Protecting software application

• US 10,013,553 B2
• Filed: 03/27/2013
• Issued: 07/03/2018
• Est. Priority Date: 03/27/2013
• Status: Active Grant

• Current Assignee: Irdeto B.V. (MultiChoice Group Ltd.)
• Original Assignee: Irdeto B.V. (MultiChoice Group Ltd.)
• Inventors: Li, Yunpeng, Qie, Chunming
• Primary Examiner(s): Lewis, Lisa C
• Application Number:
  US14/779,207
• Publication Number:
  US 20160055333A1
• Time in Patent Office: 1,924 Days
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

There is provided a method of protecting the execution of a software application, the method performed by a plurality of processes comprising a process for executing the software application and a plurality of protection processes, wherein each protection process in the plurality of protection processes is configured to: monitor a process state of at least one other process in the plurality of processes to determine whether said process state corresponds to a predetermined process state; and perform a predetermined action in response to a determination that said process state corresponds to the predetermined process state; wherein the plurality of protection processes are configured such that a process state of the process for executing the software application is monitored by at least one protection process and a process state of each protection process is monitored by at least one other protection process in the plurality of protection processes. Additionally provided is a computer program and a system for carrying out the method and a computer readable medium for storing such a computer program.

Claims

1. A method, implemented by one or more processors, of protecting the execution of a software application, the method including a plurality of computer executed processes comprising a process for executing the software application by the one or more processors and a plurality of protection processes, wherein each protection process in the plurality of protection processes is configured to:

monitor a state of execution of at least one other process in the plurality of processes to determine whether said state of execution corresponds to a predetermined state of execution; and

perform a predetermined action in response to a determination that said state of execution corresponds to the predetermined state of execution;

wherein the plurality of protection processes are configured such that a state of execution of the process for executing the software application is monitored by at least one protection process and a state of execution of each protection process is monitored by at least one other protection process in the plurality of protection processes.

2. The method of claim 1, wherein each protection process is further configured to monitor the state of execution of the at least one other process to determine whether said state of execution corresponds to a second predetermined state of execution.

3. The method of claim 1, wherein one of the plurality of protection processes comprises the process for executing the software application.

4. The method of claim 1, wherein the predetermined state of execution corresponds to a state of execution that is indicative of a reverse-engineering attack.

5. The method of claim 1, wherein the predetermined action comprises one or more of:

causing the execution of the software application to be terminated;

causing the execution of the software application to be passed to an error handling component; and

/or causing the execution of the plurality of protection processes to be terminated.

6. The method of claim 1, wherein the plurality of protection processes are generated and executed before the software application is executed such that each protection process is being monitored by at least one other protection process in the plurality of protection processes prior to the software application being executed.

7. The method of claim 6, wherein, prior to execution of the software application, the predetermined action comprises causing the execution of the software application to be prevented.

8. The method of claim 6, wherein the software application is configured to identify itself to the plurality of protection processes when it is executed, such that the plurality of protection processes can monitor the process state of execution of the process for executing the software application.

9. The method of claim 1, wherein each protection process is configured to monitor one other protection process and is in turn monitored by one other protection process, such that the plurality of protection processes forms a ring structure.

10. The method of claim 1, wherein the number of protection processes in the plurality of processes varies during the execution of the software application.

11. The method of claim 1, wherein the number of protection processes in the plurality of processes is such that a total time required to attack the plurality of processes is greater than a time taken by any one process in the plurality of protection processes to determine that the state of execution of the at least one other process being monitored corresponds to the predetermined state of execution.

12. One or more non-transitory computer readable media comprising computer program code which, when executed by a processor, causes the processor to carry out a method to protect the execution of a software application, the method including a plurality of computer executed processes comprising a process for executing the software application by the one or more processors and a plurality of protection processes, wherein each protection process in the plurality of protection processes is configured to:

monitor a state of execution of at least one other process in the plurality of processes to determine whether said state of execution corresponds to a predetermined state of execution; and

perform a predetermined action in response to a determination that said state of execution corresponds to the predetermined state of execution;

wherein the plurality of protection processes are configured such that a state of execution of the process for executing the software application is monitored by at least one protection process and a state of execution of each protection process is monitored by at least one other protection process in the plurality of protection processes.

13. A system comprising one or more processors configured to carry out a method to protect the execution of a software application, the method including a plurality of computer executed processes comprising a process for executing the software application by the one or more processors and a plurality of protection processes, wherein each protection process in the plurality of protection processes is configured to:

monitor a state of execution of at least one other process in the plurality of processes to determine whether said state of execution corresponds to a predetermined state of execution; and

perform a predetermined action in response to a determination that said state of execution corresponds to the predetermined state of execution;

wherein the plurality of protection processes are configured such that a state of execution of the process for executing the software application is monitored by at least one protection process and a state of execution of each protection process is monitored by at least one other protection process in the plurality of protection processes.