Use of code obfuscation to inhibit generation of non-use-restricted versions of copy protected software applications

• US 6,643,775 B1
• Filed: 11/20/1998
• Issued: 11/04/2003
• Est. Priority Date: 12/05/1997
• Status: Expired due to Term

• Current Assignee: Tumbleweed Holdings LLC (Equitable IP Corporation)
• Original Assignee: Jamama LLC
• Inventors: Granger, Mark J., Smith, Cyrus E., Hoffman, Matthew I.
• Primary Examiner(s): Barrón, Gilberto
• Assistant Examiner(s): Zand, Kambiz
• Application Number:
  US09/197,052
• Time in Patent Office: 1,810 Days
• Field of Search: 380/37, 380/42, 713/155, 713/168, 713/170, 713/190, 713/191, 713/193, 713/194
• US Class Current: 713/190
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/123 by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Three methods are disclosed for protecting software applications from unauthorized distribution and use (piracy). The first method involves using values generated by a conventional ESD (Electronic Security Device) to encrypt and/or decrypt user data (such as a file) that is generated and used by the application. In a preferred embodiment, the user data is encrypted (such as during a write to memory) using values returned by the ESD, and the user data is later decrypted using like values returned by a software-implemented ESD simulator. The second and third methods involve the use of special development tools that make the task of analyzing the application'"'"'s copy protection code (such as the code used to encrypt and/or decrypt user data) significantly more difficult. Specifically, the second method involves using pseudocode to implement some or all of the application'"'"'s copy protection functions. The pseudocode for a given function is generated (preferably in encrypted form) from actual code using a special development tool, and is then imbedded within the application together with a corresponding pseudocode interpreter. The interpreter fetches, decrypts and executes the pseudocode when the function is called. Because no disassemblers or other development tools exist for analyzing the pseudocode, the task of analyzing the copy protection functions becomes significantly more complex. The third method involves the use of a special obfuscation tool to convert the code for selected copy-protection functions into unnecessarily long, inefficient sequences of machine code. In one implementation of the obfuscation tool, the developer can control the quantity of code that is generated by specifying one or more control parameters. The three methods can also be used to protect software license management systems from security attacks.

Claims

1. A method of protecting a software application from unauthorized use, the method comprising:

providing a code module which implements at least one function of a use-restriction scheme, the use-restriction scheme using an electronic security device (ESD) to prevent an unauthorized use of the application;

processing at least a portion of said code module with an obfuscation tool to controllably increase a quantity of code used to implement the function of the use-restriction scheme, obfuscation tool generating obfuscated code; and

imbedding the obfuscated code within the application;

wherein the obfuscated code inhibits the generation of a non-use-restricted version of the application.

2. The method of claim 1, wherein the function comprises an encryption function which encrypts user data based on a value generated by the ESD, the user data generated by the application based on actions of a user.

3. The method of claim 1, wherein the function comprises a decryption function which decrypts user data based on a value generated by the ESD.

4. The method of claim 1, wherein the step of processing comprises specifying a quantity of obfuscated code to be generated by the obfuscation tool.

5. The method of claim 1, wherein the step of processing comprises replacing instructions of the code module with equivalent sequences of instructions.

6. The method of claim 5, wherein the step of replacing comprises replacing machine-level instructions with equivalent sequences of machine-level instructions.

7. The method of claim 5, wherein the step of replacing comprises replacing high-level instructions with equivalent sequences of high-level instructions.

8. The method of claim 1, wherein the step of imbedding the obfuscated code within the application comprises processing obfuscated high-level source code with a compiler to generate obfuscated machine code.

9. The method of claim 1, wherein the step of processing comprises increasing a quantity of machine code used to implement the function by a factor of at least 100.

40. The method of claim 1, wherein the function of the use-restriction scheme is intermingled within the code module with a non-copy-protection function that is necessary to the proper operation of the software application.

10. On a computer-readable medium, an application that is protected from unauthorized use, the application generated by performing at least the following steps:

providing a code module which implements at least one function of a use-restriction scheme, the use-restriction scheme using an electronic security device (ESD) to prevent an unauthorized use of the application;

processing at least a portion of said code module with an obfuscation tool to controllably increase a quantity of code used to implement the function of the use-restriction scheme, the obfuscation tool generating obfuscated code; and

imbedding the obfuscated code within the application;

wherein the obfuscated code inhibits the generation of a non-use-restricted version of the application.

11. The application as in claim 10, wherein the function comprises an encryption function which encrypts user data based on a value generated by the ESD, the user data generated by the application based on actions of a user.

12. The application as in claim 10, wherein the function comprises a decryption function which decrypts user data based on a value generated by the ESD.

13. The application as in claim 10, wherein the step of processing comprises specifying a quantity of obfuscated code to be generated by the obfuscation tool.

14. The application as in claim 10, wherein the step of processing comprises replacing instructions of the code module with equivalent sequences of instructions.

15. The application as in claim 14, wherein the step of replacing comprises replacing machine-level instructions with equivalent sequences of machine-level instructions.

