一种白盒环境中抗动态攻击的软件保护方法  

Software Protection Method Defending Dynamic Attack in White-box Environment

作　　者：许广莲 房鼎益[1] 王怀军[2] 李光辉[1] 何路[1] 

机构地区：[1]西北大学信息科学与技术学院西北大学-爱迪德信息安全联合实验室,西安710127 [2]西安理工大学计算机科学与工程学院,西安710048

出　　处：《小型微型计算机系统》2015年第9期2062-2066,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(61070218;61272461;61202393)资助;国家科技支撑计划课题(2013BAK01B02)资助;陕西省教育厅产业化培育项目(2013jc07)资助;陕西省自然科学基础研究计划项目(2012JQ8049)资助

摘　　要：白盒环境是指软件安装(分发)到远程主机后攻击者对软件的执行过程完全可见、并可进行干预的状态.白盒环境中,攻击者可以利用调试,编辑等工具对运行态软件进行动态攻击,从而逆向出核心算法,达到窃取软件知识产权或机密信息的目的.为了较好地抵御白盒环境下的动态攻击,提出一种动态加解密与实时监测相结合的软件保护方法:利用动态加解密对软件的关键代码段进行保护,还引入双进程保护和线程引擎实时监测技术,增加了攻击者动态调试获取内存明文的难度,同时保证了软件运行时环境安全性.最后利用本方法实现了一个原型系统,对此进行分析并和其他常用软件保护工具比较,表明本方法可以有效提高被保护软件的安全性,且对性能影响较小.White-box environment is an environment in w hich the execution process of softw are is fully visible to the attacker after the installation（ distribution） to the remote host. Besides the attacker can intervene the execution process. In w hite-box environment,the attacker can use the debug,edit tools and so on to do dynamic attack on runtime softw are in order to reverse the core algorithm. So it causes a threat to the intellectual property. To better resist the dynamic attack in the w hite-box environment,this paper proposes a softw are protection method w hich is the combination of dynamic encryption / decryption and real-time monitoring： it uses dynamic encryption / decryption to protect the key code. Besides the double process protection and the real-time monitoring technology by thread engine are introduced. It increases the difficulties of getting the plain text in the memory and make sure the security of the process in runtime. At last,a prototype system is realized using this method. We analyze it and compare it w ith other softw are protection tools.The result indicates that this method can effectively improve the security of the protected softw are and has little effect on the performance.

关 键 词：调试进程 动态加解密 线程引擎 实时监测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]