System and method for secure distributed execution

• US 8,800,032 B2
• Filed: 02/17/2011
• Issued: 08/05/2014
• Est. Priority Date: 03/16/2002
• Status: Active Grant

• Current Assignee: Marcel Mordechay Yung, Yoram Ofek
• Original Assignee: Marcel Mordechay Yung, Yoram Ofek
• Inventors: Yung, Marcel Mordechay, Ofek, Yoram
• Primary Examiner(s): Zee, Edward
• Assistant Examiner(s): TRUVAN, LEYNNA THANH
• Application Number:
  US13/030,009
• Publication Number:
  US 20110167490A1
• Time in Patent Office: 1,265 Days
• Field of Search: 713/152, 713/160, 713/168, 726 1- 6, 726/13, 726 17- 19, 726 21- 22, 726 26- 27, 380/262, 717/103, 717/126, 717/171, 717/177, 710/55
• US Class Current: 726/22
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/193 at the transport layer, e.g. TCP related
• CPC Class Codes: H04L 47/27 Evaluation or update of window size, e.g. using information derived from acknowledged [ACK] packets
• CPC Class Codes: H04L 47/283 in response to processing delays, e.g. caused by jitter or round trip time [RTT]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

This invention discloses a method and system for processing logic modules, each having a separate functionality, into a unique functionality that is to be executed in an interlocked mode as a unique functionality. The method is based on taking logic modules (programs and data) with known functionality and transforming them into a hidden program by integrating modules to execute together into a logic which is partially obfuscated and/or encrypted and/or physically hidden. The hidden program is being updated dynamically to strengthen it against reverse engineering efforts. The program includes the functionality for generating security signals, which are unpredictable by observers, such as a pseudo random sequence of security signals. Only elements that share the means for producing the security signals can check their validity. The modules include operational tasks and performance parameters for this operation. The operation can be transmission of data packets with given parameters of performance that the hidden program contains. The generated security signals thus assure that the correct operation was taken place and can be used to signal various cryptographic parameters as well.

Claims

1. A computing system, the system comprising:

a first computing subsystem;

a second computing subsystem;

a network coupling said first computing subsystem and said second computing subsystem;

wherein the second computing subsystem provides sending of a first software application operational software module comprising a user operative portion and a hidden program portion, wherein the user operative portion provides for sending data packets for controlled transmission, and, wherein the hidden program portion provides a security signal representative of the hidden program portion that is coupled to a controller for controlling coupling of the data packets to the network responsive to the hidden program portion;

wherein the user operative portion and the hidden program portion are interlocked into an integrated logic program that provides a combined functionality that is only provided by the first computing subsystem when the integrated logic program with the combined functionality is executed unchanged;

wherein the second computing subsystem provides sending of data packets to the first computing subsystem;

wherein the first computing subsystem provides means for;

(a) receiving of the data packets from the second computing subsystem, (b) utilizing the operational software module by the first computing subsystem for processing of the data packets, and (c) utilizing the operational software module by the first computing subsystem for generating security tags responsive to said processing of the data packets and sending the security tags to the second subsystem; and

wherein the second computing subsystem provides means for;

(a) receiving the security tags from the first computing subsystem, and (b) providing processing logic for validating as a successful validation that the operational software module was unchanged when utilized in generating the security tags at the first computing subsystem, and otherwise determining a failed validation if the operational software module was changed when utilized in generating the security tags at the first computing subsystem;

wherein the sending of data packets to the first computing subsystem by the second computing subsystem is controlled responsive to the validating by the processing logic.

2. The system as in claim 1, further comprising:

logic providing an initial generator state and an initial verification state;

wherein the initial generator state is utilized in the generation of the security tags at the second computing subsystem operating from the initial generator state to locally generate a sequence of security tags responsive to concurrent execution of an operational software module utilizing a sequence of content processing steps;

wherein the initial verification state is utilized to generate a sequence of comparison security tags for selective comparison to the sequence of the security tags; and

wherein the system coordinates the initial generator state and the initial verifier state prior to the execution of the operational software module.

3. The system as in claim 1, further comprising:

a transformation controller providing interlocking of the user operative portion and a hidden program portion, into a single logic program that provides a combined functionality;

wherein the combined functionality is only provided by the first computing subsystem when the single logic program with the combined functionality are executed concurrently responsive to the single logic program; and

wherein the first computing subsystem is responsive to the single logic program to provide the combined functionality at the first computing subsystem.

