DISSECT: DIStribution for SECurity Tool

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 2200)


A security threat that affects the Java environment (as a typical environment where code is made available to the user machine) is the reverse-engineering and code-understanding of the architecture-neutral bytecode format. A natural protection strategy is to hide parts of the execution in trusted locations (e.g., servers). However, the implementation and automatization of such an approach (beyond the abstract idea) is a challenging problem. In this paper, we present a novel software protection strategy and its automatization (implemented architecture) which materialize the above idea. It is employed in protecting the binary source of Java class files. Our software protection strategy partitions “programmer selected” classes of an application into server classes and client classes. Server classes contain the actual class code and run only on trusted systems (which we call servers but they can be other dedicated machines). Client classes, on the other hand, are assumed to perform most of the task (but the sensitive part) and execute on user systems; they must interact with their corresponding server class in order to execute the sensitive code and provide the behavior of the original class. We propose and implement DISSECT (DIStribution for SECurity Tool), an architecture based on the above partitioning (dissection) strategy, for Java 1.1. The tool relieves the developers from actually writing distributed applications by distributing the application automatically, according to designated sensitivities of application portions. We note that the remote execution of classes may increase the overhead. Thus, we have conducted initial experiments to understand the impact of partitioned classes on performance.We report initial performance results which show the overhead and demonstrate when it is low or non-existing, when it is high, and when we actually gain performance by partitioning.


Server System Server Class Constructor Method Client Application Java Class 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Ahpah Software, Inc. SourceAgain.
  2. 2.
    Dirk Balfanz. Access Control for Ad-Hoc Collaboration. Ph.D. Dissertation, pages 75–110, Princeton University, USA, Jan. 2001. Scholar
  3. 3.
    B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan, and K. Le. On the (Im)possibility of Obfuscating Programs. Crypto’01.Google Scholar
  4. 4.
    Petr Beckmann. A History of Pi. St. Martin’s Press, pages 144–145, 1971.Google Scholar
  5. 5.
    A. D. Birrell and B. J. Nelson. Implementing Remote Procedure Calls. In ACM TOCS, 2(1):39–59, Feb. 1984.CrossRefGoogle Scholar
  6. 6.
    C. Collberg, C. Thomborson, and D. Low. A Taxonomy of Obfuscating Transformations. Technical Report 148, University of Auckland, NZ, July 1997. Scholar
  7. 7.
    C. Collberg, C. Thomborson, and D. Low. Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs. In Proc. of POPL 1998, pages 184–196, Jan. 1998.Google Scholar
  8. 8.
    DashO Obfuscation Edition.
  9. 9.
    N. Eastridge. Java Shrinker & Obfuscator v1.04., March 1999.
  10. 10.
    L. Gong. Inside Java 2Platform Security: Architecture, API Design, and Implementaion. Addison-Wesley, 1999.Google Scholar
  11. 11.
    S. Hada. Zero-Knowledge and Code Obfuscation. Asiacrypt 2000, LNCS 1976, Springer, 2000.CrossRefGoogle Scholar
  12. 12.
    C. S. Horstmann and G. Cornell. Core Java 1.1, Volume II-Advanced Features. Sun Microsystems Press, 1998.Google Scholar
  13. 13.
    IBM. Cryptographic cards home page.
  14. 14.
  15. 15.
  16. 16.
    KB Sriram. HashJava., Sept 1997.
  17. 17.
    D. Malkhi, M. Reiter, and A. Rubin. Secure Execution of Java Applets using a Remote Playground. In Proc. of the 1998 IEEE Sym. on Security and Privacy.Google Scholar
  18. 18.
    J. Meyer and T. Downing. Java Virtual Machine. O’Reilly & Associates, 1997.Google Scholar
  19. 19.
    M. Pistoia, D. F. Reller, D. Gupta, M. Nagnur, and A. K. Ramani. Java 2 Network Security, 2nd edition. Prentice Hall, 1999.Google Scholar
  20. 20.
    T. Sander and C. Tschudin. Towards Mobile Cryptography. In Proc. of the 1998 IEEE Sym. on Security and Privacy, pages 215–224, 1998.Google Scholar
  21. 21.
    T. Sander, A. Young, and M. Yung. Non-Interactive Crypto Computing for NC 1. In Proc. of the 40th FOCS, pages 554–566, IEEE 1999.Google Scholar
  22. 22.
    SPEC JVM Client98 Suite, Standard Performance Evaluation Corporation, Release 1.0 8/98.
  23. 23.
    Sun Microsystems, Inc. ClassServer., 1997Google Scholar
  24. 24.
    Sun Microsystems, Inc. Java Object Serialization Specification, Rev 1.2, Dec. 1996.Google Scholar
  25. 25.
    Sun Microsystems, Inc. Java Remote Method Invocation, 1997.Google Scholar
  26. 26.
    Sun Microsystems, Inc. Jini architectural overview,
  27. 27.
    J. D. Tygar and B. Yee. Dyad: A System for Using Physically Secure Coprocessors. In Proc. of Technical Strategies for Protecting Intellectual Property in Networked Multimedia Environment. Annapolis, MD, 1994.Google Scholar
  28. 28.
    E. Valdez and M. Yung. Software DisEngineering: Program Hiding Architecture and Experiments. Information Hiding ’99, LNCS 1768, Springer, 2000.CrossRefGoogle Scholar
  29. 29.
    Hanpeter van Vliet. Mocha, the Java Decompiler., Aug 1996.
  30. 30.
    U. G. Wilhelm. Cryptographically Protected Objects., May 1997.
  31. 31.
    U. G. Wilhelm, S. Staamann and L. Buttyan. Introducing Trusted Third Parties to the Mobile Agent Paradigm. Secure Internet Programming: Security Issues for Mobile and Distributed Objects, LNCS 1603, Springer, 1999.Google Scholar
  32. 32.
    Matt T. Yourst. Inside Java Class Files.
  33. 33.
    WingSoft Corporation. WingDis Java Decompiler.

Copyright information

© Springer-Verlag Berlin Heidelberg 2001

Authors and Affiliations

  1. 1.Computer and Information Science DepartmentPolytechnic UniversityBrooklynUSA
  2. 2.CertCo Inc.New YorkUSA

Personalised recommendations