Software Protection Research Articles

Research Handbook on Patent Law and Practice (Table of Content and Preface)

This significantly updated second edition of the Research Handbook on Patent Law and Practice provides comprehensive coverage of new research for patent protection in three major jurisdictions: the United States, Europe and Japan. Leading patent scholars and practitioners provide an innovative comparative analysis of fundamental issues such as patentability, examination procedure and the scope of patent protection, with current issues such as patent protection for industry standards, computer software and business methods. Updates to this second edition reflect on the dramatic changes that have taken place in the US Patent System since the first edition, including the America Invents Act that has introduced the first-inventor-to-file policy and post issuance proceedings to challenge validity. Current topics, such as the Unified Patent Court, patent litigation updates reform in the US, design patents and patent inventions in medical science, are also addressed.

The state of Microsoft?: the role of corporations in international norm creation

ABSTRACTThis research seeks to understand the role that corporations can play as global cyber norm entrepreneurs via a case study of tech giant Microsoft’s engagement in emergent international cybersecurity norms. Two key questions are addressed, including how Microsoft has been acting as a norm entrepreneur and what these actions indicate about the company's underlying objectives. Understanding Microsoft's processes and aims as a norm entrepreneur can help scholars better determine how corporate actors may fit into – or challenge – both existing norm creation theories and the development of global cyber policies. This research highlights three key takeaways that may inform further research: (1) In contrast to traditionally state-centric IR norm research, more focus is needed on the relationship between corporations and citizens when companies are acting as cyber norm entrepreneurs; (2) Four main objectives drive Microsoft’s attempts at cybersecurity norm entrepreneurship: trust building, software protection, balance of responsibility and sociopolitical influence; and (3) Microsoft provides an empirical example of a private corporation utilising all of Finnemore and Hollis’ tool categories for norm entrepreneurs. Through exploring the paths by which Microsoft strives to influence state behaviour and position themselves as a legitimate stakeholder in global cyber norm debates, we can gain insight into the methods and objectives of this newly identified form of corporate entrepreneurship and better understand the role that private actors may have in the ongoing formation of global cyber norms.

ACEDR: Automatic Compiler Error Detection and Recovery for COTS CPU and Caches

Recently there has been an increasing demand for more powerful processors for the next-generation space missions, such as communication and earth observation. The challenge is how to improve the reliability of the processor under the “single event effects” in orbit. We have previously proposed a new way of implementing any traditional software error detection and correction techniques at instruction level, capable of covering both the CPU and caches of “commercial off the shelf” processors. In this paper, a novel way of evaluation of the software protection is presented, based on a theoretical model and software injection experiments to predict the reliability of the whole processing architecture. The fault injection will evaluate the ability of the protection code to detect and recover errors in addition to the accuracy of the reliability models, by comparing the reliability of the theoretical predictions to the reliability of the injection experiments. Automatic compiler error detection and recovery improves the reliability of the system by reducing the error rate of “single event upsets.” In some benchmarks, the error rate was reduced to less than 1%. This research has been tested in two machines; Intel core i5-3470 and a Raspberry Pi 3. On the first processor, the overhead was less than 15%, and on the second one, the overhead was less than 17%. This research can also be ported to multiple high level languages, with the ability to cover multiple instructions and datatypes.

ОСОБЕННОСТИ АВТОРИЗАЦИИ И ОЦЕНКИ СТОИМОСТИ ВСТРОЕННОГО И ПРИКЛАДНОГО ПРОГРАММНОГО ОБЕСПЕЧЕНИЯ АВИАЦИОННОГО ПРИМЕНЕНИЯ В УКРАИНЕ

It is stated the increase in the complexity and cost of software in the aviation industry in recent years. It is noted that JSC “Element” actively embodies the ideology of software protection, and extends it to the structural elements of computer programs, including those that are embedded software for aviation, and software-technical complexes for testing GTE. It is revealed the key features that determine the need for registration of authorship for software for aviation applications, among which the main one is the fulfillment of the qualification requirements of KT-178 (American RTCA DO-178 / Europian EASA ED-12). It is defined software as an object of copyright according to the legislation of Ukraine. It is highlighted the complexity of protecting software components: code, algorithms, source code. It is indicated that the main feature of aviation software is to ensure safety requirements. KT-178 qualification requirements (DO-178 / ED-12) have a significant impact on the cost of developing aviation software. Reference is made to the methodological approaches used in assessing property rights to the software according to the National Standard of Ukraine. It is given a brief description of other approaches in estimating the cost of software, including the method of analogies, research and empirical methods based on mathematical models, statistical data, neural and Bayesian networks, etc. At the same time, it is given the specific combinations of methods can be selected based on specific assessment objectives, which is the subject of special study. It is provided the overview of the main factors determining the market value of intellectual property A list of key documents provided to the software evaluator. Such an important fact is noted as the level of confidence in the appraiser from both the developers and the consumers. The obtained estimated value of property rights to software can be used by the owner in the sale of licenses and, last but not least, in determining the value of new contracts that provide for the development of software for aviation applications.

