Remotely authenticated operation method

• US 7,509,687 B2
• Filed: 10/22/2003
• Issued: 03/24/2009
• Est. Priority Date: 03/16/2002
• Status: Active Grant

• Current Assignee: Attestwave LLC (Jeffrey M. Gross)
• Original Assignee: Trustedflow Systems, Inc.
• Inventors: Ofek, Yoram, Baldi, Mario
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): Moran; Randal D
• Application Number:
  US10/691,277
• Publication Number:
  US 20040230797A1
• Time in Patent Office: 1,980 Days
• Field of Search: 726/26, 726/29, 726/30, 709/227, 709/230, 709/231, 709/238
• US Class Current: 726/30
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

The objective of this invention is to provide continuous remote authenticated operations for ensuring proper content processing and management in remote untrusted computing environment. The method is based on using a program that was hidden within the content protection program at the remote untrusted computing environment, e.g., an end station. The hidden program can be updated dynamically and it includes an inseparable and interlocked functionality for generating a pseudo random sequence of security signals. Only the media server that sends the content knows how the pseudo-random sequence of security signals were generated; therefore, the media server is able to check the validity of the security signals, and thereby, verify the authenticity of the programs used to process content at the remote untrusted computing environment. If the verification operation fails, the media server will stop the transmission of content to the remote untrusted computing environment.

Claims

1. A computing system, the system comprising:

a network coupling a first computing subsystem and a second computing subsystem;

wherein the second computing subsystem provides sending of streaming data packets containing digital media to the first computing subsystem;

wherein the first computing subsystem provides means for;

(a) receiving of the streaming data packets containing digital media from the second computing subsystem,

(b) utilizing an operational software module by the first computing subsystem for processing of the streaming data packets containing digital media, and

(c) utilizing the operational software module by the first computing subsystem for generating security tags responsive to said processing of streaming data packets and sending the security tags to the second subsystem; and

wherein the second computing subsystem provides means for;

(a) receiving the security tags from the first computing subsystem, and

(b) providing processing logic for validating as a successful validation that the operational software module was unchanged when utilized in generating the security tags at the first computing subsystem, and otherwise determining a failed validation if the operational software module was changed when utilized in generating the security tags at the first computing subsystem.

2. The system as in claim 1, wherein the second computing subsystem further comprises a transmission and forwarding controller responsive to the processing logic for validating, for performing at the following:

stopping the sending of the streaming data packets containing digital media to the first computing subsystem responsive to the determining of the respective failed validation.

3. The system as in claim 1, wherein the operational software module provides rules of processing that are defined by at least one of:

a content management subsystem, a digital right management subsystem, and predefined policy rules associated with the content.

4. The system as in claim 1, further comprising:

a defined sequence of decryption keys; and

wherein portions of the defined sequence of decryption keys are sent, one portion at a time, from the second computing subsystem to first computing subsystem, responsive to successful validation of the processing logic for validating the received security tags from the first computing subsystem.

5. The system as in claim 1, wherein the processing of streaming data packets on the first computing subsystem is further responsive to a at least one of:

a privileges table, a privileges decision-tree, pseudo random rendering logic, a streaming data packet header processing privileges decision-tree, a security tag processing logic, a streaming data packet identification processing logic, a secure time-stamp processing logic, a time stamp representing execution time of at least one selected operation, a processing of streaming data packets with secure time-stamps, watermarking information processing, fingerprinting information processing, stenographic information processing, data embedding information processing, digital signature information processing, and a processing of streaming data packets with secure time-stamps that is responsive to UTC (coordinated universal time).

6. The system as in claim 1, wherein the processing of streaming data packets on the first computing subsystem utilizes codes and parameters defining and expressing at least one of:

privileges, authorizations, access rights, and entitlements as expressed in XrML (Extensible Rights Markup Language).

7. The system as in claim 1, wherein at least one of:

the processing of streaming data packets and the generating of security tags are further responsive to at least one of;

a predefined schedule, a secure time-stamp, a time stamps representing execution time of at least one selected operation, renewable codes and parameters, updated codes and parameters, a predefined schedule received from the second computing subsystem, a secure time-stamp received from the second computing subsystem, renewable codes and parameters received from the second computing subsystem, updated codes and parameters received from the second computing subsystem, replacement codes and parameters received from the second computing subsystem, a predefined schedule received from a third computing subsystem, a secure time-stamp received from a third computing subsystem, renewable codes and parameters received from a third computing subsystem, and updated codes and parameters received from a third computing subsystem.

