The purpose of this article is to describe techniques for protecting code when distributed in source format. This situation occurs when, for instance, the client component of a web application, whose source code is easily extractable from the browser even by inexperienced users. The case study proposed uses the Adobe Connect© platform, an emerging technology in the ifeld of video communication, content sharing and e-learning environments, which allows to easy integration of applications written in javascript language. The astonishing ease of realization of embedded applications within Adobe®'s ecosystem contrasts with the impossibility of protecting the work done, which is visible and redistributable simply by copying the file containing it. The unwary author may thus run the risk of seeing his work thwarted by losing any intellectual property rights arising from the use of the software he has created. For this reason we have realized a form of intellectual property protection when software is distributed in source format.
protection of a Pod realized in javascript on Adobe Connect©1.
years thanks to the advent of new technologies,
innovative development and deployment methodologies, such as 2. History of software protection
DevOps [
This article will briefly review the history of software who might be interested in compromising the protection application protection systems. It is followed by the pro- of our software. A general criterion is to assume a higher posed solution to protect the source code of a web ap- position than the potential positions of the other parties, plication. Finally, a real case will be described, i.e. the because it would not make sense to spend more energy than that. In the assessment it must be considered that the free circulation of software, even if unauthorised, favours its dissemination and knowledge [9][10], that which is normally paid for by investments in marketing campaigns. On the other hand, if a company considers
software useful, it will certainly find it more convenient in open format (typically HTML and javascript) on the to purchase it than to risk using it without a license. Over client [11]. The availability of the source code renders time, various techniques have been used to protect soft- all the protection systems examined so far useless, since ware applications, methods that have changed with the a malicious user could easily remove them. evolution of architectures and, above all, with the advent Although a developer can always register the source of the network that has made it possible to control li- code to be able to legally claim both authorship and censes in real time, initially on a LAN and later on the wrongful use, none of these threats are better deterrents Internet. than a well-designed protection system.
The first local techniques used a protection which checks whether the license related to the hardware on the machine where it was first installed. This required 3. The proposed solution a double step: the generation of a key depending on the hardware factors of the machine (serial number of the The proposed solution considers the source code dishard disk, date of the ROM, MAC address of the network tributed on the client of a typical web application as the card, ...) at the time of installation and the verification, at target to be protected. It is based on three concentric each execution, that the key calculated at that moment protection levels: was the same as the one registered during installation. • the basic level, it marks the GUI of the applicaClearly, when there was a failure of a hardware com- tion with the logo and the name of the licensee ponent, the installation had to be repeated in order to (watermark); restore the correct values. To overcome this problem, • the intermediate level, it makes the source code the alternative was the availability of a token stored on unreadable and unmodifiable to a programmer non-copyable removable media. Early systems used com- through code obfuscation techniques; mon floppy disks, later CD-ROMs, which had defective • the server level (license manager): sectors in some tracks of the medium. In this way, it was not possible to duplicate the medium with the faulty – monitors the clients and decides action tracks because the copying programs only acted on the strategies in relation to the client’s license; data. Soon, copiers were created that were able to mark – sends the missing source code to the client; the faulty tracks, so that the media could be reproduced – checks that the client’s code has not been identical to the original, making it possible to use the altered and that the logo and the licensee’s software on several machines (each with duplicate pro- name are consistent with the license. tection media). A better protection was only introduced later with the advent of USB memories, both because The architecture of the proposed solution is shown in these hardware devices are dificult to duplicate, and the Fig. 1. also because they are only accessible from the relevant application. The protection provided by a USB device, commonly called dongle, requires the use of a key at the running location, so if there are several users using the software at diferent times, they must be able to exchange the device. It is also possible associates the license to a person, who carries the device with him and can therefore use the software on diferent locations. Obviously, in order to solve the dificulties caused by the use of a dongle, it would be suficient to purchase several user licenses. Figure 1: The architecture of the proposed solution
With the increasing use of networks, computers were no longer stand-alone (i.e., isolated from each other) but they could exchange information with each other. At this point, the token could be used by a central server 3.1. Basic level: watermarking that had the task of controlling the installation of applications within the local network on the basis of the In order to prevent the difusion and use of counterfeit license purchased, distributing the privileges of use (li- copies of a product (not necessarily software), a good cense manager). The need for protection has diversified deterrent may be to indelibly and clearly mark the prodin web architectures, especially in those for which is uct itself with the logos and name of the licensee. It is suficient to have access in terms of credentials on a re- unlikely that a professional user will use it with the name mote server, while for copying the code, it is distributed of another licensee, also because if there were a check on the software, it would be dificult to prove that the purchase was made legally.
