Method to Protect Software Against Unwanted Use with a Variable Principle

• US 20070294770A1
• Filed: 08/07/2007
• Published: 12/20/2007
• Est. Priority Date: 08/01/2001
• Status: Abandoned Application

• Current Assignee: SAS VALIDY
• Original Assignee: SAS VALIDY
• Inventors: Cuenod, Jean-Christophe, Sgro, Gilles
• Application Number:
  US11/835,204
• Publication Number:
  US 20070294770A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code

Abstract

The invention concerns a process to protect a vulnerable software working on a data processing system against its unauthorized usage using a memorizing unit. The process comprises creating a protected software by choosing in the source of the vulnerable software at least one variable and by producing the source of the protected software by modifying the source of the vulnerable software, so that the chosen variable resides in the memorizing unit.

Claims

1. A method to protect, using at least one blank unit (60) including memorization means (15), a vulnerable software (2v) against its unauthorized usage, said vulnerable software (2v) being produced from a source (2vs) and working on a data processing system (3), said protection process comprising:

during a protection phase (P);

creating a protected software (2p);

by choosing in the source of the vulnerable software (2vs);

at least one variable which, during the execution of the vulnerable software (2v), partially defines the state of the latter,

and at least one portion containing at least one chosen variable,

by producing a source of the protected software (2ps) from the source of the vulnerable software (2vs), by modifying at least one chosen portion of the source of the vulnerable software (2vs), this modification being such that during the execution of the protected software (2p), at least one chosen variable or at least one copy of chosen variable resides in the blank unit (60) which is thus transformed into a unit (6), and

by producing a first object part (2pos) of the protected software (2p) from the source of the protected software (2ps), said first object part (2pos) being such that during the execution of the protected software (2p), appears a first execution part (2pes) which is executed in the data processing system (3) and whose at least a portion takes into account that at least a variable or at least a copy of variable resides in the unit (6), and

during a usage phase (U) during which the protected software (2p) is executed;

in the presence of the unit (6), each time a portion of the first execution part (2pes) imposes it, using a variable or a copy of variable residing in the unit (6), so that said portion is executed correctly and that, consequently, the protected software (2p) is completely functional, and

in the absence of the unit (6), in spite of the request by a portion of the first execution part (2pes) to use a variable or a copy of variable residing in the unit (6), not being able to fulfill said request correctly, so that at least said portion is not executed correctly and that, consequently the protected software (2p) is not completely functional, wherein said at least one blank unit (60) includes only the memorization means (15).

2. A method to protect software comprising:

storing a first portion of the software on a first unit, wherein the first unit comprises a memory and a processor;

storing a second portion of the software on a second unit, wherein the second unit comprises a secure processor and a secure memory, wherein the second portion of the software is secret, and wherein the first and second portions of the software form a single program; and

executing the single formed program by utilizing the first and second portions of the software,

wherein the secret second portion of the software comprises at least two computing operations and at least one variable, and

wherein portions of the at least two computing operations are interleaved with each other for transmission from the second unit to the first unit and vise versa, and

wherein the first unit requests the at least one variable from the second unit during the execution of the single formed program.

3. The method of claim 2, wherein portions of the second portion of the software are executed by the secure processor and the first portion of the software is executed by the processor of the first unit.

4. The method of claim 3, wherein:

the at least two computing operations stored of the second portion of the software comprise a first computing operation and a second computing operation,

the first computing operation which uses a first chosen variable to obtain a first result variable,

the second computing operation which uses a second chosen variable to obtain a second result, and

during the execution of the program by the secure processor;

performing a first variable movement by moving the first chosen variable from the first unit into the second unit,

performing a second variable movement by moving the second chosen variable from the first unit into the second unit,

performing a first result movement by moving the first result variable from the second unit into the first unit, and

performing a second result movement by moving the second result variable from the second unit into the first unit,

each of said first and second variable movements, said first and second computing operations, and said first and second result movements comprise an operation,

the first variable movement, the first result movement, and the first computing operation comprise a first set of operations and the second variable movement, the second result movement and the second computing operation comprises a second set of operations, and

at least one operation of one of the sets is interleaved with the operations of the other set.

