|
Software Patent Abstract
The invention concerns a process to protect a vulnerable software
working on a data processing system against its unauthorized usage
using a processing and memorizing unit. The process comprises creating
a protected software by choosing in the source of the vulnerable
software at least one algorithmic processing and by producing the
source of the protected software so that during the execution of
the protected software appear several distinct steps, namely 1)
the placing of at least one operand at the processing and memorizing
unit's disposal 2) the carrying out by the processing and memorizing
unit, of the algorithmic processing's functionality on at least
said operand 3) and possibly, the placing at the data processing
system's disposal of at least one result by the processing and memorizing
unit.
Software Patent Claims
1. A method to protect software comprising: storing a first portion
of the software on a first unit, the first unit comprising a memory
and a processor; storing a second portion of the software on a second
unit, the second unit comprising a secure processor and a secure
memory, where the second portion of the software is secret and the
first and second portions of the software forming a single program;
and executing the single formed program by utilizing the first and
second portions of the software, wherein the secret second portion
of the software comprises at least two computing operations, and
wherein portions of the at least two computing operations are interleaved
with each other for transmission from the second unit to the first
unit and vise versa.
2. The method of claim 1, wherein portions of the second portion
of the software are executed by the secure processor and the first
portion of the software is executed by the processor of the first
unit.
3. The method of claim 1, wherein: the at least two computing operations
stored in the second unit comprise a first computing operation and
a second computing operation, the first computing operation uses
a first variable to obtain a first result variable, the second computing
operation uses a second variable to obtain a second result, during
the execution of the program: performing a first variable movement
by moving the first variable from the first unit into the second
unit, performing a second variable movement by moving the second
variable from the first unit into the second unit, performing a
first result movement by moving the first result variable from the
second unit into the first unit, and performing a second result
movement by moving the second result variable from the second unit
into the first unit, each of said first and second variable movements,
said first and second computing operations, and said first and second
result movements comprise an operation, the first variable movement,
the first result movement, and the first computing operation comprise
a first set of operations and the second variable movement, the
second result movement and the second computing operation comprises
a second set of operations, and at least one operation of one of
the sets is interleaved with the operations of the other set.
4. The method according to claim 1, wherein the second unit is
a chip medium configured to attach and detach to the first unit.
5. The method according to claim 1, wherein the processor of the
second unit is a coprocessor of the processor of the first unit.
6. The method according to claim 1, wherein the second unit is
a token.
7. The method according to claim 1, wherein, when the second unit
is missing, the program cannot be executed correctly and the software
is not completely functional.
8. The method according to claim 1, wherein, when the at least
one variable is not provided by the second unit upon request, the
program is not executed correctly.
9. The method according to claim 1, wherein the at least two computing
operations are elementary functions.
10. The method according to claim 1, further comprising: storing
elementary functions that are to be executed in the second unit;
and providing commands from the first unit to the second unit to
trigger execution of a respective elementary function.
11. The method according to claim 1, further comprising: defining
instructions set in which instructions work with registers and use
at least one operand for returning a result, wherein at least some
of the instructions comprise: a part defining functionality of the
instruction, a part defining expected chaining for execution of
the instruction and comprising bits fields corresponding to an identification
field of the instruction, wherein each of the at least one operand
comprises: a flag field and an expected identification field, wherein,
for each register used by the instructions set, providing a generated
identification field in which the identification of the last instruction
which has returned its result in a respective register is automatically
memorized, wherein, during the execution of an instruction, for
each operand, when required by the flag field, checking the equality
of the generated identification field corresponding to the register
used by said operand, and the expected identification field of the
origin of said operand, and modifying the result of the instructions,
if at least one of the checked equalities is false.
12. The method according to claim 1, further comprising selecting
a part of the software to form the second portion during operation
of creating the protected program.
13. A system to protect software comprising: a first unit comprising
a memory and a processor and which stories a first portion of the
software; and a second unit comprising a secure processor and a
secure memory and which stores a second portion of the software,
wherein the second portion of the software is secret, wherein the
first and second portions of the software form a single program,
wherein the processor executes the single formed program utilizing
the second unit, wherein the secret second portion of the software
comprises at least two computing operations, and wherein portions
of the at least two computing operations are interleaved with each
other for transmission from the second unit to the first unit and
vise versa.
14. The system according to claim 13, wherein the second unit is
a chip medium configured to attach and detach to the first unit.
15. The system according to claim 13, wherein the processor of
the second unit is a coprocessor of the processor of the first unit.
16. The system according to claim 13, wherein the second unit is
a token.
17. A method to protect software comprising: storing a first portion
of the software on a first unit, wherein the first unit comprises
a memory and a processor; storing a second portion of the software
comprising a first and second computing operations on a second unit,
the second unit comprising a secure processor and a secure memory,
where the second portion of the software is secret, and where the
first and second portions of the software form a single program;
and executing the program, wherein, operations performed during
the execution comprise: transmitting from the first portion of the
software first input for the first computing operation and second
input for the second computing operation to the second unit, said
first and second computing operations are executed in the second
unit, transmitting by the second unit results from the first and
second computing operations to the first unit, and wherein operations
related to the first computing operation are interleaved with operations
related to the second computing operations.
Software Patent Description
BACKGROUND OF THE INVENTION
[0001] This invention concerns the technical domain of data processing
systems in the general sense, and is more precisely aimed at the
means of protecting software running on said data processing systems
against unauthorized usage.
[0002] The subject of the invention aims in particular at the means
of protecting software against unauthorized usage, using a processing
and memorizing unit, such a unit being commonly materialized by
a chip card or a material key on USB port.
[0003] In the technical domain above, the main problem concerns
the unauthorized usage of software by users who have not paid the
license rights. This illicit use of software causes an obvious loss
for software editors, software distributors and/or any person integrating
such software in products. To avoid such illicit copies, various
solutions, in the state of technology, have been proposed to protect
software.
[0004] Thus, a protection solution is known, which makes use of
a hardware protection system, such as a physical component named
protection key or "dongle". Such a protection key should
guarantee that the software executes only in presence of the key.
Yet, it must be acknowledged that this solution is ineffective because
it presents the inconvenience of being easy to bypass. An ill-intentioned
person or a hacker can, with the aid of specialized tools such as
disassemblers, delete the control instructions of the protection
key. It becomes then possible to make illicit copies corresponding
to modified versions of the software able to run without the protection.
Moreover, this solution cannot be generalized to all software, inasmuch
as it is difficult to connect more than two protection keys to the
same system.
BRIEF SUMMARY OF THE INVENTION
[0005] The subject of the invention aims precisely at finding a
solution to the aforementioned problems by proposing a process to
protect a software against unauthorized usage, using an ad hoc processing
and memorizing unit, inasmuch as the presence of such a unit is
necessary for the software to be completely functional.