8. The system as in claim 7, wherein at least one of:

selected parts of the processing of the streaming data packets, selected parts of the generating of security tags, selected parts of the renewable codes and parameters, and selected parts of the updated codes and parameters, are provided from an external storage medium.

9. The system as in claim 8, wherein the external storage medium is at least one of:

a smart card, a tamper-resistant device, an obfuscated storage, a hidden storage, an encrypted data storage, a removable storage device , a token card, a network interface, a wireless access point, a wireless base station, and a metro card.

10. The system as in claim 1, wherein selected parts of the processing of streaming data packets, and selected parts of the generating of security tags are defined as a plurality of logic modules that are interlocked to provide concurrent execution.

11. The system as in claim 1, wherein the display device is at least one of:

an analog display, a digital display, a television, a flat panel display, a screen, a movie screen, a liquid crystal display, a solid state display, a home video system, a computer display, a CRT display, a mobile phone display, a PDA display, a three-dimensional display, a holographic display, a computer monitor, a handheld display, a digital output system, an electronic book display, and an analog output system.

12. The system as in claim 1, further comprising:

an update controller separate from the first computing subsystem, and providing at least one of;

updated codes, updated parameters, update decryption codes, update decryption keys, update rendering codes, update playing codes, and updated secure time stamp to the first subsystem.

13. The system as in claim 12, further comprising:

a security management server (SMS) for providing update information to the update controller.

14. The system as in claim 1,

wherein the utilizing an operational software module by the first computing subsystem for processing of the streaming data packets containing digital media provides at least one of audio playing on a sound device and a video playing on a display device, wherein the sound device is at least one of:

a speaker, a plurality of speakers, a surrounding sound system, ear phones, loudspeakers, a high fidelity sound system, a stereo audio system, a digital output system, and an analog output system.

15. The system as in claim 1, wherein the first computing subsystem is further comprised of cryptographic modules;

and

wherein the cryptographic modules provide for at least one of;

program authentication, user authentication, cryptographic authentication, application authentication, encryption, a secure time-stamp, a digital signature, watermarking information, IPSec (IP Security) functionality, TLS (Transport Layer Security) functionality, and SSL (Secure Sockets Layer) functionality.

16. The system as in claim 1, wherein the second computing subsystem is further comprised of validation modules;

and

wherein the validation modules further provide at least one of;

program authentication, user authentication, cryptographic authentication, application authentication, encryption, a secure time-stamp, a digital signature, watermarking information, IPSec UP Security) functionality, TLS (Transport Layer Security) functionality, and SSL (Secure Sockets Layer) functionality.

17. The system as in claim 1,

wherein the utilizing an operational software module by the first computing subsystem for processing of the streaming data packers containing digital media provides at least one of audio playing on a sound device and a video playing on a display device, and

wherein the processing of the streaming data packets provides at least one of:

the audio playing and the video playing, and further provides at least one of;

deleting streaming data packets after processing, deleting streaming data packets within a predefined time interval after processing, deleting streaming data packets after a defined number of times of processing, preventing copying of the streaming data packets, preventing printing of the streaming data packets, preventing sending of the streaming data packets, encrypting video rendering of content received in the streaming data packets, pseudo random video rendering of content received in the streaming data packets, and encrypted video rendering of content received in the streaming data packets.

18. The system as in claim 1,

wherein the utilizing an operational software module by the first computing subsystem for processing of the streaming data packets containing digital media provides at least one of audio playing on a sound device and a video playing on a display device, and

wherein at least one of:

the audio playing and the video playing operate in accordance with logic based upon at least one of;

XrML (Extensible Rights Markup Language) specifications, trusted computing specifications, trusted computing based principles, validation of watermarking information, IPSec (IP Security) functionality, TLS (Transport Layer Security) functionality, and SSL (Secure Sockets Layer) functionality.

19. The system as in claim 1,

wherein the second computing subsystem further includes a media server.

20. The system as in claim 19, wherein there is a plurality of the first computing subsystems, each coupled to the network and receiving streaming data packets from the second computing subsystem, and wherein the media server regulates distribution of the streaming data packets to only a predefined number of the plurality of the first computing subsystems.