Ideally, a certificate of originality should be included in the HTML file, or in the javascript source, without the ability to be deleted or altered, the same level of guarantee that the watermark on a banknote has that ensures its originality [12]. On the other hand, in a source code, it is quite easy to alter the loading of an image from an external file or to change the name of the licensee if it is written in plain text as a sequence of characters. The solution is to devise an encapsulation and information hiding mechanism that makes the licensee’s logo and name unreadable in the HTML file but visible to runtime, only after a complex calculation process. This first level of protection must be followed by two others, which aim to encapsulate and protect it. We can say that it is similar to the technique that has been used for centuries to protect fortresses with outer walls. 3.2. Intermediate level: code obfuscation f u n c t i o n l o c a l S t o r a g e i n c r e m e n t ( ) { \ \ l o c a l S t o r a g e . s e t I t e m ( ' s t r e a m L ' , ( p a r s e I n t ( l o c a l S t o r a g e .
g e t I t e m ( ' s t r e a m L ' ) ) + 1 ) + ' ' ) ; l o c a l S t o r a g e .
s e t I t e m ( ' w' , ' &w=n ' ) ; } After applying obfuscation techniques: f u n c t i o n l o c a l S t o r a g e i n c r e m e n t ( ) { v a r _ 0 x 3 f 4 3 6 f = _ 0 x 3 0 e 3 d 7 ; l o c a l S t o r a g e [ ' s e t I t e m ' ] ( _ 0 x 3 f 4 3 6 f ( 0 x 1 6 6 ) , p a r s e I n t ( l o c a l S t o r a g e [ _ 0 x 3 f 4 3 6 f ( 0 x 1 2 e ) ] ( ' s t r e a m L ' ) ) + 0 x1 + ' ' ) , l o c a l S t o r a g e [ _ 0 x 3 f 4 3 6 f ( 0 x 1 7 6 ) ] ( ' w' , _ 0 x 3 f 4 3 6 f ( 0 x17b ) ) ; } }
that an attacker might have in deducing the behavior of the function in question. This dificulty is amplified if the code is very long and, above all, if there are useless parts to analyze. In this case the reverse engineering activity is long, laborious and has little chance of success.
of source code obfuscation, a practice well known in 3.3. Server level: license manager literature [13][14]. The third level of protection is by means of a remote
In recent years, we are witnessing machine learning server: the license manager which monitors who uses being used in a wide variety of ways [15][16][17][18] the client, sends the parts of code that the client lacks in thanks to the discovery of increasingly eficient imple- order to work, and checks which there are no alterations mentations [19][20][21]. It has been shown that such to the code (e.g. substitution of the logo or name of algorithms can also be successfully implemented in ob- the licensee). Therefore, the application that uses this fuscation techniques [22][23]. protection system needs a connection to the Internet in
However, software obfuscation for the purpose of in- order to work. This requirement is also necessary to
tellectual property protection remains a very challenging guarantee the functionality of the application itself since
topic [24], even though it has been shown that, while it is based on web technology on an internet network.
reading a web page, it is possible to automatically de- Moreover, the same server has modifiable policies
tect the content of obfuscated javascript strings [
with the server and provides information about the tasks it is called to perform. This conversation is necessary for the client to have all the software necessary for its operation.
Generally, the minimum requirement for requesting services from a server is to be authenticated. In the absence of authentication, an attack from a not trusted client can be avoided by excluding the possibility of the cross-domain: the source code will be sent only if the request comes from an authorized client and domain.
The availability of the license manager is also fundamental to check if the javascript file on the client still contains the logos of the registered licensee or if some form of code alteration has happened. All this can be easily implemented with a hashing function, so if a user should manage to penetrate the first two protection levels and change the logo in the source code, the hashing function will return a diferent value from the expected one, and the license manager could decide the best strategy to implement.
