Method and apparatus for copy protection of images in a computer system

• US 5,881,287 A
• Filed: 03/25/1997
• Issued: 03/09/1999
• Est. Priority Date: 08/12/1994
• Status: Expired due to Term

• Current Assignee: Sol Labs KG LLC (Intellectual Ventures LLC)
• Original Assignee: Michael B. Mast
• Inventors: Mast, Michael B.
• Primary Examiner(s): Hafiz, Tariq R.
• Assistant Examiner(s): DAM, TUAN QUANG
• Application Number:
  US08/824,139
• Time in Patent Office: 714 Days
• Field of Search: 395/701, 395/712, 395/705, 395/653, 380/3-5, 380/9, 380/25, 380/23, 711/164, 711/100, 345/133, 345/326
• US Class Current: 717/127
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04N 1/4406 Restricting access, e.g. according to user identity mechanisms actuated y cards, PIN or the like in apparatus for dispensing G07F7/08
• CPC Class Codes: H04N 1/4426 involving separate means, e.g. a server, a magnetic card
• CPC Class Codes: H04N 1/4486 using digital data encryption

Abstract

A method and apparatus for securing images from unlicensed appropriation on a computer system. Prior art graphics security measures, such as encryption, cease to protect the images once the images are deciphered and loaded into the video adapter memory. In the present invention, unlicensed transfers of image data from the video adapter to other storage means are substantially prevented by intercepting data transfer requests to the operating system and identifying whether the image is one to be protected. If the image is one that is marked for protection, the region of the data transfer incorporating the protected image is blacked out or replaced with a specified pattern or message. A preferred embodiment provides a library of software routines that are utilized by image display applications. These routines interface with the computer memory and the video display memory to block the copying of designated images by means of "hooks" into the operating system or operating environment. By means of these hooks and routines, the present invention identifies all regions on the video device that contain a protected image and exclude these regions from any operation that transfers data from the video display memory. Any attempts to transfer the designated regions result in an image containing "blacked out" regions in their place. The preferred embodiment includes an encryption scheme for image security prior to display.

Claims

1. A method of providing copy protection in a computer system comprising the steps of:

program code executing in said computer system intercepting requests for transfer of data from a source region to a destination region;

specifying within said source region a protection region defining protected data;

said program code transferring data from said source region to said destination region, excluding said protection region.

2. The method of claim 1 wherein said step of intercepting requests for transfer of data is performed by means of hooks into an operating environment of said computer system.

3. The method of claim 1 wherein said step of determining a protection region comprises the steps of:

processing a callback function from an application program;

receiving via said callback function an object specifying an individual region to be protected;

forming said protection region from said individual region.

4. The method of claim 1 wherein said step of determining a protection region comprises the steps of:

processing a plurality of callback functions from at least one application program;

receiving via said callback functions a plurality of objects specifying a plurality of individual regions to be protected;

forming said protection region from said individual regions.

5. The method of claim 1 wherein said step of transferring data from said source region to said destination region, excluding said protection region, comprises the steps of:

subtracting said protection region from said destination region to create a first modified destination region;

copying data from said source region into said first modified destination region.

6. The method of claim 1 wherein said step of transferring data from said source region to said destination region, excluding said protection region, comprises the steps of:

subtracting said protection region from said source region to create a modified source region;

copying data from said modified source region into said destination region.

7. The method of claim 1 further comprising the steps of:

replacing said destination region with said protection region to create a second modified destination region;

writing said substitute data into said second modified destination region.

8. The method of claim 1 wherein said data comprises image data and said source region defines a portion of video adapter memory.

9. A method for protecting files within a computer system from misappropriation, said method comprising the steps of:

encrypting files selected for protection;

deciphering said encrypted files only for authorized applications;

prohibiting copying of decrypted file data selected for protection from device memory, said prohibiting process implemented in program code executing in said computer system and comprising the steps of;

intercepting data transfer requests;

determining a protected region of said device memory comprising said decrypted file data selected for protection;

copying into a destination memory only data from those portions of said device memory not within said protected region.

10. The method of claim 9 further comprising the step of filling said protected region within said destination memory with alternate data.

11. The method of claim 9 wherein said step of intercepting data transfer requests is performed by means of hooks into an operating environment of said computer system.

12. The method of claim 9 wherein said step of determining said protected region of said device memory comprises the steps of:

processing through a callback function from an application program;

receiving via said callback function an object specifying an individual region to be protected;

forming said protected region from said individual region.

