System and method for watermarking software

Abstract

A computer-implemented system, method, and storage medium for enabling software tracing are disclosed. An exemplary implementation may: receive tagged input code corresponding to a computer program; identify locations of the tagged input code that may be modified in a manner that preserves the functionality of the computer program; select at least one code transformation with respect to associated intrinsic constants; derive derived constants from a particular intrinsic constant; apply the at least one selected code transformation, including injecting derived constants into the tagged input code; save the results of the above steps as tagged code on a computer-readable medium; and save metadata including a list of derived constants on the computer-readable medium in a file separate from the tagged code.

Description

Technical Field

[0001] The present disclosure relates to computer-implemented systems, methods, and storage media for watermarking software. Background Art

[0002] Computer software is used to control countless processes, for example in the fields of business and entertainment. It is recognized that the market for computer software in all its various forms is very large and is growing every day. In industrialized countries, there is hardly a business that does not directly or indirectly rely on computers and software in its daily operations. The expansion of powerful communication networks, such as the Internet, has made it easy to exchange, copy and distribute software.

[0003] Software programs are typically written in a programming language and processed in some manner, such as being compiled to be tuned into an executable entity or interpreted. For example, a software program may be stored as a text file containing source code in some high-level programming language, or a text file containing assembly code, which needs to be modified by a linker and loaded by a loader in order to become an executable file. Therefore, the term "software" as used herein refers to executable code and / or some executable or callable behavior providing entity, which ultimately results from the conversion of code in some programming language into some executable or interpretable form or other data called by such code, such as static or shared libraries.

[0004] Digital watermarking is a process by which a mark is secretly embedded into digital content such as audio, video or image data. The mark is often used to identify the ownership of digital content or to track the distribution of digital content. Digital watermarks are usually perceptible only under certain conditions, i.e., after using a watermark detection algorithm. It is desirable that watermarks are "robust", i.e., they cannot be easily removed and removed by an attacker. Digital watermarks are useful in detecting unauthorized distribution or other piracy of digital content (such as video or audio content). For example, a watermark can be specific to a device and / or a distribution channel. When unauthorized content is found, the watermark can be read to pinpoint the distribution device or distribution channel responsible for the unauthorized distribution.

[0005] The concepts and benefits of watermarking digital content can be extended to software. Marks can be similarly inserted into software, and when unauthorized software is discovered, people can similarly learn the responsible distribution device or channel. However, watermarking executable software has great challenges. Although minor distortions of the image may be acceptable, any changes to the software must not affect the functionality of the software. Known software tracking is achieved by recording hash codes or code signatures, or possibly by injecting identifiable strings or other junk data into executable code. For example, "A Practical Method for Watermarking Java Programs" (24th Computer Software and Applications Conference (compsac2000), Taiwan, China, October 2000) teaches that copyright notices can be inserted into Java class files. Other technologies, such as code similarity detection and plagiarism detectors are also known. However, current technologies for tracking software are not robust enough to be effective watermarks. For example, watermarks in current technologies are easily removed, do not undergo further processing such as compilation processes, and / or may interfere with the functionality of computer program code when executed. Summary of the invention

[0006] One aspect of the present disclosure relates to a system configured by computer implementation for enabling software tracing. The system may include one or more hardware processors configured by machine-readable instructions. The processor(s) may be configured to receive a tagged input code corresponding to a computer program. The processor(s) may be configured to identify a location of the tagged input code that may be modified in a manner that preserves the functionality of the computer program. The processor(s) may be configured to apply at least one code transformation to the tagged input code. Each of the at least one code transformation may have a specific intrinsic constant. The processor(s) may be configured to derive a derived constant from the specific intrinsic constant and inject the transformation including the derived constant into the tagged input code. The processor(s) may be configured to derive the derived constant from the specific intrinsic constant and save the result of the above steps as tagged code on a computer-readable medium. The processor(s) may be configured to save metadata including a list of derived constants on the computer-readable medium in a file separate from the tagged code. The metadata may be used to determine whether other computer program code is derived from the tagged code.

[0007] Another aspect of the present disclosure relates to a computer-implemented method for enabling software tracing. The method may include receiving a tagged input code corresponding to a computer program. The method may include identifying a location of the tagged input code that may be modified in a manner that preserves the functionality of the computer program. The method may include applying at least one code transformation to the tagged input code. Each of the at least one code transformation may have a specific intrinsic constant. The method may include deriving a derived constant from the specific intrinsic constant and injecting the transformation including the derived constant into the tagged input code. The method may include deriving the derived constant from the specific intrinsic constant and saving the results of the above steps as tagged code on a computer-readable medium. The method may include saving metadata including a list of derived constants on a computer-readable medium in a file separate from the tagged code. The metadata may be used to determine whether other computer program code is derived from the tagged code.

[0008] Yet another aspect of the present disclosure relates to a non-transitory computer-readable storage medium having instructions embodied thereon, the instructions being executable by one or more processors to perform a computer-implemented method for enabling software tracing. The method may include receiving a tagged input code corresponding to a computer program. The method may include identifying a location of the tagged input code that may be modified in a manner that preserves the functionality of the computer program. The method may include applying at least one code transformation to the tagged input code. Each of the at least one code transformation may have a specific intrinsic constant. The method may include deriving a derived constant from the specific intrinsic constant, injecting the transformation including the derived constant into the tagged input code. The method may include deriving the derived constant from the specific intrinsic constant, saving the results of the above steps as tagged code on a computer-readable medium. The method may include saving metadata including a list of derived constants on the computer-readable medium in a file separate from the tagged code. The metadata may be used to determine whether other computer program code is derived from the tagged code.

[0009] Yet another aspect of the present disclosure relates to a computer-implemented system for detecting watermarks in software, the system comprising: one or more hardware processors configured by machine-readable instructions to: receive a marker code corresponding to at least a portion of a computer program, wherein the marker code is created by: identifying a location of a marker input code that can be modified in a manner that preserves the functionality of the computer program, applying at least one code transformation to the marker input code, each of the at least one code transformation having a specific intrinsic constant from which a derived constant is derived; and injecting the transformation including the derived constant into the marker input code as watermark data. Scanning the marker code for a specific pattern associated with the watermark data.

