Method for protecting digital content from unauthorized use by automatically and dynamically integrating a content-protection agent

• US 7,313,824 B1
• Filed: 07/11/2002
• Issued: 12/25/2007
• Est. Priority Date: 07/13/2001
• Status: Active Grant

• Current Assignee: Liquid Machines, Inc. (Check Point Software Technologies Limited)
• Original Assignee: Liquid Machines, Inc. (Check Point Software Technologies Limited)
• Inventors: Bala, Vasanth, Smith, Michael D.
• Primary Examiner(s): Moazzami, Nasser
• Assistant Examiner(s): Cervetti, David Garcia
• Application Number:
  US10/194,655
• Time in Patent Office: 1,993 Days
• Field of Search: 726/27, 713/187
• US Class Current: 726/27
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]

Abstract

A content processor application is loaded into memory from a master image to form a runtime content processor application image. An integration agent dynamically integrates a protection agent into the loaded runtime content processor application image to form a customized content processor application with extended functionality. Only the runtime content processor application image is extended with the protection agent—the application master image remains unaltered.

Claims

1. A method for extending a content processor application, comprising:

loading a content processor application into memory from a master image to form a runtime content processor application image;

suspending execution of the runtime content processor application image;

dynamically integrating a protection agent into the runtime content processor application image to form a customized content processor application with extended functionality by (i) identifying file input/output related operating system calls of the runtime content processor application image that can be made by the application, and (ii) overwriting the identified file input/output related operating system calls of the runtime content processor application image to point to corresponding functions which extend functionality, only the runtime content processor application image being altered and extended with the protection agent, the master image being unaltered; and

resuming execution of the customized runtime content processor application image.

2. The method of claim 1, wherein the protection agent comprises at least one content protection module.

3. The method of claim 2, wherein the protection agent further comprises an amalgamator, the step of integrating the protection agent into the runtime content processor application image comprising:

injecting the amalgamator into the runtime content processor application image; and

loading, by the amalgamator, the at least one module, and integrating the module with the runtime content processor application image to provide the extended functionality.

4. The method of claim 2, wherein at least one content protection module is used to access protected content.

5. The method of claim 4, wherein at least one content protection module prevents the export, in an unprotected form, of at least a portion of the protected content.

6. The method of claim 5, wherein the at least one content protection module prevents the export of protected content by causing all input/output operations that target unprotected files/memory buffers to write out data in a protected format.

7. The method of claim 2, wherein the at least one content protection module is produced by a third-party.

8. The method of claim 2, wherein plural content protection modules are simultaneously registered with the protection agent.

9. The method of claim 8, wherein the plural content protection modules are used in parallel by the customized content processor application to process different documents.

10. The method of claim 8, wherein the plural content protection modules are used in parallel by the customized content processor application to process different portions of a single document.

11. The method of claim 2, wherein the plural content protection modules correspond to different content formats.

12. The method of claim 1, the protection agent executes within the same address space as the customized content processor application.

13. The method of claim 12, wherein the protection agent supports editing of protected content without the loss of protection.

14. The method of claim 12, wherein the protection agent intercepts any of:

input/output function calls, memory storage calls, and cut/paste calls.

15. The method of claim 1, wherein the protection agent is used by the customized content processor application to process different documents in parallel.

16. The method of claim 1, wherein the protection agent is used by the customized content processor application to process differently protected portions of a single document in parallel.

17. The method of claim 1, wherein the protection agent prevents the export, in an unprotected form, of at least a portion of the protected content.

18. The method of claim 17, wherein the protection agent prevents the export of protected content by causing all input/output operations that target unprotected files/memory buffers to write out data in a protected format.

19. The method of claim 1, wherein the protection agent maintains an audit trail.

20. The method of claim 1, wherein the customized content processor processes both protected and unprotected content.

21. The method of claim 1, wherein the extended functionality comprises any of content protection, rights management, and encryption/decryption.

