Manipulating rights-to-execute in connection with a software copy protection mechanism

• US 5,109,413 A
• Filed: 11/28/1989
• Issued: 04/28/1992
• Est. Priority Date: 11/05/1986
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Comerford, Liam D., White, Steve R.
• Primary Examiner(s): Tarcza, Thomas H.
• Assistant Examiner(s): CAIN, DAVID C
• Application Number:
  US07/441,221
• Time in Patent Office: 882 Days
• Field of Search: 380/4, 364/200, 364/900
• US Class Current: 705/54
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/1082 Backup or restore
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/123 by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

A software asset protection mechanism segregates the right to execute software from the software itself. The rights to execute, when installed on a composite computing system, are stored in a coprocessor element of the composite computing system. The software asset protection mechanism is enhanced as described herein by providing for the manipulation of those rights to execute. More particularly, the rights to execute can be conditioned at least in terms of a valid period of execution at least in terms of a valid period of execution or a valid number of executions. The rights to execute can be safely transferred from one coprocessor to another, or can be returned to the software vendor. Finally, a method of backing up the rights to execute to provide the user with the rights to execute in case the coprocessor element of the composite computing system fails.

Claims

1. A method of safely extracting a right to execute from a logically secure coprocessor associated with a host processor, where said coprocessor stores at least a supervisor key and further stores a software key representing said right to execute a particular application, said host processor having access to said particular application encrypted under said software key, said method comprising the steps of:

a) providing to the coprocessor a transfer set including at least a writable medium and a physically and logically secure medium, said physically and logically secure medium storing clear text token data,

b) providing to said coprocessor a data block comprising said clear text token data encrypted under said supervisor key,

c) decrypting said data block, in said coprocessor to produce said clear text token data,

d) encrypting said clear text token data in said coprocessor under said software key to produce a corresponding data block,

e) encrypting said software key under said supervisor key to produce an encrypted software key, and

f) writing said corresponding data block, said encrypted application file and said encrypted software key to said transfer set and deleting said software key from said coprocessor,

whereby said software key is removed from said coprocessor and written to said transfer set to constitute said transfer set as a backup set.

2. A method as claimed in claim 1 wherein said encrypted token data is read by said coprocessor from said writable medium of said transfer set.

3. A method as claimed in claim 1 wherein said corresponding data block, said encrypted application file and said encrypted software key are written to said writable medium of said transfer set.

4. A method as claimed in claim 1 in which said writable medium of said transfer set comprises a magnetic medium and said physically and logically secure medium comprises a read once storage cartridge.

5. A method as claimed in claim 4 in which said magnetic medium comprises a magnetic disk.

6. A method of transferring a right to execute a particular protected application from a logically secure coprocessor associated with a host processor to a different host processor associated with a different coprocessor, said method comprising the steps of:

A) extracting said right to execute and writing to a transfer set as claimed in claim 1,

B) providing said transfer set to said different coprocessor storing said supervisor key but not said software key, and

1) extracting and decrypting said encrypting software key,

2) extracting said corresponding data block and decrypting said corresponding data block to produce corresponding clear text data,

3) reading said physically and logically secure medium to determine whether said clear text token data does or does not correspond to said corresponding clear text data, said reading step necessarily altering said clear text token data as stored in said physically and logically secure medium,

4 a) if said data do not correspond, rejecting said transfer, or

b) if said data do correspond, storing said decrypted software key,

whereby said reading step destroys said clear text token data so that no further transfers may be effected by said physically and logically secure medium.

7. A method as claimed in claim 1 which includes the further steps of:

e1) presenting to said coprocessor any previously written backup set,

e2) invalidating said backup set, and

e3) only after executing said step e1) and step e2), if there was any backup set, proceeding to execute said step f).