5. The method according to claim 2, wherein the second unit is a chip medium configured to attach and detach to the first unit.

6. The method according to claim 2, wherein the processor of the second unit is a coprocessor of the processor of the first unit.

7. The method according to claim 2, wherein the second unit is a token.

8. The method according to claim 2, wherein, when the second unit is missing, the program cannot be executed correctly and the software is not completely functional.

9. The method according to claim 2, wherein, when the at least one variable is not provided by the second unit upon request, the program is not executed correctly.

10. The method according to claim 2, wherein the at least two computing operations are elementary functions.

11. The method according to claim 2, further comprising:

storing elementary functions that are to be executed in the second unit; and

providing commands from the first unit provides to the second unit to trigger execution of a respective elementary function.

12. The method according to claim 2, further comprising:

defining instructions set in which instructions work with registers and use at least one operand for returning a result,

wherein at least some of the instructions comprise;

a part defining functionality of the instruction,

a part defining expected chaining for execution of the instruction and comprising bits fields corresponding to an identification field of the instruction, wherein each of the at least one operand comprises;

a flag field and an expected identification field,

wherein, for each register used by the instructions set, providing a generated identification field in which the identification of the last instruction which has returned its result in a respective register is automatically memorized,

wherein, during the execution of an instruction, for each operand, when required by the flag field, checking the equality of the generated identification field corresponding to the register used by said operand, and the expected identification field of the origin of said operand, and modifying the result of the instructions, if at least one of the checked equalities is false.

13. The method according to claim 2, further comprising selecting a part of the software to form the second portion during operation of creating the protected program.

14. A system to protect software comprising:

a first unit comprising a memory and a processor and which stories a first portion of the software; and

a second unit comprising a secure processor and a secure memory and which stores a second portion of the software,

wherein the second portion of the software is secret,

wherein the first and second portions of the software form a single program,

wherein the processor executes the single formed program utilizing the second unit,

wherein the secret second portion of the software comprises at least two computing operations and at least one variable, and

wherein portions of the at least two computing operations are interleaved with each other for transmission from the second unit to the first unit and vise versa, and

wherein the first unit requests the at least one variable from the second unit during the execution of the single formed program.

15. A method to protect, using at least one blank unit (60) including at least memorization means (15), a vulnerable software (2v) against its unauthorized usage, said vulnerable software (2v) being produced from a source (2vs) and working on a data processing system (3), said protection process comprising:

during a protection phase (P);

creating a protected software (2p);

by choosing in the source of the vulnerable software (2vs);

at least one variable which, during the execution of the vulnerable software (2v), partially defines the state of the latter, and

at least one portion containing at least one chosen variable,

by producing a source of the protected software (2ps) from the source of the vulnerable software (2vs), by modifying at least one chosen portion of the source of the vulnerable software (2vs), this modification being such that during the execution of the protected software (2p), at least one chosen variable or at least one copy of chosen variable resides in the blank unit (60) which is thus transformed into a unit (6), and

by producing a first object part (2pos) of the protected software (2p) from the source of the protected software (2ps), said first object part (2pos) being such that during the execution of the protected software (2p), appears a first execution part (2pes) which is executed in the data processing system (3) and whose at least a portion takes into account that at least a variable or at least a copy of variable resides in the unit (6), and

during a usage phase (U) during which the protected software (2p) is executed;

in the presence of the unit (6), each time a portion of the first execution part (2pes) imposes it, using a variable or a copy of variable residing in the unit (6), so that said portion is executed correctly and that, consequently, the protected software (2p) is completely functional, and

in the absence of the unit (6), in spite of the request by a portion of the first execution part (2pes) to use a variable or a copy of variable residing in the unit (6), not being able to fulfill said request correctly, so that at least said portion is not executed correctly and that, consequently the protected software (2p) is not completely functional.