[0010] These and other features and characteristics of the present technology, as well as the methods of operation and function of the related structural elements and the economy of combination and manufacture of the parts will become more apparent by considering the following description and the appended claims with reference to the accompanying drawings, all of which form a part of this specification, in which the same reference numerals designate corresponding parts in the various figures. However, it should be clearly understood that the drawings are for illustration and description purposes only and are not intended as a definition of limitations of the present invention. As used in the specification and claims, the singular forms of "a", "an", and "the" include plural referents unless the context clearly indicates otherwise. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a schematic representation of a computer-implemented system for enabling software watermarking and software tracking, according to one or more implementations.

[0012] Figure 2 is a flow chart of a computer-implemented method for enabling watermarking of software in accordance with one or more implementations.

[0013] Figure 3 is a schematic data flow diagram according to one or more implementations.

[0014] Figure 4 is a schematic data flow diagram according to one or more implementations.

[0015] Figure 5 is a flow chart of a method of operation of a computer-implemented detection system in accordance with one or more implementations.

[0016] Figure 6 is a schematic data flow diagram of the blind detection mechanism.

[0017] Figure 7 is a schematic data flow diagram of a non-blind detection mechanism.

[0018] Figure 8 is a schematic diagram of the code scanning example. DETAILED DESCRIPTION

[0019] Software is often provided or otherwise made available to a party whose goals may be inconsistent with, or even outright conflicting with, the goals of its provider. For example, a party may wish to eliminate program logic in a distributed software or hardware-software system with the intent to prevent unauthorized use or use without payment, or may wish to prevent a billing function in the software from recording the full extent of usage in order to reduce or eliminate payments by the user to the provider, or may wish to steal copyrighted information for illegal redistribution.

[0020] It is well known that attacks on software are prevented by obfuscating the organization of the software code or making the organization of the software code more chaotic and therefore more difficult to modify. The term "obfuscation" as used herein refers to adding elements to the source code to make the variables, data or control flow of the executable code more difficult to understand without changing the functionality of the resulting executable code.

[0021] In a relatively simple example of obfuscation, variable names can be replaced with random strings. For example, each occurrence of the variable name "SecurityCode" can be replaced with the string "1xcd385mxc", making it more difficult for an attacker to identify the variable. Various mechanisms are known to protect software by shielding it or rendering it tamper-proof. For example, by increasing the interdependencies of parts of the software, the software may be rendered very vulnerable under modification. In addition, the software may deploy mechanisms that render normal debuggers inoperative. In addition, the software may deploy integrity verification mechanisms that check whether the currently executed software is in the form intended by its provider by periodically performing checksum checks on the code and issuing tampering diagnostics when a checksum mismatch occurs, or replacing modified code with the original code (code repair). In addition, a specific kind of data flow network called a cascade can be interwoven throughout the code in an attempt to greatly increase the density of interdependencies within the code. The protection can also take the form of a many-to-many mapping of code sites to software functional fragments. Furthermore, geometric transformations in multidimensional space can cause data addressing to be interdependent and change over time, leading to more ambiguous and fragile addressing codes.

[0022] The example of the code conversion software that is used to enhance security is known.For example, the U.S. Patent 8,161,463 entitled " System and Method of Interlocking to Protect Software-Mediate Program and Device Behaviors ", the U.S. Patent 7,966,499 entitled " System and Method for Obscuring Bit-wise and Two's Complement Integer Computations in Software " and the U.S. Patent 6,594,761 entitled " Tamper Resistant Software Encoding " all teach the system and method that software part is carried out code conversion in the mode that increases software security.

[0023] Each of these methods results in the injection of elements into the code when the program mathematics is subjected to a code transformation, such as a large number of relatively different constants. The result is that derived constants, which are essentially mathematical combinations of constants from the original applied mathematics along with constants inherent to the code transformation, are created. The disclosed implementations can utilize these derived constants for watermarking purposes. While derived constants can result from an obfuscation process, derived constants can also be the result of a process that is not intended to be obfuscated.

[0024] The watermarks described herein are applied to code, which is referred to herein as "marked input code". The marked input code can be in the form of source code, or some derived binary representation, including but not limited to so-called intermediate representations, up to binary executable form. The marked input code is processed to identify locations where program code and data can be modified in a way that preserves functionality, and to perform those modifications. The modifications cause new constants to appear in the code. The new constants are entangled with the code and can form the basis of watermarks in the marked code. Candidate code can be scanned for watermark detection. The watermarks described herein are difficult to remove from marked code because the constants cannot be changed or deleted without changing the functionality of the program. In other words, the watermark is "entangled" with the code.

[0025] Figure 1 A computer-implemented system 100 for enabling tracking software by watermarking is illustrated according to one or more implementations. In some implementations, the system 100 may include one or more servers 102. The server(s) 102 may be configured to communicate with one or more distribution platforms 104 over a network such as the Internet. Users may access the system 100 via a client computing platform(s) (not shown) or through other user interface devices.

[0026] The server(s) 102 may be configured by machine readable instructions 106 executed by computer processor(s) 128. The machine readable instructions 106 may include one or more instruction modules. The instruction modules may include computer program modules. The instruction modules may include one or more of an input code receiving module 108, a location identification module 110, a code transformation application module 112, a constant derivation module 114, a metadata preservation module 116, a value constraint module 118, a processing module 120, a metadata update module 122, and / or other instruction modules.

[0027] The input code receiving module 108 may be configured to receive a tagged input code corresponding to an executable computer program. For example, as a non-limiting example, the tagged input code may be one of a source code, an LLV bit code, a binary code, or an interpretable code such as javascript. The tagged input code may be in an executable form, or may require further processing before execution. In some implementations, the further processing may include compiling, optimizing, linking, and / or interpreting the tagged code.