13. The method of claim 9 wherein said step of determining said protected region of said device memory comprises the steps of:

processing through a plurality of callback functions from at least one application program;

receiving via said callback functions a plurality of objects specifying a plurality of individual regions to be protected;

forming said protected region from said individual regions.

14. A method of file protection for a computer system comprising the steps of:

encrypting selected files using an encryption key;

intercepting a read request from an application program;

determining if a requested file is one of said selected files;

allowing said read request to resume if said requested file is not one of said selected files;

if said requested file is one of said selected files,

finding said encryption key in a table by matching a registered application program signature with said application program and selecting a registered encryption key associated with said registered application program signature;

deciphering said requested file using said registered encryption key;

loading said decrypted file into a portion of memory assigned to said application program.

15. The method of claim 14 wherein said step of intercepting a read request is performed via hooks into an operating environment of said computer system.

16. The method of claim 14 wherein said step of deciphering said requested file occurs transparently to said application program.

17. The method of claim 16 wherein said step of deciphering said requested file comprises providing said registered encryption key and said encrypted file to a decryption program running separately from said application program, said decryption program returning said decrypted file.

18. The method of claim 14 wherein said step of determining if said requested file is one of said selected files is performed by searching a portion of said requested file for an encryption signature.

19. The method of claim 14 wherein said table is created within a virtual device driver during installation of a registered application program.

20. A method of providing copy protection of images in a computer system comprising the steps of:

encrypting selected images using an encryption key;

intercepting a request to read an image from an application program;

determining if said requested image is one of said selected images;

allowing said request to resume if said requested image is not one of said selected images;

if said requested image is one of said selected images,

finding said encryption key in a table by matching a registered application program signature with said application program and selecting a registered encryption key associated with said registered application program signature;

deciphering said requested image using said registered encryption key;

loading said decrypted image into a portion of memory assigned to said application program;

prohibiting copying of said decrypted image selected for protection from device memory.

21. The method of claim 20 wherein said step of encrypting selected images using an encryption key comprises the steps of:

reading said encryption key and an application;

recording said encryption key and an application signature which is a collection of information about a specific application;

installing said application signature and said encryption key in a decryption table.

22. The method of claim 20 wherein said step of intercepting a read request is performed via hooks into an operation environment of said computer system.

23. The method of claim 20 wherein said step of determining if a requested image is one of said selected images is performed by examining a file'"'"'s extension.

24. The method of claim 20 wherein said step of prohibiting copying of said decrypted image selected for protection from device memory comprises the steps of:

intercepting transfer requests for said decrypted file data recognizable for display on a display means;

determining a protected region of said device memory comprising said decrypted image data selected for protection;

copying into a destination memory only data from those portions of said device memory not within said protected region.

25. The method of claim 24 wherein said step of intercepting transfer requests for said decrypted file data is performed by means of hooks into an operating environment of said computer system.

26. An article of manufacture comprising:

a computer usable medium having computer readable program code embodied therein for providing copy protection, the computer readable program code in said article of manufacture comprising;

computer readable program code configured to cause a computer to intercept requests for transfer of data from a source region to a destination region;

computer readable program code configured to cause said computer to specify within said source region a protection region defining protected data; and

computer readable program code configured to cause said computer to transfer data from said source region to said destination region, excluding said protection region.

27. The article of manufacture of claim 26 wherein said program code configured to cause a computer to intercept requests for transfer of data comprises computer readable program code configured to cause said computer to hook into an operating environment of said computer system.

28. The article of manufacture of claim 26 wherein said program code configured to cause said computer to specify a protection region further comprises:

computer readable program code configured to cause said computer to process a callback function from an application program;

computer readable program code configured to cause said computer to receive via said callback function an object specifying an individual region to be protected; and

computer readable program code configured to cause said computer to form said protection region from said individual region.

29. The article of manufacture of claim 26 wherein said program code configured to cause said computer to specify a protection region further comprises:

computer readable program code configured to cause said computer to process a plurality of callback functions from at least one application program;

computer readable program code configured to cause said computer to receive via said callback functions a plurality of objects specifying a plurality of individual regions to be protected; and

computer readable program code configured to cause said computer to form said protection region from said individual region.

30. The article of manufacture of claim 26 wherein said program code configured to cause said computer to transfer data from said source region to said destination region, excluding said protection region further comprises:

computer readable program code configured to cause said computer to subtract said protection region from said destination region to create a first modified destination region; and

computer readable program code configured to cause said computer to copy data from said source region into said first modified destination region.