8. A method of safely transferring a right to execute a protected application from a logically secure first coprocessor, where said first coprocessor stores a software key representing said right to execute said protected application, to a logically secure second coprocessor, said method comprising the steps of:

a) coupling said first coprocessor to said second coprocessor for bidirectional communication,

b) challenging said second coprocessor by said first coprocessor to determine if said second coprocessor is a trusted recipient and simultaneously transferring antecedent information from said first coprocessor to said second coprocessor to allow access to an encrypted software key,

c) if said second coprocessor is determined to be a trusted recipient by said first coprocessor, encrypting said software key under a specific key, derivable by a trusted recipient from said antecedent information, to produce an encrypted software key and transmitting said encrypted software key from said first coprocessor to said second coprocessor,

d) if said second coprocessor is not determined to be a trusted recipient by said first coprocessor, then returning an error condition without transmitting said encrypted software key.

9. A method as recited in claim 8 in which said second coprocessor is determined to be a trusted recipient only if it stores a set of cryptographic keys in common with a set of cryptographic keys stored in said first coprocessor, wherein said step b) comprises:

b1) generating a random number at said first coprocessor, concatenating said random number with a message authentication code to produce a concatenated result and encrypting said concatenated result with a key selected by said first coprocessor from said set of cryptogaphic keys,

b2) transmitting a result of step b1) to said second coprocessor corresponding to said antecedent information,

b3) receiving, from said second coprocessor a message and decrypting said message with a cryptographic key from said set of cryptographic keys, if a decrypted result includes a valid message authentication code, proceeding to a step b5), otherwise,

b4) repeating step b3) with each other cryptographic key in said set of cryptographic keys until each key in said set of cryptographic keys is used without producing a result as set forth in step b3), and thereafter proceeding to said step d),

b5) creating a session key by concatenating said random number with the decrypted result of step b3) exclusive of the message authentication code of step b3),

b6) thereafter using said session key as the specific key,

whereby only if said second coprocessor is a trusted recipient will an encrypted software key be transmitted and only the second coprocessor with access to said session key can decrypt said encrypted software key to secure access to said software key.

10. A method as recited in claim 9 in which said method includes the following steps performed at said second coprocessor if said second coprocessor is a trusted recipient:

b1a) generating a second random number and selecting a key from said set of cryptographic keys,

b2a) concatenating said second random number of step b1a) and a message authentication code to produce a concatenated result,

b3a) encrypting said concatenated result of step b2a) to produce said message and transmitting said message to said first coprocessor.

11. A method as recited in claim 10 in which said second coprocessor:

b4a) decrypts information transmitted by said first coprocessor with a key from said set of cryptographic keys,

b5a) if a decrypted result includes a valid message authentication code, retaining said decrypted result exclusive of the key of step b4a),

b6a) combining said retained result of step b5a) with said second random number to produce said session key,

whereby both said first coprocessor and said second coprocessor have access to said session key without said session key being accessible even if all information exchanged by said coprocessors is observed and copied.

12. A method as recited in claim 8 which comprises the further steps of:

e) acknowledging, to said first coprocessor receipt by said second coprocessor of said encrypted software key,

f) deleting said software key from said first coprocessor and transmitting an indication of said deletion to said second coprocessor, and

g) in response to said indication of said deletion transferring said software key to a permanent memory of said second coprocessor.

13. A method as recited in claim 8 in which said first coprocessor stores said software key in permanent memory along with an indication as to the existence of any backup rights and in which said step c) includes the further steps of:

c1) checking for existence of an indication of any backup, in the presence of such indication,

c2) invalidating such backup,

c3) verifying such invalidation and only thereafter,

c4) encrypting and transmitting said encrypted software key.

14. A method of conditioning a right to execute a particular protected application on a composite computing system including a host processor and a physically and logically secure coprocessor, wherein said protected application includes at least a portion encrypted under a software key and said right to execute is represented by said software key stored in a permanent memory of said coprocessor, said method comprising the steps of:

a) incorporating at least one condition within said encrypted portion of said protected application,

b) providing to said coprocessor said at least one condition,

c) providing for storage in said permanent memory data associated with said at least one condition along with storage of said software key,

d) requiring said coprocessor to access said condition and said data prior to authorizing any use of said protected application,

e) further requiring said coprocessor to compare said condition and said data to determine if said at least one condition is met, and authorizing use if, and only if said at least one condition is met.

