System and Method for Software Protection and Secure Software Distribution

• US 20100262824A1
• Filed: 04/13/2009
• Published: 10/14/2010
• Est. Priority Date: 04/13/2009
• Status: Active Grant

• Current Assignee: Aventyn, Inc
• Original Assignee: Aventyn, Inc
• Inventors: Govind, Navin, Keshavachar, Bhaktha Ram
• Granted Patent: US 8,533,859 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

The various embodiments of the present invention provide a secure software distribution and execution method. According to the method, a server receives software from service provider for downloading to a client and identifies the sections for encoding. APIs are inserted in the identified sections. A unique ID is created based on the identity of the each client to generate an encryption algorithm, decryption key and decryption algorithm. The identified sections are encrypted with the generated encryption algorithm. The encrypted application along with encryption algorithm, decryption key and decryption algorithm are downloaded to the driver of the client machine. The API makes call to the driver by sending the encrypted segment when the encrypted portion is reached during the execution of software in the client machine so that the driver decrypts the encoded portion using the received key and the decryption algorithm to enable the continuous execution of the downloaded software.

Claims

1. A secure software distribution and execution method comprising:

receiving software application from a service provider for storing in a server for downloading to a client;

coding received software application in the server;

identifying sections of code for encryption by the server;

inserting Application Programming Interface (API) calls in the received software at appropriate places before being downloaded to the client by the server;

building the application and placing the binaries in the server;

reading the identity data of the client by the server;

generating the algorithm for encryption, decryption key and decryption algorithm based on received identity data of the client in the server;

encrypting the identified sections of the software using the generated encryption algorithm in the server; and

downloading the encrypted portions of the software along with the generated decryption key and the decryption algorithm to the driver of the client;

2. The method according to claim 1, wherein the API makes the call to the driver of the client by sending the encrypted segment to the client when the software execution reaches to encrypted portion so that the driver decrypts the encoded portion using the received key and the decryption algorithm to enable the continuous execution of the downloaded software.

3. The method according to claim 1, wherein the encryption algorithm, key and decryption algorithm are unique and are different for different clients.

4. The method according to claim 1, wherein the identification data includes the serial number of the client machine, serial number of the hard disc used in the client machine, biometric data and other identity related information provided by the client.

5. The method according to claim 1, wherein the server assigns weighting factor to each of the identification data read from the client so that the client is authenticated to decode the encrypted portion, even when the identification component is changed in the client.

6. The method according to claim 1, wherein the server authenticates the client for decoding the encrypted portion of the file by comparing the sum of the weighting factors assigned to the identity data with a threshold level.

7. The method according to claim 6, wherein the server authenticates the client for decoding the encrypted portion of the file, when the sum of the weighting factors assigned to the identity data is less than the threshold level.

8. The method according to claim 1, wherein the key generation algorithm is designed uniquely for each client.

9. The method according to claim 1, wherein the key generation algorithm and the decryption algorithm are run in privileged mode in cache memory.

10. The method according to claim 1, wherein the decrypted code is destroyed after each use.

11. The method according to claim 1, wherein the decryption algorithms used for decrypting the different encrypted files in the same application in the same client are different.

12. The method according to claim 1, wherein the unique decryption algorithm is designed for each client, when the client machine initiates a software download of an application or registers a software that is available on a media.