Automated Software Protection through Program Externalization on Memory-Limited Secure Devices

In this paper we propose a hardware assisted software protection scheme that relies on the use of a resource-limited secure token (e.g. a smart card). The protection consists in externalizing the execution of the sensitive pieces of code of the application to be protected to the token block by block, while the unsensitive code is still executed inside the untrusted computer. We define a generic process: the protection is enforced automatically. Our method relies on static analysis techniques that are used to infer the parts of code to be externalized together with run-time externalization protocol. We have developed a software environment implementing this technology for Java applications.