22. The method of claim 1, wherein the protection agent is independent of the content processor application.

23. The method of claim 1, wherein the protection agent is independent of any plugin interface provided by the content processor application.

24. The method of claim 1, wherein the content processor application is an existing/legacy application.

25. The method of claim 1, wherein the content processor application is a new version of an existing application.

26. The method of claim 1, further comprising:

modifying an operating system boot process so that upon attempting to launch of a particular application, said particular application used to launch other applications, instead an integration agent application is launched, the integration agent launching the particular application and dynamically integrating the particular application with the protection agent.

27. The method of claim 1, further comprising:

explicitly enabling, by a user, automatic and dynamic integration of the protection agent into all subsequently launched content processor applications.

28. The method of claim 1, wherein the step of dynamically integrating a protection agent into the runtime content processor application image is performed by an integration agent.

29. The method of claim 28, wherein the integration agent is a standalone software application.

30. The method of claim 28, wherein the integration agent is associated with a file type corresponding to at least one protected content document.

31. The method of claim 1, file input/output related operating system calls being identified by examining an import table associated with the runtime content processor application image, and the system calls being overwritten by overwriting corresponding identified entries in the import table.

32. The method of claim 1, further comprising:

identifying function calls to load additional executable code into memory; and

overwriting the identified function calls to point to corresponding functions contained within the protection agent.

33. The method of claim 32, wherein additional executable code comprises a dynamically linked library module.

34. The method of claim 1, wherein the steps of loading the application and integrating the protection agent into the runtime content processor application image are performed automatically when the application is selected for execution.

35. The method of claim 1, wherein the steps of loading the application and integrating the protection agent into the runtime content processor application image are performed transparently.

36. The method of claim 1, further comprising:

registering an integration agent in place of the application, the integration agent being executed when the application is selected, the integration agent integrating the protection agent into the runtime content processor application image.

37. A computer system for extending a content processor application, comprising:

a loader utility that loads a content processor application into memory from a master image to form a runtime content processor application image;

an integration agent that suspends execution of the runtime content processor application image, dynamically integrates a protection agent into the runtime content processor application image to form a customized content processor application with extended functionality by (i) identifying file input/output related operating system calls of the runtime content processor application image that can be made by the application, and (ii) overwriting the identified file input/output related operating system calls of the runtime content processor application image to point to corresponding functions which extend functionality, only the runtime content processor application image being altered and extended with the protection agent, the master image being unaltered, resumes execution of the customized runtime content processor application image; and

the protection agent.

38. The system of claim 37, wherein the protection agent comprises:

at least one content protection module.

39. The system of claim 38, wherein the protection agent further comprises an amalgamator, the integration agent injecting the amalgamator into the runtime content processor application image, and the amalgamator loading the at least one module, and integrating the module with the runtime content processor application image to provide the extended functionality.

40. The system of claim 38, at least one content protection module being used to access protected content.

41. The system of claim 40, wherein at least one content protection module prevents the export, in an unprotected form, of at least a portion of the protected content.

42. The system of claim 41, wherein the at least one content protection module prevents the export of protected content by causing all input/output operations that target unprotected files/memory buffers to write out data in a protected format.

43. The system of claim 38, the at least one content protection module being produced by a third-party.

44. The system of claim 38, plural content protection modules being simultaneously registered with the protection agent.

45. The system of claim 44, wherein the plural content protection modules correspond to different content formats.

46. The system of claim 44, wherein the plural content protection modules are used in parallel by the customized content processor application to process different documents.

47. The system of claim 44, wherein the plural content protection modules are used in parallel by the customized content processor application to process different portions of a single document.

48. The system of claim 37, the protection agent executing within the same address space as the customized content processor application.

49. The system of claim 48, the protection agent supporting editing of protected content without the loss of protection.

50. The system of claim 48, the protection agent intercepting any of:

input/output function calls, memory storage calls, and cut/paste calls.

51. The system of claim 37, wherein the protection agent is used by the customized content processor application to process different documents in parallel.

