Protection of software code from unauthorized use by executing portions of the code in a secure computer environment separate from the environment that executes the remaining portions of the code

• US 20040193987A1
• Filed: 01/06/2004
• Published: 09/30/2004
• Est. Priority Date: 07/13/1995
• Status: Abandoned Application

• Current Assignee: Sospita AS
• Original Assignee: Sospita AS
• Inventors: Sigbjornsen, Sigurd, Haglund, Magne Arild, Oleshchuk, Vladimir A.
• Application Number:
  US10/752,429
• Publication Number:
  US 20040193987A1
• Time in Patent Office: Days
• US Class Current: 714/741
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/123 by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: H04L 2209/127 Trusted platform modules [TPM]
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes

Abstract

Code of at least one software program is executed in a multi-processor computer environment. Each software program includes a first portion of software code to be executed in a computer, and a second portion of software code that includes one or more fragments of code of the software program. The second portion of code is executed in one or more external devices which are in communication with the computer. The second portion of code is encrypted, transferred to a secure computer environment, such as a smart card, and decrypted in the one or more external devices prior to execution. The fragments of code may be interspersed within the first portion of code.

Claims

1. A method of executing code of at least one software program in a multi-processor computer environment, each software program including (i) a first portion of software code to be executed in a computer, and (ii) a second portion of software code that includes one or more fragments of code of the software program, the method comprising executing the second portion of code in one or more external devices which are in communication with the computer.

2. The method of claim 1 wherein the second portion of code is encrypted, the method further comprising transferring the second portion of code to a secure computer environment, and decrypting the second portion of code in the one or more external devices prior to execution.

3. The method of claim 2 wherein the one or more external devices are one or more smart cards, each smart card including a processor for executing the second portion of code, the smart card being the secure computer environment.

4. The method of claim 1 wherein the fragments of code are interspersed within the first portion of code.

5. The method of claim 1 wherein the second portion of code is stored in the computer, the method further comprising downloading the second portion of code into the one or more external devices prior to execution.

6. The method of claim 1 wherein there are a plurality of software programs, and the second portions include fragments from more than one of the software programs.

7. The method of claim 1 wherein the one or more external devices are tamper-resistant.

8. The method of claim 1 wherein the one or more external devices are one or more smart cards.

9. An apparatus which executes code of at least one software program in a multi-processor computer environment, each software program including (i) a first portion of software code, and

(ii) a second portion of software code that includes one or more fragments of code of the software program, the apparatus comprising:

(a) a first computer which executes the first portion; and

(b) one or more externals unit in communication with the computer, the one or more external units executing the second portion.

10. The apparatus of claim 9 wherein the second portion of code is encrypted, the apparatus further comprising:

(c) means for transferring the second portion of code to a secure computer environment; and

(d) means for decrypting the second portion of code in the one or more external devices prior to execution.

11. The apparatus of claim 10 wherein the one or more external devices are one or more smart cards, each smart card including a processor for executing the second portion of code, the smart card being the secure computer environment.

12. The apparatus of claim 9 wherein the second portion of code is stored in the computer, the apparatus further comprising:

(e) means for downloading the second portion of code into the one or more external devices prior to execution.

13. The apparatus of claim 9 wherein the one or more external devices are tamper-resistant.

14. The apparatus of claim 9 wherein the one or more external devices are one or more smart cards.

15. A method of transforming a computer program which includes software code, the method comprising:

(a) identifying one or more fragments of the software code,

(b) associating a program call with each of the identified fragments; and

(c) inserting the program call into the software code, thereby transforming the software program,

wherein when a program call is reached, the respective fragment of software code is executed.

16. The method of claim 15 further comprising:

(d) encrypting the software code associated with the identified fragments; and

(e) replacing the fragments with encrypted versions of the software code.

17. A method of executing a computer program which includes software code, the software code having (i) a first portion, and (ii) a second portion, the second portion including one or more fragments of the software code and a program call associated with each fragment, the method comprising:

(a) executing the first portion; and

(b) executing the associated fragments when a program call in the second portion is reached.

18. The method of claim 17 wherein the first portion executes in a computer, and the second portion executes in an external device with respect to the computer, and step (b) further comprises sending a fragment to the external device when a program call of the associated fragment is reached, and executing the fragment in the external device.

19. The method of claim 18 wherein step (b) further comprises generating a result upon execution of the fragment in the external device, the result being used during subsequent execution of the computer program.

20. The method of claim 18 wherein the external device is a smart card.

21. The method of claim 17 wherein the one or more fragments are encrypted code, the method further comprising:

(c) decrypting the one or more fragments prior to execution thereof.

22. An apparatus for executing a computer program which includes software code, the software code having (i) a first portion, and (ii) a second portion, the second portion including one or more fragments of the software code and a program call associated with each fragment, the apparatus comprising:

(a) means for executing the first portion; and

(b) means for executing the associated fragments when a program call in the second portion is reached.

23. The apparatus of claim 22 wherein the means for executing the first portion is in a computer, and the means for executing the associated fragments is in an external device with respect to the computer, and a fragment is sent to the external device when a program call of the associated fragment is reached, and is then executed in the external device.

24. The apparatus of claim 23 wherein the external device is a smart card.

25. The apparatus of claim 22 wherein the one or more fragments are encrypted code, the apparatus further comprising:

(c) means for decrypting the one or more fragments prior to execution thereof.

26. A method of access control of software code which is executed on a smart card that is in communication with a host computer, the smart card having stored therein access control parameters for identified software code, the method comprising:

(a) the host computer uploading software code and its identity data to the smart card; and

(b) the smart card using the access control parameters and the identity data to determine whether access is permissible for the uploaded software code, wherein the software may be executed only if access is permissible.

27. The method of claim 26 wherein the software code includes one or more fragments of software code of a software program that executes at the host computer.

28. The method of claim 26 wherein access control parameters include one or more of permission status, number of runs data, time data, and program variant data.

29. The method of claim 26 further comprising:

(c) modifying at least one of the access control parameters subsequent to an initial storage of the access control parameters.

30. A method of executing a plurality of software code fragments of a software program on an external unit, wherein the external unit is connected to a computer, the external unit including a processor and a memory, the method comprising:

(a) at execution time of each of the software code fragments, automatically uploading the respective software code fragment to the memory of the external unit; and

(b) executing the respective software code fragment in the external unit using only the processor and the memory of the external unit.

31. The method of claim 30 wherein the software code fragments are encrypted, the method further comprising:

(c) after step (a) and prior to step (b), decrypting the software code fragments.

32. A method of preparing code of a software program, the software program including (i) a first portion of source code to be executed by a first processor, and (ii) a second portion of source code to be executed by a second processor, the second portion of source code including one or more fragments of code of the software program, the method comprising prior to compilation of the software program, encrypting only the second portion of source code.

33. The method of claim 32 wherein the second processor is a smart card.