Architecture, system, and method for operating on encrypted and/or hidden information

• US 8,335,930 B2
• Filed: 09/25/2009
• Issued: 12/18/2012
• Est. Priority Date: 11/20/2003
• Status: Active Grant

• Current Assignee: Andrew Morgan, H. Peter Anvin, Linus Torvalds, Richard C. Johnson
• Original Assignee: Andrew Morgan, H. Peter Anvin, Linus Torvalds, Richard C. Johnson
• Inventors: Johnson, Richard C., Morgan, Andrew, Anvin, H. Peter, Torvalds, Linus
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US12/567,519
• Publication Number:
  US 20100017625A1
• Time in Patent Office: 1,180 Days
• Field of Search: 713/189, 713/190, 713/172, 713/193, 709213-214, 709/203, 370/337, 382/100, 380/281, 712/220, 711/147, 711/170, 711/173
• US Class Current: 713/190
• CPC Class Codes: G06F 12/1416 by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights G06F12/1458 takes precedence
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

An architecture, system and method for operating on encrypted and/or hidden information (e.g., code and/or data). The invention enables creators, owners and/or distributors of proprietary code to keep such code inaccessible to users and user-controlled software programs. A memory architecture includes first and second protected memory spaces, respectively storing operating system instructions and a decrypted version of the encrypted information. The first protected memory space may further store a table linking the locations of the encrypted and/or hidden, decrypted information with a decryption and/or authorization key. The system includes the memory architecture and a processor for executing instructions, and the method loads, stores and operates on the encrypted and/or hidden information according to the memory architecture functionality and/or constraints.

Claims

1. A memory comprising:

an unprotected memory portion operable to store encrypted information; and

a protected memory portion operable to store an unencrypted form of said encrypted information, wherein said unencrypted form of said encrypted information is usable by an instruction if said instruction is at least one of predetermined instruction types stored in an encrypted form in said unprotected memory portion and if said instruction successfully passes an authorization procedure that uses a memory location of said encrypted form of said instruction in said unprotected memory portion.

2. The memory of claim 1, wherein said instruction is stored in said protected memory portion.

3. The memory of claim 1, further comprising an authorization key associated with said encrypted information, wherein said authorization key associated with said encrypted information is used by said authorization procedure.

4. The memory of claim 1, wherein said protected memory portion is further operable to store an authorization key associated with said encrypted information, and wherein said protected memory portion is further operable to store a pointer that points to a location of said unencrypted form of said encrypted information in said protected memory portion if said instruction successfully passes said authorization procedure.

5. The memory of claim 1, wherein said instruction is an operating system instruction.

6. The memory of claim 1, wherein said unencrypted form of said encrypted information is invisible to said unprotected memory portion, and wherein said unencrypted form of said encrypted information is further invisible to un-translated controlled processes.

7. The memory of claim 1, further comprising a page that is associated with said instruction in said unprotected memory portion, wherein said authorization procedure includes a comparison of a hash result with an expected hash result, and wherein said hash result represents a result of hashing at least a portion of said page.

8. A system comprising:

a processor; and

a memory comprising;

an unprotected memory portion configured to store encrypted information; and

a protected memory portion configured to store an unencrypted version of said encrypted information, wherein said processor is configured to execute an instruction to use said unencrypted version of said encrypted information if said instruction is at least one of predetermined instruction types stored in an encrypted form in said unprotected memory portion and if said instruction successfully passes an authorization procedure that uses a memory location of said encrypted form of said instruction in said unprotected memory portion.

9. The system of claim 8, wherein said instruction is stored in said protected memory portion.

10. The system of claim 8 further comprising an authorization key associated with said encrypted information, wherein said authorization key associated with said encrypted information is used by said authorization procedure.

11. The system of claim 8, wherein said protected memory portion is further operable to store an authorization key associated with said encrypted information, and wherein said protected memory portion is further operable to store a pointer that points to a location of said unencrypted version of said encrypted information in said protected memory portion if said instruction successfully passes said authorization procedure.

12. The system of claim 8, wherein said instruction is an operating system instruction.

13. The system of claim 8, wherein said unencrypted version of said encrypted information is invisible to said unprotected memory portion, and wherein said unencrypted version of said encrypted information is further invisible to un-translated controlled processes.

14. The system of claim 8, further comprising a page that is associated with said instruction in said unprotected memory portion, wherein said authorization procedure includes a comparison of a hash result with an expected hash result, and wherein said hash result represents a result of hashing at least a portion of said page.

15. A method comprising:

storing encrypted information in an unprotected memory portion; and

storing an unencrypted version of said encrypted information in a protected memory portion, wherein said unencrypted version of said encrypted information is usable by an instruction if said instruction is at least one of predetermined instruction types stored in an encrypted form in said unprotected memory portion and if said instruction successfully passes an authorization procedure that uses a memory location of said encrypted form of said instruction in said unprotected memory portion.

16. The method of claim 15 further comprising:

performing said authorization procedure on said instruction.

17. The method of claim 16, wherein said performing comprises:

hashing at least a portion of a page that is associated with said instruction in said unprotected memory portion; and

comparing a result of said hashing with an expected result, wherein said instruction successfully passes said authorization procedure if said result matches said expected result.

18. The method of claim 15 further comprising:

decrypting said encrypted information to form said unencrypted version of said encrypted information.

19. The method of claim 15, further comprising:

using an authorization key associated with said encrypted information in said authorization procedure.

20. The method of claim 15 further comprising:

pointing to a location of said unencrypted version of said encrypted information in said protected memory portion if said instruction successfully passes said authorization procedure.