Proteus: virtualization for diversified tamper-resistance

ABSTRACT

Despite huge efforts by software providers, software protection mechanisms are still broken on a regular basis. Due to the current distribution model, an attack against one copy of the software can be reused against any copy of the software. Diversity is an important tool to overcome this problem. It allows for renewable defenses in space, by giving every user a different copy, and renewable defenses in time when combined with tailored updates. This paper studies the possibilities and limitations of using virtualization to open a new set of opportunities to make diverse copies of a piece of software and to make individual copies more tamper-resistant. The performance impact is considerable and indicates that these techniques are best avoided in performance-critical parts of the code.

REFERENCES

• 1: Bertrand Anckaert , Bjorn De Sutter , Koen De Bosschere, Software piracy prevention through diversity, Proceedings of the 4th ACM workshop on Digital rights management, October 25-25, 2004, Washington DC, USA [doi>10.1145/1029146.1029157]
• 2: Bertrand Anckaert, Matias Madou, and Koen De Bosschere. A model for self-modifying code. In The 8th Information Hiding Conference, LNCS (to appear), 2006.
• 3: Ross Anderson and Markus Kuhn. Tamper Resistance - a Cautionary Note. In The 2nd Usenix Workshop on Electronic Commerce, pages 1--11, 1996.
• 4: David Aucsmith, Tamper Resistant Software: An Implementation, Proceedings of the First International Workshop on Information Hiding, p.317-333, May 30-June 01, 1996
• 5: Algirdas Avizienis and L Chen. On the implementation of n-version programming for software fault tolerance during execution. In The IEEE Computer Software and Applications Conference, pages 149--155, 1977.
• 6: Lee Badger, Larry D'Anna, Doug Kilpatrick, Brian Matt, Andrew Reisse, and Tom Van Vleck. Self-protecting mobile agents obfuscation evaluation report, 2001.
• 7: Elena Gabriela Barrantes , David H. Ackley , Stephanie Forrest , Darko Stefanović, Randomized instruction set emulation, ACM Transactions on Information and System Security (TISSEC), v.8 n.1, p.3-40, February 2005 [doi>10.1145/1053283.1053286]
• 8: Sandeep Bhatkar, Daniel DuVarney, and R. Sekar. Address obfuscation: An efficient approach to combat a broad range of memory error exploits. In The 12th USENIX Security Symposium, pages 105--120, 2003.
• 9: Business Software Alliance and International Data Corporation. Second Annual BSA and IDC Global Software Piracy Study, 2005.
• 10: Hoi Chang , Mikhail J. Atallah, Protecting Software Code by Guards, Revised Papers from the ACM CCS-8 Workshop on Security and Privacy in Digital Rights Management, p.160-175, November 05, 2001
• 11: Yuqun Chen , Ramarathnam Venkatesan , Matthew Cary , Ruoming Pang , Saurabh Sinha , Mariusz H. Jakubowski, Oblivious Hashing: A Stealthy Software Integrity Verification Primitive, Revised Papers from the 5th International Workshop on Information Hiding, p.400-414, October 07-09, 2002
• 12: Monica Chew and Dawn Song. Mitigating buffer overflows by operating system randomization. Technical Report CMU-CS-02-197, Department of Computer Science, Carnegie Mellon University, 2002.
• 13: Stanley Chow , Yuan Gu , Harold Johnson , Vladimir A. Zakharov, An Approach to the Obfuscation of Control-Flow of Sequential Computer Programs, Proceedings of the 4th International Conference on Information Security, p.144-155, October 01-03, 2001
• 14: Cristina Cifuentes , K. John Gough, Decompilation of binary programs, Software—Practice & Experience, v.25 n.7, p.811-829, July 1995 [doi>10.1002/spe.4380250706]
• 15: Frederick B. Cohen, Operating system protection through program evolution, Computers and Security, v.12 n.6, p.565-584, Oct. 1993 [doi>10.1016/0167-4048(93)90054-9]
• 16: Christian Collberg , Ginger Myles , Andrew Huntwork, Sandmark--A Tool for Software Protection Research, IEEE Security and Privacy, v.1 n.4, p.40-49, July 2003 [doi>10.1109/MSECP.2003.1219058]
• 17: Christian Collberg , Clark Thomborson, Software watermarking: models and dynamic embeddings, Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.311-324, January 20-22, 1999, San Antonio, Texas, United States [doi>10.1145/292540.292569]
• 18: Christian S. Collberg , Clark Thomborson, Watermarking, tamper-proffing, and obfuscation: tools for software protection, IEEE Transactions on Software Engineering, v.28 n.8, p.735-746, August 2002 [doi>10.1109/TSE.2002.1027797]
• 19: Christian Collberg , Clark Thomborson , Douglas Low, Breaking Abstractions and Unstructuring Data Structures, Proceedings of the 1998 International Conference on Computer Languages, p.28, May 14-16, 1998
• 20: Christian Collberg , Clark Thomborson , Douglas Low, Manufacturing cheap, resilient, and stealthy opaque constructs, Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.184-196, January 19-21, 1998, San Diego, California, United States [doi>10.1145/268946.268962]