A Compact Model to Evaluate the Effects of High Level C++ Code Hardening in Radiation Environments

A high-level C++ hardening library is designed for the protection of critical software against the harmful effects of radiation environments that can damage systems. A mathematical and empirical model to predict system behavior in the presence of radiation induced faults is also presented. This model generates a quick evaluation and adjustment of several reliability vs. performance trade-offs, to optimize radiation hardening based on the proposed C++ hardening library. Several simulations and irradiation campaigns with protons and neutrons are used to build the model and to tune it. Finally, the effects of our hardening approach are compared with other hardened and non-hardened approaches.

Exploring the Interfaces Between Big Data and Intellectual Property Law

This article reviews the application of several IP rights (copyright, patent, sui generis database right, data exclusivity and trade secret) to Big Data. Beyond the protection of software used to collect and process Big Data corpora, copyright’s traditional role is challenged by the relatively unstructured nature of the non-relational (noSQL) databases typical of Big Data corpora. This also impacts the application of the EU sui generis right in databases. Misappropriation (tort-based) or anti-parasitic behaviour protection might apply, where available, to data generated by AI systems that has high but short-lived value. Copyright in material contained in Big Data corpora must also be considered. Exceptions for Text and Data Mining (TDM) are already in place in a number of legal systems and likely to emerge to allow the creation and use of corpora of literary and artistic works, such as texts and images. In the patent field, AI systems using Big Data corpora of patents and scientific literature can be used to expand patent applications. They can also be used to “guess” and disclose future incremental innovation. These developments pose serious doctrinal and normative challenges to the patent system and the incentives it creates in a number of areas, though data exclusivity regimes can fill certain gaps in patent protection for pharmaceutical and chemical products. Finally, trade secret law, in combination with contracts and technological protection measures, can protect data corpora and sets of correlations and insights generated by AI systems.

SOFTWARE SECURITY OVERVIEW

The article analyzes the main threats and problems of software protection. Methods for protecting information, their advantages and disadvantages are considered, and the possibility of using existing tools to protect software is studied. The possibility of improving and using a number of software protection methods against active fraud attacks was brought. Type of attacks exists and why protection is necessary was specified. Furthermore, we discussed several states of the art protection techniques which can be used in software to protect against analysis and tampering attacks. Analyzed such methods: Client-Server Solutions, Code Encryption, Code Diversity, Code Obfuscation, White-Box Cryptography, Tamper Resistant Software, Software Guards, Oblivious Hashing. Although we considered all these possible techniques separately, it is possible to combine these techniques into one solution.

Testing of measurement instrument software with the purpose of conformity assessment

The analysis of the regulatory framework for testing measuring instruments (MI) software at the national level to determine its suitability for carrying out conformity assessment was conducted. Comparison of the general requirements of national normative documents and documents of international and regional organizations of legal metrology OIML and WELMEC was conducted. In particular, regarding the suitability of software for application and protection against unauthorized interference. It is found that the current national standard contains only general requirements for software protection and does not determine the methodology of software testing. This is important because the MIs, which are intended for use in the field of regulated metrology, must undergo a procedure for conformity assessment with the requirements of the technical regulations. The main differences were identified and the necessary elements were established to achieve the presumption of conformity of the software with essential requirements of the technical regulations during conformity assessment of the MI. Requirements of normative documents concerning suitability for application and protection against unauthorized interference are identified. In order to specify requirements for software and to ensure compliance with the requirements of the software test method, the need for additional use of the requirements of the OIML D 31 and WELMEC 7.2 documents was established. The need to revise the current national standard for MI software testing was proved. The algorithm of testing of the MI software for conformity assessment was established and studied. The algorithm takes into account the requirements of international standards for the software life cycle and the quality system when developing the software. This will take into account all the elements necessary to achieve the presumption of conformity of software with the essential requirements of technical regulations

Research of smart meter design scheme based on IR46

This paper compares the differences between the International Recommendation46 (IR46 for short) and the current national standards for electric energy meter of the accuracy classes, testing requirements, software protection and so on. The national meter adaptability of IR46 is analyzed, and a technical proposal of dual-core smart meter is advanced. This proposal could match the testing and software protection requirements for IR46, and could implementation in China.