21. The system as in claim 1, wherein there is a plurality of the first computing subsystems, each coupled to the network and receiving streaming data packets from the second computing subsystem.

22. The system as in claim 21, wherein the second computing subsystem encodes the respective streaming data packets responsive to the respective successful validation of the respective received security tags from the respective one of the plurality of the first computing subsystems.

23. The system as in claim 22, wherein the streaming data packets are encoded such that any of the plurality of the first computing subsystems in which the validating of their security tags fail will not thereafter be able to further decode the streaming data packets.

24. The system as in claim 21, wherein the streaming data packets are encrypted by the second computing subsystem by using a group encryption scheme such that any of the first computing subsystems in which the validating of their security tags fail will not be able to further decode the streaming data packets.

25. The system as in claim 22, wherein the streaming data packets are sent using at least one of:

multicast, IP (Internet Protocol) multicast, Secure IP multicast, group key management architecture, multi-party non-repudiation protocol, group communications, and secure group communications.

26. The system as in claim 1, wherein there is a plurality of second computing subsystems coupled to the network, each sending a respective plurality of streaming data packets to the first computing subsystem.

27. The system as in claim 26, wherein the first computing subsystem sends security tags to the plurality of second computing subsystems for validation.

28. The system as in claim 1, wherein the first computing subsystem is at least one of:

a computer, a wireless device, a handheld device, a Wi-Fi device, a device operating in accordance with IEEE 802.11 family of standards, a device operating in accordance with IEEE 802.15, a device operating in accordance with IEEE 802.16, a 2.5G cellular telephone, a 3G cellular telephone, a 4G cellular telephone, a 5G cellular telephone, a personal computer, a set-top box, a device operating in accordance with UMTS (universal mobile telephone system), and a device operating in accordance to the IEEE 802 family of standards.

29. The system as in claim 1, wherein the second computing subsystem further comprises encryption logic for encrypting streaming data packets prior to sending the respective streaming data packets;

and

wherein the first computing subsystem processing of streaming data packets further comprises logic for decrypting the streaming data packets.

30. The system as in claim 29, wherein the second computing subsystem provides a decryption key to the first computing subsystem processing logic.

31. The system as claim 30, wherein the encryption key is provided for at least one of:

periodically, at random times, at predefined time intervals, responsive to validating the security tags, and at predefined times derived from coordinated universal time (UTC).

32. The system as in claim 29, wherein the first computing subsystem further comprises logic for generating and sending encryption keys to the second computing subsystem from at least one of the following:

a smart card external device and a trusted platform module (TPM); and

wherein the second computing subsystem uses the encryption keys for encrypting the streaming data packets prior to sending them.

97. The system as in claim 1, the system further comprising:

wherein a successful validation determines that the respective security tags were properly generated responsive to said processing of streaming data packets, and

wherein a failed validation determines that the respective security tags were improperly generated responsive to said processing of streaming data packets.

33. A method for authenticating, at a second computing subsystem, a software module utilized in operation at a first computing subsystem, the method comprising:

sending of data to the first computing subsystem from the second computing subsystem;

receiving the data in the first computing subsystem;

processing the data on the first computing subsystem responsive to an operational software module, and generating security tags responsive to an associated tag generation module concurrently executing with the operational software module;

concurrently executing the associated tag generation module responsive only to executing the respective operational software module in the first computing subsystem;

sending the security tags to the second computing subsystem from the first computing subsystem;

processing the security tags in the second computing subsystem to determine successful validation responsive to validating that the processing of the data in the first computing subsystem was processed by the operational software module operating concurrently with the generating the security tags by the associated tag generation, and otherwise determining a failed validation; and

adjusting communication of sending of the data responsive to one of the successful validation and the failed validation.

34. The method as in claim 33, further comprising:

providing a plurality of operational software modules and parameters operable stand-alone to provide a respective plurality of subtask functions

providing secure integration of the plurality of operational software modules and parameters to provide a combined functionality;

interlocking the plurality of operational software modules and parameters into a single logic program that is only operable to concurrently execute the plurality of operational software modules; and

providing the combined functionality responsive to the plurality of subtask functions concurrently executing responsive to the single logic program at the first computing element.

35. The method as in claim 33, wherein the generating security tags is at least one of:

forms a pseudo-random sequence of security tags and a time stamp representing execution time of at least one selected operations.