52. The system of claim 37, wherein the protection agent is used by the customized content processor application to process differently protected portions of a single document in parallel.

53. The system of claim 37, wherein the protection agent prevents the export, in an unprotected form, of at least a portion of the protected content.

54. The system of claim 53, wherein the protection agent prevents the export of protected content by causing all input/output operations that target unprotected files/memory buffers to write out data in a protected format.

55. The system of claim 37, wherein the protection agent maintains an audit trail.

56. The system of claim 37, wherein the customized content processor processes both protected and unprotected content.

57. The system of claim 37, wherein the extended functionality comprises any of content protection, rights management, and encryption/decryption.

58. The system of claim 37, wherein the protection agent is independent of the content processor application.

59. The system of claim 37, wherein the protection agent is independent of any plugin interface provided by the content processor application.

60. The system of claim 37, wherein the content processor application is an existing/legacy application.

61. The system of claim 37, wherein the content processor application is a new version of an existing application.

62. The system of claim 37, wherein an operating system is modified so that upon an attempt to launch of a particular application, said particular application used to launch other applications, instead the integration agent is (executed, the integration agent launching the particular application and dynamically integrating the particular application with the protection agent.

63. The system of claim 37, wherein automatic and dynamic integration of the protection agent into all subsequently launched content processor applications is explicitly enabled by a user.

64. The system of claim 37, wherein the integration agent is a standalone software application.

65. The system of claim 37, wherein the integration agent is associated with a file type corresponding to at least one protected content document.

66. The system of claim 37, wherein the protection agent identifies file input/output related operating system calls by examining an import table associated with the runtime content processor application image, and overwriting the system calls by overwriting corresponding identified entries in the import table.

67. The system of claim 37, wherein the protection agent identifies function calls to load additional executable code into memory, and overwrites the identified function calls to point to corresponding functions contained within the protection agent.

68. The system of claim 67, wherein additional executable code comprises a dynamically linked library module.

69. The system of claim 37, wherein the application is loaded and integrated with the protection agent into the runtime content processor application image automatically when the application is selected for execution.

70. The system of claim 37, wherein application is loaded and integrated with the protection agent into the runtime content processor application image transparently.

71. The system of claim 37, wherein the integration agent is registered in place of the application, the integration agent being executed when the application is selected, the integration agent integrating the protection agent into the runtime content processor application image.

72. A computer program product for extending a computer application, the computer program product comprising a computer usable medium having computer readable code thereon, including program code which when executed by a computer causes the computer to:

load a content processor application into memory from a master image to form a runtime memory image of the application;

suspend execution of the runtime content processor application image;

dynamically integrate a protection agent into the runtime memory image of the application to form a customized content processor application by (i) identifying file input/output related operating system calls of the runtime content processor application image that can be made by the application, and (ii) overwriting the identified file input/output related operating system calls of the runtime content processor application image to point to corresponding functions which extend functionality, only the runtime memory image of the application being altered and extended with the protection agent, the master image being unaffected; and

resume execution of the customized runtime content processor application image.

73. A computer program product as claimed in claim 72 wherein the customized content processor application has extended functionality including any of content protection, rights management and encryption/decryption, and the customized content processor application indicates the same.

74. A computer system for extending a content processor application, comprising:

a digital processor having a memory;

means for loading the content processor application into memory from a master image to form a runtime memory image of the application;

means for suspending execution of the runtime content processor application image;

means for dynamically integrating a protection agent into the runtime memory image to form a customized content processor application by (i) identifying file input/output related operating system calls of the runtime content processor application image that can be made by the application, and (ii) overwriting the identified file input/output related operating system calls of the runtime content processor application image to point to corresponding functions which extend functionality, only the runtime memory image of the application being altered and extended with the protection agent, the master image being unaffected; and

means for resuming execution of the customized runtime content processor application image.

75. A computer system as claimed in claim 74 wherein the customized content processor application has extended functionality including any of content protection, rights management and encryption/decryption, and the customized content processor application indicates the same.