SYSTEM AND METHODS FOR EXECUTING ENCRYPTED CODE

• US 20160378690A1
• Filed: 09/12/2016
• Published: 12/29/2016
• Est. Priority Date: 11/24/2013
• Status: Active Grant

• Current Assignee: Truly Protect Oy
• Original Assignee: Truly Protect Oy
• Inventors: KIPERBERG, MICHAEL, RESH, AMIT, ZAIDENBERG, NEZER
• Granted Patent: US 9,753,865 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/0802 Addressing of a memory level in which the access to the desired data or data block requires associative addressing means, e.g. caches
• CPC Class Codes: G06F 12/0888 using selective caching, e.g. bypass
• CPC Class Codes: G06F 12/1027 using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB]
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/402 Encrypted data

Abstract

The present disclosure relates systems and methods for executing an encrypted code section in a shieldable CPU memory cache. Functional characteristics of the software product of a vendor, such as gaming or video, may be partially encrypted to allow for protected and functional operability and avoid hacking and malicious usage of non-licensed user. The encrypted instructions may be written to the CPU memory cache and decrypted only once the CPU memory cache is switched into a shielded state. The decrypted code instructions may be executed from a designated cache-line of said CPU memory cache still in the shielded state.

Claims

1. A method for executing an encrypted code section in a CPU memory cache, said encrypted code section comprising a plurality of encrypted code instructions, the method comprising:

writing said encrypted code section to said CPU memory cache;

changing said CPU memory cache into a shielded state;

decrypting said encrypted code section;

storing decrypted code instructions of said encrypted code section in said CPU memory cache; and

executing said decrypted code instructions from a designated cache-line of said CPU memory cache in the shielded state.

2. The method of claim 1, further comprising deleting said decrypted code from said CPU memory cache following execution of said decrypted code.

3. The method of claim 2, further comprising restoring said CPU memory cache to an unshielded state following the deleting of the decrypted code.

4. The method of claim 3, wherein said unshielded state is characterised by at least one of preemption and CPU interrupt handler being enabled.

5. The method of claim 1, wherein said shielded state is characterised by at least one of preemption and CPU interrupt handler being disabled.

6. The method of claim 1, wherein said decrypting said encrypted code section further comprises obtaining an encryption key, wherein said encryption key stored in a CPU register.

7. A system for executing an encrypted code section in a CPU memory cache, said encrypted code section comprising a plurality of encrypted code instructions, the system comprising:

a CPU comprising a shieldable CPU cache component; and

a main memory connectable to said CPU via a system bus;

wherein said CPU is operable to write said encrypted code section to said shieldable CPU memory cache and to set said shieldable CPU memory cache to a shielded state;

and wherein said CPU is further operable to decrypt said encrypted code section and to store decrypted code instructions such that said decrypted code instructions are executed from said designated cache-line of said CPU memory cache in the shielded state.

8. The system of claim 7, wherein said CPU is further operable to delete said decrypted code from said CPU memory cache following execution of said decrypted code.

9. The system of claim 8, wherein said CPU is further operable to restore said CPU memory cache to an unshielded state following the deleting of the decrypted code.

10. The system of claim 7 wherein said CPU further comprises a CPU Core component, a CPU set of registers and a CPU Translation Look-aside Buffer).

11. The system of claim 7 wherein said main memory further comprises a user space and a kernel space.

12. The system of claim 11 wherein said kernel space is independent and implemented in separate address spaces.

13. The system of claim 7 wherein said user space contains a runtime module section of the encrypted code.

14. The system of claim 7 wherein said kernel space hosts an installation of a kernel driver.

15. The system of claim 7 further comprising a CPU Core component comprising a processing unit operable read and execute instructions.

16. The system of claim 7 further comprising a CPU Translation Look-aside Buffer operable to map virtual addresses to physical addresses.

17. The system of claim 16 said CPU Translation Look-aside Buffer further comprising a table in the processor memory.

18. The system of claim 7 further comprising a protected CPU register storing a decryption key.

19. The system of claim 7 further comprising a CPU interrupt handler.

20. The system of claim 19 wherein said CPU interrupt handler is operable to be disabled thereby changing said CPU memory cache to the shielded state.