15. A method as claimed in claim 14 wherein:

e) said condition provides authorization for execution of said protected application no more than N times, wherein N is any integer,

f) said data represents either a count C which is incremented each time said coprocessor authorizes execution of said protected application or said integer N decremented each time said coprocessor authorizes execution of said protected application, and

g) said coprocessor either compares C to N or compares N to zero and said coprocessor authorizes execution if and only if N>

C or N>

O.

16. A method as claimed in claim 14 wherein:

e) said limits authorization for execution of said protected application until a current date and/or time reaches a terminal date and/or time,

f) said data represents said terminal date and/or time, and

g) said coprocessor compares said current date and/or time with said terminal data and/or time and authorizes execution if, and only if said current data and/or time precedes said terminal date and/or time.

17. A method of providing backup for a right to execute a particular protected application on a composite computing system including a host processor and a physically and logically secure coprocessor, wherein said protected application includes at least a portion encrypted under a software key and said right to execute is represented by said software key stored in a permanent memory of said coprocessor which coprocessor also stores a first key in said permanent memory, said method comprising the steps of:

a) providing a backup set to said coprocessor including a writable medium and a physically and logically secure medium, said physically and logically secure medium storing token data and said backup set also storing said token data encrypted under a first key,

b) passing said encrypted token data to said coprocessor and decrypting said token data so that said coprocessor has access to decrypted token data,

c) probing said physically and logically secure medium to verify that the decrypted token data corresponds to the token data stored by said physically and logically secure medium,

ci) in the event there is no correspondence, rejecting said backup set and terminating said steps,

cii) in the event there is correspondence, then

d) modifying and then encrypting said decrypted token data under said software key,

e) encrypting said software key under said first key, and

f) writing results from steps d) and e) to said backup set, and writing said protected application to said backup set.

18. A method as claimed in claim 17 in which said step c) comprises:

c1) generating and storing a random number in said coprocessor,

c2) generating a computed response as a function of both said random number and said decrypted token data,

c3) transmitting said random number to said physically and logically secure medium,

c4) generating in said physically and logically secure medium an actual response by reading said token data as selected by said random number,

c5) transmitting said actual response to said coprocessor, and

c6) comparing said actual response and said computed response.

19. A method as claimed in claim 18 in which said step c4) includes:

c4i) modifying said token data stored in said physically and logically secure medium so that thereafter said physically and logically secure medium stores modified token data.

20. A method as claimed in claim 19 in which said step d) modifies said decrypted token data in a fashion identical to a modification of said step c4i) so that said encrypted modified decrypted token data corresponds to said modified token data stored in said physically and logically secure medium.

21. A method of installing a right to execute on a different coprocessor comprising creating a backup set as claimed in claim 17 and comprising the further steps of:

g) presenting said backup set to said different coprocessor,

h) passing said encrypted modified token data of said step d) to said coprocessor and decrypting said encrypted modified token data so that said coprocessor has access to decrypted modified token data,

i) probing said physically and logically secure medium to verify that the decrypted modified token data corresponds to the modified token data stored by said physically and logically secure medium,

i-i) in the event there is no correspondence, rejecting said backup set and terminating said method of installing,

i-ii) in the event there is correspondence, then

j) accessing, decrypting and storing in permanent memory of said different coprocessor said software key representing a right to execute said protected application by a user of said different coprocessor, and

k) conditioning said right to execute for use only within a grace period.

22. A method of removing said grace period condition of a backup right to execute as installed by a method as claimed in claim 21 comprising the further steps of:

l) receiving an encrypted message in exchange for proof of failure of said coprocessor,

m) coupling said encrypted message to said different coprocessor,

n) verifying, by said different coprocessor that said encrypted message relates to said coprocessor, and

o) in response to said verification removing said grace period condition established by said step k).

23. A method as claimed in claim 22 in which said step i) comprises:

i1) generating and storing a random number in said different coprocessor,

i2) generating a computed response as a function of both said random number and said decrypted modified token data,

i3) transmitting said random number to said physically and logically secure medium,

i4) generating in said physically and logically secure medium an actual response by reading said modified token data as selected by said random number,

i5) transmitting said actual response to said different coprocessor, and

i6) comparing said actual response and said computed response.