4. The system as in claim 1,

wherein the data packets are comprised of streaming data packets, wherein the first computing subsystem provides means for:

(a) receiving of the streaming data packets from the second computing subsystem, (b) utilizing the operational software module by the first computing subsystem for processing of the streaming data packets, and (c) utilizing the operational software module by the first computing subsystem for generating security tags responsive to said processing of the streaming data packets and sending the security tags to the second subsystem.

5. The system as in claim 4,

wherein the streaming data packets are comprised of digital media.

6. The system as in claim 1,

wherein the second computing subsystem further comprises a transmission and forwarding controller responsive to the processing logic for validating, for performing at the following:

stopping the sending of the data packets to the first computing subsystem responsive to the determining of the respective failed validation.

7. The system as in claim 1,

wherein the operational software module provides rules of processing that are defined by at least one of:

a content management subsystem, a digital right management subsystem, and predefined policy rules associated with the content.

8. The system as in claim 1, further comprising:

a defined sequence of decryption keys; and

wherein portions of the defined sequence of decryption keys are sent, one portion at a time, from the second computing subsystem to first computing subsystem, responsive to successful validation of the processing logic for validating the received security tags from the first computing subsystem.

9. The system as in claim 1,

wherein the processing of the data packets on the first computing subsystem utilizes codes and parameters defining and expressing at least one of:

privileges, authorizations, access rights, and entitlements as expressed in XrML (Extensible Rights Markup Language).

10. The system as in claim 1,

wherein selected parts of the processing of streaming data packets, and selected parts of the generating of security tags are defined as a plurality of logic modules that are interlocked to provide concurrent execution.

11. The system as in claim 1,

wherein the display device is at least one of:

an analog display, a digital display, a television, a flat panel display, a screen, a movie screen, a liquid crystal display, a solid state display, a home video system, a computer display, a CRT display, a mobile phone display, a PDA display, a three-dimensional display, a holographic display, a computer monitor, a handheld display, a digital output system, an electronic book display, and an analog output system.

12. The system as in claim 1, the system further comprising:

an update controller separate from the first computing subsystem, and providing to the first subsystem, at least one of;

updated codes, updated parameters, update decryption codes, update decryption keys, update rendering codes, update playing codes, and updated secure time stamp.

13. The system as in claim 12,

wherein the processing of the data packets on the first computing subsystem utilizes the codes and parameters received from the update controller.

14. The system as in claim 12, further comprising:

a security management server (SMS) for providing update information to the update controller.

15. The system as in claim 1,

wherein the utilizing an operational software module by the first computing subsystem for processing of the data, provides at least one of audio playing on a sound device and a video playing on a display device.

16. The system as in claim 1,

wherein the second computing subsystem is further comprised at least one of a media server, an application server, a web server, a data base server, an Internet server, a network server, a firewall, a multimedia server, a video server, and a domain name server.

17. The system as in claim 1,

wherein the network provides a defined communications path that is part of at least one of:

a VPN, an ATM, a FR, a CPN, a content delivery network (CDN), an ISP, a shared media, a firewall, a local area network, an Internet, a metropolitan area network, a SAN, a link to application server, a link to web server, a link to data base server, a link to Internet server, a link to network server, a public network, an enterprise network, and a carrier network.

18. The system as in claim 1,

wherein there is a plurality of the first computing subsystems, each coupled to the network and each receiving the data packets from the second computing subsystem, and wherein the second computing subsystem regulates distribution of the data packets to only a predefined number of the plurality of the first computing subsystems.

19. The system as in claim 1,

wherein there is a plurality of the first computing subsystems, each coupled to the network and receiving the data packets from the second computing subsystem.

20. The system as in claim 19,

wherein the second computing subsystem encodes the respective said data packets for transmission responsive to the respective successful validation of the respective received security tags from the respective one of the plurality of the first computing subsystems.

21. The system as in claim 20,

wherein the data packets are encoded such that any of the plurality of the first computing subsystems in which the validating of their security tags fail, will not thereafter be able to further decode the streaming data packets.

22. The system as in claim 19,

wherein the data packets are encrypted by the second computing subsystem by using a group encryption scheme such that any of the first computing subsystems in which the validating of their security tags fail will not be able to further decode the data packets.

23. The system as in claim 20,

wherein the data packets are sent using at least one of:

multicast, IP (Internet Protocol) multicast, Secure IP multicast, group key management architecture, multi-party non-repudiation protocol, group communications, and secure group communications.

