System for preventing software piracy employing multi-encrypted keys and single decryption circuit modules

• US 4,683,968 A
• Filed: 09/03/1985
• Issued: 08/04/1987
• Est. Priority Date: 09/03/1985
• Status: Expired due to Term

• Current Assignee: First Cad/Cam Incorporated
• Original Assignee: Burroughs Incorporated (Terreno Realty Corp.)
• Inventors: Nieglos, Donald J., Lehman, David B., Nolte, Stanley C., Oehler, Michael P., Appelbaum, Matthew A.
• Primary Examiner(s): Cangialoso, Salvatore
• Assistant Examiner(s): Lewis, Aaron J.
• Application Number:
  US06/771,901
• Time in Patent Office: 700 Days
• Field of Search: 178/22.08, 178/22.09, 178/22.10, 340/825.34, 235/380, 235/381, 235/382, 235/379
• US Class Current: 705/59
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]

Abstract

A system which enables a protected program to run only a selected plurality of computers includes a respective unique key Ki for each computer of the plurality, the key being triple encrypted in the form E_FK [E_Ki [E_FK [Ki]]]. A respective module is coupled to each computer of the plurality. A checker program in each computer responds to a request to use the protected program by performing a single decryption procedure E_FK^-1 on the triple encrypted key and sends the result to the module as a message. The module performs a single decryption procedure E_Ki^-1 on the message and sends that result back to the computer. The checker program receives the module'"'"'s result and performs another single decryption procedure E_FK^-1 on it to obtain key Ki. Then the checker program uses key Ki to decrypt an identifier, and proceeds with the execution of the protected program only if it is identified by the decrypted identifier.

Claims

1. A system for enabling a protected program to run on only a selected plurality of computers, comprising:

a respective triple encrypted key for each of said computers of the form E_FK [E_Ki [E_FK [Ki]]] where Ki is an unencryped key that is unique to each of said computers, E_Ki is an encryption procedure E which uses key Ki, and E_FK is the same encryption procedure E using a single fixed key FK for all of said computers;

a respective unique module coupled to each computer of said plurality for performing a decryption procedure E_Ki^-1 where Ki is unique to each module;

a checker program in each computer which responds to requests to use said protected program by performing a single decryption procedure E_FK^-1 on said triple encrypted key and sends the result to said module as a message M;

3. A system according to claim 1 wherein said checker program further includes a means for intermittently stopping the protected program'"'"'s execution to send a random number to said module, to receive a response from said module, and to continue with the execution of said protected program only if the encryption E_Ki of said response matches said random number.

5. A system according to claim 3 wherein said module is coupled to its computer via a bit serial bus.

7. A system according to claim 5 wherein said checker program further includes a means for temporarily stopping the protected program'"'"'s execution to send a random number to said module, to receive a response from said module, and to continue with the execution of said protected program only if the encryption E_Ki of said response matches said random number.

8. A system according to claim 5 wherein said key Ki is stored in a storage media in a triple encrypted form E_FK [E_Ki [E_FK [Ki]]], and said checker program includes a means for performing E_FK^-1 on the permanently stored key and sending the double encrypted result to said module.

9. A system according to claim 5 wherein said identifier is double encrypted via procedures E_FK and E_Ki.

10. A system according to claim 5 wherein said module is coupled to said computer via a bit serial bus.

2. said module being adapted to perform said single decryption procedure E_Ki^-1 on said message M and send E_Ki^-1 [M] back to said computer;

a means in said checker program for receiving E_FK^-1 [M] from said module and for performing another single decryption procedure E_FK^-1 on it to obtain key Ki;

an identifier that is encrypted with said key Ki; and

a means in said checker program for using key Ki to decrypt said identifier, and for proceeding with the execution of said protected program only if it is identified by the decrypted identifier.

4. A system according to claim 2 wherein said identifier is double encrypted via procedures E_FK and E_Ki.

6. A data processing system comprised of:

a computer having a key Ki that is unique to said computer and is at least double encrypted in the form E_Ki [E_FK [Ki]] where E_Ki is an encryption procedure E which uses key Ki, and E_FK is the same encryption procedure E using another key FK;

a module coupled to said computer for receiving said key in said double encrypted form in response to a request for said computer to run a protected program and for partially decrypting said double encrypted key to a single encrypted key E_FK [Ki];

a checker program for receiving said single encrypted key E_FK [Ki] from said module and for completing its decryption to Ki;

an identifier that is encrypted with said key Ki; and

a means in said checker program for using Ki to decrypt said identifier, and for proceeding to run said protected program only if it is identified by the decrypted identifier.

11. A data processing system of the type which includes a computer, a protected program for said computer, and a module coupled to said computer;

said system further including;

a key Ki that is unique to said computer and is double encrypted;

a means in said computer for receiving a request to use said protected program, and in response thereto, for sending said double encryted key to said module;

a means in said module for performing a decryption procedure E_Ki^-1 on said double encrypted key to obtain a single encrypted key and for sending the latter back to said computer;

a means in said computer for decrypting said single encrypted key to an unencrypted key; and

12. a means in said computer for utilizing said unencrypted key to decrypt an encrypted identifier, and for proceeding with the execution of said protected program only if the decrypted identifier has a predetermined value.