Research On Code Obfuscation Technology Based On Fingerprint USBKEY

In recent years,with the rapid iterative update of information technology,the software industry also has experienced fast growth.Almost every industry is inseparable from software,and the application scope of software has become wider and wider.Weather in people’s life area or work area,software has gradually become an indispensable factor.In the military field,with the advancement of military informationization construction,various kinds of software play an important role and bear a large number of military secrets in military networks and information systems.On another hand,military software is faced with some security threats,such as unauthorized access,illegal copying and reverse cracking.This paper proposes a code obfuscation technology based on combination of software and hardware,which combines the encryption,fingerprint-based authorized authentication and code obfuscation technologies,aiming at lowering the security risks in access control,anti-copying and anti-reverse protection of the software.The obfuscation equips the programs with the function of verifying the user’s physical identity and operating environment,and also increases the difficulty of reverse analysis,which achieves effective protection of the software.The relevant research results are as follows:(1)Research on encryption-based code obfuscation technology.To solve the problem that the obfuscation effect decreases after the current code obfuscation technology is identified,the OLLVM open source obfuscation technology solution is improved and optimized in aspects of control flow obfuscation and data obfuscation.In terms of control flow obfuscation,in view of the disadvantage that control variables are easily exposed in the flattened control flow,the control variables are encrypted to protect the flattened control flow.As to the simplicity of opaque predicates in the bogus control flow,the augment of opaqueness and the design of encrypted opaque predicates enhance the diversity and concealment of opaque predicates,making it difficult to identify them.Additionally,an encryption-based branch condition obfuscation technology is proposed to protect branch conditions.In terms of data obfuscation,to avoid the leakage of sensitive strings and constants in programs,an obfuscation method based on encrypted strings and constants is proposed to protect sensitive data.(2)Research on function call obfuscation technology based on Windows API callback.By analyzing the working mechanism of Windows API callback functions,a screening method for Windows API functions suitable for code obfuscation is given.The problem of inconsistency between function prototypes and callback function prototypes is solved by using globalized parameters.The critical interval set for these parameters solves the problem of function parameter transfer in multi-thread mode,and realizes the hidden call of functions.Moreover,a function call obfuscation technology based on the construction of address management function is proposed,in which the constructed function manages the addresses of functions to be obfuscated and encrypts the index of these functions.The direct calling method is replaced by an indirect way,which makes the calls between functions more concealed and increases the difficulty for attackers to analyze the calling relationship between functions.(3)Research on authorization and authentication technology based on fingerprint usbkey.By using the fingerprint information to realize the binding of the program and the executor,and by using the machine fingerprint information to realize the binding of the program and the operating environment,the application of encryption technology and code obfuscation technology to integrate the fingerprint information,the machine fingerprint information and the program achieves the binding of "human-computer-program",and the use of usbkey to protect the encryption key enhances the security of the key.Based on the research contents of above three aspects,this paper builds a software protection prototype system,and conducts experimental analysis in three aspects: effect,function and performance.The experimental results show that the code obfuscation prototype system has good effects in terms of security,usability and effectiveness.