Architecting Systems to Protect Intellectual Property Presentation to NZTE China Workshop Prof. Clark Thomborson Auckland NZ 16 th November 2007

Lessig’s Taxonomy of Control LegalIllegal Moral Immoral EasyDifficult Inexpensive Expensive Easy Difficult Ideally: it would be difficult, immoral, expensive, and illegal for anyone to misappropriate your IP. IP theft

Defense in Depth for Software IP 1.Prevention: a)Don’t allow unauthorised use (licence control). b)Don’t let anyone read your code (black box). c)Don’t let anyone decipher your code (encryption). d)Don’t let anyone understand your code (obfuscation). e)Don’t let anyone modify your code (tamper-proofing). 2.Detection: a)Monitor subjects (user logs). Requires user ID and user surveillance. b)Monitor uses (execution logs). Requires code ID (hashing or watermarking) and platform surveillance. c)Monitor objects (inventory logs). Requires code ID, storage surveillance. d)Monitor platforms (platform logs). Requires tamper-evident platforms and platform surveillance. 3.Response: a)Automated. Requires a trusted platform which can “call for help”. b)Offline. Requires a trusted inspector (to read the logs).