36. The method as in claim 35, further comprising:

producing the pseudo-random sequence of security tags utilizing computation according to at least one of;

applying a pseudo-random generator, applying a pseudo-random function, applying a cryptographic function, applying an encryption function, applying a scrambling subroutine, applying an authentication function, applying a digital signing function, applying a cryptographic bash function, applying a subroutine, applying a computational logic module, applying a symmetric cryptography function, applying an asymmetric cryptography function, employing a cryptographic key, employing a cryptographic seed, employing an encrypted software, employing an obfuscated software, employing a hidden program, employing watermarking information, employing fingerprinting information, employing digital signature information, employing logic with a set of parameters, employing a hardware module, employing a trusted platform module (TPM), employing a smart card, employing a portable device, and employing a distributed protocol.

37. The method as in claim 34, further comprising:

an external smart card device that is part of the first computing element, and

wherein selected modules and parameters of the plurality of software logic modules and parameters reside on the external smart card device.

38. The method as in claim 34, wherein selected ones of the parameters are at least one of:

an encryption key, a decryption key, and an authentication parameter.

39. The method as in claim 34, further comprising:

renewing selected ones of the plurality of operational software modules and parameters.

40. The method as in claim 34, further comprising:

replacing selected ones of the plurality of operational software modules and parameters.

41. The method as in claim 39, wherein the renewing is performed in at least one of:

periodically, at random times, at predefined times, at predefined times derived from coordinated universal time (UTC), responsive to receiving data by the first computing element, responsive to sending the security tags, and responsive to sending data by the second computing element.

42. The method as in claim 34, wherein the data is stored in a memory in the first computing clement responsive to the receiving the data in the first computing element;

the method further comprising;

erasing the data from the memory in the first computing element by the single logic program in the first computing element.

43. The method as in claim 42, wherein the memory is at least one of:

a solid state device, random access memory, a main memory, a secondary memory, a magnetic storage device, and an optical storage device.

44. The method as in claim 42, wherein the erasing the data is performed at least one of:

after a predefined time, after the data has been output to an output device, and after the data has been output a predefined number of times to an output device.

45. The method as in claim 33, wherein the first computing element is comprised of at least one of:

a computer, a wireless device, a handheld device, a Wi-Fi device, a device operating in accordance with IEEE 802.11, a device operating in accordance with IEEE 802.15, a device operating in accordance with IEEE 802.16, 2.5G cellular telephone, a 3G cellular telephone, a 4G cellular telephone, a 5G cellular telephone, a personal computer, a computing subsystem, a set-top box, a device operating in accordance with UMTS (Universal Mobile Telephone System), and a device operating in accordance with IEEE 802.3 family of standards.

98. The method as in claim 33, wherein the processing provides playing that provides at least one of:

an input to an audio device and an input to a video display.

99. The method as in claim 33, further comprising:

stopping sending of further data to the first computing subsystem responsive to the failed validation.

46. A method of protected communicating of streaming data packets, the method comprising:

receiving the streaming data packets containing content, in the first computing subsystem;

processing of the streaming data packets in the first computing subsystem according to defined rules for processing;

generating security tags responsive to execution of the defined rules for processing;

sending the security tags from the first computing subsystem to a second computing subsystem;

providing security tag validation logic in the second computing subsystem;

processing, in the second computing subsystem, the received security tags, responsive to the security tag validation logic to provide respective validated security tags; and

processing in the second computing subsystem the validated security tags and the received security tags to determine whether the generating security tags in the first computing subsystem was properly generated responsive to execution of the defined rules for processing at the first computing subsystem so as to validate that the defined rules of processing were unchanged at the time of execution at the first computing subsystem.

47. The method as in claim 46, wherein the content is representative of at least one of:

a movie, a book, a music piece, a concert, a 3D movie, a sport event, a text file, and a multimedia file;

wherein the content is divided into predefined number of parts, and

wherein each of the parts is associated with a decryption key.

100. The method as in claim 46, wherein the processing in the second computing subsystem further provides for protection of the content.

48. A method for authentication of integrity of software executed in generating of communicated data packets within a computer, the method comprising:

transmitting data packets from a second computing subsystem to a first computing subsystem;

receiving the streaming data packets for processing in the first computing subsystem;

providing operation software that provides for defining rules of processing for execution on the first computer subsystem;

generating security tags at the first computing subsystem responsive to the streaming data packets and responsive to the rules of processing;

sending respective ones of the security tags from the first computing subsystem to the second computing subsystem; and

processing the received security tags in the second computing subsystem to validate that the operation software was unchanged when the operation software performed the processing in the first computing subsystem when operating according to the rules of processing.

