Method to detect cloned software

• US 9,582,685 B2
• Filed: 11/15/2011
• Issued: 02/28/2017
• Est. Priority Date: 11/19/2010
• Status: Active Grant

• Current Assignee: Nagravision SA (Kudelski SA)
• Original Assignee: Nagravision SA (Kudelski SA)
• Inventors: Fischer, Jean-Bernard, Marcacci, Patrik, Schwarz, Christian, Wyseur, Brecht
• Primary Examiner(s): Abyaneh, Ali
• Application Number:
  US13/988,292
• Publication Number:
  US 20130312119A1
• Time in Patent Office: 1,932 Days
• Field of Search: 726/32, 726/27
• US Class Current: 1/1
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 21/1014 to tokens
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04N 21/25816 involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/42684 Client identification by a unique number or address, e.g. serial number, MAC address, socket ID network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/44236 Monitoring of piracy processes or activities protecting computer platforms against harmful, malicious or unexpected behaviour or activities using intrusion detection and counter measures G06F21/566; computer virus detection and handling G06F21/56
• CPC Class Codes: H04N 21/6334 for authorisation, e.g. by transmitting a key wireless communications network key management H04W12/04; wireless communications network access security H04W12/08
• CPC Class Codes: H04N 21/6377 directed to server one-way streaming services wherein the source is controlled by the destination H04L65/613

Abstract

Method to detect cloned software being used on a client user unit. An initialization phase comprises: defining a tag value as being equal to an initial random value, opening a new record storing the tag value and introducing the tag value into the client user unit. An operating phase comprises: preparing a client message comprising the request and a value depending on the tag value; sending the client message to the server; and checking if the tag value of the client message is correct with respect to the stored tag value. If they do not match, the requested service is denied. If they do match, the method sends a server message to the user unit; updates the tag value with a new tag value; and stores the new tag value on the server and user unit.

Claims

1. A method to detect a cloned software to be used on a client user unit communicating with a server for requesting said server to deliver media content to be played on the client user unit, by sending a request for the media content from the client user unit to the server, the server being connected to a database comprising client records, each of the client records comprising at least a tag value enabling run-time software diversity, the method comprising:

an initialization phase comprising;

defining the tag value as being equal to an initial random value;

opening a new record storing the tag value; and

introducing the tag value into the client user unit; and

an operating phase comprising the steps of;

preparing, on the client user unit side, a client message for the server comprising the request for the media content and the tag value;

sending the client message from the client user unit to the server;

performing an access condition test, on the server side, by checking whether the tag value of the client message is in the database;

denying the request when the tag value of the client message is not in the database;

when the tag value of the client message is in the database;

sending a server message to the client user unit as a response to said request, said server message comprising the requested media content;

calculating, both on the server side and on the client user unit side, a new tag value derived from a last tag value and from at least a part of the request comprised in said client message or a part of the media content comprised in said server message so that said new tag value represents a specific track of at least a partial media content usage history of a client;

updating said tag value by replacing it with said new tag value; and

storing the new tag value in the record of the database of the server and in the client user unit.

2. The method of claim 1, wherein the part used to calculate the new tag value is a timestamp.

3. The method of claim 1, wherein the client message further comprises a unique identifier assigned to the client.

4. The method of claim 1, wherein:

the initialization phase further comprises the steps of;

defining a signature function and a signature key derivation function for encrypting a digest resulting from the signature function;

sharing the definition of the signature function and the signature key derivation function between the client user unit and the server;

the operating phase further comprises the steps of;

calculating an authentication code by applying the signature function to the request and using the signature key for encrypting the digest resulting from the signature function, then performing the preparation step of the client message by preparing the client message comprising the authentication code and the request; and

testing if the authentication code received within the client message is equal to an authentication code calculated by the server by applying the same signature function to the request comprised in the client message and using the same signature key for processing the digest;

the signature key being preferably derived from the expected tag value that is stored in the server database.

5. The method of claim 4, wherein:

the initialization phase further comprises the steps of;

assigning a unique identifier to the client user unit and storing this identifier in the new record;

sharing said unique identifier between the client user unit and the server;

the operating phase further comprises the step of;

amending the preparation step of the client message by including the client unique identifier into the client message.

6. The method of claim 4, wherein the signature key is either identical to the tag value of the client user unit or derived from the tag value.

