Attacks and risk analysis for hardware supported software copy protection systems

ABSTRACT

<i>Recently, there is a growing interest in the research community to use tamper-resistant processors for software copy protection. Many of these tamper-resistant systems rely on a specially tailored secure processor to prevent, 1) illegal software duplication, 2) unauthorized software modification, and 3)unauthorized software reverse engineering. The published techniques primarily focused on feasibility demonstration and design details rather than analyzing security risks and potential attacks from an adversary's perspective. The uniqueness of software copy protection may lead to some potential attacks on such a secure environment that have been largely ignored or insufficiently addressed in the literature. One should not take security for granted just because it is implemented on a tamper-resistant secure processor. Detailed analysis on some proposed ideas reveal potential vulnerability and attacks. Some of the attacks are known to the security community, nevertheless, their implications to software copy protection are not well understood and discussed. This paper presents these cases for designers to improve their systems and circumvent the potential security pitfalls and for users of such systems to be aware of the potential risks</i>

REFERENCES

• 1: M-TREE: A Fast Secure Architecture for Protecting the Integrity and Privacy of Software. Submitted for publication. http://www.cc.gatech.edu/people/home/lulu/Mtree.pdf, 2004.
• 2: A. W. Biermann. The inference of regular lisp programs from examples. In IEEE Trans. on Systems, Man, and Cybernetics, 8(8):585--600, 1978.
• 3: Andrew "bunnie" Huang. Hacking the Xbox: An Introduction to Reverse Engineering. No Starch Press, 2003.
• 4: N.S. Chaudhari and A. Tiwari. Extension of Binary Neural Networks for Multi-class Output and Finite Automata. Neural Information Processing: Research and Development. Ed. Jagath Rakjkapse and Lipo Wang, December, 2003.
• 5: Compaq Computer. Alpha 21264 Microprocessor Hardware Reference Manual.
• 6: Giancarlo Ferrari-Trecate , Marco Muselli, A New Learning Method for Piecewise Linear Regression, Proceedings of the International Conference on Artificial Neural Networks, p.444-449, August 28-30, 2002
• 7: The Trusted Computing Group. https://www.trustedcomputinggroup.org/home. 2003.
• 8: A. Huang. Keeping secrets in hardware the microsoft xbox case study. MIT AI Memo, 2002.
• 9: Interposer. http://www.arium.com.
• 10: David Lie Chandramohan Thekkath , Mark Mitchell , Patrick Lincoln , Dan Boneh , John Mitchell , Mark Horowitz, Architectural support for copy and tamper resistant software, Proceedings of the ninth international conference on Architectural support for programming languages and operating systems, p.168-177, November 2000, Cambridge, Massachusetts, United States
• 11: David Lie , Chandramohan A. Thekkath , Mark Horowitz, Implementing an untrusted operating system on trusted hardware, Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA
• 12: M.Anthony. Boolean functions and artificial neural networks. Boolean Functions: Volume II. Ed. Yves Crama and Peter Hammer, December, 2003.
• 13: Martin M. Anthony , Peter Bartlett, Learning in Neural Networks: Theoretical Foundations, Cambridge University Press, New York, NY, 1999
• 14: Andrew C. Myers, JFlow: practical mostly-static information flow control, Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.228-241, January 20-22, 1999, San Antonio, Texas, United States [doi>10.1145/292540.292561]
• 15: Blaise Gassend , G. Edward Suh , Dwaine Clarke , Marten van Dijk , Srinivas Devadas, Caches and Hash Trees for Efficient Memory Integrity Verification, Proceedings of the 9th International Symposium on High-Performance Computer Architecture, p.295, February 08-12, 2003
• 16: G. Edward Suh , Dwaine Clarke , Blaise Gassend , Marten van Dijk , Srinivas Devadas, AEGIS: architecture for tamper-evident and tamper-resistant processing, Proceedings of the 17th annual international conference on Supercomputing, June 23-26, 2003, San Francisco, CA, USA [doi>10.1145/782814.782838]
• 17: G. Edward Suh , Dwaine Clarke , Blaise Gassend , Marten van Dijk , Srinivas Devadas, Efficient Memory Integrity Verification and Encryption for Secure Processors, Proceedings of the 36th annual IEEE/ACM International Symposium on Microarchitecture, p.339, December 03-05, 2003
• 18: Jun Yang , Youtao Zhang , Lan Gao, Fast Secure Processor for Inhibiting Software Piracy and Tampering, Proceedings of the 36th annual IEEE/ACM International Symposium on Microarchitecture, p.351, December 03-05, 2003
• 19: Xiangyu Zhang , Rajiv Gupta, Hiding program slices for software security, Proceedings of the international symposium on Code generation and optimization: feedback-directed and runtime optimization, March 23-26, 2003, San Francisco, California
• 20: Xiaotong Zhuang , Tao Zhang , Hsien-Hsin S. Lee , Santosh Pande, Hardware assisted control flow obfuscation for embedded processors, Proceedings of the 2004 international conference on Compilers, architecture, and synthesis for embedded systems, September 22-25, 2004, Washington DC, USA [doi>10.1145/1023833.1023873]
• 21: X. Zhuang, T. Zhang, S. Pande, and H.-H. S. Lee. HIDE: Hardware-support for Leakage-Immune Dynamic Execution. Report GIT-CERCS-03-21, Geogia Institute of Technology, Atlanta, GA, November 2003.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.0 GENERAL

General Terms:
Security

Keywords:
attack, copy protection, tamper resistance