24. The system as in claim 1,

wherein there is a plurality of second computing subsystems coupled to the network, each sending a respective plurality of streaming data packets to the first computing subsystem.

25. The system as in claim 24,

wherein there is a plurality of the first computing subsystems, each of the first computing subsystems coupled to the network, and each of the first computing subsystems receiving the data packets from at least one respective one of the second computing subsystems.

26. The system as in claim 24,

wherein the first computing subsystem sends security tags to the plurality of second computing subsystems for validation.

27. The system as in claim 1,

wherein a successful validation determines that the respective security tags were properly generated responsive to said processing of the data, and wherein a failed validation determines that the respective security tags were improperly generated responsive to said processing of the data.

28. A method for authenticating, at a second computing subsystem, a software module utilized in operation at a first computing subsystem, the method comprising:

sending of data and software modules comprised of an operational software module and an associated tag generation module to the first computing subsystem from the second computing subsystem,

wherein the operational software module and the associated tag generation module are interlocked into an integrated logic program that provides a combined functionality that is only provided by the first computing subsystem when the integrated logic program with the combined functionality is executed unchanged;

receiving and storing the data and the and software modules in the first computing subsystem;

processing the data on the first computing subsystem responsive to the operational software module of the integrated logic program;

generating security tags in the first computing subsystem responsive to the associated tag generation module of the integrated logic program concurrently executing with the operational software module;

sending the security tags to the second computing subsystem from the first computing subsystem;

processing the security tags in the second computing subsystem to determine successful validation responsive to validating that the processing of the data in the first computing subsystem was processed by the operational software module of the integrated logic program operating concurrently with the generating the security tags by the associated tag generation module of the integrated logic program, and otherwise determining a failed validation; and

adjusting communication of sending of the data responsive to the validating.

29. The method as in claim 28, wherein the associated tag generation module of the integrated logic program, will only execute properly responsive to its concurrently executing with the respective operational software module of the integrated logic program in the first computing subsystem.

30. The method as in claim 28, wherein the adjusting communication of sending of the data responsive to the validating is comprised of limiting the sending of the data to the first computing subsystem from the second computing subsystem responsive to the failed validation.

31. The method as in claim 28, wherein the adjusting communication of sending of the data responsive to the validating is comprised of stopping the sending of the data to the first computing subsystem from the second computing subsystem responsive to the failed validation.

32. The method as in claim 28, further comprising:

providing a plurality of operational software modules and parameters operable stand-alone to provide a respective plurality of subtask functions;

providing secure integration of the plurality of operational software modules and parameters and the associated tag generation module to provide a combined functionality;

interlocking the plurality of operational software modules and parameters and the associated tag generation module into a single logic program that concurrently executes the plurality of operational software modules; and

providing the combined functionality responsive to the plurality of subtask functions concurrently executing responsive to the single logic program at the first computing element.

33. A method of protected communicating of data, the method comprising:

sending data comprising operational software module comprising a user operative portion and a hidden program portion, wherein the user operative portion provides for sending data packets for controlled transmission, and, wherein the hidden program portion provides a security signal representative of the hidden program portion that is coupled to a controller for controlling coupling of the data packets to the network responsive to the hidden program portion, from a second computing subsystem to a first computing subsystem, wherein the hidden program portion and the user operative portion are interlocked into an integrated logic program that provides a combined functionality that is only provided by the first computing subsystem when the integrated logic program with the combined functionality is executed unchanged;

receiving and storing the data in the first computing subsystem;

processing of the data in the first computing subsystem according to defined rules for processing in the hidden program portion;

generating security tags responsive to execution of the defined rules for processing;

sending the security tags from the first computing subsystem to a second computing subsystem;

providing security tag validation logic in the second computing subsystem;

processing, in the second computing subsystem, the received security tags,

responsive to the security tag validation logic to provide respective validated security tags; and

processing in the second computing subsystem the validated security tags and the received security tags to determine whether the generating security tags in the first

computing subsystem were properly generated responsive to execution of the defined rules for processing at the first computing subsystem so as to validate that the defined rules of processing were unchanged at the time of execution at the first computing subsystem, wherein the sending of the data to the first computing subsystem by the second computing subsystem is controlled responsive to the determining that the security tags were properly generated at the first computing subsystem.

34. The method as in claim 33,

wherein the data is comprised of at least one of the defined rules of processing and information content.

