SHARING AND EXECUTING SENSITIVE LOGIC SEMANTICS

摘要

Obfuscating denotational logic in a source program. A non-rule-based object oriented source program is received. The source program is transformed into a rule-based source program that includes an object model and a ruleset. Attribute domains of the rule-based source program are characterized by a structure of their values in which the structure of the values is nominal, ordered, interval, or ratio. A minimum cardinality is calculated for each domain attribute. First domain attributes are randomly mapped to second domain attributes, each second domain attribute having the same value structure and a same or higher cardinality as the corresponding first domain attribute. For each randomly mapped pair a domain range of the first domain attribute is mapped to a domain range of the second domain attribute. In the rule-based source program first domain input fields and values are replaced with the respective second domain input fields and values.

主权项

1. A method for obfuscating denotational logic in a source program, the method comprising:
receiving, by a computer, a non-rule-based object oriented source program; transforming, by the computer, the non-rule-based source program into a rule-based source program that includes an object model and a ruleset; characterizing, by the computer, attribute domains of the rule-based source program by a structure of their respective values, wherein the structure of the values is a structure selected from a list consisting of: nominal, ordered, interval, and ratio; calculating, by the computer, a minimum cardinality for each domain attribute using static analysis of the ruleset and the object model; randomly mapping one or more first domain attributes to one or more second domain attributes, respectively, wherein each second domain attribute has the same value structure and a same or higher cardinality as the corresponding first domain attribute; for each randomly mapped pair of a first domain attribute to a second domain attribute, mapping, by the computer, a domain range of the first domain attribute to a domain range of the second domain attribute; and for the ruleset in the rule-based source program in which an input field is in one of the one or more first domains, replacing, in the ruleset, the input field with the respective input field from the respective second domain, and replacing each input field value with the corresponding mapped second field value.