24. A method of providing backup for a right to execute a particular protected application on a composite computing system including a host processor and a physically and logically secure coprocessor, wherein said protected application includes at least a portion encrypted under a software key and said right to execute is represented by said software key stored in a permanent memory of said coprocessor which coprocessor also stores a first key in said permanent memory, said method comprising the steps of:

a) coupling said coprocessor to a different coprocessor,

b) challenging said different coprocessor by said coprocessor to determine if said different coprocessor is a trusted recipient and simultaneously transferring antecedent information from said coprocessor to said different coprocessor to allow access to an encrypted backup,

c) if said different coprocessor is determined to be a trusted recipient by said coprocessor, encrypting said software key under a specific key derivable from said antecedent information to produce an encrypted backup and transmitting said encrypted backup from said coprocessor to said different coprocessor,

d) if said different coprocessor is not determined to be a trusted recipient by said coprocessor, then returning an error condition without creating said backup.

25. A method as recited in claim 24 in which a coprocessor is determined to be a trusted recipient only if it stores a set of cryptographic keys in common with a set of cryptographic keys stored in said coprocessor, of which said first key is a member of said set, wherein said step b) comprises:

b1) generating a random number at said coprocessor, concatenating said random number with a message authentication code to produce a concatenated result and encrypting said concatenated result with a key selected by said coprocessor from said set of cryptographic keys,

b2) transmitting a result of step b1) to said different coprocessor corresponding to said antecedent information,

b3) receiving, from said different coprocessor a message and decrypting said message with a key from said set of cryptographic keys, if a decrypted result includes a valid message authentication code, proceeding to a step b5), otherwise,

b4) repeating step b3) with each other key in said set of cryptographic keys until each key in said set is used without producing a result as set forth in step b3), and thereafter proceeding to said step d),

b5) creating a session key by combining said random number with the decrypted result of step b3) exclusive of the message authentication code of step b3),

b6) thereafter using said session key as the specific key,

whereby only if said different coprocessor is a trusted recipient will an encrypted backup be transmitted and only the different coprocessor with access to said session key can decrypt said backup to secure access to said software key.

26. A method as recited in claim 25 in which said method includes the following steps performed at said different coprocessor if said different coprocessor is a trusted recipient:

b1a) generating a different random number and selecting a key from said set of cryptographic keys,

b2a) concatenating said different random number of step b1a) and a message authentication code to produce a concatenated result,

b3a) encrypting said concatenated result of step b2a) to produce said message and transmitting said message to said coprocessor.

27. A method as recited in claim 26 in which said different coprocessor:

b4a) decrypts information transmitted by said coprocessor with a key form said set of cryptographic keys,

b5a) if a decrypted result includes a valid message authentication code, retaining said decrypted result exclusive of the message authentication code,

b6a) combining said retained result of step b5a) with said different random number to produce said session key,

whereby both said coprocessor and said different coprocessor have access to said session key without said session key being accessible even if all information exchanged by said coprocessors is observed and copied.

28. A method of installing a right to execute on a further coprocessor subsequent to failure of said coprocessor comprising creating a backup as claimed in claim 24 and comprising the further steps of:

e) coupling said different coprocessor to said further coprocessor,

f) challenging said further coprocessor by said different coprocessor to determine if said further coprocessor is a trusted recipient and simultaneously transferring further antecedent information from said different coprocessor to said further coprocessor to allow access to an encrypted software key corresponding to said encrypted backup,

g) if said further coprocessor is determined to be a trusted recipient by said different coprocessor, encrypting said software key under a specific key derivable from said further antecedent information to produce an encrypted software key and transmitting said encrypted software key from said different coprocessor to said further coprocessor,

h) if said further coprocessor is not determined to be a trusted recipient by said different coprocessor then returning an error condition without transmitting said encrypted software key,

i) accessing, decrypting and storing in permanent memory of said further coprocessor said software key representing a right to execute said protected application by a user of said further coprocessor, and

j) conditioning said right to execute for use only within a grace period.

29. A method of removing said grace period condition of a backup as installed by a method as claimed in claim 28 comprising the further steps of:

k) receiving an encrypted message in exchange for proof of failure of said coprocessor,

l) coupling said encrypted message to said further coprocessor,

m) verifying, by said further coprocessor that said encrypted message relates to said coprocessor, and

n) in response to said verification removing said grace period condition established by said step j.

