Obfuscation of Abstract Data-Types - Rowan

CHAPTER 3. TECHNIQUES FOR OBFUSCATION 49
So, for obfuscation we require an abstraction function af with type
af :: O → D
and a data-type invariant dti such that for elements x :: D and y :: O
x ❀ y ⇔ x = af (y) ∧ dti(y) (3.1)
The term x ❀ y is read as “x is data refined by y” (or in our case, “. . .is
obfuscated by. . . ”) which expresses how data-types are related.
For obfuscation the abstraction function acts as a “deobfuscation” and therefore
it is important to keep this function secret from an attacker. In our situation,
it turns out that af is a surjective function so that if we have an obfuscation
function of
of :: D → O
that satisfies
then
of (x) = y ⇒ x ❀ y
af · of = id (3.2)
Thus, of is a right-inverse for af . Note that it is not necessarily the case that
of · af = id (3.3)
since we could have another obfuscation function of ′ such that of ′ (x) = y ′ and
x ❀ y ′ and so we have that
of (af (y ′ )) = of (x) = y
The abstraction function will have a left-inverse only if it is injective. In that
case, each object of D will be refined by exactly one of O and we will call the
inverse (which is both left and right) of af the conversion function (cf ) for the
obfuscation.
3.2.1 Homogeneous operations
Suppose that the operation f with type
f :: D → D
is defined in D. Then to obfuscate f we want a operation f O with type
f O :: O → O
which preserves the correctness of f . In terms of data refinement, we say that
f O is correct if it is satisfies:
(∀x :: D;y :: O) • x ❀ y ⇒ f (x) ❀ f O (y) (3.4)