7. The method of claim 4, wherein the signature key is an unpredictable value.

8. The method of claim 1, wherein the operating phase comprises a resynchronization step amending the updating step by replacing the tag value by a new tag value equal to a new random value, then sending the new tag value to the client user unit.

9. The method of claim 1, wherein the client message and/or the tag value sent between the server and the client user unit are exchanged within a secure communication channel.

10. The method of claim 9, wherein the secure communication is obtained by encryption of at least a part of media content.

11. The method of claims 10, wherein the tag value is used to derive at least an encryption key for encrypting the media content.

12. A method to detect a cloned software to be used on a client user unit communicating with a server for requesting said server to deliver media content to be played on the client user unit, by sending a request for the media content from the client user unit to the server, the server being connected to a database comprising client records, each of the client records comprising at least a tag value enabling run-time software diversity, the method comprising:

an initialization phase comprising;

defining the tag value as being equal to an initial random value;

opening a new record storing the tag value; and

introducing the tag value into the client user unit; and

an operating phase comprising the steps of;

preparing, on the client user unit side and sending to the server, a client message comprising the request for the media content and the tag value;

(1) checking at the server whether the tag value has to be updated;

(2) when the tag value has to be updated, updating the tag value on the server and on the client user unit by;

(3) sending from the server to the client user unit an update message including an update value;

(4) calculating, both on the server side and on the client user unit side, a new tag value derived from a last tag value and from said update value;

(5) replacing the tag value with the new tag value;

(6) storing the new tag value in the record of the database of the server and the client user unit;

repeating steps 1-6 checking whether the tag value has to be updated until a check counter has reached a predetermined threshold;

(7) when the tag value does not have to be updated;

(8) sending a server message to the client user unit, as a response to the request, said server message comprising the requested media content;

(9) calculating, both on the server side and on the client user unit side, a new tag value derived from a last tag value and from at least a part of the request comprised in said client message or a part of the media content comprised in said server message so that said new tag value represents a specific track of at least a partial media content usage history of a client;

(10) replacing the tag value with the new tag value derived from the last tag value and from at least a part of the request comprised in said client message or a part of the media content comprised in said server message; and

(11) storing the new tag value derived from the last tag value and from at least a part of the request comprised in said client message or a part of the media content comprised in said server message in the record of the database of the server and in the client user unit.

13. A method to detect a cloned software to be used on a client user unit communicating with a server for requesting said server to deliver media content to be played on the client user unit, by sending a request for the media content from the client user unit to the server, the server being connected to a database comprising client records, each of the client records comprising at least a tag value enabling run-time software diversity, the method comprising:

an initialization phase comprising;

defining the tag value as being equal to an initial random value;

opening a new client record storing the tag value;

introducing the tag value into the client user unit;

assigning a unique identifier to the client user unit and storing the unique identifier in the new client record; and

sharing the unique identifier between the client user unit and the server; and

an operating phase comprising the steps of;

preparing, on the client user unit side, a client message for the server comprising the request for the media content, the client unique identifier and the tag value;

checking whether the client unique identifier included in the client message is already stored in one of the records of the database;

denying the request when the client unique identifier is not stored in one of the records of the database;

when the client unique identifier is stored in one of the records of the database;

incrementing by one unit a value of a client counter associated with the client unique identifier in a client'"'"'s record;

checking when the client counter associated with the client unique identifier reaches a predetermined threshold;

when the predetermined threshold is not met;

storing the value of the incremented client counter in the client'"'"'s record;

assigning a new unique client identifier to the client by storing, in a new record of the database, the new unique client identifier, a new tag value and a new client counter, which reaches said predetermined threshold;

sending a server message to the user unit, as a response to said request, said server message comprising the requested media content;

calculating, both on the server side and on the client user unit side, a new tag value derived from a last tag value and from at least a part of the request comprised in said client message or a part of the media content comprised in said server message so that said new tag value represents a specific track of at least a partial media content usage history of a client;

updating said tag value by replacing it with said new tag value derived from the last tag value and from at least a part of the request comprised in said client message or a part of the media content comprised in said server message; and

storing the new tag value derived from the last tag value and from at least a part of the request comprised in said client message or a part of the media content comprised in said server message in the record of the database of the server and the client user unit.