35. The method as in claim 33,

wherein the processing of the data is comprised of processing of he information content in the first computing subsystem according to defined rules for processing.

36. The method as in claim 33,

wherein the data is at least in part representative of at least one of:

a movie, a book, a music piece, a concert, a 3D movie, a sport event, a text file, and a multimedia file;

wherein the content is divided into predefined number of parts, and wherein each of the parts is associated with a decryption key.

37. A method for authentication of integrity of software executed within a computer, the method comprising:

sending data comprising operation software comprising an operational program and an associated tag generation program from a second computing subsystem to a first computing subsystem, wherein the associated tag generation program of the operation software provides for defining rules of processing for execution on the first computer subsystem, wherein the associated tag generation program and the operational program are interlocked into an integrated logic program that provides a combined functionality that is only provided by the first computing subsystem when the integrated logic program with the combined functionality is executed unchanged;

transmitting data packets from the second computing subsystem to the first computing subsystem;

receiving the data packets for processing in the first computing subsystem;

generating security tags at the first computing subsystem responsive to the data packets and responsive to the rules of processing to validate that the operational program was operated unchanged;

sending selected ones of the security tags from the first computing subsystem to the second computing subsystem; and

processing the selected ones of the security tags in the second computing subsystem to validate that the operational program of the operation software was

unchanged when the operation software performed the processing in the first computing subsystem when operating according to the rules of processing; and

wherein the transmitting the data packets is controlled responsive to the validating the operation software was unchanged.

38. The method as in claim 37, further comprising:

validating the received security tags in the second computing subsystem responsive to second rules of processing; and

processing the received security tags in the second computing subsystem to validate execution of the operation software providing defining of the rules of processing in the first computing subsystem, to validate that the processing of the data packets in the first computing subsystem is according to the respective defined rules for processing utilizing the respective unchanged operation software.

39. A computer system providing remote authentication, the system comprising:

a second computing subsystem sending data comprising software modules comprising an operational software module comprising a user operative portion and a hidden program portion, wherein the user operative portion provides for sending data packets for controlled transmission, and, wherein the hidden program portion provides a security signal representative of the hidden program portion that is coupled to a controller for controlling coupling of the data packets to the network from a second location, responsive to the hidden program portion, wherein the hidden program portion and the user operative portion are interlocked into an integrated logic program that provides a combined functionality that is only provided by the first computing subsystem when the integrated logic program with the combined functionality is executed unchanged;

a first computing subsystem receiving and storing the data at a remote location;

processing logic within the first computing subsystem providing processing in accordance with first defined rules responsive to the hidden program of the software modules;

a tag generator at the second computing subsystem operating from an initial generator state to locally generate a sequence of security tags responsive to concurrent execution of the hidden program and the operational software module utilizing a sequence of content processing steps;

wherein the remote computing subsystem provides transmission of the sequence of security tags to the first computing subsystem;

a tag verifier at the first computing subsystem, operating from an initial verification state to generate a sequence of comparison security tags for selective comparison to the sequence of the security tags responsive to the hidden program of the software modules;

means for coordinating the initial generator state and the initial verifier state prior to the execution of the operational software module;

wherein the tag verifier selectively provides valid comparison tags responsive to the means for coordinating, and

wherein the valid comparison tags are utilized to authenticate that the operational software module was unchanged during the execution at the remote computing subsystem;

wherein the sending data is controlled responsive to the valid companion tags.

40. A system for authenticating operation by providing secure integration of separate software logic modules to provide a combined functionality, the system comprising:

a first computing subsystem for sending data comprising a plurality of software logic modules from a first location;

a second computing subsystem for receiving and storing the data at a second location;

wherein the plurality of software logic modules each are operable stand-alone to provide a respective one of a plurality of subtask functions associated with operations on a first computing subsystem;

a transformation controller providing interlocking of the plurality of software logic modules, comprised at least of a first separate operational module and a second separate operational module, into a single logic program that provides a combined functionality;

wherein the combined functionality is only provided by the first computing subsystem when the plurality of subtask functions are executed concurrently responsive to the single logic program; and

wherein the second computing subsystem is responsive to the single logic program to provide the combined functionality at the second computing subsystem and providing the subtask functions of;

(a) receiving of communicating data from the second computing subsystem responsive to the first separate operational module within the single logic program, and providing processing of the data responsive to defined rules for processing of the data, and (b) generation of security tags responsive to the second separate operational module within the single logic program and selectively sending of the security tags to the first computing subsystem from the second computing subsystem;

and,

validation logic verifying the combined functionality and that the first separate operational software module for receiving of the data executed unchanged and concurrently with execution of the second separate software logic module while the second separate software logic module is generating the security tags;

wherein the sending of the data is controlled responsive to verifying the combined functionality.

