Software protection aims at safeguarding assets embedded in software by preventing and delaying reverse engineering and tampering attacks. This article presents an architecture and supporting tool flow to renew parts of native applications dynamically. Renewed and diversified code and data belonging to either the original application or to linked-in protections are delivered from a secure server to a client on demand. This results in frequent changes to the software components when they are under attack, thus making attacks harder. By supporting various forms of diversification and renewability, novel protection combinations become available and existing combinations become stronger. The prototype implementation is evaluated on several industrial use cases.

Software Protection techniques aim to defend the confidentiality and integrity of software applications that are exposed to an adversary that shares the execution host and access privileges of the application. This scenario is often denoted as protection against MATE (Man-At-The-End) attacks. This is an area of growing importance. For industry, in many cases the deployment of such techniques is crucial to ensure business continuity. Following the first SPRO workshop co-located with ICSE 2015 in Florence, Italy, this second edition aims to establish a tradition where academics and industrial experts in software protection can meet to confront the challenges in designing stronger protections and in developing better support to deploy those protections and to make them compatible with industrial software development life cycle requirements.

This paper describes the ASPIRE reference architecture designed to tackle one major problem in this domain: the lack of a clear process and an open software architecture for the composition and deployment of multiple software protections on software applications.

There are many reasons to protect software: your banking app needs to be protected to prevent fraud; software operating on critical infrastructures needs to be protected against vulnerability discovery; software vendors and service companies need it to protect their business; etc. In the past decade, many techniques to protect software have been presented and broken. Beyond making individual techniques better, the challenge includes to be able to deploy them in practice and be able to evaluate them. This is the objective of SPRO, the first International Workshop on Software Protection: to bring together researchers and industrial practitioners both from software protection and the wider software engineering community to share experience and provide directions for future research, in order to stimulate the use of software engineering techniques in novel aspects of software protection. This first edition of the workshop is held at ICSE 2015 in Florence (Italy) with the aim of creating a community working in this new growing area of security, and to highlight its synergies with different research fields of software engineering, like: formal models, program analysis, reverse engineering, code transformations, empirical evaluation, and software metrics. This paper presents the research themes and challenges of the workshop, describes the workshop organization, and summarizes the research papers.