Software Watermarking Imran Ali CSEP 590TU

What is software watermarking? Embed a secret into software which can be retrieved on demand Embed a secret into software which can be retrieved on demand Watermarks usually contain a client ID, vendor information or some cryptographic information Watermarks usually contain a client ID, vendor information or some cryptographic information

Static Data Watermarks Stored in program itself statically Stored in program itself statically Data Watermarks Data Watermarks Stored in headers, string resources or debug symbols. > strings /usr/local/bin/netscape | \ grep -i copyright Copyright (C) 1995, Thomas G. Lane Code Watermarks Code Watermarks Stored in the code itself int main () { int a = 10; int b = 20; print ("Authored by Alice") ; print (a+b) ; }

Dynamic Watermarks I Stored in program’s execution state Stored in program’s execution state Easter Egg Watermarks Easter Egg Watermarks Runs after an unusual sequence of inputs For example, Open Word document and type = rand (200,99) Press enter and wait 3 seconds... Data Structure Watermarks Data Structure Watermarks Stored in data structure in program String v; if input=I {v[0]=‘C’; v[1]=‘o’; v[2]=‘p’; …}

Dynamic Watermarks II Execution Trace Watermarks Execution Trace Watermarks Embedded within trace of executing program. Example: some sequence of operators/values pushed onto stack. Very rare. Embedded within trace of executing program. Example: some sequence of operators/values pushed onto stack. Very rare. Dynamic Graph Watermarking Dynamic Graph Watermarking Embedding a watermark in the topology of a dynamic built graph structure Embedding a watermark in the topology of a dynamic built graph structure Involves embedding a product of primes embedded in a graph. When a sequence of input are run, graph is built and recognizer function to detect the graph on heap is used. Involves embedding a product of primes embedded in a graph. When a sequence of input are run, graph is built and recognizer function to detect the graph on heap is used. Ownership is proven when recognizer finds watermark and owner can factor the product of primes Ownership is proven when recognizer finds watermark and owner can factor the product of primes

Current Market Java Watermarking Java Watermarking DashO – PreEmptive solutions DashO – PreEmptive solutions.NET Watermarking.NET Watermarking Dotfuscator – PreEmptive solutions Dotfuscator – PreEmptive solutions ThatsMyCode ThatsMyCode

Future Very few commercial vendors in the market Very few commercial vendors in the market Software watermarking is still being researched Software watermarking is still being researched Solutions are getting more complex such as graph-based watermarking Solutions are getting more complex such as graph-based watermarking