Any software application that wants to adopt the
proposed protection solution does not need to know not
send personal data in the conversation from the client
to the license manager. Also because it depends on the
regulations in the country where the user is located and
the license manager server too. In Europe such
legislation is Regulation (EU) 2016/679 (General Data Protection
Regulation)[
The application is assembled in a container that we will call Pod in ZIP format. The process of developing and deploying an application (Fig. 2) consists of the following steps: • collection of functional requirements including the definition of the GUI; • definition of the layout of the web page; • identification of the API necessary for the functioning of the application; • development of the application components (custom library); • release of the ZIP file on the Adobe Connect © server.
sign of the human-machine interface (HTML file) and
to identify the APIs necessary for the operation of the
application through the mechanism of callback. In this
4. Case Study way it will be possible to activate the new custom
developed functions, following the events that the system
This Case Study aims to demonstrate, with a practical ex- will receive. Once the application components have been
ample, the theoretical concepts described so far. In recent created, they will be inserted in the javascript library
acyears we have been witnessing an increase in the use of cessible by the HTML file. At this point it will be possible
video communication software especially in relation to to create the ZIP file that will contain:
the problem of the pandemic caused by the coronavirus,
SARS-CoV-2, also known as COVID-19 [
These platforms can be enriched with new functionali- • the folder css eventually added for the webpage ties and promote new job opportunities for programmers layout settings. who have a new space where to spread their ideas. For this reason, we have chosen to use the Adobe Connect© communication platform for reasons of dissemination [34][35][36] but also because it allows us to write applications in a programming language already known and established as javascript.
Below there is a simple example of using the SDK classes available in the javascript file ( connect_customPodSDK.js):
ment Kit (SDK)2 that contains all the documentation and tools useful for developers to build embedded applications. The SDK consists of: • the manual for the use of the javascript-capable
Application Programming Interface (API); < s c r i p t t y p e = " t e x t / j a v a s c r i p t " > cpu =ConnectCustomSDK . S y n c C o n n e c t o r | | { } ; cpu . i n i t ( o n C o n f i g u r e d , " com . adobe . c o n n e c t . b a s i c l i s t s y n c " , " 9 . 5 . 0 0 1 " , " c o n n e c t s d k h o o k " ) ; </ s c r i p t > to read the information related to the user role (Fig. 4) and consequently to select the operational mode. v a r myUserData = cpu . g e t M y U s e r D e t a i l s ( ) ; i f ( myUserData . d a t a . r o l e == ' owner ' ) {
/ / t e a c h e r a c t i o n s } e l s e {
/ / s t u d e n t a c t i o n s }
essary to link the system events to the custom javascript methods through the callback registration. For simplicity and without loss of generality, we will define javascript methods that are homonyms to the Adobe Connect© API. Communication between the teacher and the learner is done using the APIs: dispatchSyncMessage and syncMessageReceive. The first API send broadcast messages from one participant to the others, the second API allows participants to receive messages.
cpu . r e g i s t e r C a l l b a c k ( " U s e r J o i n e d " , U s e r J o i n e d ) ; / / New u s e r j o i n s t h e room f u n c t i o n U s e r J o i n e d ( e v t ) { / / e v t . u s e r i s i s t a n c e o f M y U s e r D a t a i l s v a r f u l l n a m e = e v t . u s e r . f u l l n a m e ; / / send b r o a d c a s t t h e message cpu . d i s p a t c h S y n c M e s s a g e ( " USERJOINED " , [ f u l l n a m e ] , f a l s e , t r u e ) ; / / s y n c h r o n i z e s t h e v i d e o f o r new u s e r chec kVideoS ync ( ) ;
pending on the user who is connected (teacher or learner).
