Secure access to software modules

• US 6,000,032 A
• Filed: 07/15/1997
• Issued: 12/07/1999
• Est. Priority Date: 07/15/1997
• Status: Expired due to Term

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Millard, John
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Baderman, Scott T.
• Application Number:
  US08/893,934
• Time in Patent Office: 875 Days
• Field of Search: 713/200-201, 713/202, 380/3, 380/4, 380/23-25
• US Class Current: 726/2
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

Apparatus and method for obtaining a security value (50) that enables a calling module (7) to achieve secure access to a called module (5) within a digital computer (1). A distributive invertible function f is selected. f may be the cyclic redundancy check function modulo p, where p is a prime number. A desired residual value r associated with the application of f and a desired size of the security value (50) are also selected. Space is allocated within the called module (5) for storing the security value (50). A portion of the called module (5) is designated as a test block (51). f is applied to a numerical representation of test block (51) to generate a first challenge value CV1. f is applied to a numerical value of the security value (50) and a number representative of the location of the security value (50) within the called module (5) to calculate a second challenge value CV2. n is the number of bits from the beginning of the security value (50) to the end of the called module (5). CV1 and CV2 are typically calculated by called module (5). Calling module (7) then calculates the security value (50) based upon CV1 and CV2, and using f. Called module (5) uses this calculated value of the security value (50) in function f. If this application of f provides the desired residual value r, then it is known that calling module (7) had proper access to called module (5). At this point, one or more functions accessible by called module (5) may be activated. Access codes may be coded within residual value r itself.

Claims

1. A computer-implemented method for enabling a calling module to achieve secure access to a called module within a digital computer, said method comprising the steps of:

selecting a desired size of S;

selecting a distributive invertible function f;

selecting a desired residual value r associated with the application of f;

allocating a space within the called module for storing S;

designating a portion of the called module as a test block TB;

causing the called module to apply f to a numerical representation N of the TB, to calculate a first challenge value CV1;

causing the called module to apply f to a numerical value of S and to a number n representative of the location of S within the called module, to calculate a second challenge value CV2;

causing the calling module to calculate S based upon CV1 and CV2, and using f;

having the calling module pass the calculated S to the called module;

having the called module apply f to a number representative of the contents and location of the calculated S and the contents of TB, resulting in the calculation of a test residual value R; and

when R=r, having the called module declare that the calling module has proper authority to access the called module.

2. The method of claim 1, wherein the function f is of the form f(N+(S)2ⁿ)=r, where n is the distance in bits from the beginning of S to the end of the called module.

3. The method of claim 1, wherein f is the cyclic redundancy check function known as modulo p, p being a "polynomial".

4. The method of claim 3, wherein p is a prime number.

5. The method of claim 4, wherein the length of p is one bit greater than the length of S.

6. The method of claim 1, wherein the contents of the test block change each time the called module is loaded into the computer.

7. The method of claim 1, wherein r is large enough to accommodate preselected control parameters conveying informational content.

8. The method of claim 7, wherein the control parameters are from a group of parameters comprising a parameter permitting the called module to function for a longer period of time, a parameter allowing the called module to access a hidden feature, and a parameter permitting the called module to operate on an additional processing unit.

9. The method of claim 7, wherein the calling module is at a central location;

and

the called module is one of a plurality of called modules at locations remote from the central location.

10. The method of claim 9, wherein the calling module is controlled by a purveyor of the called modules;

and

the called modules are under the aegis of customers of the purveyor.

11. Apparatus for enabling a calling module to obtain secure access to a called module located within a computer, the apparatus comprising:

a test block TB located within the called module;

a security value S located within the called module;

situated within the called module, means for applying a distributive invertible function f to a numerical representation N of the TB, to calculate a first challenge value CV1;

situated within the called module, means for applying f to a block within the called module representative of the contents and location of S within the called module, to calculate a second challenge value CV2;

located within the calling module, means for calculating S based upon CV1 and CV2, and using f; and

means for allowing the calling module to have access to the called module when the calculated S corresponds to the security value S located within the called module.

12. A computer-implemented method for enabling a calling module to obtain secure access to a called module located within a computer, the method comprising the steps of:

forming a test block TB located within the called module;

locating a security value S within the called module;

having the called module apply a distributive invertible function f to a numerical representation N of the TB, to calculate a first challenge value CV1;

having the called module apply f to a block within the called module representative of the contents and location of S within the called module, to calculate a second challenge value CV2;

having the calling module calculate S based upon CV1 and CV2, and using f; and

granting the calling module access to the called module when the calculated S corresponds to the security value S stored within the called module.

13. A computer-readable medium containing a software program that includes instructions for performing the method in claim 12.