[0006] So as to reach such a goal, the subject of the invention
concerns a process to protect, using at least one blank unit including
at least processing means and memorization means, a vulnerable software
against its unauthorized usage, said vulnerable software being produced
from a source and working on a data processing system. The process
according to the invention comprises: [0007] .fwdarw. in a protection
phase: [0008] creating a protected software: [0009] by choosing,
at least one algorithmic processing which, during the execution
of the vulnerable software, uses at least one operand and enables
to obtain at least one result, [0010] by choosing at least one portion
of the source of the vulnerable software containing, at least one
chosen algorithmic processing, [0011] by producing a source of the
protected software from the source of the vulnerable software, by
modifying at least one chosen portion of the source of the vulnerable
software to obtain at least one modified portion of the source of
the protected software, this modification being such that: [0012]
during the execution of the protected software a first execution
part is executed in the data processing system and a second execution
part is executed in a unit, obtained from the blank unit after upload
of information, [0013] the second execution part executes at least
the functionality of at least one chosen algorithmic processing,
[0014] at least one chosen algorithmic processing is split so that
during the execution of the protected software appear by means of
the second execution part, several distinct steps, namely: [0015]
the placing of at least one operand at the unit's disposal, [0016]
the carrying out by the unit, of the algorithmic processing's functionality
on at least said operand, [0017] and possibly, the placing at the
data processing system's disposal of at least one result by the
unit, [0018] for at least one chosen algorithmic processing, steps
commands are defined so that during the execution of the protected
software, each step command is executed by the first execution part
and triggers, in the unit, the execution by means of the second
execution part, of a step, [0019] and a sequence of the steps commands
is chosen among the set of sequences allowing the execution of the
protected software, [0020] and by producing: [0021] a first object
part of the protected software, from the source of the protected
software, said first object part being such that during the execution
of the protected software, appears a first execution part which
is executed in the data processing system and whose at least a portion
takes into account that the steps commands are executed according
to the chosen sequence, [0022] and a second object part of the protected
software, said second object part being such that, after being uploaded
to the blank unit and during the execution of the protected software,
appears the second execution part by means of which the steps triggered
by the first execution are executed. [0023] and uploading the second
object part to the blank unit, with the intention of obtaining the
unit, [0024] .fwdarw. and during a usage phase during which is executed
the protected software: [0025] in the presence of the unit and each
time a step command contained in a portion of the first execution
part imposes it, executing the corresponding step in the unit, so
that said portion is executed correctly and that, consequently,
the protected software is completely functional, [0026] and in the
absence of the unit, in spite of the request by a portion of the
first execution part to trigger the execution of a step in the unit,
not being able to fulfill said request correctly, so that at least
said portion is not executed correctly and that, consequently the
protected software is not completely functional.
[0027] According to a preferred embodiment, the process according
to the invention comprises: [0028] .fwdarw. during the protection
phase: [0029] modifying the protected software: [0030] by choosing
at least one variable used in at least one chosen algorithmic processing,
which during the execution of the protected software, partially
defines the state of the protected software, [0031] by modifying
at least one chosen portion of the source of the protected software,
this modification being such that during the execution of the protected
software, at least one chosen variable or at least one copy of chosen
variable resides in the unit, [0032] and by producing: [0033] the
first object part of the protected software, said first object part
being such that during the execution of the protected software,
at least one portion of the first execution part takes also into
account that at least one variable or at least one copy of variable
resides in the unit, [0034] and the second object part of the protected
software, said second object part being such that, after upload
to the unit and during the execution of the protected software,
appears the second execution part by means of which at least one
chosen variable, or at least one copy of chosen variable resides
too in the unit, [0035] .fwdarw. and during the usage phase: [0036]
in the presence of the unit each time a portion of the first execution
part imposes it, using a variable or a copy of variable residing
in the unit, so that said portion is executed correctly and that,
consequently, the protected software is completely functional, [0037]
and in the absence of the unit, in spite of the request by a portion
of the first execution part to use a variable or a copy of variable
residing in the unit, not being able to fulfill said request correctly,
so that at least said portion is not executed correctly and that,
consequently the protected software is not completely functional.
[0038] According to another preferred embodiment, the process according
to the invention comprises: [0039] .fwdarw. during the protection
phase: [0040] defining: [0041] a set of elementary functions whose
elementary functions are liable to be executed in the unit, [0042]
and a set of elementary commands for said set of elementary functions,
said elementary commands being liable to be executed in the data
processing system and to trigger the execution in the unit, of the
elementary functions, [0043] constructing exploitation means enabling
the unit to execute the elementary functions of said set, the execution
of said elementary functions being triggered by the execution in
the data processing system, of the elementary commands, [0044] and
modifying the protected software: [0045] by modifying at least one
chosen portion of the source of the protected software, this modification
being such that: [0046] at least one step is split so that during
the execution of the protected software, said step is executed by
means of the second execution part, using elementary functions,
[0047] for at least one split step, elementary commands are integrated
to the source of the protected software, so that during the execution
of the protected software, each elementary command is executed by
the first execution part and triggers in the unit, the execution
by means of the second execution part, of an elementary function,
[0048] and a sequence of the elementary commands is chosen among
the set of sequences allowing the execution of the protected software,
[0049] and by producing: [0050] the first object part of the protected
software, said first object part being such that during the execution
of the protected software, at least one portion of the first execution
part also executes the elementary commands according to the chosen
sequence, [0051] and the second object part of the protected software
also containing the exploitation means, said second object part
being such that, after upload to the unit and during the execution
of the protected software, appears the second execution part by
means of which are also executed the elementary functions triggered
by the first execution part, [0052] .fwdarw. and during the usage
phase: [0053] in the presence of the unit and each time an elementary
command contained in a portion of the first execution part imposes
it, executing the corresponding elementary function in the unit,
so that said portion is executed correctly and that, consequently,
the protected software is completely functional, [0054] and in the
absence of the unit, in spite of the request by a portion of the
first execution part, to trigger the execution of an elementary
function in the unit, not being able to fulfill said request correctly,
so that at least said portion is not executed correctly and that,
consequently, the protected software is not completely functional.
[0055] According to another preferred embodiment, the process according
to the invention comprises: [0056] .fwdarw. during the protection
phase: [0057] defining: [0058] at least one software execution characteristic,
liable to be monitored at least in part in the unit, [0059] at least
one criterion to abide by for at least one software execution characteristic,
[0060] detection means to implement in the unit and enabling to
detect that at least one software execution characteristic does
not abide by at least one associated criterion, [0061] and coercion
means to implement in the unit and enabling to inform the data processing
system and/or modify the execution of a software, when at least
one criterion is not abided by, [0062] constructing the exploitation
means enabling the unit, to also implement the detection means and
the coercion means, [0063] and modifying the protected software:
[0064] by choosing at least one software execution characteristic
to monitor, among the software execution characteristics liable
to be monitored, [0065] by choosing at least one criterion to abide
by for at least one chosen software execution characteristic, [0066]
by choosing in the source of the protected software, elementary
functions for which at least one chosen software execution characteristic
is to be monitored, [0067] by modifying at least one chosen portion
of the source of the protected software, this modification being
such that during the execution of the protected software, at least
one chosen execution characteristic is monitored by means of the
second execution part, and the fact that a criterion is not abided
by leads to the data processing system being informed and/or to
a modification of the execution of the protected software, [0068]
and by producing the second object part of the protected software
containing the exploitation means also implementing the detection
means and the coercion means, said second object part being such
that, after upload to the unit and during the execution of the protected
software, at least one software execution characteristic is monitored
and the fact that a criterion is not abided by leads to the data
processing system being informed and/or to a modification of the
execution of the protected software, [0069] .fwdarw. and during
the usage phase: [0070] in the presence of the unit: [0071] as long
as all the criteria corresponding to all the monitored execution
characteristics of all the modified portions of the protected software
are abided by, enabling said portions of the protected software
to work nominally and consequently enabling the protected software
to work nominally, [0072] and if at least one of the criteria corresponding
to a monitored execution characteristic of a portion of the protected
software is not abided by, informing the data processing system
of it and/or modifying the functioning of the portion of the protected
software, so that the functioning of the protected software is modified.