wherein during the protection phase (P);

defining;

a set of elementary functions whose elementary functions are liable to be executed in the unit (6) which also includes processing means (16), and

a set of elementary commands for said set of elementary functions, said elementary commands being liable to be executed in the data processing system (3) and to trigger the execution in the unit (6), of the elementary functions,

constructing exploitation means enabling to transform the blank unit (60) into the unit (6) able to execute the elementary functions of said set, the execution of said elementary functions being triggered by the execution in the data processing system (3), of elementary commands,

modifying the protected software (2p);

by choosing in the source of the protected software (2ps);

at least one algorithmic processing which during the execution of the protected software (2p), uses at least one chosen variable, and enables to obtain at least one result variable, and

at least one portion containing at least one chosen algorithmic processing,

by modifying at least one chosen portion of the source of the protected software (2ps), this modification being such that;

during the execution of the protected software (2p) the first execution part (2pes) is executed in the data processing system (3) and a second execution part (2peu) is executed in the unit (6),

at least the functionality of at least one chosen algorithmic processing is executed by means of the second execution part (2peu),

said at least one chosen algorithmic processing is executed by means of the second execution part (2peu), using elementary functions of the set of elementary functions,

for at least one chosen algorithmic processing, elementary commands are integrated to the source of the protected software (2ps), so that during the execution of the protected software (2p), each elementary command is executed by the first execution part (2pes) and triggers in the unit (6), the execution by means of the second execution part (2peu), of a corresponding elementary function of the set of elementary functions, and

a sequence of the elementary commands is chosen among the set of sequences allowing the execution of the protected software (2p), and

by producing;

the first object part (2pos) of the protected software (2p), said first object part (2pos) being such that during the execution of the protected software (2p), the elementary commands are executed according to the chosen sequence, and

a second object part (2pou) independent of the protected software (2p) containing the exploitation means, said second object part (2pou) being such that, after upload to the blank unit (60) and during the execution of the protected software (2p), appears the second execution part (2peu) by means of which the elementary functions triggered by the first execution part (2pes) are executed, and

uploading the second object part (2pou) to the blank unit (60), with the intention of obtaining the unit (6), and

wherein during the usage phase (U);

in the presence of the unit (6) and each time an elementary command contained in a portion of the first execution part (2pes) imposes it, executing the corresponding elementary function in the unit (6), so that said portion is executed correctly and that, consequently, the protected software (2p) is completely functional, and

in the absence of the unit (6), in spite of the request by a portion of the first execution part (2pes), to trigger the execution of an elementary function in the unit (6), not being able to fulfill said request correctly, so that at least said portion is not executed correctly and that, consequently, the protected software (2p) is not completely functional.

16. The method according to claim 15, further comprising:

during the protection phase (P);

defining;

as a triggering command, an elementary command,

as a dependent function, an elementary function,

as an order, at least one argument for a triggering command, corresponding at least in part to the information transmitted by the data processing system (3) to the unit (6), so as to trigger the execution of the corresponding dependent function,

a method of renaming of the orders enabling to rename the orders so as to obtain triggering commands with renamed orders, and

restoring means (20) designed to be used in the unit (6) during the usage phase (U), and enabling to restore the dependent function to execute, from the renamed order,

constructing exploitation means enabling the unit (6) to also implement the restoring means, and

modifying the protected software (2p);

by choosing in the source of the protected software (2ps), triggering commands,

by modifying at least one chosen portion of the source of the protected software (2ps) by renaming the orders of the chosen triggering commands, so as to conceal the identity of the corresponding dependent functions, and

by producing;

the first object part (2pos) of the protected software (2p), said first object part (2pos) being such that during the execution of the protected software (2p), the triggering commands with renamed orders are executed, and

the second object part (2pou) of the protected software (2p) containing the exploitation means also implementing the restoring means (20), said second object part (2pou) being such that, after upload to the unit (6) and during the execution of the protected software (2p), the identity of the dependent functions whose execution is triggered by the first execution part (2pes) is restored by means of the second execution part (2peu), and the dependent functions are executed by means of the second execution part (2peu), and

during the usage phase (U);

in the presence of the unit (6) and each time a triggering command with renamed order, contained in a portion of the first execution part (2pes) imposes it, restoring in the unit (6), the identity of the corresponding dependent function and executing it, so that said portion is executed correctly and that, consequently, the protected software (2p) is completely functional, and

in the absence of the unit (6), in spite of the request by a portion of the first execution part (2pes), to trigger the execution of a dependent function in the unit (6), not being able to fulfill said request correctly, so that at least said portion is not executed correctly and that, consequently, the protected software (2p) is not completely functional.