A Software Security Optimization Architecture (SoSOA) and Its Adaptation for Mobile Applications

—Security attacks become daily news due to an exposure of a security threat in a widely used software. Taking software security into consideration during the analysis, design, and implementation phases is a must. A software application should be protected against any security threat such as unauthorized distribution or code retrieval. Due to the lack of applying a software security standard architecture, developers may create software that may be vulnerable to many types of security threats. This paper begins by reviewing different types of known software security threats and their countermeasure mechanisms. Then, it proposes a new security optimization architecture for software applications. This architecture is a step towards establishing a standard to guarantee the software's security. Furthermore, it proposes an adapted software security optimization architecture for mobile applications. Besides, it presents an algorithmic implementation of the newly proposed architecture, then it proves its security. Moreover, it builds a secure mobile application based on the newly proposed architecture.


Introduction
Developers afford a great work in order to produce a single application. So, securing this hard work is absolutely necessary; i.e. any software application should be protected. Protecting any software application -includes but not limited to -the following: 1. Secure source code against source code hacking, and code reverse engineering. 2. Secure software applications against illegal download and illegal copy and/or distribution. 3. Secure data against internal threats (data loss) and external threats (Information leakage).
To secure data against internal threats, then the countermeasures are including but not limited to data protection (data loss prevention), utilize security frameworks and libraries, and error monitoring and handling exception. To secure data against external threats, then the countermeasures are including but not limited to security tests, data validation, access control (authorization), authentication, logging and intrusion detection, and SQL injection prevention.
Developers should take software security into account during the analysis, design, and implementation phases. To guarantee the software security, developers should follow a software security standard architecture. Besides introducing new algorithms that guarantee digital rights management (DRM), this paper integrates all security mechanisms into a single robust software security architecture. This paper presents a secure optimization architecture for software security. Then it presents an adapted architecture for mobile applications. By using the proposed architecture, software developers can integrate all security mechanisms in-house. Accordingly, they do not have to send the source code to a respectable software security company to add the needed security mechanisms.
The rest of this paper is organized as follows. Section 2 presents the mechanisms that may be used to secure software applications. Section 3 proposes a new software security optimization architecture (SoSOA). Section 4 adapts SoSOA to mobile applications. Finally, Section 5 presents the conclusion and further works.

Software Applications Security
This section reviews the mechanisms used to ensure the security of any software application. These mechanisms could be used to secure source code, software application and data.

Secure source code
A software package may have several alternatives. One of them implements an original algorithm and the others just imitate it. If the programmers can imitate other programmers work, then the computer may imitate a given application. The programmer/computer captures the main features of the original software package and builds a new one (using what is called reverse engineering) [1].
Source code hacking: To prevent an attacker form stealing the source code, developers should use at least one of the following methods: Some of the most popular obfuscation tools are ProGuard [13], DexProtector [14], and DexGuard [15]. These tools use cryptographic algorithms besides security checks in Android APK to prevent attacks such as intrusions. Once these tools detect that the code is being hacked, the application will be blocked immediately.

Secure software application
This section presents DRM functionality; security mechanisms that could be used to prevent illegal software application download and/or illegal copy and illegal distribution.
Secure software application: against illegal download. If the program is free, then there is no illegal download. Otherwise, A digital distribution platform (Such as app store, play store, galaxy apps, amazon app store, etc.) could be used to handle such a problem [16]. The illegal copied-software application should not work.
Secure software application: against illegal copy and/or illegal distribution. This can be done using a dongle [17] and/or code signing [18] with Android Application Licensing [7].

Secure data
This section discusses the mechanisms used by developers to secure data against both internal and external threats.
Internal threats (Data Loss). Data loss means losing sensitive information due to human errors, computer viruses, adversaries' attacks, computer hardware or software failure, or natural disasters. Various mechanisms utilized to protect stored and transmitted data such as Utilize Security Frameworks and Libraries [19,20], Data Protection (Data Loss Prevention -DLP), Error Monitoring and Handling Exception.
External threats (Information leakage): A software application could leak sensitive information such as application configuration details, comments within the code or personal data. This information could be used to attack the software application, its network host or its users. Various security mechanisms utilized to prevent information leakages, such as Authentication [21,22], Access Control (Authorization), Logging and Intrusion Detection [23,24], Auditability, SQL Injection [25][26][27][28], Data Validation, and Security Tests [29,30].