[0073] According to a variant embodiment, the process according
to the invention comprises: [0074] .fwdarw. during the protection
phase: [0075] defining: [0076] as software execution characteristic
liable to be monitored, a variable of measurement of the usage of
a functionality of a software, [0077] as criterion to abide by,
at least one threshold associated to each variable of measurement,
[0078] and actualization means enabling to update at least one variable
of measurement, [0079] constructing the exploitation means enabling
the unit to also implement the actualization means, [0080] and modifying
the protected software: [0081] by choosing as software execution
characteristic to monitor, at least one variable of measurement
of the usage of at least one functionality of a software, [0082]
by choosing: [0083] at least one functionality of the protected
software whose usage is liable to be monitored using a variable
of measurement, [0084] at least one variable of measurement used
to quantify the usage of said functionality, [0085] at least one
threshold associated to a chosen variable of measurement corresponding
to a limit of usage of said functionality, [0086] and at least one
method of update of a chosen variable of measurement depending on
the usage of said functionality, [0087] and by modifying at least
one chosen portion of the source of the protected software, this
modification being such that, during the execution of the protected
software, the variable of measurement is actualized by means of
the second execution part depending on the usage of said functionality,
and at least one threshold crossing is taken into account, [0088]
.fwdarw. and during the usage phase, in the presence of the unit,
and in the case where at least one threshold crossing corresponding
to at least one limit of usage is detected, informing the data processing
system of it and/or modifying the functioning of the portion of
the protected software, so that the functioning of the protected
software is modified.
[0089] According to a variant embodiment, the process according
to the invention comprises: [0090] .fwdarw. during the protection
phase: [0091] defining: [0092] for at least one variable of measurement,
several associated thresholds, [0093] and different coercion means
corresponding to each of said thresholds, [0094] and modifying the
protected software: [0095] by choosing in the source of the protected
software, at least one chosen variable of measurement to which must
be associated several thresholds corresponding to different limits
of usage of the functionality, [0096] by choosing at least two thresholds
associated to the chosen variable of measurement, [0097] and by
modifying at least one chosen portion of the source of the protected
software, this modification being such that, during the execution
of the protected software, the crossings of the various thresholds
are taken into account differently, by means of the second execution
part, [0098] .fwdarw. and during the usage phase: [0099] in the
presence of the unit: [0100] in the case where the crossing of a
first threshold is detected, enjoining the protected software not
to use the corresponding functionality anymore, [0101] and in the
case where the crossing of a second threshold is detected, making
ineffective the corresponding functionality and/or at least one
portion of the protected software.
[0102] According to a variant embodiment, the process according
to the invention comprises: [0103] .fwdarw. during the protection
phase: [0104] defining refilling means enabling to credit at least
one software functionality monitored by a variable of measurement
with at least one additional usage, [0105] constructing the exploitation
means also allowing the unit to implement the refilling means, [0106]
and modifying the protected software: [0107] by choosing in the
source of the protected software, at least one chosen variable of
measurement enabling to limit the usage of a functionality and which
must be able to be credited with at least one additional usage,
[0108] and by modifying at least one chosen portion, this modification
being such that during a phase called of refilling, at least one
additional usage of at least one functionality corresponding to
a chosen variable of measurement can be credited, [0109] .fwdarw.
and during the phase of refilling: [0110] reactualizing at least
one chosen variable of measurement and/or at least one associated
threshold, so as to allow at least one additional usage of the functionality.
[0111] According to a variant embodiment, the process according
to the invention comprises: [0112] .fwdarw. during the protection
phase: [0113] defining: [0114] as software execution characteristic
liable to be monitored, a profile of software usage, [0115] and
as criterion to abide by, at least one feature of software execution,
[0116] and modifying the protected software: [0117] by choosing
as software execution characteristic to monitor at least one profile
of software usage, [0118] by choosing at least one feature of execution
by which at least one chosen profile of usage must abide, [0119]
and by modifying at least one chosen portion of the source of the
protected software, this modification being such that, during the
execution of the protected software, the second execution part abides
by all the chosen features of execution, [0120] .fwdarw. and during
the usage phase in the presence of the unit, and in the case where
it is detected that at least one feature of execution is not abided
by, informing the data processing system of it and/or modifying
the functioning of the portion of the protected software, so that
the functioning of the protected software is modified.
[0121] According to a variant embodiment, the process according
to the invention comprises: [0122] .fwdarw. during the protection
phase: [0123] defining: [0124] an instructions set whose instructions
are liable to be executed in the unit, [0125] a set of instructions
commands for said instructions set, said instructions commands being
liable to be executed in the data processing system and to trigger
in the unit the execution of the instructions, [0126] as profile
of usage, the chaining of the instructions, [0127] as feature of
execution, an expected chaining for the execution of the instructions,
[0128] as detection means, means enabling to detect that the chaining
of the instructions does not correspond to the expected one, [0129]
and as coercion means, means enabling to inform the data processing
system and/or to modify the functioning of the portion of protected
software when the chaining of the instructions does not correspond
to the expected one, [0130] constructing the exploitation means
also enabling the unit to execute the instructions of the instructions
set, the execution of said instructions being triggered by the execution
in the data processing system, of the instructions commands, [0131]
and modifying the protected software: [0132] by modifying at least
one chosen portion of the source of the protected software: [0133]
by transforming the elementary functions into instructions, [0134]
by specifying the chaining by which must abide at least some of
the instructions during their execution in the unit, [0135] and
by transforming the elementary commands into instructions commands
corresponding to the instructions used, [0136] .fwdarw. and during
the usage phase, in the presence of the unit, in the case where
it is detected that the chaining of the instructions executed in
the unit does not correspond to the expected one, informing the
data processing system of it and/or modifying the functioning of
the portion of the protected software, so that the functioning of
the protected software is modified.
[0137] According to a variant embodiment, the process according
to the invention comprises: [0138] .fwdarw. during the protection
phase: [0139] defining: [0140] as instructions set, an instructions
set whose at least some instructions work with registers and use
at least one operand with the intention of returning a result, [0141]
for at least some of the instructions working with registers: [0142]
a part defining the functionality of the instruction, [0143] and
a part defining the expected chaining for the execution of the instructions
and including bits fields corresponding to: [0144] an identification
field of the instruction, [0145] and for each operand of the instruction:
[0146] a flag field, [0147] and an expected identification field
of the operand, [0148] for each register belonging to the exploitation
means and used by the instructions set, a generated identification
field in which is automatically memorized the identification of
the last instruction which has returned its result in said register,
[0149] as detection means, means enabling, during the execution
of an instruction, for each operand, when the flag field imposes
it, to check the equality of the generated identification field
corresponding to the register used by said operand, and the expected
identification field of the origin of said operand, [0150] and as
coercion means, means enabling to modify the result of the instructions,
if at least one of the checked equalities is false.
[0151] According to another preferred embodiment, the process according
to the invention comprises: [0152] .fwdarw. during the protection
phase: [0153] defining: [0154] as a triggering command, an elementary
command or an instruction command, [0155] as a dependent function,
an elementary function or an instruction, [0156] as an order, at
least one argument for a triggering command, corresponding at least
in part to the information transmitted by the data processing system
to the unit, so as to trigger the execution of the corresponding
dependent function, [0157] a method of renaming of the orders enabling
to rename the orders so as to obtain triggering commands with renamed
orders, [0158] and restoring means designed to be used in the unit
during the usage phase, and enabling to restore the dependent function
to execute, from the renamed order, [0159] constructing exploitation
means enabling the unit to also implement the restoring means, [0160]
and modifying the protected software: [0161] by choosing in the
source of the protected software, triggering commands, [0162] by
modifying at least one chosen portion of the source of the protected
software by renaming the orders of the chosen triggering commands,
so as to conceal the identity of the corresponding dependent functions,
[0163] and by producing: [0164] the first object part of the protected
software, said first object part being such that during the execution
of the protected software, the triggering commands with renamed
orders are executed, [0165] and the second object part of the protected
software containing the exploitation means also implementing the
restoring means, said second object part being such that, after
upload to the unit and during the execution of the protected software,
the identity of the dependent functions whose execution is triggered
by the first execution part is restored by means of the second execution
part, and the dependent functions are executed by means of the second
execution part, [0166] .fwdarw. and during the usage phase: [0167]
in the presence of the unit and each time a triggering command with
renamed order, contained in a portion of the first execution part
imposes it, restoring in the unit, the identity of the corresponding
dependent function and executing it, so that said portion is executed
correctly and that, consequently, the protected software is completely
functional, [0168] and in the absence of the unit, in spite of the
request by a portion of the first execution part, to trigger the
execution of a dependent function in the unit, not being able to
fulfill said request correctly, so that at least said portion is
not executed correctly and that, consequently, the protected software
is not completely functional.
