Hardware-enforced Protection against Software Reverse-Engineering based on an Instruction Set Encoding

Abstract

Software programs are prone to reverse-engineering. Protection usually consists either in obfuscation or Randomized Instruction Set Emulation (RISE). In this article, we explore a mixed software/hardware RISE suitable for embedded systems. This solution is very easy to implement on any open CPU core (LEON, openRISC, LatticeMicro32, etc.), as it implies only localized changes at the latest stage of the code execution hardware, which makes Dallas and DMA attacks unsuccessful. Similarly, alternations in the software development flow are minor and straightforward. All in one, our study shows that an easy protection can be attained at virtually no overhead cost if both the hardware and the software are customized.

Design and implementation of instruction indirection for embedded software obfuscation

“…Compared to robust but costly modern ciphers, most of them are based on simple substitution ciphers for lower overhead. Both hardware [5,7,8] and software [3,4,6] implementations have been studied. Some methods utilize the characteristics of the target instruction set [5] .…”

“…Some methods utilize the characteristics of the target instruction set [5] . Some other methods rely on stream ciphers [4,8] , whose characteristics are closer to those of memory encryption: higher safety but higher cost.…”

“…• encryption of the machine codes to make them meaningless without a hidden key [1,2] , • obstruction of disassembly by confusing disassemblers or preventing them from accessing necessary information about the instructions [3][4][5][6][7][8][9][10] , and Instruction set randomization (ISR) [3][4][5][6][7][8] is an approach to protect software by obstructing disassembly, where each processor (or group of processors) has a different instruction set. Software is protected from analysis or plagiarism by different or additional instruction coding system that is hidden from attackers.…”

Hardware-Assisted Program Execution Integrity: HAPEI

“…Danger at al. [5] introduce a new instruction to selectively randomize parts of a program. Closer to us, Hiscock et al [10] propose a scheme that encrypt the whole application using a stream cipher.…”

SOFIA: Software and Control Flow Integrity Architecture

“…ASIST [29] decrypts instructions in hardware using a simple XOR cipher, which could make it trivial to derive its encryption key. In [30] a stream cipher is used to encrypt instructions with a seed value that can be updated at run-time.…”