas, which are recalculated again and again,
• - Check whether a debugger is accessing the application or
• - Checking whether the app is running on a rooted device.

An app usually ends when it detects any of the above. In the method according to the invention, however, the app remains silent, i.e. no signal is given from which an attacker could conclude that the attack was noticed. The app “remembers” the attack at a suitable point.

• - Bei einer YouTube-App (sofern diese im Sinne dieser Erfindungsmeldung schützenswert wäre) wäre der Applikationsserver der Server, der die angezeigten Videos bereitstellt.
• - Bei einer Banking-App ist der Applikationsserver der Server, über den das Online-Banking abgewickelt wird.

As in 3 , Step 2 displayed, the recorded data of possible attacks on the app are forwarded to an application server. An application server is a server with which an app must logically communicate in order to function properly:

• - In the case of a YouTube app (insofar as this would be worth protecting in the sense of this invention notification), the application server would be the server that provides the displayed videos.
• - In the case of a banking app, the application server is the server through which online banking is carried out.

It is advantageous that the data of possible attacks is passed on to an application server. It is easy for an attacker to change the network access of an app in such a way that only very specific network addresses can be reached and / or all network accesses are logged. Therefore, contacting a specially configured "alarm server" by the app for an attacker would be virtually identical to a message from the app on the screen: "Attempted attack".

The transmission of the attack data also happens as inconspicuously as possible. The amount of data transmitted in the event of an attack moves in the statistical noise of the user data usually transmitted, so that usually only a few bytes of additional data volume are available. The data are also transferred within normal requests and no additional requests are made to the application server.

In 3 , Step 3 , the application server transmits the received attack data to the Attack Analysis Server after it has been filtered out of the user data stream. The attacker of the app cannot understand this transmission, so it does not represent a loss of security.

In step 4 the attack analysis server collects the incoming attack data for the app. It is clear that there is not an attack with every incorrect checksum, so an analysis over a certain period of time - usually hours or days - is necessary.

If the attack analysis server comes to the conclusion that there is an attack, it sends it, as in step 5 shown, a corresponding message to the Safeguard server. If available, this message contains information on which specific part of the app the attack relates to. This gives the Safeguard server the opportunity to set priorities when the app is disguised again.

In 3 , Step 6 the Safeguard server creates a newly disguised version of the app. It is clear that a different “seed” is used for this than for all other previous versions of the app. The Safeguard server accordingly keeps a record of the seeds already used.

In step 7 the Safeguard server places the newly disguised app in the app store so that it becomes available to the public.

This will start the app store in step 8th to distribute the newly veiled app as an update, and all new users can download the latest version.

4 shows a schematic flow diagram of a method for iterative and attack-specific concealment of control commands according to an aspect of the present invention, comprising a transmission 100 of control commands to a protection unit, which changes the control commands as a function of a protection configuration 101 automatic detection that an unauthorized access to the control commands is made difficult 102 unauthorized access to the control commands including creation 103 an attack documentation, whereby an adjustment 104 the security configuration depending on the attack documentation and a new change 101 of the control commands are carried out.

• - Erneute Verschleierung der App bereits bei laufenden Angriffen, dadurch Erhöhung der Sicherheit der App,
• - falls keine Angriffe vorliegen, werden keine unnötigen neu verschleierten Versionen der App erzeugt, was vor allem Übertragungsvolumen zum Endkunden (User Devices) hin einspart.
• - Das manuelle Erneuern der App nach einem grob geschätzten Zeitraum entfällt.

The solution eliminates the disadvantages mentioned at the beginning:

• - re-obfuscation of the app already during attacks, thereby increasing the security of the app
• - If there are no attacks, no unnecessarily newly veiled versions of the app are generated, which in particular saves transmission volume to the end customer (user devices).
• - There is no need to manually renew the app after a roughly estimated period of time.

• - sowohl die Sicherheit der gerade angegriffenen App gezielt zu verbessern (welche Teile werden wie stark gesichert) und
• - die allgemeine Weiterentwicklung der Sicherheit von Apps zu fördern.

In addition, information is collected on how attacks on apps work and which parts of the app are attacked first. These are in turn used to

• - Improve both the security of the app under attack (which parts are secured and how strongly) and
• - to promote the general further development of the security of apps.

QUOTES INCLUDE IN THE DESCRIPTION

This list of documents listed by the applicant has been generated automatically and is only included for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• US 20120284791 A1 [0002]
• US 20050004863 A1 [0003]
• US 20060031686 A1 [0004]

Claims (15)

Method for iterative and attack-specific concealment of control commands, comprising: - transmitting (100) control commands to a security unit which changes (101) the control commands depending on a security configuration in such a way that unauthorized access to the control commands is made more difficult; - Automatic detection (102) of the unauthorized access to the control commands together with the creation (103) of an attack documentation, characterized in that - an adaptation (104) of the security configuration depending on the attack documentation; and - the control commands are changed again (101). Procedure according to Claim 1 , characterized in that the protection configuration has a starting value, a limitation of the control commands to be protected, a type of protection, a protection level and / or a protection instruction. Procedure according to Claim 1 or 2 , characterized in that the modification (101) comprises encryption, renaming of names of the control commands and / or parameters, changing an order of control commands, adding control commands and / or concealing control commands. Method according to one of the preceding claims, characterized in that the automatic detection (102) of the unauthorized access, a calculation of at least one checksum, an access check on the control commands, a detection of decompiling the control commands, a detection of an access of a predetermined entity, a detection access by a debugger, analyzing an entity that executes the control commands and / or recognizing an unexpected output value. Method according to one of the preceding claims, characterized in that before the automatic detection (102) the changed (101) control commands are stored on a mobile terminal. Method according to one of the preceding claims, characterized in that an unauthorized access is read and / or write. Method according to one of the preceding claims, characterized in that the attack documentation describes which parts of the control commands are accessed without authorization. Method according to one of the preceding claims, characterized in that the adaptation (104) of the protection configuration is carried out on the basis of stored rules which make predetermined attacks more difficult. Method according to one of the preceding claims, characterized in that the adaptation (104) of the security configuration takes place on the basis of empirically determined bypasses of attacks. Method according to one of the preceding claims, characterized in that the renewed change (101) already takes place during the unauthorized access. Method according to one of the preceding claims, characterized in that the changed (101) control commands are made available to a plurality of mobile terminals. Method according to one of the preceding claims, characterized in that the hedging unit persistently stores the hedging configuration. Method according to one of the preceding claims, characterized in that the security unit carries out a version management of the security configuration. Computer arrangement for iterative and attack-specific concealment of control commands, comprising: - an interface unit set up for transmitting (100) control commands to a security unit, which is set up to change (101) the control commands depending on a security configuration in such a way that unauthorized access to the control commands is difficult; - A monitor unit set up for automatic detection (102) of the unauthorized access to the control commands together with the creation (103) of an attack documentation, characterized in that - the security unit is set up to adapt (104) the security configuration depending on the attack documentation; and a renewed change (101) of the control commands can be carried out. Computer program product with control commands which implement the method according to one of the Claims 1 to 13 execute when executed on a computer.

Images