• 21: Patrick Cousot , Radhia Cousot, An abstract interpretation-based framework for software watermarking, Proceedings of the 31st ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.173-185, January 14-16, 2004, Venice, Italy
• 22: Larry D'Anna, Brian Matt, Andrew Reisse, Tom Van Vleck, Steve Schwab, and Patric LeBlanc. Self-protecting mobile agents obfuscation report, 2003.
• 23: S. Forrest , A. Somayaji , D. Ackley, Building Diverse Computer Systems, Proceedings of the 6th Workshop on Hot Topics in Operating Systems (HotOS-VI), p.67, May 05-06, 1997
• 24: Oded Goldreich , Rafail Ostrovsky, Software protection and simulation on oblivious RAMs, Journal of the ACM (JACM), v.43 n.3, p.431-473, May 1996 [doi>10.1145/233551.233553]
• 25: Bill Horne , Lesley R. Matheson , Casey Sheehan , Robert Endre Tarjan, Dynamic Self-Checking Techniques for Improved Tamper Resistance, Revised Papers from the ACM CCS-8 Workshop on Security and Privacy in Digital Rights Management, p.141-159, November 05, 2001
• 26: Yuichiro Kanzaki , Akito Monden , Masahide Nakamura , Ken-ichi Matsumoto, Exploiting Self-Modification Mechanism for Program Protection, Proceedings of the 27th Annual International Conference on Computer Software and Applications, p.170, November 03-06, 2003
• 27: Gaurav S. Kc , Angelos D. Keromytis , Vassilis Prevelakis, Countering code-injection attacks with instruction-set randomization, Proceedings of the 10th ACM conference on Computer and communications security, October 27-30, 2003, Washington D.C., USA [doi>10.1145/948109.948146]
• 28: Cullen Linn , Saumya Debray, Obfuscation of executable code to improve resistance to static disassembly, Proceedings of the 10th ACM conference on Computer and communications security, October 27-30, 2003, Washington D.C., USA [doi>10.1145/948109.948149]
• 29: Matias Madou, Bertrand Anckaert, Patrick Moseley, Saumya Debray, Bjorn De Sutter, and Koen De Bosschere. Software protection through dynamic code mutation. In The 6th International Workshop on Information Security Applications, volume 3786 of LNCS, pages 194--206, 2005.
• 30: Gleb Naumovich , Nasir Memon, Preventing Piracy, Reverse Engineering, and Tampering, Computer, v.36 n.7, p.64-71, July 2003 [doi>10.1109/MC.2003.1212692]
• 31: David A. Patterson , John L. Hennessy, Computer architecture: a quantitative approach, Morgan Kaufmann Publishers Inc., San Francisco, CA, 1990
• 32: Todd A. Proebsting, Optimizing an ANSI C interpreter with superoperators, Proceedings of the 22nd ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.322-332, January 23-25, 1995, San Francisco, California, United States [doi>10.1145/199448.199526]
• 33: Calton Pu, Andrew Black, Crispin Cowan, and Jonathan Walpole. A specialization toolkit to increase the diversity of operating systems. In The ICMAS Workshop on Immunity-Based Systems, 1996.
• 34: B. Randell, System structure for software fault tolerance, ACM SIGPLAN Notices, v.10 n.6, p.437-449, June 1975
• 35: Daniel Dominic Sleator , Robert Endre Tarjan, Self-adjusting binary search trees, Journal of the ACM (JACM), v.32 n.3, p.652-686, July 1985 [doi>10.1145/3828.3835]
• 36: Paul van Oorschot. Revisiting software protection. In The 6th Conference on Information Security, volume 2851 of LNCS, pages 1--13, 2003.
• 37: Avinash Varadarajan and Ramarathnam Venkatesan. Limited obliviousness for data structures and efficient execution of programs. Technical report, Microsoft Research, 2006.
• 38: Ramarathnam Venkatesan , Vijay V. Vazirani , Saurabh Sinha, A Graph Theoretic Approach to Software Watermarking, Proceedings of the 4th International Workshop on Information Hiding, p.157-168, April 25-27, 2001
• 39: Chenxi Wang , Jonathan Hill , John C. Knight , Jack W. Davidson, Protection of Software-Based Survivability Mechanisms, Proceedings of the 2001 International Conference on Dependable Systems and Networks (formerly: FTCS), p.193-202, July 01-04, 2001
• 40: Glenn Wurster , P. C. van Oorschot , Anil Somayaji, A Generic Attack on Checksumming-Based Software Tamper Resistance, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.127-138, May 08-11, 2005 [doi>10.1109/SP.2005.2]
• 41: Yongxin Zhou and Alec Main. Diversity via code transformations: A solution for NGNA renewable security. In NCTA - The National Show, 2006.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.5 LEGAL ASPECTS OF COMPUTING
      K.5.1 Hardware/Software Protection
          Subjects: Copyrights

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.0 General
          Subjects: Protection mechanisms

  K. Computing Milieux
  K.5 LEGAL ASPECTS OF COMPUTING
      K.5.1 Hardware/Software Protection
          Subjects: Licensing

General Terms:
Design, Legal Aspects, Security

Keywords:
copyright protection, diversity, intellectual property, obfuscation, tamper-resistance, virtualization