31. The article of manufacture of claim 26 wherein said program code configured to cause said computer to transfer data from said source region to said destination region, excluding said protection region further comprises:

computer readable program code configured to cause said computer to subtract said protection region from said source region to create a modified source region; and

computer readable program code configured to cause said computer to copy data from said modified source region into said destination region.

32. The article of manufacture of claim 26 further comprising:

computer readable program code configured to cause said computer to replace said destination region with said protection region to create a second modified destination region; and

computer readable program code configured to cause said computer to write said substitute data into said second modified destination region.

33. The article of manufacture of claim 26 wherein said data comprises image data and said source region defines a portion of video adapter memory.

34. An article of manufacture comprising:

a computer usable medium having computer readable program code embodied therein for protecting files within a computer system from misappropriation, the computer readable program code in said article of manufacture comprising;

computer readable program code configured to cause a computer to encrypt files selected for protection;

computer readable program code configured to cause said computer to decipher said encrypted files only for authorized applications;

computer readable program code configured to cause said computer to prohibit copying of decrypted file data selected for protection from device memory, said prohibiting program code further comprising;

computer readable program code configured to cause said computer to intercept data transfer requests;

computer readable program code configured to cause said computer to determine a protected region of said device memory comprising said decrypted file data selected for protection;

computer readable program code configured to cause said computer to copy into a destination memory only data from those portions of said device memory not within said protected region.

35. The article of manufacture of claim 34 further comprising computer readable program code configured to cause said computer to fill said protected region within said destination memory with alternate data.

36. The article of manufacture of claim 34 wherein said program code configured to cause said computer to intercept data transfer requests comprises computer readable program code configured to cause said computer to hook into an operating environment of said computer system.

37. The article of manufacture of claim 34 wherein said program code configured to cause said computer to determine said protected region of said device memory comprises:

computer readable program code configured to cause said computer to process through a callback function from an application program;

computer readable program code configured to cause said computer to receive via said callback function an object specifying an individual region to be protected;

computer readable program code configured to cause said computer to form said protected region from said individual region.

38. The article of manufacture of claim 34 wherein said program code configured to cause said computer to determine said protected region of said device memory comprises:

computer readable program code configured to cause said computer to process through a plurality of callback functions from at least one application program;

computer readable program code configured to cause said computer to receive via said callback functions a plurality of objects specifying a plurality of individual regions to be protected; and

computer readable program code configured to cause said computer to form said protected region from said individual regions.

39. An article of manufacture comprising:

a computer usable medium having computer readable program code embodied therein for file protection for a computer system, the computer readable program code in said article of manufacture comprising;

computer readable program code configured to cause a computer to encrypt selected files using an encryption key;

computer readable program code configured to cause said computer to intercept a read request from an application program;

computer readable program code configured to cause said computer to determine if a requested file is one of said selected files;

if said requested file is not one of said selected files, computer readable program code configured to cause said computer to allow said read request to resume;

if said requested file is one of said selected files,

computer readable program code configured to cause said computer to find said encryption key in a table by matching a registered application program signature with said application program and selecting a registered encryption key associated with said registered application program signature;

computer readable program code configured to cause said computer to decipher said requested file using said registered encryption key;

computer readable program code configured to cause said computer to load said decrypted file into a portion of memory assigned to said application program.

40. The article of manufacture of claim 39 wherein said program code configured to cause said computer to intercept a read request comprises computer readable program code configured to cause said computer to hook into an operating environment of said computer system.

41. The article of manufacture of claim 39 wherein said program code configured to cause said computer to decipher said requested file occurs transparently to said application program.

42. The article of manufacture of claim 41 wherein said program code configured to cause said computer to decipher said requested file comprises computer readable program code configured to cause said computer to provide said registered encryption key and said encrypted file to a decryption program running separately from said application program, said decryption program returning said decrypted file.

43. The article of manufacture of claim 39 wherein said program code configured to cause said computer to determine if said requested file is one of said selected files comprises computer readable program code configured to cause said computer to search a portion of said requested file for an encryption signature.

44. The article of manufacture of claim 39 wherein said table is created within a virtual device driver during installation of a registered application program.

