Code Renewability for Native Software Protection

Abstract

Software protection aims at safeguarding assets embedded in software by preventing and delaying reverse engineering and tampering attacks. This paper presents an architecture and supporting tool flow to renew parts of native applications dynamically. Renewed and diversified code and data belonging to either the original application or to linked-in protections are delivered from a secure server to a client on demand. This results in frequent changes to the software components when they are under attack, thus making attacks harder. By supporting various forms of diversification and renewability, novel protection combinations become available, and existing combinations become stronger. The prototype implementation is evaluated on a number of industrial use cases. CCS Concepts: Security and privacy → Software reverse engineering; Digital rights management.

Man-at-the-End Software Protection as a Risk Analysis Process

“…This is particularly the case when irregular communication patterns can be linked to unauthorized activities such as running multiple copies in parallel or executing program fragments in a debugger in orders or frequencies not consistent with authorized uses. Such patterns can occur from communications present in the original applications, or from online SPs such as code renewability [2] and client-server code splitting [19]. Importantly, the use of non-monitoring communication does not require the implementation of reaction mechanisms in the protected application to be effective.…”

“…It is based on a survey among the developers of all protections integrated in the ASPIRE project [6], whom we asked to score the impact of their protections on a range of attack activities in terms of concrete, clearly differentiated forms of impacts. These include impact on human comprehension difficulty by increasing code complexity, impact by moving relevant code fragments from the client-side software to a secure server not under control of an attacker [2,16,73], impact on difficulty of tampering through anti-tampering techniques with different reaction mechanisms and present monitoring capabilities [73], and impact of preventive protections such as anti-debugging [1,3]. The survey results were complemented with security expert feedback, and validated in pen test experiments with professional and amateur pen testers [20,21].…”