[0028] The location identification module 110 can be configured to identify the location of the mark input code, which can be modified in a manner that retains the function of the computer program corresponding to the mark input code. The code transformation application module 112 can be configured to apply at least one code transformation to the mark input code. Each of the at least one code transformation can have a specific intrinsic constant. The constant derivation module 114 can be configured to derive the derived constant from the specific intrinsic constant. The code transformation application module 112 then injects the derived constant into the mark input code. The code transformation application module 112 and the constant derivation module 114 work in association with each other. The constant derivation module determines the derived constant to be injected, and the code transformation module 112 injects the derived constant together with the additional executable instructions. The derived constant is fundamentally linked to the transformation itself, and it is very difficult to remove them without destroying the transformation and thus changing the function of the code. The result of the above steps can be stored on a computer readable medium as a mark code.

[0029] The derived constants may be a mathematical combination of constants in the marked input code and intrinsic constants. The derived constants may be used as watermarks, and the metadata may be used in conjunction with a detection algorithm to determine whether other candidate computer program code is derived from at least a portion of the marked code. As a non-limiting example, the steps of identifying, applying, deriving, and / or injecting may be part of an obfuscation process that renders the computer program more difficult to understand without adversely affecting the functionality of the code.

[0030] As non-limiting examples, the detection algorithm may scan other computer program code for the presence of a specified percentage of derived constants, scan within a portion of candidate computer program code for constants in a corresponding portion of flagged code, scan candidate computer program code for derived constants identified as being from the same function across all similarly sized chunks, scan candidate computer program code for derived constants within a certain distance from already found derived constants, scan candidate computer program code for derived constants having certain properties, and / or scan candidate computer program code for the closest match to a derived constant. Applying the transformation may include transforming a control flow including introducing a switch statement on the flow based on setting dummy variables to different random values ​​and the derived constants being random values.

[0031] Applying code transformations may include transforming enumeration values, and the derived constants are substituted enumeration values. As non-limiting examples, the detection algorithm may be applied to object code static libraries, shared libraries, and / or executable files. The portion of the marked code may be a fraction of the marked code. The detection algorithm may detect a fraction of the watermark in other computer program code. Note that in Figure 1 , the detection system 124 is shown as being distinct from the server(s) 102 and coupled to the server(s) 102 via a network. However, the detection system 124 can be part of the server(s) 102. Furthermore, the detection system 124 need not be coupled to the server(s) 102 via a network. Figure 5-8 Describe in more detail.

[0032] In one implementation, the location identification module 110 looks for mathematical operations (e.g., addition, multiplication, XOR, comparison) in the received markup input code, and the code transformation application module 112 modifies the representation of both the associated data and the operation on the data, transforming the original representation into an alternative form. As an example, the operation z=x+y may be transformed using one or more of the following code transformation processes:

[0033] - transform the input data x into an alternative form x' = a*x + b, where a and b are constants chosen randomly over a finite ring 2n, where n is the size of x in bits;

[0034] - Transform the input data y into y' = c*y + d;

[0035] - Transform the output data z into z' = e*z + f;

[0036] - Transform the addition z = x + y to z' = gx' + hy' + j, where g, h and j are derived constants, calculated as:

[0037] g = e*a-1

[0038] h = e*c-1

[0039] j = f - e*a-1 *b - e*c-1 *d.

[0040] The constants a through f may or may not appear in the code, but the constants g, h, and j will be added, i.e., injected, into the code by the constant export module 114 to perform the operation in the transformed space. The direct result of these transformations will be to modify the labeled input code and inject many different constants into the code to create the labeled code. Furthermore, these constants are largely unconstrained - in the example above, a, c, and e must be odd numbers, while b, d, and f can be freely chosen. For operations on 32-bit values, there are 2 31 possibilities, and for j there are 2 32 possibilities.

[0041] Implementations of the present invention may modify other locations and may also produce large different constants in other ways. For example, control flow flattening techniques may be used as a transformation to introduce switch statements on flow based on setting dummy variables to different random values. Specific value choices may be embedded in the code as constants. Additionally, alternative / transformed enumeration constants may also be injected. As an example of this, " " will usually give the values ​​on=0 and off=1, but this could be transformed to on=0x718234923 and off=0xa124.

[0042] The metadata storage module 116 may be configured to store the tag metadata including the list of derived constants on a computer-readable medium in a file separate from the tag code. The metadata may be stored in the electronic storage device 126 and / or the memory of the detection system 124. The metadata may be used to determine whether other computer program code is derived from the tag code, as described below with reference to Figure 5-8 For each exported constant, the metadata may further include a value of the exported constant and context information related to the exported constant. As non-limiting examples, the context information may include information indicating whether the exported constant appears within a function or in global data, the compilation unit in which the exported constant appears, the expected proximity of the exported constant to other exported constants, and / or possible alternative representations of the exported constant.

[0043] The value constraint module 118 may be configured to constrain the values ​​of the derived constants. For example, a minimum constant ratio may be imposed (x constants per y bytes of code). As another example, additional constraints may be imposed on the constants as a way of storing additional information in the watermark. For example, the constraint may be that at least 50% of the constants are divisible by 3 (as opposed to 33% which is random). The processing module 120 may be configured to further process the marked code to produce a binary executable file. The further processing may be compiling, linking, or other processes as noted above.

[0044] The metadata update module 122 may be configured to update the metadata after storing the metadata. The update may include removing at least one derived constant from the derived constant list and / or adding context information related to at least one derived constant. As described below, the update may be configured to facilitate watermark detection. Reasons for updating the metadata to remove a constant may include:

[0045] No constants can be found in this representation of the code (e.g., constants removed by optimization);

[0046] The constant appears too frequently in this representation of the code; and / or

[0047] The constant does not satisfy the identity constraints (too small, not divisible by 3, etc.).

[0048] New or changed contextual information from later stages can include:

[0049] Updated information about the location of functions (e.g., the compiler can inline functions into other functions);

[0050] In which section of the target file the constant appears (code section, bss section, etc.);

[0051] New or revised information regarding proximity to other constants; and / or

[0052] The section in which this constant appears in the linked executable.

