Method for controlling access to protected content

• US 20040054894A1
• Filed: 04/08/2003
• Published: 03/18/2004
• Est. Priority Date: 10/11/2000
• Status: Active Grant

• Current Assignee: Oracle Corporation UK Limited (Oracle Corporation)
• Original Assignee: Oracle Corporation UK Limited (Oracle Corporation)
• Inventors: Lambert, Martin R.
• Granted Patent: US 7,761,706 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/1064 Restricting content processing at operating system level
• CPC Class Codes: G06F 21/126 Interacting with the operating system
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A method is disclosed for controlling access by use of an operating system service to content that is to be protected from unauthorised access. The method includes the steps of, for an operating system service which can enable unauthorised access to protected content, modifying the operation of said operating system service to restrict or deny access to the protected content.

Claims

1. A method for controlling access by use of an operating system service to content that is to be protected from unauthorised access, the method comprising the step of:

for an operating system service which can enable unauthorised access to protected content, modifying the operation of said operating system service to restrict or deny access to the protected content.

2. A method according to claim 1, wherein the step of modifying the operation of said operating system service comprises the steps of:

obtaining an address of an entry point of the operating system service, and

placing, starting at the entry point address, an instruction such that, when the instruction is executed, substitute code is executed, the substitute code operating to restrict or deny access to the protected content.

3. A method according to claim 2, wherein the instruction is a jump instruction.

4. A method according to claim 2 or claim 3, comprising the step of, after the substitute code is executed, returning the operating system service to its unmodified state.

5. A method according to claim 4, wherein the step of modifying the operation of said operating system service comprises the step of, prior to placing of the instruction, copying to a buffer a service preamble starting at the entry point address and wherein the step of returning the operating system service to its unmodified state includes the steps of restoring the service preamble that was copied to the buffer to its original position at the entry point address and returning control to the entry point address.

6. A method according to claim 4, wherein the step of modifying the operation of said operating system service comprises the step of, prior to placing of the instruction, copying to a buffer a service preamble starting at the entry point address and wherein the step of returning the operating system service to its unmodified state includes the steps of executing the service preamble from the buffer to which it was copied and then returning control to a point just after the place from which the service preamble was copied.

7. A method according to claim 1, wherein the step of modifying the operation of said operating system service comprises the step of:

replacing an address of an entry point of the operating system service in a trap dispatcher table with an address of an entry point of substitute code, the substitute code operating to restrict or deny access to the protected content.

8. A method according to any of claims 1 to 7, wherein the operating system service is modified before any application processes are loaded.

9. A method according to claim 8, wherein an initialisation module is loaded before any application processes have been loaded, and wherein the modifying step is based on instructions in the initialisation module.

10. A method according to claim 9, wherein the initialisation module is loaded into every application process.

11. A method according to any of claims 1 to 7, wherein a loadable module has initialisation code which when executed causes said modifying step to take place and wherein the loadable module has clean-up code which when executed causes said modifying step to be undone, the method comprising the step of loading the loadable module into every running application process.

12. A method according to claim 11, wherein the step of loading the loadable module is carried out as a result of the execution of another operating system service.

13. A method according to claim 11 or claim 12, wherein the act of loading the loadable module into a running application process causes the initialisation code to be executed.

14. A method according to any of claims 11 to 13, wherein the act of unloading the loadable module from a running application process causes the clean-up code to be executed.

15. A method according to claim 11, comprising the step of a digital rights management client operating via an inter-process communication mechanism to cause the loadable module to execute its initialisation code and clean-up code within the context of each running application process.

16. A method according to claim 11, wherein running of an application process into which the loadable module has been loaded calls the loadable module thereby to cause the modifying step to be carried out.

17. A method according to any of claims 1 to 16, wherein the modification of the operating system service protects, from screen grabbing, at least a visible area of an image displayed on a screen.

18. A method according to any of claims 1 to 17, comprising the step of implementing a virtual file system that can be used to communicate decrypted content to a renderer without exposing the decrypted content to unauthorised access via a local file system.

19. A method according to claim 18, comprising the steps of:

passing to a renderer a filename for a virtual file;

requesting by the renderer access to the file; and

,

routing the renderer'"'"'s access request via the virtual file system to a buffer containing the protected content.

20. A method according to claim 19, comprising the step of decrypting the protected content before placing the protected content in the buffer.

21. A method according to claim 19, comprising the step of placing encrypted content in the buffer, the modified operating system service obtaining a decryption key to decrypt the encrypted content on demand.

22. A method according to any of claims 1 to 17, comprising the step of implementing a secure file system by which only trusted invocations of the operating system are permitted to decrypt encrypted files stored within an encrypted portion of the secure file system.

23. A method according to claim 20, wherein said encrypted portion of the file system contains protected content and associated licensing information.