49. The method as in claim 48, further comprising:

validating the received security tags in the second computing subsystem responsive to second rules of processing; and

processing the received security tags in the second computing subsystem to validate execution of the operation software providing defining of the rules of processing in the first computing subsystem, to validate that the processing of the streaming data packets in the first computing subsystem is according to the respective defined rules for processing utilizing the respective unchanged operation software.

101. The method as in claim 48, wherein the processing in the first computer subsystem provides at least one of:

an input to an audio device and an input to a video display.

50. A computer system providing remote authentication on a first computing subsystem of processing of content at a remote computing subsystem, the system comprising:

a tag generator at the remote computing subsystem operating from an initial generator state to locally generate a sequence of security tags responsive to concurrent execution of an operational code module utilizing a sequence of content processing steps;

wherein the system provides transmission from the remote computing subsystem to the first computing subsystem of the sequence of security tags;

a tag verifier at the first computing subsystem, operating from an initial verification state to generate a sequence of comparison security tags for selective comparison to the sequence of the security tags; and

wherein the system coordinates the initial generator state and the initial verifier state prior to the execution of the operational code module,

wherein the tag verifier selectively provides valid comparison tags responsive to the means for coordinating, wherein the valid comparison tags are utilized to authenticate that the operation code module was unchanged during the execution at the remote computing subsystem for assuring integrity of the sequence of content processing steps.

51. The system as in claim 50, wherein the tag generator includes a sequence number as part of the security tags.

52. The system as in claim 51, wherein the tag verifier generates a comparison sequence number for selective comparison to the sequence number that is part of the security tags.

53. The system as in claim 51, wherein the sequence number is used for at least detecting a loss of a respective security tag.

54. The system as in claim 50, wherein the tag generator provides a secure time-stamp as part of each of the security tags.

55. The system as in claim 54, wherein the tag verifier generates a comparison secure time-stamp for selective comparison to the secure lime-stamp that is part of each of the security tags.

56. The system as in claim 50,

wherein the system remotely downloads of codes and parameters for use with the tag generator and the sequence of content processing steps.

57. The system as in claim 56, wherein the codes and parameters are used to perform at least one of:

processing to provide the sequence of content processing steps, and generating security tags.

58. A system for authenticating operation by providing secure integration of separate software logic modules to provide a combined functionality, the system comprising:

a plurality of software logic modules each operable stand-alone to provide a respective one of a plurality of subtask functions associated with operations on a first computing subsystem; and

a transformation controller providing interlocking of the plurality of software logic modules, comprised at least of a first separate operational module and a second separate operational module, into a single logic program that provides a combined functionality;

wherein the combined functionality is only provided by the first computing subsystem when the plurality of subtask functions are executed concurrently responsive to the single logic program;

wherein the combined functionality provides for the first computing subsystem providing the subtask functions of;

(a) receiving of streaming data packet from a media server associated with the first computing subsystem responsive to the first separate operational module within the single logic program, and providing processing of the streaming data packets responsive to defined rules for processing of the streaming data packets, and

(b) generation of security tags responsive to the second separate operational module within the single logic program and selectively sending of the security tags to said media server associated with the first computing subsystem,

wherein the combined functionality assures that the first separate operational software module for receiving of data packets executes concurrently with the second separate software logic module generating security tags.

59. The system as in claim 58, wherein the single logic program is written to be immune to reverse generation.

60. The system as in claim 58, wherein one of the software logic modules provides a function for producing at least one of:

pseudo-random sequence of security tags and time stamps representing the execution time of selected operations, at the first computing subsystem;

wherein at least one of;

the pseudo-random sequence of security tags and the time stamps representing the execution time of selected operations, are sent to the second computing subsystem for verification of correct processing on the first computing subsystem; and

wherein the streaming data packets are sent to the first computing subsystem from said media server, only upon successful verification that the combined functionality was executed on the first computing subsystem.