16. The application as in claim 14, wherein the step of replacing comprises replacing high-level instructions with equivalent sequences of high-level instructions.

17. The application as in claim 10, wherein the step of imbedding the obfuscated code within the application comprises processing obfuscated high-level source code with a compiler to generate obfuscated machine code.

18. The application as in claim 10, wherein the step of processing comprises increasing a quantity of machine code used to implement the function by a factor of at least 100.

19. The application as in claim 10, in combination with the ESD.

41. The application as in claim 10, wherein the function of the use-restriction scheme is intermingled within the code module with a non-copy-protection function.

20. A copy-protected software application, comprising:

application code which provides end-user functionality; and

copy protection code that implements a use-restriction scheme to control execution of the application code, the copy protection code comprising obfuscated machine code, the obfuscated machine code generated using an obfuscation tool which controllably increases a quantity of instructions within an input code sequence while preserving a function performed by the code sequence, the obfuscation tool thereby making the task of evaluating machine-level copy protection code more complex, such that the obfuscated machine code inhibits disablement of the use-restriction scheme.

21. The application as in claim 20, wherein the copy protection code communicates with an electronic security device (ESD).

22. The application as in claim 21, wherein the copy protection code uses a value generated by the ESD to encrypt and/or decrypt user data generated by the application code.

23. The application as in claim 21, wherein the obfuscated machine code is generated using an obfuscation tool which replaces instructions of an input code sequence with equivalent sequences of instructions.

24. The application as in claim 20, wherein the copy protection code communicates with a license management system (LMS).

25. The application as in claim 20, wherein the copy protection code communicates with a license management system (LMS) over a wide area network.

26. The application as in claim 20 in combination with a license management system (LMS), wherein LMS uses or simulates an electronic security device (ESD) to restrict use of the application.

42. The application as in claim 20, wherein the obfuscated machine code implements at least one copy protection function that is intermingled with a non-copy-protection function.

43. The application as in claim 42, wherein the non-copy-protection function is necessary to the operation of the application.

27. A method of protecting a software application from unauthorized use, the method comprising:

providing a code module which implements at least one function of a use-restriction scheme, the use-restriction scheme using a license management system (LMS) to prevent an unauthorized use of the application;

processing at least a portion of said code module with an obfuscation tool to controllably increase a quantity of code used to implement the function of the use-restriction scheme, the obfuscation tool generating obfuscated code; and

imbedding the obfuscated code within the application;

wherein the obfuscated code inhibits the generation of a non-use-restricted version of the application.

28. The method of claim 27, wherein the function comprises at least one of the following:

(a) a decryption function which decrypts an encrypted authorization certificate received from the LMS;

(b) a certificate processor which interprets an authorization certificate received from the LMS.

29. The method of claim 27, further comprising configuring the application to communicate with the LMS over a wide area network.

30. The method of claim 27, wherein processing at least a portion of said code module with an obfuscation tool comprises specifying a quantity of obfuscated code to be generated by the obfuscation tool.

31. The method of claim 27, wherein processing at least a portion of said code module with an obfuscation tool comprises replacing instructions of the code module with equivalent sequences of instructions.

32. The method of claim 31, wherein replacing instructions of the code module comprises replacing machine-level instructions with equivalent sequences of machine-level instructions.

33. The method of claim 31, wherein replacing instructions of the code module comprises replacing high-level instructions with equivalent sequences of high-level instructions.

34. The method of claim 31, wherein imbedding the obfuscated code within the application comprises processing obfuscated high-level source code with a compiler to generate obfuscated machine code.

35. The method of claim 27, wherein processing at least a portion of said code module with an obfuscation tool comprises increasing a quantity of machine code used to implement the function by a factor of at least 100.

36. A software application generated according to the method of claim 27, said software application stored by a computer-readable medium.

37. The software application of claim 36, wherein the software application is configured to communicate with the LMS over a wide area network.

38. The software application of claim 36, wherein the software application uses an electronic security device (ESD) simulator to decrypt data received from the LMS.

39. The software application of claim 36, in combination with the LMS.

44. The method of claim 27, wherein the at least one function of the use-restriction scheme is intermingled within the code module with a non-copy-protection function that is necessary to the proper operation of the software application.

45. A method of protecting a software application from unauthorized use, the method comprising:

intermingling a copy protection function with a non-copy-protection function within a code module, wherein the copy protection function implements at least a portion of a use-restriction scheme to control use of the software application, and the non-copy-protection function provides application-level functionality;

processing the code module with an obfuscation tool to controllably increase a quantity of executable code used to implement at least the intermingled copy protection and non-copy-protection functions, to thereby generate obfuscated code that implements the intermingled copy protection and non-copy-protection functions; and

incorporating the obfuscated code into the software application.

46. The method of claim 45, wherein the non-copy-protection function is necessary for operation of the software application.

47. The method of claim 45, wherein the copy protection function includes a function that encrypts and/or decrypts user data using values generated by an electronic security device (ESD).

48. A copy protected software application generated according to the method of claim 45 and stored on a computer-readable medium.