Barrier Slicing for Remote Software Trusting

Abstract

Remote trusting aims at verifying the "healthy" execution of a program running on an untrusted client that communicates with a trusted server via network connection. After giving a formal definition of the remote trusting problem and a test to determine whether an attack against a given remote trusting scheme is successful or not, we propose a protection against malicious modification of the client code, based on the replication of a portion of the client on the server. To minimize the size of the code that is replicated, we propose to use barrier slicing. We show the feasibility of our approach on a case study. Our results indicate that a barrier slice is significantly smaller than the corresponding backward slice while providing the same level of protection.

Trading-off security and performance in barrier slicing for remote software entrusting

“…This represents a well-known limitation of program slicing. However, previous studies (Ceccato et al 2007;Krinke 2003Krinke , 2004 report that barrier slices are sensibly smaller than traditional backward slices, which reduces the conservativity issue for our protection technique.…”

“…The barrier slicing solution proposed in (Ceccato et al 2007) uses a completely different approach, in fact it does not rely on any hardware or any precise time computation, which is hard to achieve in the presence of non-collaborative users. The idea here is to use barrier slicing and program transformations to ensure that the critical portion of the client computation that cannot be protected through assertions is executed on the server.…”

“…The core idea of the solution proposed in (Ceccato et al 2007) is to move to the server the portion (slice) of application P that maintains the variables in Unsafe. This ensures that attackers cannot access the variables in Unsafe and therefore it prevents attackers from tampering with them.…”

“…A possible solution is to use program slicing to identify the remaining portion of the client that cannot be verified through assertions, but that is still sensitive. The idea is to move this relevant part of the application from the client to the server, so it can be run untampered (Ceccato et al 2007). A similar approach was used by Zhang and Gupta in order to prevent software piracy (Zhang and Gupta 2003).…”

“…The values of the variables secured in this way can act as barriers and slice computation based on the transitive closure of program dependencies can stop at such barriers, since the server knows these values and is sure that they can be trusted. After computing the barrier slices, program transformations are applied to generate the secured client and the corresponding server (Ceccato et al 2007). If, on the one hand, moving the barrier slice is the optimal solution with regards to security, on the other hand it imposes a performance overhead.…”