Newly Proposed Software Security Optimization Architecture
This section proposes a new security architecture which can be used by developers in order to protect their software application. This architecture could be described as follows: 1. During the application development phase, the developer should secure the software applications using: a) Mechanisms that are used to ensure source code protection and software application protection as described in Sections 2.1 and 2.2 respectively. Accordingly, developers could:7 i. Add a watermark to the source code and encrypt its files, in order to avoid source code stealing. ii. Use obfuscation to prevent reverse engineering. Furthermore, for Android applications, tools such as ProGuard, DexProtector and DexGuard could be used, in order to avoid reverse engineering. b) Mechanisms that are used to prevent data loss and information leakage as described in Section 2.3.
2. Assure legal and paid software application utilization: Software application should be published on app store and this app store manages such issues. 3. Secure software application against illegal distribution: To protect a software application against illegal distribution, developers should use a DRM system.

Newly proposed secure software applications against illegal distribution
Whenever the developers do not want to use an external DRM system, they may use the following new proposed DRM procedure.
The notations to be used in the proposed procedure may be described as follows: • : is a secure hash function.
• : is a secure message authentication code (a keyed secure hash function). • ∥: is the concatenation operation.
• Nonce: is a random 256 bits string that may be used only once.

•
: is the Company's Master Key, which is a 256 bits secure company's key for a specific software application.

•
: is the machine motherboard serial number.

•
: is the International Mobile Equipment Identifier, which is also known as the Mobile Equipment Identifier ( ).

•
: is the User identification, which may be the user's email, phone number, fax number, or mobile phone number. • − : is the key that is used to generate the such that : is a product key such that, app- To avoid sending the source code to a third party to add the DRM functionalities, the developers may use the following procedure: Install and activate the application: To install the application, the software development company and the user should do as follows: 1. The company server deploys the software application on an app store. 2. The user: a) Buys the software application from a trusted app store. The purchase-ticket containing the and should be signed. b) Downloads the purchased software application from the app store. c) Installs the software application and opens it for the first time, then registers as a new user. d) Sends , and purchase-ticket via a secure channel to the company's server. Whenever the app starts up and the machine connected to the Internet: Immediately after the device is connecting to the internet, the company's server should ensure that the app-KEY-file has not been altered. This should be done, even if the software application is opened and being used. To this end, the subsequent steps should be followed: ]. If yes, then the software application runs. Else, the software application aborts.
Whenever the mobile is lost, changed or destroyed: A new product key should be generated for the legitimate user. To this end, the subsequent steps might be followed: 1. The user: a) Downloads the application from an authentic app store. b) Installs the software application and opens it for the first time, then requests a new activation. c) Sends and the new to the company's server via a secure channel.
2. The company's server checks whether the is registered. If yes, then it sends a validation message to this user using the . Else, it revokes the operation. 3. After receiving the validation message, if the user has asked for a new activation, then sends a response to the validation message with the current machine . Else, the user revokes the operation. 4. After receiving the response, the company's server checks the user legitimacy. If the user is not legitimate, then aborts the operation. Else, the company's server:

Security analysis
This section provides a security analysis for the newly proposed DRM procedure to prove its ability to prevent all famous attacks' scenarios.
First scenario: If the attacker Eve tries to register as a new user without a purchaseticket, then the company's server will revoke the operation. Also, since every purchaseticket contains someone's and , then Eve never be able to use it. Second scenario: Since all communications use a secure channel, then when a legal user tries to register for the first time, the attacker Eve cannot change the couple ( , ) to her own in order to get the activation parameters. Moreover, if Eve succeeds to change the couple to her own data, then she cannot change it within the purchase-ticket. Consequently, the company's server will revoke the operation.
Third scenario: Since the activation parameters are produced for a specific machine, then the attacker Eve cannot capture them to complete the installation and activate the application.
Forth scenario: Whenever the attacker Eve tries to ask for a new activation, the company's server will revoke the operation. This is because her does not exist in the company's server database. Moreover, if Eve asks for a new activation with a legal , then the legal user will be acknowledged and consequently revoke the operation. And even if the legal user responded positively, the new activation parameters will be produced for the legal user's machine, not for Eve's machine.
Fifth scenario: When a legal user asks for a new activation, the license on the prior machine will be revoked. As the application will not work once the prior machine is connected to the Internet. So, the legal user will never to be able to have the application installed on more than one machine at a time.
Sixth scenario: An attacker Eve might buy an old machine with an installed application. As mentioned, the application checks the machine authenticity when it connects to the Internet. Thus, the application will revoke the old license when the legal user asks for a new activation. Consequently, the application will stop running on the old machine when it connects to the Internet.