61. The system as in claim 60, wherein at least one of producing:

the pseudo-random sequence of security tags and the time stamps representing the execution time of selected operations, utilizes computation by at least one of;

applying a pseudo-random generator, applying pseudo-random function, applying a cryptographic function, applying an encryption function, applying a scrambling subroutine, applying an authentication function, applying a digital signing function, applying a cryptographic hash function, applying a subroutine, applying a computational logic module, applying a symmetric cryptography function, applying an asymmetric cryptography function, employing a cryptographic key, employing a cryptographic seed, employing an encrypted software, employing an obfuscated software, employing a hidden program, employing logic with a set of parameters, employing a hardware module, employing a smart card, employing a portable device, employing local clock, employing universal time, and employing a distributed protocol.

62. The system as in claim 58, wherein one of the software logic modules provides logic to process content of the streaming data packets.

63. The system as in claim 62, wherein logic to process the content of the streaming data packets performs at least one of:

video rendering of the content on a video display, playing the content via audio speakers, displaying the content on an e-book output device, outputting the content to an output device, and outputting the content to an analog output device.

64. The system as in claim 58, wherein one of the software logic modules provides rules of playing of audio and video content.

65. The system as in claim 64, wherein the rules of playing of audio and video content ensure at least one of:

the content is not printed;

the content is not sent to a third party;

the content is destroyed after being displayed on a video monitor;

the content is being destroyed after being played via an audio speakers;

the content is erased from all memory storage devices after being displayed on a video monitor;

the content is erased from all memory storage devices after being played via an audio speakers;

the content is erased from all memory storage devices after being used via an e-book output device;

the content is erased from all memory storage devices after a predefined time interval;

the content is erased from all memory storage devices at a time defined time by coordinated universal time (UTC);

the content is used in accordance with rights defined using XrML (Extensible Rights Markup Language) specifications;

the content is used in accordance with trusted computing specifications;

the content is used in accordance with trusted computing based principles; and

the content is used in accordance with at least one of the following;

watermarking information, stenographic information, fingerprinting information, embedded data and digital signature information.

66. The system as in claim 64, wherein the rules of playing provide at least one of:

content processing and determining a renewable software for content processing.

67. The system as in claim 66, wherein the renewable software for content processing is at least one of:

a number of times the content can be displayed, a number of times the content can be played, a time signal, a UTC time signal, a digitally signed time signal, a software element, a predefined task, a code for processing content signature, and a code for watermarking the content.

68. The system as in claim 66, wherein the renewable software for content processing is obtained from at least one of:

a second computing subsystem, a second computing element, predefined logic, an external rule controller, a security management system, via a network interface, a network appliance, a server, a network management system, a firewall, a local computing subsystem, a smart card device, a trusted platform module (TPM) device, and a portable device.

69. The system as in claim 58, wherein one of the software logic modules provides a cryptographic function for producing a pseudo-random sequence of security tags;

and

wherein one of the software logic modules provides logic to process and play audio and video content.

70. The system as in claim 58, wherein one of the software logic modules provides a cryptographic function for verifying at least one of:

watermarking, embedded data and fingerprinting.

71. The system as in claim 58, further comprising:

a source of interlocking parameters, and

wherein the transformation controller is further comprised of means for combining the software logic modules responsive to the interlocking parameters.

72. The system as in claim 71, wherein the source of interlocking parameters is generated by at least one of:

a random source, a cryptographic key, and a defined table and location in memory.

73. The system as in claim 71, wherein the transformation controller determines an intermixture of the subtask functions of the plurality of software logic modules into the single logic program to provide the combined functionality.

74. The system as in claim 73, wherein the intermixture of the subtask functions of the plurality of software logic modules into the single logic program to provide the combined functionality can be provided in a defined plurality of different ways;

and

wherein each of the defined plurality of different ways provides a different version of the single logic program providing the combined functionality.

75. The system as in claim 74, wherein the intermixture of the subtask functions of the plurality of software logic modules into the single logic program to provide the combined functionality is further comprised of at least one of:

obfuscation, encryption, replication, adding dummy code, addition of redundant control, renaming of variables, splitting a procedure into multiple sub-procedure, dictionary transformation, compilation, interpretation, cryptographic transformation, digital signing, and scrambling.

76. The system as in claim 75, wherein the replication is comprised of repetitions of the software logic modules into an oversize program comprising the single logic program embedded therein.

77. The system as in claim 76, wherein each of the repetitions is made active separately to define an active single program within the oversize program which acts as the single logic program.

