1. Experience with Software Watermarking Jens Palsberg, Sowmya Krishnaswamy, Minseok Kwon, Di Ma, Qiuyun Shao, Yi Zhang CERIAS and Department of Computer Science Purdue University West Lafayette, IN 47907 Presented by Dejin Zhao

2. Outline 1.Introduction: Dynamic Graph Watermarking 2.Watermark Representation 3.Watermark Embedding and the Problems (my focus) 4. Watermark Retrieval and Experiment 5. Summary

3. Introduction Attacks : locating, distorting, or removing watermark, etc. “Semantics-Preserving Program Transformations”: easily remove or distort watermarks embedded in the static data structure, for example, comments, string constants, the order of instructions, etc. Solution: store watermark in dynamic data structure that are created at run-time. An approach [Collberg and Thomborsen]: represent a number by a dynamic graph which can be built as object structure at run-time.

4. Watermark Representation * assume: a watermark is a number W ** C(n) is the number of PPCTs with n leaves Number W can be represented by the graph whose index is exactly this number according to graph enumeration (figure 2). After determining watermark’s graph representation, How to build this graph in the run-time and how to merge it into the original program in order to protect against other attacks?

5. Watermark Embedding 1. Build a Node Class for this Graph: choose a base class in the original program and convert it into a node class. class base{ int a; Node ( ) { a=0; } class base{ int a; Node left, right; //additional fields holding an outgoing edge to another node public base ( ) { a=0; } addedge (base outgoing-edge, int branch){//additional function if (branch = 0) this.left = outgoing-edge;//adding a outgoing edge else this.right = outgoing-edge;//to the Node. }

6. Watermark Embedding 2. Build and Merge Graph: class A{ A( ){ a1=0; } int a1; } (2) change a expression “new A( )” to “new A1( )” class A1 extends A { A1( ) { a1=0; } int a1; } (1) add a class A1 extending A and merge code for building graph in its constructor. * It is sufficient to protect against a variety of program-transformation attacks, but 3. Problem: The extra code for building the graph can easily be located and removed by an attacker.

7. Solution for the Problem 1. Introduction to Opaque Predicates : P1P1 C ode for building watermark graph G w P 2 if (predicates from Gw) S (1) Opaque Predicates (one of obfuscation techniques): replaces statement “S” with the form “if (x!=y) S”. (2) Watermark Graph is an excellent source for opaque predicates, where x, y are distinct nodes of the graph. We can use it to obfuscate the original program P as following diagram. Here both P1 and C are unobfuscated because Gw must be created and executed before “If (x!=y) S” can be implemented. Program P = P1 + [Code for Gw] + P2 Run- time

8. 2. Obfuscate P and C: by introducing another graph Program P C' for building another graph G P 1 before C is executed if (predicates from G) S C for building watermark graph G w if (predicates from G) S P 2 after C if (predicates from G) S if (predicates from Gw) S P’P’ general- purpose obfuscator 3. Tamperproofing: we have achieved a level of tamperproofing

9. Watermark Retrieval and Experiment Calculate the index of the graph Find node of the graph Locate the Origin node 1. Watermark Retrieval: retrieve the watermark graph by accessing the heap image. 2. Experimental Results: (1) JavaWiz adds less than 10 kilobytes of code on average. (2) Embedding a watermark is done in less than 20 seconds. (3) Watermarking increases a program’s execution time less than 7%. (4) Watermark retrieval is done in about 1 minute per 1 megabytes of heap.

10. Summary Graph: W(1) Node Class Graph Construction C ode P C Original P rogram Run-time C PPCT Heap int(T) = 1 = W R ecognizer Question: Why not add a new class for the node instead of choosing a base class from the original program? Embedding Obfuscation Tamperproofing Retrieval A simple example