F-LaaS: A Control-Flow-Attack Immune License-as-a-Service Model
F-LaaS: A Control-Flow-Attack Immune License-as-a-Service Model
复制标题
DOI：
10.1109/scc.2019.00025
复制
发表时间：
2019-07
期刊：
影响因子：
--
通讯作者：
Sandeep Kumar;Diksha Moolchandani;Takatsugu Ono;S. Sarangi
中科院分区：
文献类型：
--
作者：
Sandeep Kumar;Diksha Moolchandani;Takatsugu Ono;S. Sarangi
我们使用许可证服务器来验证用户的凭据并限制对专有软件的访问。由于后勤原因，使用第三方服务器管理许可证通常是经济的。不幸的是，客户端机器上的用户可以对可执行文件进行复杂的攻击，并试图绕过许可证检查。这可以用来破解软件，因此软件编写者有必要防止这种攻击，包括使用额外的代码来检查二进制文件和控制流的完整性。尽管有这样的技术，依赖于在虚拟机上运行插装二进制文件的现代控制流弯曲（CFB）技术可以规避这样的检查并在运行时改变分支和跳转的行为。然而，它们在计算上效率极低。我们提出了一种基于人工智能的技术，它比最先进的技术快一个数量级，并通过破坏三个广泛使用的许可证管理器和五个常用软件来显示其有效性。最后，我们提出了一种新的许可证管理服务F-LaaS，它将关键功能隐藏在二进制文件中。这些函数在运行时在成功验证许可证后下载。我们发现F-LaaS的平均性能开销可以忽略不计：0.26%。
We use license servers to verify users' credentials and to restrict access to proprietary software. Due to logistical reasons, it is often economical to use third-party servers to manage licenses. Sadly, users on client machines can mount sophisticated attacks on the executables and try to circumvent the license check. This can be used to crack the software, and thus it is necessary for software writers to prevent such attacks, which include the use of additional code to check the integrity of the binary and the control flow. In spite of such techniques, modern control flow bending(CFB) techniques that rely on running instrumented binaries on virtual machines can circumvent such checks and change the behavior of branches and jumps at runtime. They are however extremely computationally inefficient. We propose an AI-based technique that is an order of magnitude faster than the state-of-the-art and show its efficacy by breaking three widely used license managers, and five popularly used software. Finally, we propose a new license management service, F-LaaS, which hides key functions in the binary. These functions are downloaded at runtime upon the successful verification of the license. We show that the mean performance overhead of F-LaaS is negligible: 0.26%.