一种基于API安全属性隐藏的软件保护方法

A software protection method base on concealment of API security attributes

基于三种软件攻击目的,分析了不同API(application programming interface)安全属性在软件攻击过程中的作用,确定出API安全属性集,并分析了每一种API安全属性的攻击特点。借鉴现有的API保护方法,提出了基于API安全属性隐藏的软件保护方法。该方法使安全属性以一种更加隐蔽的方式存在,以此增加攻击者动态获取它们的难度。分别从安全性和性能影响两方面进行评价,实验结果表明该方法能够抵御API安全属性的静态获取,也能在一定程度上增加动态获取的难度,同时,未对性能造成较大影响。

Based on three attacking targets of software,the role of each API security attribute was analyzed and the attributes set was collected. The attacking features（ i. e. presence state and extracting ways） of each attribute were analyzed,based on which a method of concealing API security attributes was proposed. This method makes security attributes exist in a more subtle way. So it increases the difficulty of extracting them for attackers. In the end,experiments from two aspects： security effect and performance cost were conducted. And the experiment results showthat the method can resist the API static security attributes of the acquisition. To a certain extent,it can also increase the difficulty of the dynamic acquisition without causing a great influence on the system performance.