The teacher must be able to choose the video to send in broadcast to all students, start it and block it. The student must view the video sent by the teacher during the } teaching session. During a teaching session, a teacher may need to stop
The application sends information to the license man- the video to add a contribution relating to the video they ager about the activities and receives the code parts and have just watched. In this case, it is useful to realize details about the operation mode from the license man- a function that allows the video to be blocked for all ager. In Fig. 3 is shown in UML language the context students following the lesson. This can be easily done diagram of the application. sending a message to all learner connected: The class MyUserDetail available in the SDK allows us cpu . r e g i s t e r C a l l b a c k it. Although, it is always possible to trace the source code ( " s y n c M e s s a g e R e c e i v e d " , that generates it, the source code (except in the case of s y n c M e s s a g e R e c e i v e d ) ; particular programming languages) will never have the f u n c t i o n s y n c M e s s a g e R e c e i v e d ( syncMsg ) { same readability and form as the original code. Therei f ( syncMsg . msgNm== ' STOPVIDEO ' ) fore, it may be more dificult to copy it and reuse it in s t o p V i d e o ( ) ; environments other than where it was licensed.
} In the case of open source distribution, there are variIn Fig. 5 it is shown how the Pod is distributed from the ous forms of licenses that the owner can choose, but it is Adobe Connect© server to the student client worksta- not easy to block copying and use. tions. This is done automatically with no intervention The growing use of video communication, content required from the user connecting to the meeting. sharing and e-learning environments is encouraging the development of embedded applications and ofering new scenarios and opportunities for work.
The Adobe Connect© communication platform encourages the development of applications in the javascript language that is already known to the developer community.
The idea of the proposed solution shows how it is possible to adopt a multi-layered protection solution in order to protect the intellectual property of the developed code when it is distributed in source format.
Although the case study is focused on an embedded application, the proposed method remains valid in general and can be adopted regardless of the programming language.
Now let’s see how the authorised client requests from We would like to thank Luciano Fazio and Katherine L. the license manager the javascript code it needs to func- Ryan for their careful revisions and valuable suggestions tion. One method is to perform a GET call from the client to the text. We are also grateful to Maria Cristina Paoletti to the server that returns the code inserted in a client’s and Emanuele Iannaccone for the stimulating discussion HTML tag (demo in the following example). on the research articles and to the President of the UNI CT 510 Security Commission, Fabio Guasconi, for his interesting suggestions on security issues. <p i d =" demo " > </ p> All trademarks mentioned in this article belong to their \. $. .( .document ) . r e a d y ( f u n c t i o n ( ) { rightful owners, have been used for explanatory purposes \ $ . a j a x ( only, without any purpose of infringement of Copyright { rights in force.
u r l : " h t t p s : / / servername / i n j e c t " , ' method ' : ' GET ' , ' s u c c e s s ' : f u n c t i o n ( answer ) { document . g e t E l e m e n t B y I d ( " demo " ) . innerHTML = answer [ 0 ] . s c r i p t ; } , ' e r r o r ' : f u n c t i o n ( ) {
a l e r t ( ' something wrong ' ) ;
[3] C. Napoli, G. Pappalardo, E. Tramontana, Using [14] C. K. Behera, D. L. Bhaskari, Diferent obfusmodularity metrics to assist move method refactor- cation techniques for code protection, Proing of large systems, in: 2013 Seventh International cedia Computer Science 70 (2015) 757–763. Conference on Complex, Intelligent, and Software URL: https://www.sciencedirect.com/science/ Intensive Systems, IEEE, 2013, pp. 529–534. article/pii/S1877050915032780. doi:https: [4] S. R. Dileepkumar, J. Mathew, Optimize contin- //doi.org/10.1016/j.procs.2015.10.114, uous integration and continuous deployment in proceedings of the 4th International Conference azure DevOps for a controlled microsoft .NET en- on Eco-friendly Computing and Communication vironment using diferent techniques and prac- Systems. tices, IOP Conference Series: Materials Science [15] G. Capizzi, G. Lo Sciuto, C. Napoli, E. Tramonand Engineering 1085 (2021) 012027. URL: https: tana, A multithread nested neural network archi//doi.org/10.1088/1757-899x/1085/1/012027. doi:10. tecture to model surface plasmon polaritons prop1088/1757-899x/1085/1/012027. agation, Micromachines 7 (2016). doi:10.3390/ [5] D. Taibi, V. Lenarduzzi, C. Pahl, Continuous Ar- mi7070110.
chitecting With Microservices and DevOps: a [16] R. Avanzato, F. Beritelli, M. Russo, S. Russo, M. VacSystematic Mapping Study, 2019. doi:10.1007/ caro, Yolov3-based mask and face recognition al978-3-030-29193-8_7. gorithm for individual protection applications, in: [6] O. Katz, Y. Olshaker, Y. Goldberg, E. Yahav, Towards CEUR Workshop Proceedings, 2020, pp. 41–45.