[0053] A separate tagging metadata file can be created at each stage, or the original tagging metadata file can be updated. The former approach can be beneficial if it is desired to perform watermark detection on different code representations (e.g., source code found on github). The latter is beneficial in reducing storage requirements. The tagging metadata can be specifically named. For example, the metadata can be named source code tagging metadata, post-compilation tagging metadata, or binary executable tagging metadata. The tagged code can be classified as tagged target files, tagged binary executable files, etc. If there is a minimum constant ratio as a constraint, it can be enforced at any stage, causing rejection of the tagging software, and if the tagged code does not meet the constraint, the watermarking process for the tagged input code is restarted.

[0054] Server(s) 102 may include electronic storage 126, one or more processors 128, and / or other components. Server(s) 102 may include communications links or ports to enable information exchange with a network and / or other computing platforms. Figure 1The illustration of the server(s) 102 in FIG. 1 is not intended to be limiting. The server(s) 102 may include multiple hardware, software, and / or firmware components that operate together to provide the functionality attributed herein to the server(s) 102. For example, the server(s) 102 may be implemented by a cloud as a computing platform on which the server(s) 102 operate together.

[0055] The server(s) 102, the distribution platform(s) 104, and / or the detection system 124 may be operably linked via one or more electronic communication links. For example, such electronic communication links may be established at least in part via a network such as the Internet and / or other networks. It will be appreciated that this is not intended to be limiting, and the scope of the present disclosure includes implementations in which the server(s) 102, the distribution platform(s) 104, and / or the detection system 124 may be operably linked via some other communication medium or not linked at all.

[0056] The detection system 124 may include one or more processors configured to execute computer program modules. As a non-limiting example, the detection system 124 may include one or more servers or other computing devices.

[0057] Electronic storage 126 may include non-transitory storage media that electronically stores information. The electronic storage media of electronic storage 126 may include one or both system storage devices that are integrally (i.e., substantially non-removable) provided with server(s) 102, and / or removable storage devices that are removably connectable to server(s) 102 via, for example, a port (e.g., a USB port, a FireWire port, etc.) or a drive (e.g., a disk drive, etc.). Electronic storage 126 may include one or more of the following: optically readable storage media (e.g., optical disks, etc.), magnetically readable storage media (e.g., magnetic tape, magnetic hard disk, floppy drive, etc.), charge-based storage media (e.g., EEPROM, RAM, etc.), solid-state storage media (e.g., flash drives, etc.), and / or other electronically readable storage media. Electronic storage 126 may include one or more virtual storage resources (e.g., cloud storage, virtual private networks, and / or other virtual storage resources). Electronic storage 126 may store software algorithms, information determined by processor(s) 128, information received from server(s) 102, and / or other information that enables server(s) 102 to function as described herein.

[0058] Processor(s) 128 may be configured to provide information processing capabilities in server(s) 102. As such, processor(s) 128 may include one or more of a digital processor, an analog processor, a digital circuit designed to process information, an analog circuit designed to process information, a state machine, and / or other mechanisms for electronically processing information. Figure 1 128 is shown as a single entity, but this is for illustration purposes only. In some implementations, the processor(s) 128 may include multiple processing units. These processing units may be physically located within the same device, or the processor(s) 128 may represent processing functions of multiple devices operating in coordination. The processor(s) 128 may be configured to execute modules 108, 110, 112, 114, 116, 118, 120, and / or 122 and / or other modules. The processor(s) 128 may be configured to execute modules 108, 110, 112, 114, 116, 118, 120, and / or 122 and / or other modules by software; hardware; firmware; some combination of software, hardware, and / or firmware; and / or other mechanisms for configuring processing capabilities on the processor(s) 128. As used herein, the term "module" may refer to any component or set of components that perform the functions attributed to the module. This may include one or more physical processors, processor readable instructions, circuits, hardware, storage media, or any other component during execution of processor readable instructions.

[0059] It should be appreciated that although modules 108, 110, 112, 114, 116, 118, 120, and / or 122 are Figure 1128 as being implemented within a single processing unit, but in implementations where the processor(s) 128 include multiple processing units, one or more of the modules 108, 110, 112, 114, 116, 118, 120, and / or 122 may be implemented remotely from the other modules. The description of functionality provided by the different modules 108, 110, 112, 114, 116, 118, 120, and / or 122 described below is for purposes of illustration and is not intended to be limiting, as any of the modules 108, 110, 112, 114, 116, 118, 120, and / or 122 may provide more or less functionality than described. For example, one or more of the modules 108, 110, 112, 114, 116, 118, 120, and / or 122 may be eliminated, and some or all of their functionality may be provided by other modules of the modules 108, 110, 112, 114, 116, 118, 120, and / or 122. As another example, the processor(s) 128 may be configured to execute one or more additional modules that may perform some or all of the functionality attributed below to one of the modules 108, 110, 112, 114, 116, 118, 120, and / or 122.

[0060] Figure 2 A method 200 for watermarking software according to one or more implementations is illustrated. The operations of method 200 presented below are intended to be illustrative. In some implementations, method 200 may be accomplished with one or more additional operations not described, and / or without one or more of the operations discussed. Additionally, the operations of method 200 may be performed in a manner that is not described in detail. Figure 2 The order illustrated in and described below is not intended to be limiting.

[0061] In some implementations, method 200 may be implemented in one or more processing devices (e.g., digital processors, analog processors, digital circuits designed to process information, analog circuits designed to process information, state machines, and / or other mechanisms for electronically processing information). The one or more processing devices may include one or more devices that perform some or all of the operations of method 200 in response to instructions stored electronically on an electronic storage medium. The one or more processing devices may include one or more devices configured by hardware, firmware, and / or software that are specifically designed to perform one or more operations of method 200.

[0062] Operation 202 may include receiving a markup input code corresponding to a computer program. According to one or more implementations, operation 202 may be performed by one or more hardware processors configured by machine-readable instructions, including modules that are the same or similar to the markup input code receiving module 108 .