[0169] According to a variant embodiment, the process according
to the invention comprises: [0170] .fwdarw. during the protection
phase: [0171] defining for at least one dependent function, a family
of dependent functions algorithmically equivalent, but triggered
by triggering commands whose renamed orders are different, [0172]
and modifying the protected software: [0173] by choosing, in the
source of the protected software at least one triggering command
with renamed order, [0174] and by modifying at least one chosen
portion of the source of the protected software by replacing at
least the renamed order of one chosen triggering command with renamed
order, with another renamed order, triggering a dependent function
of the same family.
[0175] According to a variant embodiment, the process according
to the invention comprises: [0176] .fwdarw. during the protection
phase, defining, for at least one dependent function, a family of
algorithmically equivalent dependent functions: [0177] by concatenating
a field of noise to the information defining the functional part
of the dependent function to execute in the unit, [0178] or by using
the identification field of the instruction and the expected identification
fields of the operands.
[0179] According to a variant embodiment, the process according
to the invention comprises: [0180] .fwdarw. during the protection
phase: [0181] defining: [0182] as method of renaming of the orders,
a ciphering method to cipher the orders, [0183] and as restoring
means, means implementing a deciphering method to decipher the renamed
orders and thus restore the identity of the dependent functions
to execute in the unit.
[0184] According to another preferred embodiment, the process according
to the invention comprises: [0185] .fwdarw. during the protection
phase: [0186] modifying the protected software: [0187] by choosing,
in the source of the protected software, at least one conditional
branch carried out in at least one chosen algorithmic processing,
[0188] by modifying at least one chosen portion of the source of
the protected software, this modification being such that during
the execution of the protected software, the functionality of at
least one chosen conditional branch is executed, by means of the
second execution part, in the unit, [0189] and by producing: [0190]
the first object part of the protected software, said first object
part being such that during the execution of the protected software,
the functionality of at least one chosen conditional branch is executed
in the unit, [0191] and the second object part of the protected
software, said second object part being such that, after upload
to the unit and during the execution of the protected software,
appears the second execution part by means of which the functionality
of at least one chosen conditional branch is executed, [0192] .fwdarw.
and during the usage phase: [0193] in the presence of the unit and
each time a portion of the first execution part imposes it, executing
the functionality of at least one conditional branch in the unit,
so that said portion is executed correctly and that, consequently,
the protected software is completely functional, [0194] and in the
absence of the unit and in spite of the request by a portion of
the first execution part to execute the functionality of a conditional
branch in the unit, not being able to fulfill said request correctly,
so that at least said portion is not executed correctly and that
consequently, the protected software is not completely functional.
[0195] According to a variant embodiment, the process according
to the invention comprises, during the protection phase, modifying
the protected software: [0196] by choosing, in the source of the
protected software, at least one series of chosen conditional branches,
[0197] by modifying at least one chosen portion of the source of
the protected software, this modification being such that during
the execution of the protected software, the overall functionality
of at least one chosen series of conditional branches is executed,
by means of the second execution part, in the unit, [0198] and by
producing: [0199] the first object part of the protected software,
said first object part being such that during the execution of the
protected software, the functionality of at least one chosen series
of conditional branches is executed in the unit, [0200] and the
second object part of the protected software, said second object
part being such that, after upload to the unit and during the execution
of the protected software, appears the second execution part by
means of which the overall functionality of at least one chosen
series of conditional branches is executed.
[0201] The process according to the invention thus enables to protect
usage of a software by using a processing and memorizing unit which
presents the characteristic of containing a part of the software
being executed. It follows that any derived version of the software
attempting to work without the processing and memorizing unit imposes
to recreate the part of the software contained in the processing
and memorizing unit during the execution, or else said derived version
of the software will not be completely functional.
BRIEF DESCRIPTION OF THE DRAWINGS
[0202] Various other characteristics emerge from the description
made below in reference to the appended diagrams which show, as
non-limiting examples, embodiments and implementations of the subject
of the invention.
[0203] FIGS. 10 and 11 are functional blocks diagrams illustrating
the various representations of a software respectively not protected
and protected by the process in accordance with the invention.
[0204] FIGS. 20 to 22 illustrate as examples, various embodiments
of an apparatus implementing the process in accordance with the
invention.
[0205] FIGS. 30 and 31 are functional blocks diagrams making explicit
the general principle of the process in accordance with the invention.
[0206] FIGS. 40 to 43 are diagrams illustrating the protection
process according to the invention implementing the principle of
protection by variable. FIGS. 50 to 54 are diagrams illustrating
the protection process according to the invention implementing the
principle of protection by temporal dissociation.
[0207] FIGS. 60 to 64 are diagrams illustrating the protection
process according to the invention implementing the principle of
protection by elementary functions.
[0208] FIGS. 70 to 74 are diagrams illustrating the protection
process according to the invention implementing the principle of
protection by detection and coercion.
[0209] FIGS. 80 to 85 are diagrams illustrating the protection
process according to the invention implementing the principle of
protection by par renaming.
[0210] FIGS. 90 to 92 are diagrams illustrating the protection
process according to the invention implementing the principle of
protection by conditional branch.
[0211] FIG. 100 is a diagram illustrating the different phases
of implementation of the subject of the invention.
[0212] FIG. 110 illustrates an embodiment of a system allowing
the implementation of the construction stage of the protection phase
in accordance with the invention.
[0213] FIG. 120 illustrates an embodiment of a pre-customization
unit used in the protection process in accordance with the invention.
[0214] FIG. 130 illustrates an embodiment of a system allowing
the implementation of the tools making stage of the protection phase
in accordance with the invention.
[0215] FIG. 140 illustrates an embodiment of a system allowing
the implementation of the protection process according to the invention.
[0216] FIG. 150 illustrates an embodiment of a customization unit
used in the protection process in accordance with the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0217] In the rest of the description, the following definitions
will be used: [0218] A data processing system 3 is a system able
to execute a program. [0219] A processing and memorizing unit is
a unit able: [0220] to accept data provided by a data processing
system 3, [0221] to return data to the data processing system 3,
[0222] to store data at least partly in secret and to retain at
least a part of said data even if the unit is switched off, [0223]
and to carry out algorithmic processing on said data, part or all
of the result being secret. [0224] A unit 6 is a processing and
memorizing unit implementing the process according to the invention.
[0225] A blank unit 60 is a unit which does not implement the process
according to the invention, but which can receive data transforming
it into a unit 6. [0226] A pre-customized unit 66 is a blank unit
60 which has received part of data enabling it, after reception
of supplementary data, to be transformed into a unit 6. [0227] The
upload of information to a blank unit 60 or a pre-customized unit
66 corresponds to a transfer of information to the blank unit 60
or the pre-customized unit 66, and to a storage of said transferred
information. The transfer can possibly include a change of the information
format. [0228] A variable, a function or data contained in the data
processing system 3 will be indicated by an uppercase letter, while
a variable, a function or data contained in the unit 6 will be indicated
by a lowercase letter. [0229] A "protected software",
is a software which has been protected by at least one of the principles
of protection implemented by the process in accordance with the
invention. [0230] A "vulnerable software", is a software
which has not been protected by any principle of protection implemented
by the process in accordance with the invention. [0231] In the case
where differentiation between a vulnerable software and a protected
software is not important, the term "software" is used.