Становлення правової охорони комп'ютерних програм нормами авторського і патентного права

Становлення правової охорони комп'ютерних програм нормами авторського і патентного права

The Model of Intrusion into the Information System

Categories ‘attack’, ‘intrusion’ and ‘incident’ of information security are defined. The types of intrusions into the information system are revealed, and their brief analysis is given. The proposed model of intrusion into the information system will allow to increase its efficiency at almost all stages of the information security system life cycle. The use of the proposed model is associated with the solution of specific practical problems in the field of information security, including the definition of vulnerabilities of the information system. The latter, in turn, is necessary to determine the elements of the protection system. For example, at the design stage of the information security system, when choosing software protection you need to take into account the location of the intruder relative to the attacked object. When working with functioning systems of information protection, i.e. at the solution of questions of modernization or optimization, changes in the system of information security are resolved in accordance with statistical data for the intrusion into the information system with available results of information security incidents, with the forecast data. Thus, the proposed model of intrusion into the information system is one of the external conditions when working with the information system of the organization (enterprise) may well determine (set) the level of risk of information security of the enterprise.

A meta-model for software protections and reverse engineering attacks

Software protection techniques are used to protect valuable software assets against man-at-the-end attacks. Those attacks include reverse engineering to steal confidential assets, and tampering to break the software’s integrity in unauthorized ways. While their ultimate aims are the original assets, attackers also target the protections along their attack path. To allow both humans and tools to reason about the strength of available protections (and combinations thereof) against potential attacks on concrete applications and their assets, i.e., to assess the true strength of layered protections, all relevant and available knowledge on the relations between the relevant aspects of protections, attacks, applications, and assets need to be collected, structured, and formalized. This paper presents a software protection meta-model that can be instantiated to construct a formal knowledge base that holds precisely that information. The presented meta-model is validated against existing models and taxonomies in the domain of software protection, and by means of prototype tools that we developed to help non-modelling-expert software defenders with populating a knowledge base and with extracting and inferring practically useful information from it. All discussed tools are available as open source, and we evaluate their use as part of a software protection work flow on an open source application and industrial use cases.

After Alice: how do Finjan and Core Wireless change the patentability of software in the USA?

Despite the lack of clarity arising from the US Supreme Court’s decision in Alice v CLS Bank,1 the Federal Circuit has begun to more clearly define the boundaries of patent eligibility for software. In particular, in early 2018, the Federal Circuit issued two decisions which build upon its 2016 ruling in Enfish LLC v Microsoft Corp,2 to more clearly permit the patenting of software which improves computer functionality. As a result of these decisions, software developers will be more likely to identify software as potentially patent-eligible, leading to increased attention to patent terms within software transactions, despite the traditional focus on copyright and trade secret protection. Although private contracts and industry customs do not have the force of judicial determinations, they are critical to the development of predictable outcomes in the area of intellectual property protection for software, given the uncertainty surrounding the eligibility of software for patent protection.

Software protection of the maglev transport control system

Background: The article examines the issues of regulation and the development of methodological approaches to ensuring the security of the software system for the management of magnetic-leaving transport at all stages of the life cycle, as well as the development of a tool to detect high-level (logical) software vulnerabilities.
 Aim: Development of a methodology for the creation of an error-free and impact-resistant software for the management system of magnetic-levitational transport.
 Methods: In the development of the methodology, the existing practices of searching for errors and vulnerabilities in software and approaches to the algorithmization of program code were studied.
 Results: During the study, a methodology was developed for creating an error-free and impact-resistant software for the management system of magnetic-levitational transport, which makes it possible to exclude the possibility of errors in the software, which significantly increases the safety of the overall transportation process.
 Conclusion: The application of the developed technique will improve the security of software for magnetic levitation transport control system from destructive external influences

The computer for the 21st century: present security & privacy challenges

Decades went by since Mark Weiser published his influential work on the computer of the 21st century. Over the years, some of the UbiComp features presented in that paper have been gradually adopted by industry players in the technology market. While this technological evolution resulted in many benefits to our society, it has also posed, along the way, countless challenges that we have yet to surpass. In this paper, we address major challenges from areas that most afflict the UbiComp revolution: Software Protection: weakly typed languages, polyglot software, and networked embedded systems.Long-term Security: recent advances in cryptanalysis and quantum attacks.Cryptography Engineering: lightweight cryptosystems and their secure implementation.Resilience: issues related to service availability and the paramount role of resilience.Identity Management: requirements to identity management with invisibility.Privacy Implications: sensitivity data identification and regulation.Forensics: trustworthy evidence from the synergy of digital and physical world.We point out directions towards the solutions of those problems and claim that if we get all this right, we will turn the science fiction of UbiComp into science fact.

