Data processing apparatus with software protecting functions

• US 5,915,025 A
• Filed: 01/15/1997
• Issued: 06/22/1999
• Est. Priority Date: 01/17/1996
• Status: Expired due to Term

• Current Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Original Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Inventors: Taguchi, Masahiro, Saito, Kazuo, Kawano, Kenji
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/779,643
• Time in Patent Office: 888 Days
• Field of Search: 380/4, 380/9, 380/21, 380/28, 380/44, 380/45, 380/46, 380/47, 380/49, 380/250, 395/186, 395/187.01
• US Class Current: 380/44
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2207/7219 Countermeasures against side channel or fault attacks
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation

Abstract

A data processing apparatus with software protecting functions capable of enhancing the level of encryption security independently of the memory management method of the system comprising the apparatus. Upon receiving target data to be encrypted, an encryption key generation unit generates an encryption key in accordance with an attribute of the target data. Using the encryption key, an encryption unit encrypts the target data. The encrypted data is placed into a storage unit. When a request is made to process the encrypted data, a decryption key generation unit generates a decryption key in accordance with the attribute of the encrypted data. A decryption unit decrypts the encrypted data using the decryption key. The decrypted data is processed by a processing unit. A control unit supplies the encryption unit with the data processed by the processing unit as data to be encrypted.

Claims

1. A data processing apparatus with software protecting functions based on data encryption and decryption, comprising:

encryption key generation means for generating an encryption key depending on an attribute of data including instructions to be encrypted;

decryption key generation means for generating a decryption key depending on an attribute of encrypted data;

encryption means for encrypting data to be encrypted by use of said encryption key generated by said encryption key generation means;

storage means for storing encrypted data from said encryption means;

decryption means for decrypting said encrypted data in said storage means by use of said decryption key generated by said decryption key generation means;

processing means connected directly to said decryption means so as to process data decrypted by said decryption means in accordance with instructions included in the decrypted data; and

control means for outputting processed data from said processing means directly to said encryption means as data to be encrypted.

2. A data processing apparatus with software protecting functions according to claim 1, wherein said encryption key generation means generates said encryption key depending on either an address or an address region of data to be encrypted;

and

wherein said decryption key generation means generates said decryption key depending on either said address or said address region of the encrypted data.

3. A data processing apparatus with software protecting functions according to claim 1, wherein said storage means has a storage space managed by a virtual storage method;

wherein said encryption key generation means generates said encryption key depending on either a virtual address or a virtual address region of data to be encrypted; and

wherein said decryption key generation means generates said decryption key depending on either said virtual address or said virtual address region of the encrypted data.

4. Image processing apparatus with software protecting functions according to claim 1, wherein said storage means has a storage space managed by a paged memory management method;

wherein said encryption key generation means generates said encryption key depending on a page to which data to be encrypted belongs; and

wherein said decryption key generation means generates said decryption key depending on the page to which the encrypted data belongs.

5. A data processing apparatus with software protecting functions according to claim 1, wherein said storage means has a storage space managed by a segmented memory management method;

wherein said encryption key generation means generates said encryption key depending on a segment to which data to be encrypted belongs; and

wherein said decryption key generation means generates said decryption key depending on the segment to which the encrypted data belongs.

6. A data processing apparatus with software protecting functions according to claim 1, wherein said storage means has a storage space managed by a multiple virtual storage method;

wherein said encryption key generation means generates said encryption key depending on a virtual storage space to which data to be encrypted belongs; and

wherein said decryption key generation means generates said decryption key depending on the virtual storage space to which the encrypted data belongs.

7. A data processing apparatus with software protecting functions according to claim 1, wherein said processing means performs processing in units of processes;

wherein said encryption key generation means generates said encryption key depending on a process to which data to be encrypted belongs; and

wherein said decryption key generation means generates said decryption key depending on the process to which the encrypted data belongs.

8. A data processing apparatus with software protecting functions according to claim 1, wherein said encryption key generation means generates said encryption key by use of data to be encrypted regarded as an attribute;

and

wherein said decryption key generation means generates said decryption key by use of the encrypted data regarded as the attribute of the encrypted data.

9. A data processing apparatus with software protecting functions according to claim 1, further comprising security means for deleting data for controlling processing functions in the event of an externally applied physical action on an inclusive body including said encryption key generation means, said decryption key generation means, said encryption means, said decryption means, said processing means and said control means;

wherein said encryption means encrypts data processed by said security means and outputs the encrypted data from said inclusive body; and

wherein said decryption means retrieves encrypted data from said storage means and places the retrieved data into said inclusive body for decryption.