[0232] A software has various representations depending on the instant
considered in its life cycle: [0233] a source representation, [0234]
an object representation, [0235] a distribution, [0236] or a dynamic
representation. [0237] A source representation of a software is
understood as a representation which after transformation, results
in an object representation. A source representation can offer different
levels, from a conceptual abstract level to a level executable directly
by a data processing system or a processing and memorizing unit.
[0238] An object representation of a software corresponds to a level
of representation which after transfer to a distribution and upload
to a data processing system or a processing and memorizing unit,
can be executed. It can be, for instance, a binary code, an interpreted
code, etc. [0239] A distribution is a physical or virtual support
containing the object representation, said distribution having to
be put at the user's disposal to enable them to use the software.
[0240] A dynamic representation corresponds to the execution of
the software from its distribution. [0241] A portion of a software
corresponds to some part of the software and can, for instance correspond,
to one or several consecutive or not instructions, and/or one or
several consecutive or not functional blocks, and/or one or several
functions, and/or one or several subprograms, and/or one or several
modules. A portion of a software can also correspond to all of said
software.
[0242] FIGS. 10 and 11 illustrate the various representations respectively
of a vulnerable software 2v in the general sense, and of a protected
software 2p protected according to the process in accordance with
the invention.
[0243] FIG. 10 illustrates various representations of a vulnerable
software 2v appearing during its life cycle. The vulnerable software
2v can thus appear under any of the following representations: [0244]
a source representation 2vs, [0245] an object representation 2vo,
[0246] a distribution 2vd. Said distribution can have commonly the
form of a physical distribution medium such as a CDROM or the form
of files distributed through a network (GSM, Internet, etc.), [0247]
or a dynamic representation 2ve corresponding to the execution of
the vulnerable software 2v on a data processing system 3 of any
known type, which classically includes, at least one processor 4.
[0248] FIG. 11 illustrates various representations of a protected
software 2p appearing during its life cycle. The protected software
2p can thus appear under any of the following representations: [0249]
a source representation 2ps including a first source part intended
for the data processing system 3 and a second source part intended
for the unit 6, part of said source parts can commonly be contained
in common files, [0250] an object representation 2po including a
first object part 2pos intended for the data processing system 3
and a second object part 2pou intended for the unit 6, [0251] a
distribution 2pd including: [0252] a first distribution part 2pds
containing the first object part 2pos, said first distribution part
2pds being intended for the data processing system 3 and which can
commonly have the form of a physical distribution medium such as
a CDROM or the form of files distributed through a network (GSM,
Internet, etc.), [0253] and a second distribution part 2pdu having
the form: [0254] of at least one pre-customized unit 66 to which
a part of the second object part 2pou has been uploaded and for
which the user has to finish the customization by uploading supplementary
data so as to obtain a unit 6, said supplementary data being obtained,
for instance, by download through a network, [0255] or of at least
one unit 6 to which the second object part 2pou has been uploaded,
[0256] or a dynamic representation 2pe corresponding to the execution
of the protected software 2p. Said dynamic representation 2pe includes
a first execution part 2pes which is executed in the data processing
system 3 and an second execution part 2peu which is executed in
the unit 6.
[0257] In the case where the differentiation between the different
representations of the protected software 2p is not important, the
expressions first part of the protected software and second part
of the protected software shall be used.
[0258] The implementation of the process according to the invention
in accordance with the dynamic representation of FIG. 11, uses an
apparatus 1p including a data processing system 3 linked up by a
link 5 to a unit 6. The data processing system 3 is of any type
and includes, classically, at least one processor 4. The data processing
system 3 can be a computer or be part, for instance, of various
machines, devices, fixed or mobile products, or vehicles in the
general sense. The link 5 can be realized in any possible way, such
as for instance a serial link, a USB bus, a radio link, an optical
link, a network link or a direct electric connection to a circuit
of data processing system 3, etc. It should be observed that the
unit 6 can possibly be physically located inside the same integrated
circuit than the processor 4 of the data processing system 3. In
this case, the unit 6 can be considered as a co-processor in relation
to the processor 4 of the data processing system 3 and the link
5 is internal to the integrated circuit.
[0259] FIGS. 20 to 22 show in an illustrative and non-limiting
manner, various embodiments of the apparatus 1p allowing the implementation
of the protection process in accordance with the invention.
[0260] In the embodiment illustrated in FIG. 20, the protection
apparatus 1p includes, as a data processing system 3, a computer
and, as a unit 6, a chip card 7 and its interface 8 commonly called
card reader. The computer 3 is linked up to the unit 6 by a link
5. During the execution of the protected software 2p, the first
execution part 2pes which is executed in the computer 3 and the
second execution part 2peu which is executed in the chip card 7
and its interface 8, must both be functional so that the protected
software 2p is completely functional.
[0261] In the embodiment illustrated in FIG. 21, the protection
apparatus 1p equips a product 9 in the general sense, including
various components 10 adapted to the function(s) assumed by such
a product 9. The protection apparatus 1p includes, on the one hand,
a data processing system 3 embedded in the product 9 and, on the
other hand, a unit 6 associated with the product 9. So that the
product 9 is completely functional, the protected software 2p, must
be completely functional. Thus, during the execution of the protected
software 2p, the first execution part 2pes which is executed in
the data processing system 3 and the second execution part 2peu
which is executed in the unit 6, must both be functional. Said protected
software 2p enables therefore indirectly, to protect against unauthorized
usage, the product 9 or one of its functionalities. For instance,
the product 9 can be an installation, a system, a machine, a toy,
a piece of domestic appliances, a phone, etc.
[0262] In the embodiment illustrated in FIG. 22, the protection
apparatus 1p includes several computers, as well as part of a communication
network. The data processing system 3 is a first computer linked
up by a link 5 of network type, to a unit 6 constituted by a second
computer. For the implementation of the invention, the second computer
6 is used as a license server for a protected software 2p. During
the execution of the protected software 2p, the first execution
part 2pes which is executed in the first computer 3 and the second
execution part 2peu which is executed in the second computer 6,
must both be functional so that the protected software 2p is completely
functional.
[0263] FIG. 30 enables to make explicit more precisely, the protection
process in accordance with the invention. It should be observed
that a vulnerable software 2v, is considered as being executed totally
in a data processing system 3. On the other hand, in the case of
the implementation of a protected software 2p, the data processing
system 3 includes transfer means 12 linked up by the link 5, to
transfer means 13 being part of the unit 6 enabling to establish
communication between the first execution part 2pes and the second
execution part 2peu of the protected software 2p.
[0264] It must be considered that the transfer means 12, 13 are
of software and/or hardware nature and are capable of providing
and, possibly, optimizing the data communication between the data
processing system 3 and the unit 6. Said transfer means 12, 13 are
adapted to enable to have at one's disposal a protected software
2p which is, preferably, independent from the type of link 5 used.
Said transfer means 12, 13 are not part of the subject of the invention
and are not described more precisely as they are well known by the
Man of art. The first part of the protected software 2p includes
commands. During the execution of the protected software 2p, the
execution of said commands by the first execution part 2pes enables
the communication between the first execution part 2pes and the
second execution part 2peu. In the rest of the description, said
commands are represented by IN, OUT or TRIG.
[0265] As illustrated in FIG. 31, to allow the implementation of
the second execution part 2peu of the protected software 2p, the
unit 6 includes protection means 14. The protection means 14 include
memorization means 15 and processing means 16.
[0266] For the sake of simplification in the rest of the description,
it is chosen to consider, during the execution of the protected
software 2p, the presence of the unit 6 or the absence of the unit
6. In actual fact, a unit 6 providing protection means 14 not adapted
to the execution of the second execution part 2peu of the protected
software 2p is also considered as missing, each time the execution
of the protected software 2p is not correct. In other words: [0267]
a unit 6 physically present and including protection means 14 adapted
to the execution of the second execution part 2peu of the protected
software 2p, is always considered as present, [0268] a unit 6 physically
present but including protection means 14 not adapted, i.e. not
allowing the correct implementation of the second execution part
2peu of the protected software 2p is considered as present, when
it works correctly, and as missing when it does not work correctly,
[0269] and a unit 6 physically missing is always considered as missing.
