Protecting Software Code By Guards Hoi Chang and Mikhail J. Atallah CERIAS, Purdue University and Arxan Technologies, Inc.

2/11 Contents  Introduction  Related work  The guarding framework  Description of system  Experimental result  Conclusion

3/11 Introduction  Existing TRS  Single point of failure or high cost  Protection mechanisms should have …  Resilience: no single point of failure, hard to disable  Self-defense: detect tampering  Configurability: customizable  White-box security: security based on secret key  Network of Guards  Security is shared among all guard  Many ways to form a network  More guard  greater level of security

4/11 Related work  Hardware based protection  Coprocessor  Smart card  Dongles  Software based protection  Code obfuscation  Self-modifying code  Code encryption/decryption

5/11 The guarding framework (1/2)  Guards  Checksum code: 1-way property  Repair code  Strengthening individual guards  Stealthiness  Guard templates: polymorphic instance  Delayed alarm upon detection of an attack  Blurred boundaries between the runtime code and data  Tamper-resistance  Guard protect itself (not by other guards)  Code obfuscation

6/11 The guarding framework (2/2)  Guards network  Security  Distributedness  Multiplicity  Dynamism  Scalability  Strengthening the network  Without any “loose end” (unprotected guards)  Strongly connected graph

7/11 Description of system (1/2)  Version 1.0 for protecting Win32 executables  Automated guard installation  Process Win32 binary code directly  Guard template: object code stored in database Unguarded Win32 EXE Guard graph specification Guard Installation System Guarded Win32 executable The guarding system guard: add ebp, -checksum mov eax, client_addr for: cmp eax, client_end jg end mov ebx, dword[eax] add ebp, ebx add eax, 4 jmp for End: Guard template

8/11 Description of system (2/2) Memory Layout of guarded program (307 guards)

9/11 Experimental result (1/2)  Impact on program size  Proportional to the number of installed guards and their average size  Storage space is not a problem to guarding Statistics of the guarded programs and their guards

10/11 Experimental result (2/2)  Impacts on program performance Increases in execution time of controlled and uncontrolled guard invocations

11/11 Conclusion  Software based TRS by Guards  Distributed protection  Variety of protection schemes  Configurable tamper-resistance  Our TRS provides...  Automated guard installation in Win32 executables  With configurable manner  Graphical user interface