Call for Participants

Cloakware Workshop:          White-Box Security and Software Protection

Date and time:               1-5:30pm, Saturday December 12, 2009

Location: Beijing Friendship Hotel, Room TBD by SKLOIS,

Host:                   Dr. Chuan-Kun Wu, Institute of Software, CAS, China

We are entering a new technological age for consumer electronics, in which previously unprecedented bandwidth and reach are becoming the norm. Advanced Internet-based technologies and broadband content are penetrating every aspect of life. The consumer’s interface – hand-held devices (portable media players, smart phones) and home networking (set-top boxes, media players, and the ever-more-flexible personal computer) – demand increasing software-mediated intelligence at the end-nodes of communication fabrics. (Isolating such intelligence on servers is impossible: the cost in latency and loss of scalability is too high. Moreover, only minimal hardware protection is competitively feasible in commodity consumer electronics). Software controlling such devices is thus increasingly deployed without the traditional protection of computer isolation: users enjoy total physical access to host devices and application software installed on them.

Malicious users have complete access to mount direct attacks of any kind, scope, and duration, using widely available tools permitting static and dynamic inspection and observation of software code. They can modify it, replace it, run it under their own control, and extract it to be deployed for their own purposes elsewhere. Worse yet, a successful attack by a highly-skilled attacker or attack-team may be converted into an automated attack, which can then be made widely available for subsequent launch by hoards of far more weakly-skilled attackers.

The modern attack landscape is thus characterized by ‘Man-at-the-End White-Box’ attacks. Traditional perimeter defenses are useless against such attacks. Security solutions addressing ‘Man-in-the-Middle’ attacks have very limited relevance to these types of assaults. While protecting against White-Box attacks is far more challenging than addressing Black-Box or Grey-Box attacks, meeting this challenge is essential to the future of our industry.

We must not only prevent and disable direct and automated White-Box attacks, but diagnose and mitigate them to shut down wide-spread, pandemic attacks, so that protected application systems can remain trustworthy even when deployed in highly-exposed consumer environments. We must build device-control software which can rapidly recover and renew its protections when attacks are detected, so that the system as a whole remains highly available and obstinately robust in the presence of the inevitable attacks - which accompany distribution of valuable content. Thus the role of software protection is to create applications which are stubbornly reliable in an increasingly hostile environment.

Many real life and modern server-client application systems - wireless systems, DRM systems, on-line banking systems, on-line shopping systems, and conditional access systems for cable or satellite -  are highly attractive subjects for White-Box attackers since the client sides of such systems are typically homogeneous and distributed over a very large customer base:  i.e., these systems make the attack surface extremely large. As the value of services deployed on such systems grows, so does their attraction as targets for hackers. Thus security against White-Box Man-at-the-End attacks is becoming absolutely essential to the successful deployment of such systems.

Program Schedule:

-     1:00pm, Opening speech by workshop host

-     1:15pm, Keynote speech, by Andrew Wajs (CTO of Irdeto /Cloakware)

-     2:00pm, The Local, Remote, and Insider Man-At-The-End - Attacks and Defenses,

                      By Christian Collberg (Professor of University of Arizona)

-     3:00pm, break

-     3:15pm, Software Security Lifecycle and Software Protection,

                      By Yuan Xiang Gu (Co-founder and Chief Architect of Cloakware)

-     4:30pm, Panel:  Software Security Trends

                      By Chuan-Kun Wu, Andrew Wajs, Christian Collberg and Yuan Xiang Gu

-     5:30pm, End of the program

This workshop is organized jointly by Cloakware, SKLOIS, and University of Arizona. The goals of the workshop are to discuss White-Box security challenges, and present state of the art in software security and protection technology from both research and market standpoints.

Cloakware, an Irdeto company and part of the Naspers group, provides innovative, secure, proven software technology solutions that enable customers to protect business and digital assets in enterprise, consumer and government markets. Cloakware’s two main product lines include: Cloakware Enterprise Solutions which help organizations meet governance, risk management and compliance (GRC) objectives for privileged password management while ensuring business continuity and the security of mission-critical data and IT infrastructure. Cloakware Consumer Product Solutions protect software and content on PCs, set-top boxes, mobile phones and media players. Protecting more than one billion deployed applications, Cloakware is the security cornerstone of many of the world's largest, most recognizable and technologically advanced companies. Headquartered in Vienna, VA USA and Ottawa, Canada, Cloakware has regional sales offices worldwide.

 State Key Laboratory of Information Security (SKLOIS), managed by the Chinese Academy of Sciences (CAS), is located in the Institute of Software of CAS and is cooperated with the Graduate University of CAS.  It has 20 years history on the research and critical technology development of information security. SKLOIS commits itself to providing a scientific foundation for information security; developing critical technology; and developing high-level specialists in information security. Since its establishment, SKLOIS has made great achievements in information security theory and technology. SKLOIS has published more than 1500 papers and more than 70 books. As of June 2008, the laboratory has completed more than 300 important projects, including National Key Foundation Theory Research and Natural Science Foundation projects. SKLOIS has received more than 20 awards from the Central Government or National Ministries. These include one first place and four second place State Scientific and Technological Progress Awards, two third place State Natural Science Awards and six first place National Ministry Awards. As of June 2008, SKLOIS has recruited a diverse faculty of 53 members, and 193 researchers including visiting scholars, post-doctoral, doctoral, and master students. The Laboratory has cryptology and network security research environment which are first-class in China.

The University of Arizona Security Group has extensive background in the study of defenses against Man-At-The-End (MATE) attacks. This includes algorithms for code obfuscation, software tamperproofing, watermarking, and birthmarking. Most recently, the group has developed algorithms for the dynamic analysis of computer viruses and for evolving defenses in the remote man-at-the-end scenario.

This workshop is geared towards graduate students, researchers and security professionals in the field of software security and protection. This workshop is free.