45. An article of manufacture comprising:

a computer usable medium having computer readable program code embodied therein for providing copy protection of images in a computer system, the computer readable program code in said article of manufacture comprising;

computer readable program code configured to cause a computer to encrypt selected images using an encryption key;

computer readable program code configured to cause said computer to intercept a request to read an image from an application program;

computer readable program code configured to cause said computer to determine if said requested image is one of said selected images;

computer readable program code configured to cause said computer to allow said request to resume if said requested image is not one of said selected images;

if said requested image is one of said selected images,

computer readable program code configured to cause said computer to finding said encryption key in a table by matching a registered application program signature with said application program and selecting a registered encryption key associated with said registered application program signature;

computer readable program code configured to cause said computer to decipher said requested image using said registered encryption key;

computer readable program code configured to cause said computer to load said decrypted image into a portion of memory assigned to said application program;

computer readable program code configured to cause said computer to prohibit copying of said decrypted image selected for protection from device memory.

46. The article of manufacture of claim 45 wherein said program code configured to cause a computer to encrypt selected images using an encryption key further comprises:

computer readable program code configured to cause said computer to read said encryption key and an application;

computer readable program code configured to cause said computer to record said encryption key and an application signature which is a collection of information about a specific application;

computer readable program code configured to cause said computer to install said application signature and said encryption key in a decryption table.

47. The article of manufacture of claim 45 wherein said computer readable program code configured to cause said computer to intercept a read request comprises computer readable program code configured to cause said computer to hook into an operation environment of said computer system.

48. The article of manufacture of claim 45 wherein said computer readable program code configured to cause said computer to determine if a requested image is one of said selected images comprises computer readable program code configured to cause said computer to examine a file'"'"'s extension.

49. The article of manufacture of claim 45 wherein said program code configured to cause said computer to prohibit copying of said decrypted image selected for protection from device memory comprises:

computer readable program code configured to cause said computer to intercept transfer requests for said decrypted file data recognizable for display on a display means;

computer readable program code configured to cause said computer to determine a protected region of said device memory comprising said decrypted image data selected for protection;

computer readable program code configured to cause said computer to copy into a destination memory only data from those portions of said device memory not within said protected region.

50. The article of manufacture of claim 49 wherein said program code configured to cause said computer to intercept transfer requests for said decrypted file data comprises computer readable program code configured to cause said computer to hook into an operating environment of said computer system.

51. An article of manufacture comprising:

a computer usable medium having computer readable program code embodied therein for providing copy protection in a computer system, the computer readable program code in said article of manufacture comprising;

computer readable program code configured to cause a computer to intercept requests for transfer of data that is displayed on a display means from a source region to a destination region;

computer readable program code configured to cause said computer to specify within said source region a protection region defining protected data; and

computer readable program code configured to cause said computer to transfer data from said source region to said destination region, excluding said protection region.

52. The article of manufacture of claim 51 wherein said program code configured to cause a computer to intercept requests for transfer of data comprises computer readable program code configured to cause said computer to hook into an operating environment of said computer system.

53. The article of manufacture of claim 51 wherein said program code configured to cause said computer to specify a protection region comprises:

computer readable program code configured to cause said computer to process a callback function from an application program;

computer readable program code configured to cause said computer to receive via said callback function an object specifying an individual region to be protected; and

computer readable program code configured to cause said computer to form said protection region from said individual region.

54. The article of manufacture of claim 51 wherein said program code configured to cause said computer to specify a protection region comprises the steps of:

computer readable program code configured to cause said computer to process a plurality of callback functions from at least one application program;

computer readable program code configured to cause said computer to receive via said callback functions a plurality of objects specifying a plurality of individual regions to be protected; and

computer readable program code configured to cause said computer to form said protection region from said individual regions.

55. The article of manufacture of claim 51 wherein said program code configured to cause said computer to transfer data from said source region to said destination region, excluding said protection region, comprises:

computer readable program code configured to cause said computer to subtract said protection region from said destination region to create a first modified destination region; and

computer readable program code configured to cause said computer to copy data from said source region into said first modified destination region.

56. The article of manufacture of claim 51 wherein said program code configured to cause said computer to transfer data from said source region to said destination region, excluding said protection region, comprises:

computer readable program code configured to cause said computer to subtract said protection region from said source region to create a modified source region; and

computer readable program code configured to cause said computer to copy data from said modified source region into said destination region.

57. The article of manufacture of claim 51 further comprising:

computer readable program code configured to cause said computer to replace said destination region with said protection region to create a second modified destination region; and

computer readable program code configured to cause said computer to write said substitute data into said second modified destination region.

58. The article of manufacture of claim 51 wherein said data comprises image data and said source region defines a portion of video adapter memory.