Automated Software Protection for the Masses Against Side-Channel Attacks

We present an approach and a tool to answer the need for effective, generic, and easily applicable protections against side-channel attacks. The protection mechanism is based on code polymorphism, so that the observable behaviour of the protected component is variable and unpredictable to the attacker. Our approach combines lightweight specialized runtime code generation with the optimization capabilities of static compilation. It is extensively configurable. Experimental results show that programs secured by our approach present strong security levels and meet the performance requirements of constrained systems.

SHARC: An efficient metric for selective protection of software against soft errors

This paper presents a metric for the efficient application of selective hardening using software-based techniques against soft errors. It offers a method for selecting the resources to be protected obtaining maximum fault coverage with the minimum overhead. Common approaches are based on exhaustive exploration of the solution space or time-consuming fault injection campaigns. Contrarily, our Software based HARdening Criticality metric (SHARC) relies on early estimations of the impact that protection techniques will have on the global reliability of the application. SHARC estimations are based on features extracted from the dynamic analysis of source code and produce a prioritization of the resources involved accordingly. For assessing our approach two case studies were carried out using low-cost embedded microprocessors. Results were compared to traditional approaches like brute-force exploration and the Architectural Vulnerability Factor (AVF) metric. Experiments show that SHARC improves the results between 5% and 21% at a fraction of the effort.

A Subtle Serial Key based Software Protection Scheme

Software piracy is a modern day war between malicious software pirates and software developers. Annually, developers lose billions of dollars in revenue to piracy, making it an industry bane that must be controlled by all means. The drivefor improved software protection systems has increased the complexity of both proposed and implemented schemes. Some of the methods are cost intensive in terms of development, management and hardware requirement (smart card tokens), while this may be justified for costly software applications, for low cost and basic applications by small scale study presents a subtle software protection model using serial keys. The model implements a form of obfuscation by using hidden codes, encrypted functions and uses a distraction technique by diverting the attention of potential hackers to the serial key while trickily using coded strings for the actual user authentication

Intangible machines: Patent protection for software in the United States.

Intellectual property law has been interacting with software for over sixty years. Despite this, the law in this area remains confused and uncertain: this is particularly evident in patent law. Focusing on U.S. patent law from the 1960s through to the mid-1970s, this article argues that a key reason for this confusion relates to the particular way that the subject matter was construed. While the early discussions about subject matter eligibility were framed in terms of the question "is software patentable?", what was really at stake in these debates was the preliminary ontological question: what is software? Building on work that highlights the competing ways that software was construed by different parts of the information technology industry at the time, the article looks at the particular way that the law responded to these competing interpretations and how in so doing it laid the foundation for the confusion that characterizes the area. When engaging with new types of subject matter, patent law has consistently relied on the relevant techno-scientific communities not only to provide the law with a relatively clear understanding of the nature of the subject matter being considered; they have also provided the means to allow the law to describe, demarcate, and identify that new subject matter. The inherently divided nature of the nascent information technology industry meant that this was not possible. As a result, the law was forced to develop its own way of dealing with the would-be subject matter.

National survey on dose data analysis in computed tomography.

A nationwide survey was performed assessing current practice of dose data analysis in computed tomography (CT). All radiological departments in Switzerland were asked to participate in the on-line survey composed of 19 questions (16 multiple choice, 3 free text). It consisted of four sections: (1) general information on the department, (2) dose data analysis, (3) use of a dose management software (DMS) and (4) radiation protection activities. In total, 152 out of 241 Swiss radiological departments filled in the whole questionnaire (return rate, 63%). Seventy-nine per cent of the departments (n = 120/152) analyse dose data on a regular basis with considerable heterogeneity in the frequency (1-2 times per year, 45%, n = 54/120; every month, 35%, n = 42/120) and method of analysis. Manual analysis is carried out by 58% (n = 70/120) compared with 42% (n = 50/120) of departments using a DMS. Purchase of a DMS is planned by 43% (n = 30/70) of the departments with manual analysis. Real-time analysis of dose data is performed by 42% (n = 21/50) of the departments with a DMS; however, residents can access the DMS in clinical routine only in 20% (n = 10/50) of the departments. An interdisciplinary dose team, which among other things communicates dose data internally (63%, n = 76/120) and externally, is already implemented in 57% (n = 68/120) departments. Swiss radiological departments are committed to radiation safety. However, there is high heterogeneity among them regarding the frequency and method of dose data analysis as well as the use of DMS and radiation protection activities. • Swiss radiological departments are committed to and interest in radiation safety as proven by a 63% return rate of the survey. • Seventy-nine per cent of departments analyse dose data on a regular basis with differences in the frequency and method of analysis: 42% use a dose management software, while 58% currently perform manual dose data analysis. Of the latter, 43% plan to buy a dose management software. • Currently, only 25% of the departments add radiation exposure data to the final CT report.