Surreptitious Software Obfuscation, Watermarking, and Tamperproofing for Software Protection: Obfuscation, Watermarking, and Tamperproofing for Software Protection

by Collberg, Christian; Nagra, Jasvir

• ISBN13: 9780321549259
• ISBN10: 0321549252
• Edition: 1st
• Format: Paperback
• Copyright: 2009-07-24
• Publisher: Addison-Wesley Professional

Summary

"Without protection, software is vulnerable to reverse engineering, piracy, and tampering. Every software vendor should be aware of this threat and make use of techniques such as those described inSurreptitious Softwareto protect their valuable intellectual property. This is the first book of its kind and it provides an excellent description of these challenges as well as possible solutions." -Sandy Ring, Founder and CEO of Pikewerks Corporation "This book gives a thorough scholarly coverage of an area of growing importance in computer security, and is a ls"must havers" for every researcher, student, and practicing professional in software protection." -Mikhail Atallah, Distinguished Professor of Computer Science at Purdue University Breakthrough Techniques for Fighting Software Piracy, Tampering, and Malicious Reverse Engineering Leading-edge researchers have developed several pioneering approaches to preventing or resisting software piracy and tampering. These techniques are indispensable for software developers seeking to protect vital intellectual property: They can mean the difference between business survival and failure.Surreptitious Softwareis the first authoritative, comprehensive resource for developers who want to understand them, choose amongst them, and apply them with minimal performance impact. Christian Collberg and Jasvir Nagra bring together techniques drawn from all areas of computer science, including cryptography, steganography, watermarking, software metrics, reverse engineering, and compiler optimization. Using extensive sample code, they show how to implement protection schemes ranging from birthmarking and fingerprinting to code obfuscation. They also demonstrate how to manage virtually any IP protection challenge, from tracing piracy to preventing the removal of license checks. Coverage includes bull; Predicting the comparative effectiveness of different algorithms and approaches in resisting attack bull; Mastering techniques that both attackers and defenders use to analyze programs bull; Using code obfuscation to make software harder to read, understand, and steal bull; Fingerprinting software to identify the source of piracy bull; Tamperproofing software with authorization checks, guards, and other techniques bull; Strengthening content protection through dynamic watermarks bull; Resisting piracy via software similarity analysis and birthmarking algorithms bull; Using software to defend against hardware exploits Whatever your role in protecting software or content, itrs"s harder than ever to stay ahead of the crackers and pirates. You canrs"t do it without the tools, techniques, and code yours"ll find inSurreptitious Software.

Author Biography

Christian Collberg received a B.Sc. in computer science and numerical analysis and a Ph.D. in computer science from Lund University, Sweden. He is currently an associate professor in the department of computer science at the University of Arizona and has also worked at the University of Auckland, New Zealand, and the Chinese Academy of Sciences in Beijing. Professor Collberg is a leading researcher in the intellectual property protection of software, and also maintains an interest in compiler and programming language research. In his spare time he writes songs, sings, and plays guitar for The Zax and hopes one day to finish his Great Swedish Novel.

Jasvir Nagra received his B.Sc. in mathematics and computer science and a Ph.D. in computer science from the University of Auckland, New Zealand. He’s been a postdoctoral scholar on the RE-TRUST project at the University of Trento, where his focus is on applying obfuscation, tamperproofing, and watermarking techniques to protect the integrity of software executing on a remote untrusted platform. His research interests also include the design of programming languages and its impact on the security of applications. He’s currently with Google Inc., where he is building Caja, an open source, secure subset of JavaScript. In his spare time Jasvir dabbles with Lego and one day hopes to finish building his Turing machine made entirely out of Lego blocks.

Table of Contents

Preface

About the Authors

Acknowledgments

What Is Surreptitious Software?

Setting the Scene

Attack and Defense

Program Analysis

Code Obfuscation

Tamperproofing

Software Watermarking

Software Similarity

Hardware-Based Protection Techniques

Discussion

Notation

Methods of Attack and Defense

Attack Strategies

Defense Strategies

Discussion

Program Analysis

Static Analysis

Dynamic Analysis

Reconstituting Source

Pragmatic Analysis

Discussion

Code Obfuscation

Semantics: Preserving Obfuscating Transformations

Definitions

Complicating Control Flow

Opaque Predicates

Data Encodings

Breaking Abstractions

Discussion

Obfuscation Theory

Definitions

Why Might Obfuscation Be Possible?

Algorithm obfA: Deobfuscating Programs

Algorithm obfLBS: Obfuscating with Point Functions

Algorithm obfNS: Obfuscating Databases

Algorithm obfP: Adding Encryption

Algorithm obfNS: White-box DES

Substitution and Permutations as Matrix Operations

Obfuscation Is Impossible

Why Do We Want Provable Obfuscation So Badly?

Alternatives

Secure Multi-party Computation

Discussion

Dynamic Obfuscation

Definitions

Moving code around

Encryption

Discussion

Software Tamperproofing

Definitions

Introspection

Algorithm tpTCJ: Response Mechanisms

State Inspection

Remote Tamperproofing

Discussion

Software Watermarking

History and Applications

Watermarking Software

Definitions

Watermarking by Permutation

Tamperproofing Watermarks

Improving Resilience

Improving Stealth

Steganographic Embeddings

Splitting Watermark Integers

Graph Codecs

Discussion

Dynamic Watermarking

Algorithm wmCT: Exploiting Aliasing

Algorithm wmNT: Exploiting Parallelism

Algorithm wmCCDKHLS: Expanding Execution Paths

Algorithm wmCCDKHLS: Tamperproofing Execution Paths

Discussion

Software Similarity Analysis

Applications

Definitions

k-Gram-Based Analysis

API-Based Analysis

Tree-Based Analysis

Graph-Based Analysis

Metrics-Based Analysis

Discussion

Hardware for Protecting Software

Anti-piracy by Physical Distribution

Authenticated Boot Using a Trusted Platform Module

Encrypted Execution

Attacks on Tamperproof Devices

Discussion

Bibliography

Index

Table of Contents provided by Publisher. All Rights Reserved.