30. A method of safely distributing demonstration software only for demonstration use on composite computing systems comprising a host computer and a logically and physically secure coprocessor, wherein the coprocessor stores at least a specific key, said method comprising the steps of:

a) distributing said demonstration software in a form in which at least a portion thereof is encrypted under a software key,

b) distributing, along with said demonstration software said software key encrypted under said specific key and a null token data file, encrypted under said software key, said software key including at least a condition of use flag inhibiting any coprocessor from erasing said software key,

c) installing said software key on a coprocessor by;

c1) decrypting said software key under said specific key, and

c2) searching permanent memory of said coprocessor to determine if said software key had previously been installed,

c3) writing said software key to said permanent memory only if said step c2) indicates that said software key had never been previously installed, whereafter said demonstration software can be executed on said composite computing system by decrypting encrypted portions by said coprocessor, or

c4) inhibiting said writing step c3) in the event said software key had been previously installed wherefore said demonstration software cannot be executed on said composite computing system,

whereby a user may install said demonstration software into a composite computing system only on a single occasion thereby protecting software vendors from users repeatedly installing demonstration software.

31. A method as recited in claim 30 in which said composite computing system includes a cartridge connector for connection to a hardware cartridge storing clear text token data and wherein said step c) further comprises:

cl.1) reading said encrypted software key and said null token data file, decrypting and temporarily storing said software key and said null token data file,

cl.2) generating a random number, temporarily storing said random number, driving said cartridge connector with data corresponding to said random number and storing data produced at said cartridge connector,

cl.3) computing in said coprocessor an expected response of a cartridge by combining said null token data file and said random number,

cl.4) comparing said expected response with said data stored in said step cl.2),

cl.5) if said comparison is favorable transferring said software key to said permanent memory and if said comparison is unfavorable not transferring said software key to said permanent memory.

32. A method of encrypting software keys as a service by a physically and logically secure coprocessor under a first key which method is resistant to a plain text attack on said first key, said method comprising the steps of:

a) accepting a software key for encryption,

b) padding said software key with a number of a given length, said number including at least a component which is random,

c) encrypting a result produced by said step b) under said first key,

whereby said padding produces an encrypted result in response to a first encryption operation which is different form an encryption result produced on a second encryption operation even though an identical software key is presented on each occasion thus foiling a plain text attack on said first key.

33. A method as recited in claim 32 in which said step b) includes:

b1) padding said software key with a prefix comprising a random number of a first bit length,

b2) padding a result of step b1) with a message authentication code of a second bit length.

34. A method of decrypting a software key encrypted as claimed in claim 32 comprising the steps of:

d) employing said first key to decrypt a result produced by said step c), and

e) discarding, from a result of step d) padding added in said step b) to leave said software key.

35. A method of decrypting a software key encrypted as claimed in claim 33 comprising the steps of:

d) employing said first key to decrypt a result produced by said step c), and

e) discarding, from a result of step d) said random number prefix added in said step b1),

f) discarding, from a result of step e) said message authentication code to leave said software key.

36. A method as recited in claim 33 in which said message authentication code comprises a recognition flag stored in the coprocessor.

37. A method as recited in claim 36 in which said recognition flag comprises said first key.

38. A method of identifying first and second processors to each other as companion processors which companion processors are characterized by storing a set of keys, which set includes a number of keys greater than one, comprising the steps of:

a) at a fist processor, generating a first random number, concatenating said first random number with a message authentication code, to produce a concatenated result and encrypting said concatenated result under one key of said set of keys to produce a first identifier,

b) at a second processor, generating a second random number, concatenating said second random number with a message authentication code, to produce a concatenated result and encrypting said concatenated result under another key, said another key selected by said second processor from said set of keys, to produce another identifier,

c) transmitting said first and another identifiers to said second and first processors, respectively,

d) determining, at said processors that said identifiers were generated by companion processors by;

1) decrypting said identifiers with keys selected from said set of keys until a decrypted result includes a valid message authentication code as a portion, or

e) determining that said first and second processors are not companion processors if all keys in said set are employed without any decrypted result including a valid message authentication code.