Efficiency analysis
The following notations are used to analyze the performance of the newly proposed DRM procedure: 1.
: is the time complexity of the used message authentication code. 2.
: is the time complexity of generating the _ _ . 3.
: is the time complexity of the used digital signature.
Accordingly, the time complexity required to install and activate the application is + + . The time complexity requited at the application's start-up is + . The time complexity required whenever the app starts up and the machine connected to the Internet is 2 + . The time complexity required whenever the mobile is lost, changed or destroyed is + + . Since the newly proposed DRM procedure just sends and receives a few messages with negligible time according to the current Internet's speed. Besides, it performs at most three security mechanisms such as MAC and digital signature with trivial time according to the modern computers' speed. Consequently, the efficiency of the newly proposed DRM procedure is similar to the efficiency provided by Google or any other companies DRM procedures.

A comparative study among various related security architectures
This section provides a comparative study among the proposed SoSOA, and various related security architectures (Android applications licensing) that provide DRM functionality such as Google play licensing, Amazon DRM, Android licensor, Droid activator, etc [7].
The proposed SoSOA is an open source architecture for software security optimization. It enables software developers to add DRM functionality in-house as described in Section 3.1. The DRM functionality will be adapted in Section 4.1 for mobile applications. Furthermore, the proposed SoSOA urges software developers to secure the source code and the data using the mechanisms described in Sections 2.1 and 2.3 respectively. Besides, the proposed SoSOA, is a platform-independent software security architecture.
Google play licensing is an open source system. that provide digital rights management (DRM) functionality. Even though, Google play licensing requires having Google accounts for both developers and users. Also, it requires source code to add the protection mechanisms. Moreover, the copy protection mechanism is no longer supported. Furthermore, it does not support Java/C/C++ code protection.
Amazon DRM provides DRM functionality. Even though, it requires source code to automatically add the protection mechanisms, which produce unexpected results. For example, sometimes verification errors cause apps to close. Moreover, it does not support Java/C/C++ code protection. Besides, it is a proprietary system.
Android licenser is an open source system that provides DRM functionality. Even though, it requires source code to add the protection mechanisms. Also, it provides low level of protection. Moreover, an adversary could bypass the protection due to using public channels to deliver the keys. Furthermore, it does not support Java/C/C++ code protection. Besides, it is a paid DRM service.
Droid activator is an open source system. Even though, the developer needs to deploy his/her own server, for the sake of storing the server part of Droid activator protection. Also, it provides a low level of protection. Moreover, it is easy to capture the activation keys. Furthermore, it does not support Java/C/C++ code protection.
Unfortunately, these Android applications licensing provide neither source code protection nor data protection. Moreover, software developers have to provide their own application source code to a software security company to add DRM functionality. Thus, the proposed SoSOA is superior to the Android applications licensing, as it provides source code protection, DRM, and data protection functionalities in-house. Table 1 summarizes the comparative study, which presents the results of the comparison among the proposed SoSOA and various Android applications licensing.

An Adapted Software Security Optimization Architecture for Mobile Applications (SoSOA-MA)
To adapt SoSOA to mobile applications, and will be replaced by the ℎ ( ) and respectively. To secure software mobile app against illegal distribution, this section presents an applied algorithmic methodology for the adapted architecture. It also presents an Android implementation for the proposed DRM algorithms in Section 4.1. Moreover, it presents a case study (VirTour application) in Section 4.2.

An applied methodology for securing mobile applications against illegal distribution
This section presents the algorithms that may be used to secure mobile applications against illegal distribution after deploying it on an app store.
Download, install and activate a mobile application: Once a user buys the mobile application and gets the purchase-ticket, the newly proposed algorithm 1 may be used to complete legal installation of the mobile application. This algorithm generates the activation parameters for a specific mobile phone. Algorithm 1 creates − , ] for a particular user and stores them in a database. Meanwhile, the company's server delivers these values to the user via a secure channel. After getting these values, the app on the mobile device should protect them from being altered. After that, the app will generate and use the − − for its activation. Then, the app constructs [ − − ], which cannot be altered. This algorithm is activated only once at application's installation. Run the mobile application. 9: Else 10: Abort running the mobile application. 11: end if 12: End Whenever the app starts up and the mobile connected to the Internet: To maximize the copyrights protection, the newly proposed algorithm 3 ensures the app authenticity whenever the app's starts up and the mobile is connected to the Internet. if registered MPN == true then 7: Generate and send a ValidationMessage to the user. 8: procedure VALIDATE ACTIVATION PARAMETERS' REQUEST AT THE CLIENT SIDE(ValidationMessage) 9: if The user asked for a new activation == true then 10: Generate a response message to the company's server with IMEI of the current mobile device. 11: return the response message. The advantages of using the proposed algorithms can be listed as follows: 1. As illustrated in Sections Fig. 1 and 3.3, the newly proposed algorithms are secure and efficient. For instance, an adversary cannot bypass the protection due to the use of a secure channel to deliver the ( ∥ ∥ ).

