Obfuscation of Abstract Data-Types - Rowan

CHAPTER 3. TECHNIQUES FOR OBFUSCATION 48
could define length as follows:
public static int length(list l)
{
int s = 0;
while (l ! = null)
{ s = s + 1;
l = l.next; }
return s;
}
We can consider this to be an operation on the data-type of lists which leaves a
list unchanged but gives a natural number as an output. This conversion from
“function” to “operation” is valid for all our definitions and so, in our cases,
these two notions are equivalent. Thus we will write operation or function to
denote the actions that we allow on our data-types.
3.2 Obfuscation as data refinement
Suppose that we have a data-type D and we want to obfuscate it to obtain the
data-type O. Obfuscating D involves giving definitions for the obfuscation of
each of the operations defined in D and ensuring that they are correct. What
does it mean to be correct and how can we prove correctness?
To provide a framework for obfuscating data-types (and establishing the
correctness of the obfuscated operations) we view obfuscation as data refinement
[16]. A refinement can be achieved by a relation R between an abstract and a
concrete state:
R :: A ↔ C
that satisfies a simulation condition [16, Section 2.1]. A refinement is called
functional if and only if there exists a data-type invariant dti and a function af
called an abstraction function with type:
af :: C → A
such that R has the form
a R c ≡ af (c) = a ∧ dti(c)
If we have a functional refinement then each instance of the concrete state satisfying
the data-type invariant is related to at most one instance of the abstract
state. That corresponds to the concrete state having more “structure” than the
abstract state. In general, when obfuscating we aim to obscure the data-type by
adding more structure and so we propose that the obfuscated data-type O will
be no more abstract than the original data-type D. Thus the most general form
of refinement for us is functional refinement. This formulation allows us to have
many obfuscations which can be “undone” by the same abstraction function
(see Section 7.2.2 for an example using trees). We may have a situation where
we obfuscate a data-type by first performing a (possibly non-functional) refinement
and then obfuscating this refinement. As data refinement is a well-known
technique, we will concentrate on just the obfuscation part of the refinement.