10. A data processing apparatus with software protecting functions according to claim 1, further comprising distributed data decryption means for decrypting encrypted data which has been input and for which a decryption key and a decryption algorithm have been specified, said distributed data decryption means further inputting the decrypted data to said encryption means as data to be encrypted.

11. A data processing apparatus with software protecting functions according to claim 1, wherein said encryption key generation means manages a plurality of encryption keys as encryption key groups and selects an encryption key group depending on an attribute of a plurality of data to be encrypted;

wherein said decryption key generation means manages a plurality of decryption keys as decryption key groups and selects a decryption key group depending on the attribute of the plurality of encrypted data;

wherein said encryption means encrypts individually a plurality of data to be encrypted by use of individual encryption keys constituting the encryption key group selected by said encryption key generation means; and

wherein said decryption means decrypts individually the plurality of encrypted data by use of individual decryption keys constituting the decryption key group selected by said decryption key generation means.

12. A data processing apparatus according to claim 1, further comprising re-encryption command means for outputting a re-encryption command to re-encrypt encrypted data of which the encryption key used upon encryption needs to be changed;

wherein said encryption key generation means, upon receiving said re-encryption command, changes the encryption key corresponding to the attribute of the data to be re-encrypted so as to generate a changed encryption key;

wherein said decryption key generation means, upon receiving said re-encryption command, generates a decryption key depending on the attribute of the data to be re-encrypted and, when the re-encrypted data are all decrypted, changes the decryption key corresponding to the attribute of the re-encrypted data;

wherein said decryption means decrypts the re-encrypted data by use of the decryption key generated by said decryption key generation means; and

wherein said encryption means encrypts the decrypted re-encrypted data by use of the encryption key generated by said encryption key generation means.

13. A data processing apparatus with software protecting functions according to claim 12, wherein said re-encryption command means manages effective periods of encryption keys, said re-encryption command means further outputting a re-encryption command to re-encrypt data when the effective period of the encryption key by which said data was encrypted has expired.

14. A data processing apparatus with software protecting functions based on data encryption and decryption, comprising:

an encryption key generation circuit for generating an encryption key depending on an attribute of data including instructions to be encrypted;

a decryption key generation circuit for generating a decryption key depending on an attribute of encrypted data;

an encryption circuit for encrypting data to be encrypted by use of said encryption key generated by said encryption key generation circuit;

a memory for storing encrypted data from said encryption circuit;

a decryption circuit for decrypting said encrypted data in said memory by use of said decryption key generated by said decryption key generation circuit;

an MPU connected directly to said decryption circuit so as to process data decrypted by said decryption circuit in accordance with instructions included in the decrypted data; and

a control circuit for outputting processed data from said processing circuit directly to said encryption circuit as data to be encrypted.

15. A data processing apparatus with software protecting functions according to claim 14, wherein said encryption key generation circuit generates said encryption key depending on either an address or an address region of data to be encrypted;

and

wherein said decryption key generation circuit generates said decryption key depending on either said address or said address region of the encrypted data.

16. A data processing apparatus with software protecting functions based on data encryption and decryption, comprising:

key supply means for supplying a plurality of keys used for encryption and decryption;

algorithm supply means for supplying a plurality of pieces of algorithm information expressing algorithms for encryption and decryption;

encryption-decryption method selection means for selecting an encryption key and encryption algorithm information respectively from among said plurality of keys and said plurality of pieces of algorithm information supplied for encryption, and selecting a decryption key and decryption algorithm information respectively from among said plurality of keys and said plurality of pieces of algorithm information supplied for decryption;

encryption means for encrypting data to be encrypted by use of the encryption key and encryption algorithm information selected by said encryption-decryption method selection means;

storage means for storing encrypted data from said encryption means;

decryption means for decrypting said encrypted data in said storage means by use of the decryption key and decryption algorithm information selected by said encryption-decryption method selection means;

processing means connected directly to said decryption means so as to process data decrypted by said decryption means in accordance with instructions included in the decrypted data; and

control means for outputting processed data from said processing means directly to said encryption means as data to be encrypted.

17. A data processing apparatus with software protecting functions according to claim 16, wherein said encryption-decryption method selection means changes from time to time and in accordance with a predetermined manner, the combination of the encryption key and encryption algorithm information selected upon encryption, and the combination of the decryption key and decryption algorithm information selected upon decryption.

18. A data processing apparatus with software protecting functions according to claim 16, wherein said algorithm supply means changes the contents of the algorithm information it supplies from time to time and in accordance with a predetermined manner.

19. A data processing apparatus with software protecting functions according to claim 18, wherein said algorithm supply means manages effective periods of the algorithm information it supplies, said algorithm supply means further substituting new algorithm information for the algorithm information supplied beyond the effective period thereof.