Protecting an item of software

Patent metadata

Field	Value
Publication number	US-11222096-B2
Application number	US-201415129681-A
Country	US
Kind code	B2
Filing date	Mar 28, 2014
Priority date	Mar 28, 2014
Publication date	Jan 11, 2022
Grant date	Jan 11, 2022

Abstract

A method for securely executing an item of software. One or more security modules are executed by a computer and a computer executes the item of software. The execution of the item of software includes, at at least one point during execution of the item of software at which a predetermined function is to be performed, attempting to perform the predetermined function. The attempt to perform the predetermined function including sending, to an address system, a request for an address of instructions for carrying out the predetermined function, the request including an identifier of the predetermined function; receiving, from the address system in response to the request, an address generated by the address system based, at least in part, on (a) the identifier and (b) verification data provided to the address system from at least one of the one or more security modules; and continuing execution of the item of software at the address received from the address system.

First claim

The invention claimed is:

1. A method for a computer to execute an item of software, the method comprising:
the computer executing one or more security modules;
the computer executing the item of software, said executing the item of software comprising, at at least one point during execution of the item of software at which a predetermined function is to be performed, attempting to perform the predetermined function by:
sending, to an address system, a request message for an address of instructions for carrying out the predetermined function, the request message comprising an identifier of the predetermined function;
receiving, from the address system in response to the request message, an address generated by the address system based, at least in part, on (a) the identifier and (b) verification data provided to the address system from at least one of the one or more security modules; and
continuing execution of the item of software at the address received from the address system;

wherein the verification data comprises a hash value based on a hash of one or more software portions, wherein each software portion is a respective part of the item of software or a respective part of one of the one or more security modules.

2. The method of claim 1 , comprising the at least one of the one or more security modules providing the verification data to the address system in response to receiving a request for the verification data from the address system.

3. The method of claim 1 , comprising the at least one of the one or more security modules providing the verification data to the address system periodically.

4. The method of claim 1 , in which each of the one or more security modules is arranged to perform a respective security-related operation.

5. The method of claim 1 , in which the verification data comprises one or more values dependent on a current state of at least one of the one or more security modules.

6. The method of claim 1 , in which the verification data comprises data representing one or more properties of the computer.

7. The method of claim 1 , in which the address system executes on the computer.

8. The method of claim 4 , wherein the respective security-related operation comprises one or more of:
(a) software license processing in relation to the item of software;
(b) preventing the item of software from executing on a device other than the computer;
(c) authenticating the item of software;
(d) authenticating a user of the item of software;
(e) authorizing use of the item of software;
(f) providing a countermeasure against an attack on the item of software;
(g) detecting an attack on the item of software.

9. The method of claim 6 , in which the one or more properties of the computer comprises one or both of: (a) an identification number for the computer; (b) a model type of the computer.

10. A method of facilitating execution of an item of software by a computer, the method comprising an address system performing the steps of:
receiving, from the computer, a request message for an address of instructions for carrying out a predetermined function of the item of software, the request message comprising an identifier of the predetermined function;
receiving, from at least one of one or more security modules being executed by the computer, verification data;
generating an address based, at least in part, on (a) the identifier and (b) the verification data;
providing the generated address to the computer for the computer to continue execution of the item of software at the provided address;
wherein the method further includes at least one of:
(i) in response to receiving the request message for the address, sending, to the at least one of the one or more security modules, a request for the verification data and identifying, based on the identifier, the at least one of the one or more security modules to which the request for the verification data is to be sent;
(ii) wherein generating the address comprises:
generating a hash value by performing a hash based, at least in part, on the verification data; and
combining the generated hash value with a predetermined compensation value to generate a result, wherein the address system stores the predetermined compensation value in association with the identifier;
wherein the address is generated based on the result; or

(iii) wherein the verification data comprises a hash value based on a hash of one or more software portions, wherein each software portion is a respective part of the item of software or a respective part of one of the one or more security modules.

11. The method of claim 10 , comprising receiving the verification data from the at least one of the one or more security modules periodically.

12. The method of claim 10 , wherein the address is a predetermined part of the result.

13. The method of claim 10 , wherein the address equals the result.

14. The method of claim 10 , comprising performing an error-detection operation on the result, and:
if no errors are detected in the result, then the address is generated as at least part of the result;
if at least one error is detected in the result, then the address is set to be a predetermined address.

15. The method of claim 10 , in which the hash is further based, at least in part, on the identifier.

16. The method of claim 10 , wherein combining the generated hash value with the predetermined compensation value comprises XOR-ing the generated hash value with the predetermined compensation value.

17. The method of claim 10 , in which each of the one or more security modules is arranged to perform a respective security-related operation.

18. The method of claim 10 , in which the verification data comprises one or more values dependent on a current state of at least one of the one or more security modules.

19. The method of claim 10 , in which the verification data comprises data representing one or more properties of the computer.

20. The method of claim 10 , in which the address system executes on the computer.

21. The method of claim 14 , wherein the predetermined address is arranged such that continuing execution of the item of software at the predetermined address causes the item of software to perform at least one of:
(a) ceasing execution of the item of software;
(b) providing a notification to a provider of the item of software or to another entity;
(c) preventing future execution of the item of software;
(d) ensuring that data output by the item of software is corrupted.

22. The method of claim 17 , wherein the respective security-related operation comprises one or more of:
(a) software license processing in relation to the item of software;
(b) preventing the item of software from executing on a device other than the computer;
(c) authenticating the item of software;
(d) authenticating a user of the item of software;
(e) authorizing use of the item of software;
(f) providing a countermeasure against an attack on the item of software;
(g) detecting an attack on the item of software.

23. The method of claim 19 , in which the one or more properties of the computer comprises one or both of: (a) an identification number for the computer; (b) a model type of the computer.

24. The method of claim 21 , wherein the notification comprises data identifying the computer and/or a user of the computer.

25. An apparatus comprising a processor, the processor arr

Assignees

• Irdeto Bv

Inventors

• Krten Robert

Classifications

• G06F21/125 Primary

  by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code · CPC title

• G06F21/14

  against software analysis or reverse engineering, e.g. by obfuscation · CPC title

• G06F21/121 Primary

  Restricting unauthorised execution of programs · CPC title

• G06F2221/0735

  Physics · mapped topic

• G06F2221/0737

  Physics · mapped topic