Tamper-proofing basis path by using oblivious hashing on Java

ABSTRACT

Java programs are often downloaded (distributed) to unknown environments, so protect Java code from malicious modification is an important issue. This paper presents a tamper-proofing software technology on basis paths for stack-machine based languages, such as Java, by improving Oblivious Hashing. Our approach is based on a new dynamic stack-tracing approach which inserts hash instructions to monitor the top of the stack to check whether the program running has been tampered with or not. A user can choose one or more methods in a class to tamper-proof program. The protective codes are added to basic blocks at the bytecode level. We developed a new approach to protect constants and variables by alternative hashing functions. The overhead is proportional to the number of Load and Push instructions to be protected.

REFERENCES

• 1: A. B. Konovalov. On the nilpotency class of a multiplicative group of a modular group algebra of a dihedral 2-group. Ukrainian Mathematical Journal, vol. 47, no. 1, January 1995.
• 2: Christian S. Collberg , Clark Thomborson, Watermarking, tamper-proffing, and obfuscation: tools for software protection, IEEE Transactions on Software Engineering, v.28 n.8, p.735-746, August 2002 [doi>10.1109/TSE.2002.1027797 ]
• 3: Chung Laung Liu. Elements of Discrete Mathematic. McGraw-Hill, pages 346--349, ISBN:007038133X, 1998.
• 4: D. Curran , N. J. Hurley , M. Ó Cinnéide, Securing Java through software watermarking, Proceedings of the 2nd international conference on Principles and practice of programming in Java, June 16-18, 2003, Kilkenny City, Ireland
• 5: David Lie , Chandramohan Thekkath , Mark Mitchell , Patrick Lincoln , Dan Boneh , John Mitchell , Mark Horowitz, Architectural support for copy and tamper resistant software, ACM SIGPLAN Notices, v.35 n.11, p.168-177, Nov. 2000 [doi>10.1145/356989.357005]
• 6: Geneviève Arboit. A Method for Watermarking Java Programs via Opaque Predicates. In The Fifth International Conference on Electronic Commerce Research (ICECR-5), October 2002
• 7: Gleb Naumovich , Nasir Memon, Preventing Piracy, Reverse Engineering, and Tampering, Computer, v.36 n.7, p.64-71, July 2003 [doi>10.1109/MC.2003.1212692]
• 8: Hoi Chang , Mikhail J. Atallah, Protecting Software Code by Guards, Revised Papers from the ACM CCS-8 Workshop on Security and Privacy in Digital Rights Management, p.160-175, November 05, 2001
• 9: Jien-Tsai Chan , Wuu Yang, Advanced obfuscation techniques for Java bytecode, Journal of Systems and Software, v.71 n.1-2, p.1-10, April 2004 [doi>10.1016/S0164-1212(02)00066-3]
• 10: Jon Meyer. Jasmin. http://cat.nyu.edu/~meyer/jvm/, March 1997
• 11: Joseph Poole. A method to determine a basis set of paths to perform program testing. U.S. Department of Commerce/National Institute of Standards and Technology, NISTIR 5737, November 1995.
• 12: Markus Jakobsson , Michael K. Reiter, Discouraging Software Piracy Using Software Aging, Revised Papers from the ACM CCS-8 Workshop on Security and Privacy in Digital Rights Management, p.1-12, November 05, 2001
• 13: Rainer Güting. Subtractive abelian groups. Notre Dame Journal of Formal Logic, vol. XVI, no. 3, pages 425--428, July 1975.
• 14: Raja Vallée-Rai, Laurie Hendren, Vijay Sundaresan, Patrick Lam, Etienne Gagnon and Phong Co. Soot - a Java bytecode optimization framework. Proceedings of CASCON 1999, Mississauga, Ontario, Canada, pages 125--135, 1999, http://www.sable.mcgill.ca/soot/.
• 15: Stanley Chow, Philip A. Eisen, Harold Johnson and Paul C. van Oorschot. A White-Box DES Implementation for DRM Applications. Digital Rights Management Workshop, Washington, DC, USA, November 2002, Revised Papers. Lecture Notes in Computer Science (LNCS), vol. 2696, pages 1--15, October 2003.
• 16: Thomas J. McCabe. A complexity measure. IEEE Transactions on Software Engineering, vol. 2, no. 4, pages 308--320, December 1976.
• 17: Ting-Wei Hou, Hsiang-Yang Chen and Ming-Hsiu Tsai. Three Control Flow Obfuscation methods for Java Software. IEE Proceedings Software, vol. 153, no. 2, pages 80--86, April 2006.
• 18: Yuqun Chen , Ramarathnam Venkatesan , Matthew Cary , Ruoming Pang , Saurabh Sinha , Mariusz H. Jakubowski, Oblivious Hashing: A Stealthy Software Integrity Verification Primitive, Revised Papers from the 5th International Workshop on Information Hiding, p.400-414, October 07-09, 2002

INDEX TERMS

Primary Classification:
  F. Theory of Computation
  F.3 LOGICS AND MEANINGS OF PROGRAMS
      F.3.2 Semantics of Programming Languages
          Subjects: Program analysis

Additional Classification:
  D. Software
  D.3 PROGRAMMING LANGUAGES
      D.3.2 Language Classifications

          Nouns: Java

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Algorithms, Design, Experimentation, Languages, Measurement, Performance, Theory

Keywords:
Java, basis paths, oblivious hashing, tamper-proofing