Multiple "guards" foil hackers - Software

USA Today (Society for the Advancement of Education), June, 2003

Hackers who try to use or copy software illegally may soon find a sticky web waiting to trap them. It's not the World Wide Web. Instead, it's a new approach under development at Purdue University, West Lafayette, Ind., designed to protect software. By placing a linked brigade of hundreds of tiny "guards" at different points within software code, computer scientists have made it far more difficult for hackers to use software without permission from the vendor.

"Merely cracking a single password won't do it anymore," explains Mikhail Atallah, professor of computer science. "We are distributing security measures throughout the software. It is no longer enough to hack past one point; the guards will notice what you've done and prevent you from using the program. ... We are encouraged by our test results so far. We have been able to add custom levels of security to software without significantly decreasing its speed or increasing the time it takes to download over the Internet."

Traditional software protection measures typically demand that a user enter a password supplied by the vendor at the time of purchase. However, it has proven all too easy for hackers to get past a single security checkpoint, after which they can use a program for free and copy it as often as they wish. "The old way is a lot like having a single guard at the bank," Atallah points out. "Neutralize him, and the vault is yours."

The innovation of Atallah's team lies in connecting the security measures with the software's operation, making the two inextricable. This effectively multiplies the number of guards to dozens or hundreds, and makes it impossible for a hacker to neutralize one guard without the rest noticing. "These measures will deter software piracy for a simple reason--it will become too much of a hassle for a hacker to find and disable all the guards. And we have additional strategies to compound the effectiveness of our approach."

One such strategy involves adding 100 guards to a piece of software, but only having 10 of them actively on the job at a given moment; their membership changes constantly and in secret. Keeping most of the guards "sidelined" in this fashion is one way to keep programs functioning fast, even after the guards are added.

"Security measures like ours must be added to existing software," Atallah maintains. "Historically, this has meant two things in practice: The modified software takes up more memory in your computer, and it runs more slowly. Our approach sidesteps both of those problems by spreading the additional code out in tiny pieces throughout the software."