[0063] Operation 204 may include identifying a location of the mark input code, which may be modified in a manner that preserves computer program functionality. According to one or more implementations, operation 204 may be performed by one or more hardware processors configured by machine-readable instructions, the machine-readable instructions including a module that is the same or similar to the location identification module 110.

[0064] Operation 206 may include applying at least one code transformation to the mark input code. Each of the at least one code transformation may have a specific intrinsic constant. According to one or more implementations, operation 206 may be performed by one or more hardware processors configured by machine-readable instructions, and the machine-readable instructions may include a module identical or similar to the code transformation application module 112.

[0065] Operation 208 may include deriving derived constants from specific intrinsic constants, injecting derived constants into the tag input code. According to one or more implementations, operation 208 may be performed by one or more hardware processors configured by machine-readable instructions, the machine-readable instructions including a module that is the same or similar to constant derivation module 114.

[0066] Operation 210 may include saving the results of the above steps as markup code on a computer readable medium. According to one or more implementations, operation 210 may be performed by one or more hardware processors configured by machine readable instructions, including modules identical or similar to constant derivation module 114.

[0067] Operation 212 may include saving metadata including the list of derived constants on a computer-readable medium in a file separate from the markup code. The metadata may be used to determine whether other computer program code is derived from the markup code. According to one or more implementations, operation 212 may be performed by one or more hardware processors configured by machine-readable instructions, the machine-readable instructions including a module that is the same or similar to metadata saving module 116.

[0068] Watermark detection can be performed by the detection system 124 ( Figure 1) is done and can be done on software in a variety of forms, such as source code, derived binary representations including but not limited to "intermediate representations", object code, static libraries, all the way to binary executable forms, including executable files and shared libraries. Software that is scanned to detect watermarks is called "candidate software". Candidate software can be software that has been used or distributed inappropriately, or software that is suspected of being derived from marked software. There may be a single candidate software segment, or there may be many candidate software segments. The candidate software is evaluated using a detection algorithm, and the output can be "watermark found" or "watermark not found".

[0069] The basic format of a detection algorithm can be very simple - search for a constant in the candidate software. The search can be byte-by-byte, word-by-word, or another way; it can be sequential or random; it may look at all the candidate software, or just a portion; it may be format-aware, or not format-aware.

[0070] One or more of the above-described tagged metadata may be provided to the detection system 124, and will look for specific watermarks or associated patterns in the candidate software. The metadata may be in a specific form associated with a specific form of the candidate software (e.g., source code of the tagged metadata when viewing a source code representation). The detection system 124 executes the detection algorithm and accesses the tagged metadata alone or in combination with the electronic storage device 126 as needed.

[0071] Figure 3 The data flow of the disclosed implementation is illustrated. The tag input code is provided as input to a tagging system, such as (one or more) servers 102. Continued insertion results in tag codes and metadata as described above. The tag code is provided directly or indirectly to the distribution platform 104. The metadata can be provided to the detection system 124 for use in the manner described below.

[0072] Figure 4 The data flow of the disclosed implementation is illustrated, wherein the code is subjected to further processing after marking. As disclosed above, the further processing may be compiling, linking, or other processing that produces executable code. The marked input code is provided as input to a marking system, such as (one or more) servers 102. Continued insertion results in marked code and metadata as described above. The marked code is then subjected to further processing, such as compilation and linking, to create an executable file that is provided directly or indirectly to the distribution platform 104. For example, the metadata is updated in the manner described above, and the filtered metadata is provided to the detection system 124 for use in the manner described below. As noted above, filtering may include removing constants or other manipulations of the metadata based on the processing completed after marking.

[0073] Figure 5A method 500 is illustrated in which the detection system 124 operates at a high level. In step 502, a candidate code is received, i.e., made available to the detection system 124. Again, the candidate code may be an entire application or only a portion of an application, and may take various forms as noted above. In step 504, the candidate code is scanned according to a detection algorithm. Examples of detection algorithms are discussed in more detail below. In step 506, based on the detection algorithm, it is determined whether a watermark is present. Of course, the presence of a watermark is evidence that the candidate code is a copy of or derived from a marked code.

[0074] A "blind" detection algorithm is one that scans candidate software based on specific rules, without direct access to tag metadata for comparison. In other words, it is not comparing the candidate software to any other software, it is simply looking for a predetermined pattern. A non-blind detector is provided with one or more segments of tag metadata, and will look for specific watermarks in the candidate software based on the metadata. Any of a variety of detection mechanisms may be used in conjunction with the present invention. In non-blind detection, a specific form of metadata associated with the specific form the software takes (e.g., source code tag metadata when viewing a source code representation) may be used. Alternatively, general metadata may be used. In non-blind detection, the output may be refined as "watermark not found" or "watermark xyz found," naming the specific tag or tagged software segment that was matched.

[0075] Figure 6 The diagram shows the data flow of the blind detection algorithm. Figure 6 In , as input to the detection system 124, candidate software is subjected to scanning according to one or more detection algorithms that look for specified patterns. The output is the detection result.

[0076] Figure 7 The diagram shows the data flow of the non-blind detection algorithm. Figure 7 In , the candidate software is scanned as input to the detection system 124 according to one or more detection algorithms. The detection algorithm can access the above-mentioned tag metadata to find the specified constants and / or patterns indicated by the metadata. The output is the detection result. Note that in Figure 7 , metadata is shown as being stored within detection system 124. However, metadata may be stored elsewhere and accessed by detection system 124.

[0077] Various detection algorithms may be used, and the algorithms may range from very simple to more complex. Non-limiting examples of detection algorithms include:

[0078] Scan the tag metadata for the presence of a certain percentage of constants;

[0079] scanning within a portion of the candidate software for constants in a corresponding portion of the marked software;

[0080] Scanning for constants identified as being from the same function across all similarly sized chunks of candidate software;

[0081] Scan for constants within a certain distance from already found constants, scan for constants with certain properties (e.g., divisible by 3); and

[0082] Scanning for the closest match to a constant (eg, constant ±1, -constant) is a basic means of detecting tampering with the watermark.