41. The system as in claim 40,

wherein the second computing subsystem is responsive to the single logic program to provide the combined functionality at the first computing subsystem and providing the subtask functions of:

(a) receiving of streaming data packet from a media server associated with the second computing subsystem responsive to the first separate operational module within the single logic program, and providing processing of the streaming data packets responsive to defined rules for processing of the streaming data packets, and (b) generation of security tags responsive to the second separate operational module within the single logic program and selectively sending of the security tags to said media server associated with the first computing subsystem, wherein the combined functionality assures that the first separate operational software module for receiving of data packets executes concurrently with the second separate software logic module generating security tags.

42. The system as in claim 40, wherein one of the software logic modules within the single logic program provides logic to process content of the streaming data packets.

43. The system as in claim 42, wherein logic to process the content performs at least one of:

video rendering on a video display, playing audio via audio speakers, displaying an image representative of the data on an e-book output device, outputting the data to a digital output device, and outputting a signal representative of the data to an analog output device.

44. The system as in claim 40, wherein one of the software logic modules in the single logic program provides rules of playing of audio and video content.

45. The system as in claim 44,

wherein the rules of playing of audio and video content ensure at least one of:

the content is not printed;

the content is not sent to a third party;

the content is destroyed after being displayed on a video monitor;

the content is being destroyed after being played via an audio speakers;

the content is erased from all memory storage devices after being displayed on a video monitor;

the content is erased from all memory storage devices after being played via an audio speakers;

the content is erased from all memory storage devices after being used via an e-book output device;

the content is erased from all memory storage devices after a predefined time interval;

the content is erased from all memory storage devices at a time defined time by coordinated universal time (UTC);

the content is used in accordance with rights defined using XrML (Extensible Rights Markup Language) specifications;

the content is used in accordance with trusted computing specifications;

the content is used in accordance with trusted computing based principles; and

the content is used in accordance with at least one of the following;

watermarking information, stenographic information, fingerprinting information, embedded data and digital signature information.

46. The system as in claim 44,

wherein the rules of playing provide at least one of:

data processing and determining a renewable software for data processing.

47. The system as in claim 46,

wherein the renewable software for data processing controls at least one of:

a number of times a representation of the data can be displayed, a number of times a representation of the data can be utilized to provide a presentation, a number of times the representation of the data can be played, a number of times that the data can be reproduced, a time signal, a UTC time signal, a digitally signed time signal, a software element, a predefined task, a code for processing data signature, and a code for watermarking the data.

48. A method of providing controlled signaling, the method comprising:

sending data comprising software modules comprising an operational software module comprising a user operative portion and a hidden program portion, wherein the user operative portion provides for sending data packets for controlled transmission, and, wherein the hidden program portion provides a security signal representative of the hidden program portion that is coupled to a controller for controlling coupling of the data packets to the network responsive to the hidden program portion from a first computing device at a first location, wherein the hidden program portion and the user operative portion are interlocked into an integrated logic program that provides a combined functionality that is only provided by the first computing subsystem when the integrated logic program with the combined functionality is executed unchanged;

receiving and storing the data at the remote computing device at a remote node location;

receiving data from a first computing subsystem;

processing of the data on the first computing subsystem, in accordance with defined rules in the first computing subsystem, responsive to the operational software of the software modules;

generating a security tag responsive to the processing in accordance with the defined rules in the first computing subsystem, responsive to the hidden program portion of the software modules;

transmitting at least the security tag to the second computing subsystem; and

,

validating the security tag on the second computing subsystem responsive to determining that the defined rules were unchanged when the security tag was generated in accordance with the processing of the data on the first computing subsystem,

wherein the sending data is controlled responsive to the validating.

49. The method as in claim 48,

wherein the data is comprised of streaming data packets sent from a media server.

50. The method as in claim 49, further comprising:

receiving selected parts of the defined rules on the first computing subsystem from a separate rules controller.

51. The method as in claim 49,

wherein the validating confirms that the first computing subsystem is operating in compliance with at least one of digital right management rules and content management system rules.