24. A method according to any of claims 1 to 23, comprising the steps of:

establishing guard points to indicate which processes, threads, and/or windows are trusted; and

,

restricting execution of the operating system service only to the trusted processes, threads, and/or windows.

25. A method according to any of claims 1 to 24, wherein operation of the operating system service is modified by use of a device driver.

26. A method according to any of claims 1 to 24, wherein operation of the operating system service is modified by use of a file system hook.

27. A method according to any of claims 1 to 24, wherein operation of the operating system service is modified by use of an installable file system module.

28. A method according to any of claims 1 to 27, comprising the step of inspecting the operating system service for the presence of a downstream patch or hook.

29. A method according to claim 28, wherein the step of inspecting the operating system service includes the steps of comparing a snapshot of the operating system service with a snapshot of the operating system service obtained during operating system start-up.

30. A method according to any of claims 1 to 29, comprising the step of detecting an upstream patch or hook by determining whether a patched operating system service entry point still points to substitute code installed by a digital rights management client.

31. A method according to any of claims 1 to 30, comprising the step of detecting an upstream patch or hook by removing and then reinstalling a patch installed by a digital rights management client.

50. A computer program containing program instructions for causing a computer to perform a method according to any of claims 1 to 49.

51. A computer program according to claim 50, wherein the computer program is embodied in a digital rights management client.

32. A method for controlling access by use of an operating system service to content that is to be protected from unauthorised access, the method comprising the steps of:

running an untrusted application routine; and

,

prior to the application routine using an operating system service that would enable unauthorised access to content which is to be protected, determining whether use of said operating system service would cause said operating system service to access said content and, if so, restricting or denying the operating system service access to said content.

33. A method according to claim 32, wherein the step of denying the operating system service access to said content comprises the steps of:

obtaining an address of an entry point of the operating system service, and

placing, starting at the entry point address, an instruction such that, when the instruction is executed, substitute code is executed, the substitute code operating to restrict or deny access to the protected content.

34. A method according to claim 33, wherein the instruction is a jump instruction.

35. A method according to claim 33 or claim 34, comprising the step of, after the substitute code is executed, returning the operating system service to its unmodified state.

36. A method according to claim 35, wherein the step of modifying the operation of said operating system service comprises the step of, prior to placing of the instruction, copying to a buffer a service preamble starting at the entry point address and wherein the step of returning the operating system service to its unmodified state includes the steps of restoring the service preamble that was copied to the buffer to its original position at the entry point address and returning control to the entry point address.

37. A method according to claim 35, wherein the step of modifying the operation of said operating system service comprises the step of, prior to placing of the instruction, copying to a buffer a service preamble starting at the entry point address and wherein the step of returning the operating system service to its unmodified state includes the steps of executing the service preamble from the buffer to which it was copied and then returning control to a point just after the place from which the service preamble was copied.

38. A method according to claim 32, wherein the step of denying the operating system service access to said content comprises the step of:

replacing an address of an entry point of the operating system service in a trap dispatcher table with an address of an entry point of substitute code, the substitute code operating to restrict or deny access to the protected content.

39. A method according to any of claims 32 to 38, comprising the step of implementing a virtual file system that can be used to communicate decrypted content to a renderer without exposing the decrypted content to unauthorised access via a local file system.

40. A method according to claim 39, comprising the steps of:

passing to a renderer a filename for a virtual file;

requesting by the renderer access to the file; and

,

routing the access request to a buffer containing the protected content.

41. A method according to claim 40, comprising the step of decrypting the protected content before placing the protected content in the buffer.

42. A method according to claim 40, comprising the step of placing encrypted content in the buffer, the operating system service obtaining a decryption key to decrypt the encrypted content on demand.

43. A method according to any of claims 32 to 38, comprising the step of implementing a secure file system by which only trusted invocations of the operating system are permitted to decrypt encrypted files stored within an encrypted portion of the secure file system.

44. A method according to claim 43, wherein said encrypted portion of the file system contains protected content and associated licensing information.

45. A method according to any of claims 32 to 44, comprising the steps of:

establishing guard points to indicate which processes, threads, and/or windows are trusted; and

,

restricting execution of the operating system service only to the trusted processes, threads, and/or windows.

46. A method according to any of claims 32 to 45, comprising the step of inspecting the operating system service for the presence of a downstream patch or hook.

47. A method according to claim 46, wherein the step of inspecting the operating system service includes the steps of comparing a snapshot of the operating system service with a snapshot of the operating system service obtained during operating system start-up.

48. A method according to any of claims 32 to 47, comprising the step of detecting an upstream patch or hook by determining whether a patched operating system service entry point still points to substitute code installed by a digital rights management client.

49. A method according to any of claims 32 to 48, comprising the step of detecting an upstream patch or hook by removing and then reinstalling a patch installed by a digital rights management client.