[0270] In the case where the unit 6 is constituted by a chip card
7 and its interface 8, the transfer means 13 are split into two
parts, one being on the interface 8 and the other one being on the
chip card 7. In this embodiment, the absence of the chip card 7
is considered as equivalent to the absence of the unit 6. In other
words, in the absence of the chip card 7 and/or its interface 8,
the protection means 14 are not accessible and do not enable the
execution of the second execution part 2peu of the protected software
2p, so much so that the protected software 2p is not completely
functional.
[0271] In accordance with the invention, the protection process
aims at implementing a principle of protection, called by "temporal
dissociation", a description of which is carried out in relation
to FIGS. 50 to 54.
[0272] For the implementation of the principle of protection by
temporal dissociation, is chosen, in the source of the vulnerable
software 2vs, at least one algorithmic processing using at least
one operand and returning at least one result. Is also chosen at
least one portion of the source of the vulnerable software 2vs containing
at least one chosen algorithmic processing.
[0273] At least one chosen portion of the source of the vulnerable
software 2vs is then modified, so as to obtain the source of the
protected software 2ps. This modification is such that, among others:
[0274] during the execution of the protected software 2p, at least
one portion of the first execution part 2pes, which is executed
in the data processing system 3, takes into account that the functionality
of at least one chosen algorithmic processing is executed in the
unit 6, [0275] during the execution of the protected 2p, the second
execution part 2peu, which is executed in the unit 6, executes at
least the functionality of at least one chosen algorithmic processing,
[0276] during the execution of the protected software 2p, each chosen
algorithmic processing is split into several distinct steps, namely:
[0277] step 1: the placing of the operand(s) at the unit 6's disposal,
[0278] step 2: the carrying out in the unit 6, of the functionality
of the chosen algorithmic processing using said operand(s), [0279]
and step 3: possibly, the placing of the result of the chosen algorithmic
processing at the data processing system 3's disposal by the unit
6, [0280] steps commands are defined to trigger the execution of
the steps, [0281] and a sequence of the steps commands is chosen
among the set of sequences allowing the execution of the protected
software 2p.
[0282] The first execution part 2pes of the protected software
2p, which is executed in the data processing system 3, executes
the steps commands, triggering in the unit 6, the execution by means
of the second execution part 2peu, of each of the previously defined
steps.
[0283] FIG. 50 illustrates an example of execution of a vulnerable
software 2v. In this example, appears, during the execution of the
vulnerable software 2v, in the data processing system 3, at a certain
time instant, the calculation of Z.rarw.F(X, Y) corresponding to
the assignment to a variable Z, of the result of an algorithmic
processing represented by a function F and using operands X and
Y.
[0284] FIG. 51 illustrates an example of implementation of the
invention for which the algorithmic processing chosen in FIG. 50
is remoted in the unit 6. In this example, during the execution
in the data processing system 3 of the first execution part 2pes
of the protected software 2p and in the presence of the unit 6,
appear: [0285] at time instant t.sub.1, the step 1, i.e. the execution
of a step command CE.sub.1 triggering the transfer of data X and
Y from the data processing system 3 to the memorization zones respectively
x and y located in the memorization means 15 of the unit 6, said
step command CE, being represented by OUT(x, X), OUT(y, Y), [0286]
at time instant t.sub.2, the step 2, i.e. the execution of a step
command CE.sub.2, triggering in the unit 6, the execution by means
of the second execution part 2peu, of the function f, said function
f being algorithmically equivalent to the function F and said step
command CE.sub.2 being represented by TRIG(f). More precisely, the
execution of the step command CE.sub.2 leads to the execution of
the function f which uses the contents of the memorization zones
x and y and returns its result to a memorization zone z of the unit
6, [0287] and at time instant t.sub.3, the step 3, i.e. the execution
of a step command CE.sub.3 triggering the transfer of the result
of the function f, contained in the memorization zone z of the unit
6 to the data processing system 3 so as to assign it to the variable
Z, said step command CE.sub.3 being represented by IN(z).
[0288] In the illustrated example, the steps 1 to 3 are executed
successively. It should be observed that two improvements can be
effected: [0289] The first improvement concerns the case where several
algorithmic processings are remoted in the unit 6 and at least the
result of one algorithmic processing is used by another algorithmic
processing. In this case, certain transfer steps can possibly be
removed. [0290] The second improvement aims at opting for a pertinent
sequence of the steps commands among the set of sequences allowing
the execution of the protected software 2p. In this respect, it
is preferable to chose a sequence of the steps commands which temporally
dissociates the execution of the steps, by intercalating between
them, portions of code executed in the data processing system 3
and including or not steps commands used to determine other data.
FIGS. 52 and 53 illustrate the principle of such an embodiment.
[0291] FIG. 52 shows an example of execution of a vulnerable software
2v. In this example, appears, during the execution of the vulnerable
software 2v, in the data processing system 3, the execution of two
algorithmic processings leading to the determination of Z and Z',
such that Z.rarw.F (X, Y) and Z'.rarw.F' (X', Y').
[0292] FIG. 53 illustrates an example of implementation of the
process according to the invention for which the two algorithmic
processings chosen in FIG. 52 are remoted in the unit 6. According
to such an example, during the execution in the data processing
system 3, of the first execution part 2pes of the protected software
2p, and in the presence of the unit 6, appears, as explained above,
the execution of steps commands CE.sub.1, CE.sub.2, CE.sub.3 corresponding
to the determination of Z and of steps commands CE'.sub.1, CE'.sub.2,
CE'.sub.3 corresponding to the determination of Z'. As illustrated,
the steps commands CE.sub.1 to CE.sub.3 are not executed consecutively
inasmuch as steps commands CE'.sub.1 to CE'.sub.3, as well as other
code portions are intercalated. In the example, the following sequence
is thus carried out: CE.sub.1, portion of intercalated code, CE.sub.2,
portion of intercalated code, CE'.sub.1, portion of intercalated
code, CE'.sub.2, portion of intercalated code, CE'.sub.3, portion
of intercalated code, CE.sub.3.
[0293] It should be observed that, during the execution of the
protected software 2p, in the presence of the unit 6, each time
a step command contained in a portion of the first execution part
2pes of the protected software 2p imposes it, the corresponding
step is executed in the unit 6. Thus, it appears, that in the presence
of the unit 6, said portion is executed correctly and that, consequently,
the protected software 2p is completely functional.
[0294] FIG. 54 illustrates an example of an attempt of execution
of the protected software 2p, when the unit 6 is missing. In this
example, during the execution in the data processing system 3 of
the first execution part 2pes of the protected software 2p: [0295]
at time instant t.sub.1, the execution of the step command OUT(x,
X), OUT(y, Y) cannot trigger the transfer of data X and Y to the
respective memorization zones x and y taking into account the absence
of the unit 6, [0296] at time instant t.sub.2, the execution of
the step command TRIG(f) cannot trigger the execution of the function
f, taking into account the absence of the unit 6, [0297] and at
time instant t.sub.3, the execution of the step command IN(z) cannot
trigger the transfer of the result of the function f, taking into
account the absence of the unit 6.
[0298] It therefore appears that in the absence of the unit 6,
at least one request by a portion of the first execution part 2pes
to trigger the execution of a step in the unit 6, cannot be fulfilled
correctly, so that at least said portion is not executed correctly
and that, consequently, the protected software 2p is not completely
functional.
[0299] According to another advantageous characteristic of the
invention, the protection process aims at implementing a principle
of protection called by <<variable>> a description of
which is carried out in relation to FIGS. 40 to 43.