[0083] In one implementation, the detection system 124 includes a framework into which various detection algorithms can be plugged in, e.g., programmed and / or selectively executed. If simpler detection algorithms do not produce deterministic results, more advanced (and potentially slower) algorithms are run to add determinism. The algorithms can be set to achieve desired false positive (incorrectly finding a watermark) and false negative (watermark missing) rates, and the detection algorithms can be executed in combination until the desired rates are achieved. Some non-limiting examples of tuning the detection system 124 to achieve desired results are set forth below.

[0084] In one scenario, a software creator encapsulates valuable intellectual property in one or more functions of a software program. It is assumed that this IP is worth protecting against reverse engineering, and the code is written in such a way that it would be worthless for an attacker to lift only part of it (essentially, this means that the attacker will not lift half of the function; this is difficult to do anyway). If the attacker lifts the code intact, the entire watermark associated with the code will be found in the pirated program. In most cases, these assumptions are unnecessary, but they facilitate the explanation of the possible mathematical model.

[0085] The format of the stolen code (candidate code) in the pirated program will be roughly the same as the original one. In particular, we can assume that if the code originally occupies b bytes, it will occupy no more than k*b bytes after decryption, where k is a parameter analyzed below. The upper limit on the size of the candidate program can be set to 100GB to balance resources and detection accuracy.

[0086] As an example, the desired false positive rate can be set to 10 -9 , i.e., less than one in a billion chance of falsely determining that a program was derived from the watermarked code. In practice, this number can be adjusted based on the specifics of the application. The actual probability of a false positive is likely to be much lower, because once a candidate has been identified, it can be manually analyzed to look for other features, most importantly its functionality.

[0087] refer to Figure 8, the number of constants in the watermarked code will be denoted as m. In the case where the watermark is embedded in b bytes of code, the detection system 124 can scan a range of t = 2 * k * b bytes at a time (one such range is indicated at 802), where each chunk has 50% overlap with the previous chunk. If the assumption that the watermark appears within a k * b byte range holds, the detection algorithm is guaranteed to find the watermark. A reasonable value for k is 4.

[0088] Then, the maximum number of chunks to be scanned is (if k = 4, it is ). The actual number of chunks for a given program can be denoted as h. If one of the t - byte chunks has all m watermark constants within it, a false positive will occur. However, the likelihood of this happening randomly is very small. This can be modeled as follows: in t independent trials of an experiment with n possible outcomes, what is the likelihood that all m specified outcomes occur. (Note that m < t, otherwise the likelihood is trivially 0). Call this value . Since t is relatively small compared to n, this can be approximated as , where n = 2 32 . Then, across all chunks, the probability of a false positive is .

[0089] Experimentally, this can be approximated as . Recall that h varies inversely with t, and for m > 1, the smaller t is, the smaller the likelihood of a false positive. Since t is just a multiple of b, where b is the size of the original code, we find that for a fixed - size watermark, there is essentially no lower bound on the size of the watermarkable code, because the smaller the code, the more robust the watermark. In the case of a 100 - GB candidate program, the result is that for small t (< 1000), only 3 constants are needed to keep the false - positive rate below 10 -9 . This shows that any code with enough operations during marking to generate 3 persistent constants can be protected. Depending on the functionality, this could be as small as a single - line of code.

[0090] Another consideration is the size of the candidate code required for watermark detection. In cases such as examples like proprietary codecs or white - box encryption implementations, the complete encapsulation of valuable IP can be considered to be no less than 1 KiB and perhaps no more than 100 KiB. Depending on the choice of k, this suggests that t values are between 1 and 1000 KiB. In the case where m = 4 and t = 1000000, the false - positive rate is at 6 * 10 -10Or so. Now, in this case, while larger t requires larger m as a percentage overhead, the smaller m / t becomes the larger t you get. Regardless, 4 constants in 1 KiB or more of code is a tiny overhead, far less than what we would normally expect for hiding valuable IP. From another perspective, if the transformed code is only used for watermarking purposes, and not obfuscation or other processes / purposes, then marking can be done with a very small performance penalty.

[0091] Piracy detection, i.e., detecting the unauthorized use and distribution of code, is a common use of watermarking. Although some cities are known as illegal distributors, it may be difficult to identify the relevant software of concern among the millions of software applications on these websites. In addition, the "pirate" may take the step of disguising the software. In addition to obvious things such as changing the file name and date, removing copyright information and stripping code signatures, the pirate may try to change the size of the file, and may even try to change some instructions that are considered harmless. Simple hash / signature comparisons will usually not work.

[0092] However, if the pirate fills the file with multiple GB of zeros or random data, this can be detected and stripped out. Therefore, it is practical to assume that the code size of the pirated program is no more than k times the code size of the original program (k is defined above). As in the case of IP theft, the pirate has limited ability to move constants around without affecting the functionality of the program. Therefore, if a set of watermark constants appear within b bytes of the original program, they appear within k*b bytes in the pirated program.

[0093] It can be assumed that the code segment of the entire application is at least 100KiB in size. Again, with an upper limit of 100GB for the size of the candidate program (and therefore an upper limit of (100 / k)GB for the size of the original marked code), a portion of the candidate program can be downloaded to distinguish the code segment from other segments. The watermarks can be distributed throughout the code. As discussed above, the overhead of watermarking is small. There may be some functions that are more heavily converted by the code and therefore generate a large number of constants, but we can assume that there are some minimum number of constants in each part of the code.

[0094] Assuming that we can receive the entire candidate download and that the pirate has not altered the watermark, the false positive rate can be set to the desired maximum level. The false negative rate will be 0; any candidate program that meets the watermark threshold will be identified as a pirated program. For example, for 10 -9 Given the expected false positive rate, we can determine the minimum number of candidate programs that must be analyzed without violating the watermark. -9Given the expected false positive rate, we can determine how much of the watermark must be intact. In other words, the difficulty for pirates to disguise the software and avoid detection can be adjusted based on situational characteristics such as code value, bandwidth, etc.