neural decompilation, 2019. arXiv:1905.08325. [17] G. Capizzi, G. Lo Sciuto, C. Napoli, E. Tramontana, [7] United States Trade Representative (USTR), M. Woźniak, A novel neural networks-based texSpecial 301 report, 2021. URL: https: ture image processing algorithm for orange defects //ustr.gov/sites/default/files/files/reports/2021/ classification, Int. J. Comput. Sci. Appl. 13 (2016) 2021%20Special%20301%20Report%20(final).pdf. 45–60. [8] S. Sahni, I. Gupta, Piracy in the Digital Era: Psy- [18] C. Napoli, F. Bonanno, G. Capizzi, Exploiting chosocial, Criminological and Cultural Factors, solar wind time series correlation with magneto2019. doi:10.1007/978-981-13-7173-8. spheric response by using an hybrid neuro-wavelet [9] J. Wang, R. L. Axtell, A. Loerch, Utilizing the pos- approach, Proceedings of the International Asitive impacts of software piracy in monopoly in- tronomical Union 6 (2010) 156–158. doi:10.1017/ dustries (2017). URL: https://dl.acm.org/doi/10.5555/ S1743921311006806, cited By 26. 3106078.3106083. [19] G. C. Cardarilli, L. D. Nunzio, R. Fazzolari, D. Gi[10] A. Prasad, V. Mahajan, How many pirates should ardino, A. Nannarelli, M. Re, S. Spanò, A pseudoa software firm tolerate? an analysis of piracy pro- softmax function for hardware-based high speed tection on the difusion of software, International image classification, Scientific Reports 11 (2021). Journal of Research in Marketing 20 (2003) 337–353. doi:10.1038/s41598-021-94691-7. doi:10.1016/j.ijresmar.2003.02.001. [20] S. Spanò, G. C. Cardarilli, L. Di Nunzio, R. Fazzo[11] T. Groß, T. Müller, Protecting javascript apps from lari, D. Giardino, M. Matta, A. Nannarelli, M. Re, code analysis, in: Proceedings of the 4th Workshop An eficient hardware implementation of reinon Security in Highly Connected IT Systems, SHCIS forcement learning: The q-learning algorithm, ’17, Association for Computing Machinery, New IEEE Access 7 (2019) 186340–186351. doi:10.1109/ York, NY, USA, 2017, p. 1–6. URL: https://doi.org/ ACCESS.2019.2961174. 10.1145/3099012.3099018. doi:10.1145/3099012. [21] S. Russo, S. Illari, R. Avanzato, C. Napoli, Reducing 3099018. the psychological burden of isolated oncological [12] L. Regano, D. Canavese, C. Basile, A. Lioy, Towards patients by means of decision trees, volume 2768, optimally hiding protected assets in software ap- 2020, pp. 46–53. plications, in: 2017 IEEE International Conference [22] M. Romanelli, K. Chatzikokolakis, C. Palamidessi, on Software Quality, Reliability and Security (QRS), Optimal obfuscation mechanisms via machine 2017, pp. 374–385. doi:10.1109/QRS.2017.47. learning, arXiv preprint arXiv:1904.01059 (2019). [13] S. Hosseinzadeh, S. Rauti, S. Laurén, J.-M. Mäkelä, [23] D. Canavese, L. Regano, C. Basile, A. Viticchié, EstiJ. Holvitie, S. Hyrynsalmi, V. Leppänen, Diversi- mating software obfuscation potency with artificial ifcation and obfuscation techniques for software neural networks, in: G. Livraga, C. Mitchell (Eds.), security: A systematic literature review, Infor- Security and Trust Management, Springer Internamation and Software Technology 104 (2018) 72– tional Publishing, Cham, 2017, pp. 193–202. 93. URL: https://www.sciencedirect.com/science/ [24] S. Schrittwieser, S. Katzenbeisser, J. Kinder, article/pii/S0950584918301484. doi:https://doi. G. Merzdovnik, E. Weippl, Protecting software org/10.1016/j.infsof.2018.07.007. through obfuscation: Can it keep pace with