[0300] For the implementation of the principle of protection by
variable, is chosen in the source of the vulnerable software 2vs
at least one variable which, during the execution of the vulnerable
software 2v, partially defines its state. By state of a software,
must be understood the set of pieces of information, at a given
moment, necessary to the complete execution of said software, so
much so that the absence of such a chosen variable prejudices the
complete execution of said software. Is also chosen at least one
portion of the source of the vulnerable software 2vs containing
at least one chosen variable.
[0301] At least one chosen portion of the source of the vulnerable
software 2vs is then modified, so as to obtain the source of the
protected software 2ps. This modification is such that during the
execution of the protected software 2p, at least one portion of
the first execution part 2pes which is executed in the data processing
system 3, takes into account that at least one chosen variable or
at least one copy of chosen variable resides in the unit 6.
[0302] FIG. 40 illustrates an example of execution of a vulnerable
software 2v. In this example, during the execution of the vulnerable
software 2v in the data processing system 3, appear: [0303] at time
instant t.sub.1, the assignment of the data X to the variable V.sub.1,
represented by V.sub.1.rarw.X, [0304] at time instant t.sub.2, the
assignment of the value of the variable V.sub.1 to the variable
Y, represented by Y.rarw.V.sub.1, [0305] and at time instant t.sub.3,
the assignment of the value of the variable V.sub.1 to the variable
Z, represented by Z.rarw.V.sub.1.
[0306] FIG. 41 illustrates an example of a first form of implementation
of the invention for which the variable resides in the unit 6. In
this example, during the execution in the data processing system
3 of the first execution part 2pes of the protected software 2p,
and in presence of the unit 6, appear: [0307] at time instant ti,
the execution of a transfer command triggering the transfer of the
data X from the data processing system 3 to the variable v.sub.1
located in the memorization means 15 of the unit 6, said transfer
command being represented by OUT(v.sub.1, X) and corresponding in
the end to the assignment of the data X to the variable v.sub.1,
[0308] at time instant t.sub.2, the execution of a transfer command
triggering the transfer of the value of the variable v.sub.1 residing
in the unit 6 to the data processing system 3 so as to assign it
to the variable Y, said transfer command being represented by IN(v.sub.1)
and corresponding in the end to the assignment of the value of the
variable v.sub.1 to the variable Y, [0309] and at time instant t.sub.3,
the execution of a transfer command triggering the transfer of the
value of the variable v.sub.1 residing in the unit 6 to the data
processing system 3 so as to assign it to the variable Z, said transfer
command being represented by IN(v.sub.1) and corresponding in the
end to the assignment of the value of the variable v.sub.1 to the
variable Z.
[0310] It should be observed that during the execution of the protected
software 2p, at least one variable resides in the unit 6. Thus,
when a portion of the first execution part 2pes of the protected
software 2p imposes it, and in the presence of the unit 6, the value
of said variable residing in the unit 6 is transferred to the data
processing system 3 to be used by the first execution part 2pes
of the protected software 2p, so much so that said portion is executed
correctly and that, consequently, the protected software 2p is completely
functional.
[0311] FIG. 42 illustrates an example of a second form of implementation
of the invention for which a copy of the variable resides in the
unit 6. In this example, during the execution in the data processing
system 3 of the first execution part 2pes of the protected software
2p, and in the presence of the unit 6, appear: [0312] at time instant
t.sub.1, the assignment of the data X to the variable V.sub.1 located
in the data processing system 3, as well as the execution of a transfer
command triggering the transfer of the data X from the data processing
system 3 to the variable v.sub.1 located in the memorization means
15 of the unit 6, said transfer command being represented by OUT(v.sub.1,
X), [0313] at time instant t.sub.2, the assignment of the value
of the variable V.sub.1 to the variable Y, [0314] and at time instant
t.sub.3, the execution of a transfer command triggering the transfer
of the value of the variable v.sub.1 residing in the unit 6 to the
data processing system 3 so as to affect it to the variable Z, said
transfer command being represented by IN(v.sub.1).
[0315] It should be observed that during the execution of the protected
software 2p, at least one copy of a variable resides in the unit
6. Thus, when a portion of the first execution part 2pes of the
protected software 2p, imposes it, and in the presence of the unit
6, the value of said copy of variable residing in the unit 6 is
transferred to the data processing system 3 to be used by the first
execution part 2pes of the protected software 2p, so much so that
said portion is executed correctly and that, consequently, the protected
software 2p is completely functional.
[0316] FIG. 43 illustrates an example of attempt of execution of
the protected software 2p, when the unit 6 is missing. In this example,
during the execution in the data processing system 3 of the first
execution part 2pes of the protected software 2p: [0317] at time
instant t.sub.1, the execution of the transfer command OUT(v.sub.1,
X) cannot trigger the transfer of the data X to the variable v.sub.1,
taking into account the absence of the unit 6, [0318] at time instant
t.sub.2, the execution of the transfer command IN(v.sub.1) cannot
trigger the transfer of the value of the variable v.sub.1 to the
data processing system 3, taking into account the absence of the
unit 6, [0319] and at time instant t.sub.3, the execution of the
transfer command IN(v.sub.1) cannot trigger the transfer of the
value of the variable v.sub.1 to the data processing system 3, taking
into account the absence of the unit 6.
[0320] It therefore appears that in the absence of the unit 6,
at least one request by a portion of the first execution part 2pes
to use a variable or a copy of variable residing in the unit 6,
cannot be fulfilled correctly, so that at least said portion is
not executed correctly and that, consequently, the protected software
2p is not completely functional.
[0321] It should be observed that the data transfers between the
data processing system 3 and the unit 6 illustrated in the previous
examples use only simple assignments but that the Man of art will
know how to combine them with other operations to obtain complex
operations such as for instance OUT(v.sub.1, 2*X+3) or Z.rarw.(5*v1+v2).
[0322] According to another advantageous characteristic of the
invention, the protection process aims at implementing a principle
of protection called by <<elementary function>> a description
of which is carried out in relation to FIGS. 60 to 64.
[0323] For the implementation of the principle of protection by
elementary functions, are defined: [0324] a set of elementary functions
whose elementary functions are liable to be executed, by means of
the second execution part 2peu, in the unit 6, and possibly to transfer
data between the data processing system 3 and the unit 6, [0325]
and a set of elementary commands for said set of elementary functions,
said elementary commands being liable to be executed in the data
processing system 3 and to trigger the execution in the unit 6,
of the corresponding elementary functions.
[0326] For the implementation of the principle of protection by
elementary functions, are also constructed exploitation means enabling
to transform a blank unit 60 into a unit 6 able to execute elementary
functions, the execution of said elementary functions being triggered
by the execution in the data processing system 3, of elementary
commands.
[0327] For the implementation of the principle of protection by
elementary functions, is also chosen, in the source of the vulnerable
software 2vs, at least one algorithmic processing using at least
one operand and returning at least one result. Is also chosen at
least one portion of the source of the vulnerable software 2vs containing
at least one chosen algorithmic processing.
[0328] At least one chosen portion of the source of the vulnerable
software 2vs is then modified, so as to obtain the source of the
protected software 2ps. This modification is such that, among others:
[0329] during the execution of the protected software 2p, at least
one portion of the first execution part 2pes, which is executed
in the data processing system 3, takes into account that the functionality
of at least one chosen algorithmic processing is executed in the
unit 6, [0330] during the execution of the protected software 2p,
the second execution part 2peu, which is executed in the unit 6,
executes at least the functionality of at least one chosen algorithmic
processing, [0331] each chosen algorithmic processing is split so
that during the execution of the protected software 2p, each chosen
algorithmic processing is executed, by means of the second execution
part 2peu, using elementary functions. Preferably, each chosen algorithmic
processing is split into elementary functions fe.sub.n (with n varying
from 1 to N), namely: [0332] possibly one or several elementary
functions enabling the placing of one or several operands at the
unit 6's disposal, [0333] elementary functions, some of which use
the operand(s) and in combination, execute the functionality of
the chosen algorithmic processing, using said operand(s), [0334]
and possibly one or several elementary functions enabling the placing
of the result of the chosen algorithmic processing at the data processing
system 3's disposal by the unit 6, [0335] and a sequence of the
elementary commands is chosen among the set of sequences allowing
the execution of the protected software 2p.