39. A method of inter-processor communication which restricts exchange of key information to within a class of companion processors which are characterized by storage of a set of keys greater in number than one, said method comprising the steps:

i) using a method of identification as recited in claim 38,

ii) combining said first and another identifiers at both said processors to produce a session key, and

iii) exchanging key information by first encrypting said key information under said session key and transmitting said encrypted key information from said first to said second or from said second to said first processor.

40. A method of safely transferring a right to execute from a logically secure source coprocessor associated with a host source processor to a logically secure sink coprocessor associated with a host sink processor, where said source coprocessor stores at least a source key and a software key representing said right to execute a particular application and said sink coprocessor stores a sink key, both said source and sink keys included within a set of keys stored in both said source and sink coprocessors, said host processors having access to said particular application encrypted under said software key, said method comprising the steps of:

e) at said source coprocessor, generating a first random number, concatenating said first random number with a first message authentication code to produce a concatenated result and encrypting said concatenated result under said source key to produce a source identifier,

b) at said sink coprocessor, generating a second random number, concatenating said second random number with a second message authentication code to produce a concatenated result and encrypting said concatenated result under said sink key to produce a sink identifier,

c) transmitting said source and sink identifiers to said sink and source coprocessors, respectively,

d) verifying, at said coprocessors that said identifiers were generated by companion coprocessors by

1) decrypting said identifiers with keys selected from said set until a decrypted result includes a valid message authentication code as a portion, or

2) until all keys in said set are employed without any decryption result including a valid message authentication,

3) terminating an attempt to transfer a right to execute if step d2) is reached, and otherwise,

e) creating a session key at each coprocessor from said source and sink identifiers,

f) encrypting said software key at said source coprocessor under said session key to produce a transmittable software key and deleting said software key from said source coprocessor,

g) transmitting said transmittable software key from said source to said sink coprocessor,

h) decrypting said transmittable software key at said sink coprocessor with said session key to recreate said software key, and

i) storing said software key in a non-volatile memory of said sink coprocessor,

whereby said software key has been extracted and transferred from source to sink coprocessors without exposing said software key and without revealing either said source or sink keys.

41. A method of safely increasing storage capacity without compromising security for software keys normally stored within a logically and physically secure storage of finite storage capacity, said storage accessible to a logically secure coprocessor element of a composite computing system comprising the steps of:

a) selecting one or more software keys for storage external to said logically and physically secure storage to form a key block,

b) generating a random number,

c) encrypting said key block under said random number to produce an encrypted key block,

d) storing said random number internally to said physically and logically secure coprocessor,

e) storing said encrypted key block external to said physically and logically secure coprocessor in unsecured storage, and

f) erasing said software keys form storage internal to said logically and physically secure coprocessor.

42. A method of storing and retrieving a set of software keys without compromising security where said set of software keys are stored external to a physically and logically secure coprocessor element of a composite computing system, wherein said coprocessor has access to a set of supervisor keys, said method comprising the steps of:

i) storing said software keys as recited in claim 41,

ii) retrieving said encrypted key block and said encrypted key from said external storage,

iii) decrypting said encrypted key with a selected one of said supervisor keys and verifying the presence of a valid message authentication code,

iv) repeating step iii with each different supervisor key until one such step results in a valid message authentication code,

v) decrypting said encrypted key block with that unselected portion of the result of step iv),

whereby a result of said step v) is the original key block including each of said selected software keys.

43. A method of conditioning manipulation, in the form of transfer, hardware backup or erasure, of a right to execute a protected application on a composite computing system including a host processor and a physically and logically secure coprocessor, wherein said protected application includes at least a portion encrypted under a software key and said right to execute, if present, is represented by said software key along with a data object stored in a permanent memory of said coprocessor, said method comprising the steps of:

a) providing said data object to said coprocessor,

b) storing said software key in association with said data object in said permanent memory of said coprocessor,

c) in response to a request for said manipulation of said software key, requiring said coprocessor to access said data object prior to any such manipulation of said software key, and

d) thereafter requiring said coprocessor to interpret said data object as a specification of permitted manipulations and executing said manipulation if, and only if, said manipulation is a permitted manipulation.