[0095] As an example, a conservative minimum watermark ratio of 1 constant per 1000 bytes of code can be set. There is no direct conversion between constants / KiB and performance overhead, but it is safe to assume that at this ratio the overhead should be small for most programs. Based on these assumptions, there are at least 100 watermark constants in the marked software.

[0096] If the candidate program has been downloaded (or otherwise received / accessed), the candidate program can be scanned one chunk at a time. For convenience, chunks of k*100 KiB can be used and mapped to the corresponding 100KiB of the marked program. Thus, at least 100 specific watermark constants are identified. If the candidate program is a pirated program, i.e., derived from the marked code, all of these constants would be expected to appear. However, the probability that all of these constants appear in a non-pirated program is very low. For all reasonable values ​​of k (e.g., < 1000), this number is much smaller than 10 -100 Furthermore, this number doubles with each chunk. For example, if 10 chunks are scanned, this number is less than 10. -1000 , for 100 blocks, it is 10 -10000 , etc. Based on the selected minimum program size, the false positive rate is at most 10 -100 .

[0097] Furthermore, for every k KiB of the candidate program, there will be at least 1 watermark constant if the candidate program is a pirated program. The probability of seeing the identified constant in a non-pirated program varies with k. Again, looking at the extreme example case of k=1000, the probability is Therefore, in order to get 10 -9 or a smaller false positive rate, we can download 3 chunks of k KiB ( ). This suggests that it may not be necessary to download the entire candidate program to determine whether it is a pirated program.

[0098] Suppose the candidate programs are scanned, and d watermark constants are found for each k*100 KiB. d may be smaller than expected, because the pirates have taken active steps to change the software to break the watermark constants. As above, this is quite difficult to do, but the question can still be asked: how many watermarks must persist in order to still be detected. The answer depends on the desired false positive rate, such as less than 10, for example. -9For a given ratio, we can calculate the minimum value of d that achieves that ratio. For example, with k=1000 and d=6, the false positive rate is 1.5*10 -10 Therefore, only 6% of the watermark must be intact to achieve a resolution better than 10 -9 Distinguish non-pirated programs from pirated programs with a false positive rate of .

[0099] The above mentioned It can be defined as follows: In t independent trials of an experiment with n possible outcomes, what is the probability that all m specified outcomes occur. For clarity, we can assume that the m outcomes must all be different. To give a concrete example, if the die is rolled 5 times, what is the probability that you see 1, 2, and 3 all together.

[0100] Consider the conditions for m, n, and t:

[0101] : You can't roll the dice 1.5 times, or see 2 or 3 results.

[0102] n>0: The experiment must have at least 1 possible outcome.

[0103] t>0: There must be at least 1 trial.

[0104] : It doesn't make sense to specify a negative number for the result, but m = 0 means we place no restrictions on the result.

[0105] : Because all specified outcomes must be distinct, the maximum m is the total number of possible outcomes.

[0106] The number of ways to obtain a given result / Total of results . Let's The numerator of this fraction is labeled as the number of ways to do t independent trials of an experiment with n possible outcomes, including all m specific and distinct outcomes. The denominator is easy to calculate: because each trial is independent, there are a total of n t possible results.

[0107] consider Some basic information

[0108] n t This leads to , as expected.

[0109]

[0110] If m > t, then .

[0111] Now consider two cases. The given trial either matches one of the specified outcomes or it does not. If it does (m possibilities), then there is one fewer matching outcome and one fewer trial to make it. If it does not (n - m possibilities), then there are the same number of outcomes to match and one fewer trial to make it. Thus, the recurrence formula for Q is:

[0112] .

[0113] Ignoring the case where m > t, for which the formula is unnecessary, if we maintain the recurrence, we will eventually always reach either m' = 0 or m' = t', one of the base cases. By convention, the primes in the above statements are meant to distinguish the variables from the original constants m and t. Applying the formula to the rolling dice example above yields:

[0114]

[0115] .

[0116] Unfortunately, the formula is difficult to use in practice because the depth of the recursion is large and the numbers involved quickly become very large. However, the formula can be approximated. First, it can be recognized that:

[0117] .

[0118] Using induction, it can be shown that the expansion of via the recursion will generate (t choose m) terms. Each term will be of the form where t' < t, or each term will be of the form where m' < m. Each term is generated by the recursion where m and t are reduced m times and t is further reduced t - m - t' times. The reduction of m and t together gives the product of the coefficients . The reduction of t alone gives the product of t - m - t' coefficients . Finally, itself is . Thus we have the term .

[0119] Each term is generated by the recursion where m and t are reduced m - m' times and t is further reduced t - m times. The reduction of m and t together gives the product of the coefficients and the reduction of t alone gives the t - m coefficients Finally, Itself is . So we have the term .

[0120] Putting the items together, we can see that:

[0121]

[0122] And therefore

[0123] .

[0124] Importantly, the formula It has been proven to be overestimated , so the false positive rate is always this in the worst case. Taking into account the simplification, as long as both t and n are larger than m, they are reasonable approximations. It can be seen that the disclosed implementation provides highly robust software watermarking and very accurate watermark detection.

[0125] Description Extension Table

[0126] Although the present technology has been described in detail based on what are currently considered to be the most practical and preferred implementations for purposes of illustration, it should be understood that such details are for that purpose only and that the technology is not limited to the disclosed implementations, but rather is intended to cover modifications and equivalent arrangements within the spirit and scope of the appended claims. For example, it should be understood that the present technology contemplates that, to the extent possible, one or more features of any implementation may be combined with one or more features of any other implementation.

Claims

1. A computer-implemented system for enabling software tracing, the system comprising: One or more hardware processors configured by machine-readable instructions to: receiving a markup input code corresponding to a computer program; Identify locations marking input code that can be modified in a manner that preserves the functionality of the computer program; selecting at least one code transformation to apply to the marked input code, each of the at least one code transformation having a specific intrinsic constant; Deriving derived constants from certain intrinsic constants; injecting the at least one code transformation, including corresponding derived constants, into the marked input code; The result of the above steps is stored as a marking code on a computer readable medium; and Metadata including the list of derived constants on a computer-readable medium is stored in a file separate from the markup code, wherein the metadata can be used to determine whether other computer program code is derived from the markup code.

