This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
CodeBender: Remote Software Protection Using Orthogonal Replacement
March/April 2011 (vol. 28 no. 2)
pp. 28-34
ASCII Text
x 
 
Mariano Ceccato, Paolo Tonella, "CodeBender: Remote Software Protection Using Orthogonal Replacement," IEEE Software, vol. 28, no. 2, pp. 28-34, March/April, 2011.
 
 
BibTex
x
 
@article{ 10.1109/MS.2010.158,
author = {Mariano Ceccato and Paolo Tonella},
title = {CodeBender: Remote Software Protection Using Orthogonal Replacement},
journal ={IEEE Software},
volume = {28},
number = {2},
issn = {0740-7459},
year = {2011},
pages = {28-34},
doi = {http://doi.ieeecomputersociety.org/10.1109/MS.2010.158},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
}
 
 
RefWorks Procite/RefMan/Endnote
x 
 
TY - MGZN
JO - IEEE Software
TI - CodeBender: Remote Software Protection Using Orthogonal Replacement
IS - 2
SN - 0740-7459
SP28
EP34
EPD - 28-34
A1 - Mariano Ceccato,
A1 - Paolo Tonella,
PY - 2011
KW - hardware/software protection
KW - development tools
KW - software/software engineering
KW - program transformation
KW - security and protection
VL - 28
JA - IEEE Software
ER -
 
Mariano Ceccato, Fondazione Bruno Kessler
Paolo Tonella, Fondazione Bruno Kessler
In a typical client-server scenario, a server provides valuable services to client applications that run remotely on untrusted client computers. Typical examples are video on demand, online games, voice-over-IP communications, and many others. However, client-side users often hold administrative privileges on their machines and could tamper with the client application to fulfill the service in violation of the service usage conditions or service agreements. Guaranteeing client-code security is one of the most difficult security problem to address. It's an instance of the malicious host problem, where an adversary in control of the client's host environment tries to tamper with the client code. The authors present CodeBender, a tool that implements a novel client replacement strategy to counter the malicious host problem. The client code has limited validity and, when it expires, the server provides a new client that replaces the former one. The reverse-engineering efforts of adversaries are deterred by the complexity of analyzing frequently changing, always different (orthogonal) program code.

1. M. Ceccato et al., "The Effectiveness of Source Code Obfuscation: An Experimental Assessment," Proc. IEEE 17th Int'l Conf. Program Comprehension (ICPC 09), IEEE CS Press, 2009, pp. 178–187.
2. M. Ceccato et al., "Barrier Slicing for Remote Software Trusting," Proc. 7th IEEE Int'l Working Conf. Source Code Analysis and Manipulation (SCAM 07), IEEE CS Press, 2007, pp. 27–36.
3. T. Kamiya, S. Kusumoto, and K. Inoue, "CCFinder: A Multilinguistic Token-Based Code Clone Detection System for Large Scale Source Code," IEEE Trans. Software Eng., vol. 28, no. 7, 2002, pp. 654–670.
4. M. Ceccato et al., "Remote Software Protection by Orthogonal Client Replacement," Proc. 24th ACM Symp. Applied Computing (SAC 09), ACM Press, 2009, pp. 448–455.
1. C. Collberg, C. Thomborson, and D. Low, "A Taxonomy of Obfuscating Transformations," tech. report 148, Dept. of Computer Science, Univ. of Auckland, 1997.
2. C. Collberg, C. Thomborson, and D. Low, "Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs," Proc. 25th ACM SIGPLAN-SIGACT Symp. Principles of Programming Languages (POPL 98), ACM Press, 1998, pp. 184–196.
1. B. Horne et al., "Dynamic Self-Checking Techniques for Improved Tamper Resistance," Security and Privacy in Digital Rights Management, LNCS 2320, Springer, 2002, pp. 77–124.
2. W. Michiels and P. Gorissen, "Mechanism for Software Tamper Resistance: An Application of White-Box Cryptography," Proc. 2007 ACM Workshop Digital Rights Management (DRM 07), ACM Press, 2007, pp. 82–89.
3. P. van Oorschot, A. Somayaji, and G. Wurster, "Hardware-Assisted Circumvention of Self-Hashing Software Tamper Resistance," IEEE Trans. Dependable and Secure Computing, vol. 2, no. 2, 2005, pp. 82–92.
4. F. Monrose, P. Wyckoff, and A. Rubin, "Distributed Execution with Remote Audit," Proc. 1999 ISOC Network and Distributed System Security Symp., Internet Society, 1999, pp. 103–113.
5. A. Seshadri et al., "Swatt: Software-Based Attestation for Embedded Devices," IEEE Symp. Security and Privacy (S&P 04), IEEE CS Press, 2004, pp. 272–283.
6. A. Seshadri et al., "Pioneer: Verifying Code Integrity and Enforcing Untampered Code Execution on Legacy Systems," Proc. 20th ACM Symp. Operating Systems Principles (SOSP 05), ACM Press, 2005, pp. 1–16.
7. R. Kennell and L.H. Jamieson, "Establishing the Genuinity of Remote Computer Systems," Proc. 12th Usenix Security Symp., Usenix Assoc., 2003, p. 21.
8. M.C. Umesh Shankar and J.D. Tygar, "Side Effects Are Not Sufficient to Authenticate Software," tech. report UCB/CSD-04-1363, EECS Dept., Univ. of California, Berkeley, 2004.
9. M. Ceccato et al., "Barrier Slicing for Remote Software Trusting," Proc. 7th IEEE Int'l Working Conf. Source Code Analysis and Manipulation (SCAM 07), IEEE CS Press, 2007, pp. 27–36.
10. M. Ceccato et al., "Trading-Off Security and Performance in Barrier Slicing for Remote Software Entrusting," J. Automated Software Eng., vol. 16, no. 2, June 2009, pp. 235–261.
11. P. Falcarin, R. Scandariato, and M. Baldi, "Remote Trust with Aspect-Oriented Programming," Proc. 20th Int'l Conf. Advanced Information Networking and Applications (AINA 06), IEEE CS Press, 2006, pp. 451–458.
12. R. Scandariato et al., "Application-Oriented Trust in Distributed Computing," Proc. 2008 3rd Int'l Conf. Availability, Reliability and Security (ARES 08), IEEE CS Press, 2008, pp. 434–439.

Index Terms:
hardware/software protection, development tools, software/software engineering, program transformation, security and protection
Citation:
Mariano Ceccato, Paolo Tonella, "CodeBender: Remote Software Protection Using Orthogonal Replacement," IEEE Software, vol. 28, no. 2, pp. 28-34, March-April 2011, doi:10.1109/MS.2010.158
Usage of this product signifies your acceptance of the Terms of Use.