Method and apparatus to copy protect software programs

• US 7,243,227 B1
• Filed: 09/07/2001
• Issued: 07/10/2007
• Est. Priority Date: 09/07/2001
• Status: Active Grant

• Current Assignee: Xilinx, Inc. (Advanced Micro Devices, Inc.)
• Original Assignee: Xilinx, Inc. (Advanced Micro Devices, Inc.)
• Inventors: Knapp, Steven K.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Wyszynski; Aubrey H.
• Application Number:
  US09/949,234
• Time in Patent Office: 2,132 Days
• Field of Search: 713/153, 713/160, 713/161, 713/165, 713/167, 713/168, 713/200
• US Class Current: 713/160
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A system and method are described for securing a configurable system on a chip (CSoC) or other programmable chip design to prevent unauthorized copying. A processor reads instructions from a memory device. The processor reads an identification code from an identification code provider. If no identification code has been previously imprinted on the memory, the processor imprints the provider identification code into the memory. If an identification code is already present, the memory identification code is compared with the provider identification code. If the memory identification code matches with the provider identification code, the processor is allowed to perform the program present on the memory. If the memory identification code does not match with the provider identification code, appropriate security countermeasures are taken. The program and identification code can be further encrypted on the memory for greater security, using the provider identification code as the encryption key.

Claims

1. A method, comprising:

using a processor to read a first unique identification code from a separate identification code provider;

using the processor to read a second identification code from a memory a first time;

comparing the second identification code to a predetermined value that indicates that the memory is not copy protected;

storing the first identification code as the second identification code in the memory in response to the second identification code read the first time being equal to the predetermined value;

using the processor to read the second identification code from the memory a second time;

comparing the second identification code read from the memory the second time to the first identification code;

indicating with the processor, failure to protect the memory in response to the second identification code read from the memory the second time being unequal to the first identification code;

using the processor to read the second identification code from the memory a third time;

comparing the first identification code to the second identification code read from the memory the third time;

allowing the processor to perform instructions contained in the memory if the first identification code matches the second identification code read from the memory the third time; and

performing a security response if the first identification code does not match the second identification code read from the memory the third time.

2. The method of claim 1, wherein the separate identification code provider and the processor are coupled together.

3. The method of claim 1, further including accessing the separate identification code provider over the Internet.

4. The method of claim 1, wherein the security response is to shut down the processor.

5. The method of claim 1, wherein the security response is to erase the memory.

6. The method of claim 1, wherein the security response is to drive current against output pins of the processor and memory.

7. The method of claim 1, further including encrypting the second identification code.

8. The method of claim 7, further including decrypting the second identification code using the first unique identification code.

9. An apparatus, comprising:

means for using a processor to read a first unique identification code from a separate identification code provider;

means for using the processor to read a second identification code from a memory a first time;

means for comparing the second identification code to a predetermined value that indicates that the memory is not copy protected;

means for storing the first identification code as the second identification code in the memory in response to the second identification code read the first time being equal to the predetermined value;

means for using the processor to read the second identification code from the memory a second time;

means for comparing the second identification code read from the memory the second time to the first identification code;

means for indicating with the processor failure to protect the memory in response to the second identification code read from the memory the second time being unequal to the first identification code;

means for using the processor to read the second identification code from the memory a third time;

means for comparing the first identification code to the second identification code read from the memory the third time;

means for allowing the processor to perform instructions contained in the memory if the first identification code matches the second identification code read from the memory the third time; and

means for performing a security response if the first identification code does not match the second identification code read from the memory the third time.

10. The apparatus of claim 9, wherein the separate identification code provider and the processor are coupled together.

11. The apparatus of claim 9, further including means for accessing the separate identification code provider over the Internet.

12. The apparatus of claim 9, wherein the security response is to shut down the processor.

13. The apparatus of claim 9, wherein the security response is to erase the memory.

14. The apparatus of claim 9, further including means for damaging the system as the security response.

15. The apparatus of claim 9, further including means for encrypting the second identification code.

16. The apparatus of claim 15, further including means for decrypting the second identification code using the first unique identification code.

17. An apparatus, comprising:

a separate identification code provider to provide a first unique identification code;

a memory to store an initial value as a second identification code; and

a processor configured with code from the memory to read the first unique identification code from the separate identification code provider, read a second identification code from the memory a first time, compare the second identification code to a predetermined value that indicates that the memory is not copy protected, and store the first identification code as the second identification code in the memory in response to the second identification code read the first time being equal to the predetermined value,

the processor being further configured with code from the memory to read the second identification code from the memory a second time, compare the first unique identification code with the second unique identification code read a second time, indicate failure to protect the memory in response to the second identification code read from the memory the second time being unequal to the first identification code,

the processor being further configured with code from the memory to read the second identification code from the memory a third time, compare the first identification code to the second identification code read the third time, allow further execution of instructions from the memory in response to the first identification code matching the second identification code read the third time, and trigger a security response if the first unique identification code does not match the second identification code read the third time; and

a circuit board connecting the processor, the memory, and the separate identification code provider.

18. The apparatus of claim 17, wherein the security response is to shut down the processor.

19. The apparatus of claim 17, wherein the security response is to erase the memory.

20. The apparatus of claim 17, wherein the security response is to drive current against output pins of the apparatus.

21. The apparatus of claim 17, wherein the second identification code is encrypted.

22. The apparatus of claim 21, wherein the second identification code is decrypted using the first unique identification code.