2.
The code is open and free to be used. It may be adapted and/or enhanced. 3. The new algorithms provide digital rights management (DRM) functionality internally. So, there is no need to send the source code to a third party to add the DRM services. 4. The new algorithms are applicable to all mobile application types (Android, iOS, etc.) [5].

Development of an android secure mobile application
This section presents an Android secure mobile application demonstration that resists illegal distribution. This demonstration provides DRM functionality for a secure mobile app. It utilizes the new algorithms proposed in Section 4.1.
An android mobile application demonstration: Due to the embedded security functions based upon the newly presented algorithms, the developed Android application prevents its illegal distribution. This application can be illustrated as follows: Installation: At the beginning, a user purchases and downloads the mobile application from a trusted App Store. Immediately, the installation process will begin. Figure 2 illustrates the different stages of the installation process. Registration: According to algorithm 1, the user should register before login to the application. At the first opening of the application on a particular mobile, the user should prove his identity as a legal user who purchases the application. Figure 3 (a) shows that the user should register before login for the first time. In Figure 3 (b), the user enters his mobile number and then hits the register button. In Figure 3 (c), the application asks the user to enter the secret code. Meanwhile, the company's server stores the mobile data into a secure database and generates a random secret code for this mobile number, as shown in Figure 3 (d). Then, the company's server sends this secret code to the user. Thereafter, the user enters the secret code as shown in Figure 3 (e). Once the user hits the submit button, the user logs in as shown in Figure 3 (f). The mobile should connect to the Internet during the registration process  Acquiring a new licensing: A legitimate user may demand a new licensing whenever (s)he changed her/his mobile device. Firstly, a legitimate user downloads and installs the application as shown in Figure 5 & Figure 6 illustrates that the user cannot log in or register before (s)he revokes the old license and demands a new one. Figure 6 (c) illustrates that the user cannot register without an Internet connection. To log in, the legitimate user should revoke the old license and demand a new one by pressing "REVOKE MY LICENSE" button, as shown in Figure 7 (a). Afterwards, the company's server creates an activation code and sends it to the legitimate user via SMS, as shown in Figure 7 (b). Subsequently, the user enters the correct activation code and press' the "SUBMIT" button, as shown in Figure 7 (c). Figure 7 (d) shows that the new mobile is registered and log in into the application. The mobile should be connected to the Internet during the whole process.  . It is a gaming platform which introduces a new technology-based approach to site attraction in Egypt. As a mobile application, the VirTour's platform needs to be protected against all types of attacks. So, developers could use the newly presented architecture to protect VirTour's platform. Section 4.1 presented algorithms that protect mobile applications against illegal distribution. So, VirTour's developers may use those algorithms to protect their platform against illegal distribution as shown in Section 4.2.

Conclusion
Protecting software applications is a critical task for application developers. This paper aimed at providing an optimized security solution for developers. Accordingly, it surveyed the current security mechanisms for software applications. Then, it proposed a new software security optimization architecture (SoSOA). SoSOA may guide software developers to secure their software applications. Furthermore, this paper adapted the software security optimization architecture to suit mobile applications. Subsequently, it proposed security algorithms and its implementation for securing mobile applications (such as VirTour gaming platform) against illegal distribution.
The further work includes generating a new framework and security libraries which reflect the proposed software security optimization architecture and its adaptation for mobile applications.

Authors
Dr. Amr Abozeid is an assistant professor of computer science at Computer Science Department, College of Science & Arts (Gurayat), Jouf University, Saudi Arabia. He also worked as assistant professor of Computer Science at the Mathematics and Computer Science department, Faculty of Science, Al-Azhar University. His fields of research include video processing, computer vision, deep learning, and mobile computing.
Dr. AbdAllah A. AlHabshy is an assistant professor of computer science at Mathematics department, Faculty of Science, Al-Azhar University. His fields of research are Cryptography, Network Security, Mobile Security, Database Security, Software Security, Internet of things, and Video Protection. Email: AbdAllah@Azhar.edu.eg Prof. Kamal Abdelraouf ElDahshan is a professor of Computer Science and Information Systems at Al-Azhar University in Cairo, Egypt. At Al-Azhar, he founded the Centre of Excellence in Information Technology, in collaboration with the Indian government, and was also the founder and former president of the coordination bureau of the Egyptian Knowledge Bank, the country's largest initiative for academic access. Among other accolades, he is a Fellow of the British Computing Society, and a Founding Member of the Egyptian Mathematical Society.