2. The system of claim 1, wherein the functionality of identifying, applying, exporting and / or injecting is part of an obfuscation process that renders the computer program more difficult to understand without adversely affecting the functionality of the code.

3. The system of claim 1, wherein the identification function comprises identifying a mathematical calculation in the markup input code and the application function comprises modifying a data representation in the mathematical calculation and modifying an operation of the mathematical calculation.

4. The system of claim 3, wherein the derived constant is a mathematical combination of a constant in the input code of the tag and an intrinsic constant.

5. The system of claim 1, wherein the derived constant is used as a watermark and the metadata is used as an input to a detection algorithm to determine whether other computer program code is derived from at least a portion of the marked code.

6. The system of claim 5, wherein the detection algorithm scans other computer program code for the presence of a specified percentage of derived constants, scans for constants in a corresponding portion of the marked code within a portion of the other computer program code, scans other computer program code for derived constants identified as being from the same function across all similarly sized chunks, scans other computer program code for derived constants within a certain distance from already found derived constants, scans other computer program code for derived constants having certain properties, and / or scans other computer program code for a closest match to a derived constant.

7. The system of claim 1, wherein the input code of the token is one of a source code, an LLV bit code, or a binary code.

8. A computer-implemented method for enabling software tracing, the method comprising: receiving a markup input code corresponding to a computer program; Identify locations marking input code that can be modified in a manner that preserves the functionality of the computer program; and selecting at least one code transformation to apply to the marked input code, each of the at least one code transformation having a specific intrinsic constant; Deriving derived constants from certain intrinsic constants; applying at least one code transformation, including injection of corresponding derived constants, into the marked input code; The result of the above steps is stored as a marking code on a computer readable medium; and Metadata including the list of derived constants on a computer-readable medium is stored in a file separate from the markup code, wherein the metadata can be used to determine whether other computer program code is derived from the markup code.

9. The method of claim 8, wherein the steps of identifying, applying, exporting and / or injecting are part of an obfuscation process that renders the computer program more difficult to understand without adversely affecting the functionality of the code.

10. The method of claim 8, wherein the identifying step includes identifying a mathematical calculation in the tag input code and the applying step includes modifying the data representation in the mathematical calculation and modifying the operation of the mathematical calculation.

11. The method of claim 10, wherein the derived constant is a mathematical combination of a constant in the input code of the signature and an intrinsic constant.

12. The method of claim 8, wherein the derived constant is used as a watermark and the metadata is used with a detection algorithm to determine whether other computer program code is derived from at least a portion of the marked code.

13. The method of claim 12, wherein the detection algorithm scans other computer program code for the presence of a specified percentage of derived constants, scans for constants in a corresponding portion of the marked code within a portion of the other computer program code, scans other computer program code for derived constants identified as being from the same function across all similarly sized chunks, scans other computer program code for derived constants within a certain distance from already found derived constants, scans other computer program code for derived constants having certain properties, and / or scans other computer program code for a closest match to a derived constant.

14. The method of claim 8, wherein the marked input code is one of a source code, an llv bit code, or a binary code.

15. A non-transitory computer-readable storage medium having instructions embodied thereon, the instructions executable by one or more processors to perform a computer-implemented method for enabling software tracing, the method comprising: receiving a markup input code corresponding to a computer program; Identify locations marking input code that can be modified in a manner that preserves the functionality of the computer program; and selecting at least one code transformation to apply to the marked input code, each of the at least one code transformation having a specific intrinsic constant; Deriving derived constants from certain intrinsic constants; injecting at least one code transformation, including corresponding derived constants, into the marked input code; The result of the above steps is stored as a marking code on a computer readable medium; and Metadata including the list of derived constants on a computer-readable medium is stored in a file separate from the markup code, wherein the metadata can be used to determine whether other computer program code is derived from the markup code.

16. The computer-readable storage medium of claim 15, wherein the steps of identifying, applying, exporting and / or injecting are part of an obfuscation process that renders the computer program more difficult to understand without adversely affecting the functionality of the code.

17. The computer readable storage medium of claim 15, wherein the identifying step includes identifying a mathematical calculation in the tag input code and the applying step includes modifying a representation of data in the mathematical calculation and modifying an operation of the mathematical calculation.

18. The computer-readable storage medium of claim 17, wherein the derived constant is a mathematical combination of a constant in the input code of the token and an intrinsic constant.

19. The computer-readable storage medium of claim 15, wherein the derived constant is used as a watermark and the metadata is used with a detection algorithm to determine whether other computer program code is derived from at least a portion of the marked code.

20. The computer-readable storage medium of claim 19, wherein the detection algorithm scans other computer program code for the presence of a specified percentage of derived constants, scans for constants in a corresponding portion of the marker code within a portion of the other computer program code, scans other computer program code for derived constants identified as being from the same function across all similarly sized chunks, scans other computer program code for derived constants within a certain distance from already found derived constants, scans other computer program code for derived constants having certain properties, and / or scans other computer program code for a closest match to a derived constant.

21. A computer-implemented system for detecting watermarks in software, the system comprising: One or more hardware processors configured by machine-readable instructions to: Receiving markup code corresponding to at least a portion of a computer program, wherein the markup code is created by: Identify locations marking input code that can be modified in a manner that preserves the functionality of the computer program; selecting at least one code transformation to apply to the marked input code, each of the at least one code transformation having a specific intrinsic constant; deriving derived constants from specific intrinsic constants; and at least one code transformation, including injection of export constants into the marked code, and The marking code is scanned for specified patterns associated with the watermark data.

22. The system of claim 21, wherein the list of at least one derived constant is stored in a file separate from the markup code on a computer readable medium, and wherein the scanning is based on metadata.

Images