Protecting an item of software

Patent metadata

Field	Value
Publication number	US-12277199-B2
Application number	US-202117537570-A
Country	US
Kind code	B2
Filing date	Nov 30, 2021
Priority date	Mar 28, 2014
Publication date	Apr 15, 2025
Grant date	Apr 15, 2025

Abstract

A system and method for a computer to execute an item of software. The computer executes security modules, each performing a respective security-related operation. The computer executes the item of software and, at a point during execution of the item of software at which a predetermined function is to be performed, the computer attempts to perform the predetermined function by sending, to an address system, a request message, including and identifier of the predetermined function, for an address of instructions for carrying out the predetermined function. In response to the request message, the computer receives, from the address system, an address generated by the address system based, at least in part, on (a) the identifier and (b) verification data provided to the address system from at least one of the plurality of security modules. Execution is the continued at the address received from the address system.

First claim

The invention claimed is:

1. A method for a computer to execute an item of software, the method comprising:
the computer executing a plurality of security modules, wherein each of the security modules is arranged to perform a respective security-related operation different from the respective security-related operation performed by each of the other security modules;
the computer executing the item of software, said executing the item of software comprising, at at least one point during execution of the item of software at which a predetermined function is to be performed, attempting to perform the predetermined function by:
sending, to an address system, a request message for an address of instructions for carrying out the predetermined function, the request message comprising an identifier of the predetermined function;
receiving, from the address system in response to the request message, an address generated by the address system based, at least in part, on (a) the identifier and (b) verification data provided to the address system from at least one of the plurality of security modules; and
continuing execution of the item of software at the address received from the address system.

2. The method of claim 1 , comprising the at least one of the plurality of security modules providing the verification data to the address system in response to receiving a request for the verification data from the address system.

3. The method of claim 1 , comprising the at least one of the plurality of security modules providing the verification data to the address system periodically.

4. The method of claim 1 , wherein the respective security-related operation comprises one or more of:
(a) software license processing in relation to the item of software;
(b) preventing the item of software 5 from executing on a device other than the computer;
(c) authenticating the item of software;
(d) authenticating a user of the item of software;
(e) authorizing use of the item of software;
(f) providing a countermeasure against an attack on the item of software;
(g) detecting an attack on the item of software.

5. The method of claim 1 , in which the verification data comprises one or more values dependent on a current state of at least one of the plurality of security modules.

6. The method of claim 1 , in which the verification data comprises data representing one or more properties of the computer.

7. The method of claim 1 , in which the address system executes on the computer.

8. The method of claim 6 , in which the one or more properties of the computer comprises one or both of: (a) an identification number for the computer; (b) a model type of the computer.

9. A method of facilitating execution of an item of software by a computer, the method comprising an address system performing the steps of:
receiving, from the computer, a request message for an address of instructions for carrying out a predetermined function of the item of software, the request message comprising an identifier of the predetermined function; receiving, from at least one of a plurality of security modules being
executed by the computer, verification data, wherein each of the security modules is arranged to perform a respective security-related operation different from the respective security-related operation performed by each of the other security modules;
generating an address based, at least in part, on (a) the identifier and (b) the verification data;
providing the generated address to the computer for the computer to continue execution of the item of software at the provided address.

10. The method of claim 9 , comprising:
in response to receiving the request message for the address, sending, to the at least one of the plurality of security modules, a request for the verification data.

11. The method of claim 9 , comprising receiving the verification data from the at least one of the plurality of security modules periodically.

12. The method of claim 9 , wherein the respective security-related operation comprises one or more of:
(a) software license processing in relation to the item of software;
(b) preventing the item of software from executing on a device other than the computer;
(c) authenticating the item of software;
(d) authenticating a user of the item of software;
(e) authorizing use of the item of software;
(f) providing a countermeasure against an attack on the item of software;
g) detecting an attack on the item of software.

13. The method of claim 9 , in which the verification data comprises one or more values dependent on a current state of at least one of the plurality of security modules.

14. The method of claim 9 , in which the verification data comprises data representing one or more properties of the computer.

15. The method of claim 9 , in which the address system executes on the computer.

16. The method of claim 14 , in which the one or more properties of the computer comprises one or both of: (a) an identification number for the computer; (b) a model type of the computer.

17. An apparatus comprising a processor, the processor arranged to execute an item of software by:
executing a plurality of security modules, wherein each of the security modules is arranged to perform a respective security-related operation different from the respective security-related operation performed by each of the other security modules;
executing the item of software, said executing the item of software comprising, at at least one point during execution of the item of software at which a predetermined function is to be performed, attempting to perform the predetermined function by:
sending, to an address system, a request message for an address of instructions for carrying out the predetermined function, the request message comprising an identifier of the predetermined function;
receiving, from the address system in response to the request message, an address generated by the address system based, at least in part, on (a) the identifier and (b) verification data provided to the address system from at least one of the plurality of security modules; and

continuing execution of the item of software at the address received from the address system.

18. An apparatus comprising a processor, the processor arranged to facilitate execution of an item of software by a computer by:
receiving, from the computer, a request message for an address of instructions for carrying out a predetermined function of the item of software, the request message comprising an identifier of the predetermined function;
receiving, from at least one of a plurality of security modules being executed by the computer, verification data, wherein each of the security modules is arranged to perform a respective security-related operation different from the respective security-related operation performed by each of the other security modules;
generating an address based, at least in part, on (a) the identifier and (b) the verification data;
providing the generated address to the computer for the computer to continue execution of the item of software at the provided address.

19. A non-transitory computer-readable medium storing a computer program which, when executed by one or more processors, causes the one or more processors to:
execute a plurality of security modules, wherein each of the security modules is arranged to perform a respective security-related operation different from the respective security-related operation performed by each of the other security modules;
execute t

Assignees

• Irdeto Bv

Inventors

• Krten Robert

Classifications

• G06F21/1064

  Restricting content processing at operating system level · CPC title

• G06F21/16

  Program or content traceability, e.g. by watermarking · CPC title

• G06F21/14

  against software analysis or reverse engineering, e.g. by obfuscation · CPC title

• G06F21/125 Primary

  by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code · CPC title

• G06F21/121 Primary

  Restricting unauthorised execution of programs · CPC title