Software Protection System Based On Windows Kernel Technology

With the computer science developing so fast, software security becomes a bigproblem. While in the field of computer security, more and more use of technology relatedto the operating system kernel, such as security testing, system monitoring and fileprotection. Protecting software from operating system kernel provide bright prospects forus.Much research has been done to software protection, such as watermarking,obfuscation, anti-debugging, anti-tampering, but all these technology are basic researchfor the study of software protection, each of them is a research against particular attack.While combine these basic technologies to form a software protection system is a moreeffective solution. The current software protection system at the application layer using avariety of software protection system methods, such as software packers, serial numberregistration, software lock, CD-Key, etc.,but the safety of these method is not rational, foreach of them has a corresponding method of crack. Although the software protectionsystem using hardware has high security, it requires hardware-assisted, high developmentcosts and the using is more complex. The software protection using OS kernel technology,not only with a high security, but also with a lower cost than the hardware protectionmethod, is a good protection scheme.We have designed a Windows kernel-based software protection framework with auniversal protection that separate protection development from software development. Inthis framework, the security depends on the software protection system, so thedevelopment process must focus on the software protection system’s development. Withkernel file access control, process access control, process control, file filtering, debuggerdetection and confrontation and related hardware binding, the software protection systemhas a higher safety and suitability. Through file access control and process access control,the system can prevent illegal copies of the protected file. With file encryption anddecryption in the file filter，the protected software can not be static analysis. Debuggerdetection and confrontation can prevent the software form being dynamic debugged. Andthe hardware binding can ensures the software only run on the legit machines.