78. The system as in claim 58, wherein the transformation controller further generates external software modules for linked operation with the single logic program as required for the combined functionality.

79. The system as in claim 78,

wherein the system transmits the external software modules to a separate computing subsystem, and

wherein the external software modules are executed in at least one of the separate computing subsystems to provide at least one of:

update information and renewable information coupled to the single logic program.

80. The system as in claim 79, wherein the system transmits utilizing at least one of:

encryption, authentication, and digital signing.

81. The system as in claim 79, wherein the update information is at least one of:

change data, change executable code, change pattern, change order and pseudo-change of dummy code.

82. The system as in claim 79, wherein the renewable information is at least one of:

renewable content processing, time signal, a UTC time signal, a digitally signed time signal, a digital cache for transmission of trusted content processing, and a cryptographic key for marking trusted content processing.

83. The system as in claim 58, wherein the system transmits the single logic program to a primary computing system.

84. The system as in claim 83, wherein the system transmits utilizing at least one of:

encryption, authentication, and digital signing.

85. The system as in claim 58, wherein security verification information is generated by the transformation controller, for utilization by separate security tag verification logic in a separate subsystem which validates the security tags.

86. The system as in claim 58, wherein one of the software logic modules provides security services.

87. The system as in claim 86, wherein the security services provide for at least one of:

user authentication, user sign-on, data packet authentication, user login, applying a user'"'"'s cryptographic key, applying an organization'"'"'s cryptographic key, group encryption, watermarking validation, and digital signing.

88. The system as in claim 86, wherein the security services further provide for applying cryptographic transformations based on keys belonging to a primary computing system.

89. The system as in claim 88, wherein the primary computing system provides for execution of the single logic program.

90. A method of providing controlled signaling for validating execution on a remote computing subsystem, the method comprising:

receiving streaming data packets from a media server, at a first computing subsystem;

processing of the streaming data packets on the first computing subsystem, in accordance with defined rules in the first computing subsystem;

generating a security tag responsive to the processing in accordance with the defined rules in the first computing subsystem;

transmitting the security tag to a second computing subsystem;

validating the security tag on the second computing subsystem responsive to determining that the defined rules were unchanged when the security tag was generated in accordance with the processing of the streaming data packets on the first computing subsystem.

91. The method as in claim 90, further comprising:

receiving selected parts of the defined rules on the first computing subsystem from a separate rules controller.

92. The method as in claim 90, further comprising:

determining a renewable software module for at least one of;

transmission, forwarding, and operation responsive to at least one of the defined rules on the first computing subsystem of at least one of;

transmission, forwarding, and operation on the first computing subsystem.

93. The method as in claim 90, wherein the generating the security tag comprises at least one of:

applying a pseudo-random generator, applying a pseudo-random function, applying a cryptographic function, applying an encryption function, applying a scrambling subroutine, applying an authentication function, applying a digital signing function, applying a cryptographic hash function, applying a subroutine, applying a computational logic module, applying a symmetric cryptography function, applying an asymmetric cryptography function, employing a cryptographic key, employing a cryptographic seed, employing an encrypted software, employing an obfuscated software, employing a hidden program, employing logic with a set of parameters, employing a hardware module, employing a smart card, employing a portable device, and employing a distributed protocol.

94. The method as in claim 90, wherein the communications path couples a network interface with at least one of:

a computer, a wireless device, handheld device, a Wi-Fi device, a device operating in accordance with IEEE 802.11, a device operating in accordance with IEEE 802.15, a device operating in accordance with IEEE 802.16, a 2.5G cellular telephone, a 3G cellular telephone, a 4G cellular telephone, a 5G cellular telephone, a personal computer, a set-top box, a device operating in accordance with UMTS (Universal Mobile Telephone System), and a device operating in accordance to IEEE 802.3 family of standards.

95. The system as in claim 90, wherein the validating confirms that the first computing subsystem is operating in compliance with at least one of digital right management rules and content management system rules.

96. The system as in claim 90, wherein the communication path is comprised of defined communications of at least one of:

a VPN, an ATM, a FR, a CPN, a content delivery network (CDN), an ISP, a shared media, a firewall, a local area network, an Internet, a metropolitan area network, a SAN, a link to application server, a link to web server, a link, to data base server, a link to Internet server, a link to network server, a public network, an enterprise network, and a carrier network.