[Paper Review] On Secure and Usable Program Obfuscation: A Survey

Hui Xu, Yangfan Zhou+2 more|arXiv (Cornell University)|Oct 3, 2017

Advanced Malware Detection Techniques99 references18 citations

TL;DR

This survey investigates the feasibility of achieving both security and usability in program obfuscation by analyzing code-oriented and model-oriented obfuscation approaches. It concludes that no current method provides adequate security guarantees or practical performance, primarily due to insufficient evaluation metrics for both security and efficiency.

ABSTRACT

Program obfuscation is a widely employed approach for software intellectual property protection. However, general obfuscation methods (e.g., lexical obfuscation, control obfuscation) implemented in mainstream obfuscation tools are heuristic and have little security guarantee. Recently in 2013, Garg et al. have achieved a breakthrough in secure program obfuscation with a graded encoding mechanism and they have shown that it can fulfill a compelling security property, i.e., indistinguishability. Nevertheless, the mechanism incurs too much overhead for practical usage. Besides, it focuses on obfuscating computation models (e.g., circuits) rather than real codes. In this paper, we aim to explore secure and usable obfuscation approaches from the literature. Our main finding is that currently we still have no such approaches made secure and usable. The main reason is we do not have adequate evaluation metrics concerning both security and performance. On one hand, existing code-oriented obfuscation approaches generally evaluate the increased obscurity rather than security guarantee. On the other hand, the performance requirement for model-oriented obfuscation approaches is too weak to develop practical program obfuscation solutions.

Motivation & Objective

• To assess whether existing code-oriented obfuscation techniques can provide strong security guarantees.
• To evaluate whether model-oriented obfuscation approaches, such as those based on graded encoding, are practical for real-world software.
• To identify the lack of comprehensive evaluation metrics as a key barrier to developing secure and usable obfuscation.
• To explore the disconnect between theoretical security (e.g., indistinguishability) and practical usability in real code.
• To propose the need for new, semantically grounded evaluation metrics that balance security and performance.

Proposed method

• Conducting a comparative survey of code-oriented obfuscation techniques using metrics like potency, resilience, stealth, and cost.
• Analyzing model-oriented obfuscation approaches based on multilinear maps and graded encoding mechanisms (e.g., GGH, CLT).
• Evaluating the performance of graded encoding schemes on small-scale programs (e.g., point functions, XOR operations).
• Surveying cryptanalysis efforts and patched schemes to assess the current security posture of graded encoding.
• Proposing semantic-based evaluation methods using abstract interpretation to model obfuscation effects on program semantics.
• Identifying the absence of standardized metrics that capture both semantic security and runtime efficiency.

Experimental results

Research questions

• RQ1 Can existing code-oriented obfuscation techniques provide provable security guarantees beyond increased obscurity?
• RQ2 Are model-oriented obfuscation schemes like GGH and CLT practical for real-world software with complex syntax and APIs?
• RQ3 Why do current evaluation metrics fail to assess the true security of obfuscated programs?
• RQ4 To what extent do graded encoding mechanisms scale to general-purpose programs beyond simple mathematical functions?
• RQ5 What kind of evaluation framework is needed to balance security and usability in program obfuscation?

Key findings

• No current code-oriented obfuscation approach provides meaningful security guarantees, as existing metrics focus on obscurity rather than semantic protection.
• Model-oriented obfuscation using graded encoding achieves strong theoretical security (e.g., indistinguishability) but incurs prohibitive overhead, with obfuscated programs reaching hundreds of megabytes or gigabytes in size.
• Graded encoding schemes like CLT and GGH are too slow and inefficient for practical use, even on small programs such as 40-bit point functions.
• Existing obfuscation tools do not handle complex code constructs like lexical information, API calls, or control flow structures, which remain exploitable by adversaries.
• The performance requirement of polynomial overhead is too weak to ensure practical usability, as programs can still grow to impractically large sizes.
• There is a critical lack of evaluation metrics that consider both semantic security and runtime efficiency, hindering progress toward secure and usable obfuscation.