[0336] The first execution part 2pes of the protected software
2p, which is executed in the data processing system 3, executes
elementary commands CFE.sub.n (with n varying from 1 to N), triggering
in the unit 6, the execution by means of the second execution part
2peu, of each of the previously defined elementary functions fe.sub.n.
[0337] FIG. 60 illustrates an example of execution of a vulnerable
software 2v. In this example, appears, during the execution of the
vulnerable software 2v in the data processing system 3, at a certain
time instant, the calculation of Z.rarw.F(X, Y) corresponding to
the assignment to a variable Z of the result of an algorithmic processing
represented by a function F and using operands X and Y.
[0338] FIG. 61 illustrates an example of implementation of the
invention for which the algorithmic processing chosen in FIG. 60
is remoted in the unit 6. In this example, during the execution
in the data processing system 3 of the first execution part 2pes
of the protected software 2p and in the presence of the unit 6,
appear: [0339] at time instants t.sub.1, t.sub.2, the execution
of the elementary commands CFE.sub.1, CFE.sub.2 triggering in the
unit 6, the execution by means of the second execution part 2peu,
of the corresponding elementary functions fe.sub.1, fe.sub.2 which
provide the transfer of data X, Y from the data processing system
3 to memorization zones respectively x, y located in the memorization
means 15 of the unit 6, said elementary commands CFE.sub.1, CFE.sub.2
being represented respectively by OUT(x, X), OUT(y, Y), [0340] at
time instants t.sub.3 to t.sub.N-1, the execution of the elementary
commands CFE.sub.3 to CFE.sub.N-1, triggering in the unit 6, the
execution by means of the second execution part 2peu, of the corresponding
elementary functions fe.sub.3 to fe.sub.N-1, said elementary commands
CFE.sub.3 to CFE.sub.N-1 being represented, respectively, by TRIG(fe.sub.3)
to TRIG(fe.sub.N-1). The series of elementary functions fe.sub.3
to fe.sub.N-1 executed in combination is algorithmically equivalent
to the function F. More precisely, the execution of said elementary
commands leads to the execution in the unit 6, of the elementary
functions fe.sub.3 to fe.sub.N-1 which use the contents of the memorization
zones x, y and return the result to a memorization zone z of the
unit 6, [0341] and at time instant t.sub.N, the execution of the
elementary command CFE.sub.N triggering in the unit 6, the execution
by means of the second execution part 2peu, of the elementary function
fe.sub.N providing the transfer of the result of the algorithmic
processing, contained in the memorization zone z of the unit 6 to
the data processing system 3, so as to assign it to the variable
Z, said elementary command CFE.sub.N being represented by IN(z).
[0342] In the illustrated example, the elementary commands 1 to
N are executed successively. It should be observed that two improvements
can be effected: [0343] The first improvement concerns the case
where several algorithmic processings are remoted in the unit 6
and at least the result of one algorithmic processing is used by
another algorithmic processing. In this case, some elementary commands
used for the transfer, can possibly be removed. [0344] The second
improvement aims at opting for a pertinent sequence of the elementary
commands among the set of sequences allowing the execution of the
protected software 2p. In this respect, it is preferable to choose
a sequence of the elementary commands which temporally dissociates
the execution of the elementary functions, by intercalating between
them, portions of code executed in the data processing system 3
and including or not elementary commands used for the determination
of other data. FIGS. 62 and 63 illustrate the principle of such
an embodiment.
[0345] FIG. 62 shows an example of execution of a vulnerable software
2v. In this example, appears during the execution of the vulnerable
software 2v, in the data processing system 3, the execution of two
algorithmic processings leading to the determination of Z and Z',
such that Z.rarw.F (X, Y) and Z'.rarw.F'(X', Y').
[0346] FIG. 63 illustrates an example of implementation of the
process according to the invention for which the two algorithmic
processing chosen in FIG. 62 are remoted in the unit 6. According
to such an example, during the execution in the data processing
system 3 of the first execution part 2pes of the protected software
2p and in the presence of the unit 6, appear, as explained above,
the execution of the elementary commands CFE.sub.1 to CFE.sub.N
corresponding to the determination of Z and the execution of the
elementary commands CFE'.sub.1 to CFE'.sub.M corresponding to the
determination of Z'. As illustrated, the elementary commands CFE.sub.1
to CFE.sub.N are not executed consecutively, inasmuch as the elementary
commands CFE'.sub.1 to CFE'.sub.M, as well as other portions of
code are intercalated. In the example, the following sequence is
thus carried out: CFE.sub.1, portion of intercalated code, CFE'.sub.1,
CFE.sub.2, portion of intercalated code, CFE'.sub.2, CFE'.sub.3,
portion of intercalated code, CFE'.sub.4, CFE.sub.3, CFE.sub.4,
. . . , CFE.sub.N, CFE'.sub.M.
[0347] It should be observed that, during the execution of the
protected software 2p, in the presence of the unit 6, each time
an elementary command contained in a portion of the first execution
part 2pes of the protected software 2p imposes it, the corresponding
elementary function is executed in the unit 6. Thus, it appears,
that in the presence of the unit 6, said portion is executed correctly
and that, consequently, the protected software 2p is completely
functional.
[0348] FIG. 64 illustrates an example of an attempt of execution
of the protected software 2p, when the unit 6 is missing. In this
example, during the execution in the data processing system 3, of
the first execution part 2pes of the protected software 2p, at every
time instant, the execution of an elementary command cannot trigger
the execution of the corresponding elementary function, because
of the absence of the unit 6. The value to assign to the variable
Z cannot therefore be determined correctly.
[0349] It therefore appears, that in the absence of the unit 6,
at least one request by a portion of the first execution part 2pes
of the protected software 2p, to trigger the execution of an elementary
function in the unit 6 cannot be fulfilled correctly, so that at
least said portion is not executed correctly and that, consequently,
the protected software 2p is not completely functional.
[0350] According to another advantageous characteristic of the
invention, the protection process aims at implementing a principle
of protection, called by <<detection and coercion>>,
a description of which is carried out in relation to FIGS. 70 to
74.
[0351] For the implementation of the principle of protection by
detection and coercion, are defined: [0352] at least one software
execution characteristic liable to be monitored at least in part
in the unit 6, [0353] at least one criterion to abide by for at
least one software execution characteristic, [0354] detection means
17 to implement in the unit 6 and enabling to detect that at least
one software execution characteristic does not abide by at least
one associated criterion, [0355] and coercion means 18 to implement
in the unit 6 and enabling to inform the data processing system
3 and/or modify the execution of a software, when at least one criterion
is not abided by.
[0356] For the implementation of the principle of protection by
detection and coercion, are also constructed exploitation means
enabling to transform a blank unit 60 into a unit 6 implementing
at least the detection means 17 and the coercion means 18.
[0357] FIG. 70 illustrates the means necessary to the implementation
of this principle of protection by detection and coercion. The unit
6 includes the detection means 17 and the coercion means 18 belonging
to the processing means 16. The coercion means 18 are informed by
the detection means 17 that a criterion has not been abided by.
[0358] More precisely, the detection means 17 use information coming
from the transfer means 13 and/or from the memorization means 15
and/or from the processing means 16, so as to monitor one or several
software execution characteristics. For each software execution
characteristic is set at least one criterion to abide by.
[0359] In the case where it is detected that at least one software
execution characteristic does not abide by at least one criterion,
the detection means 17 inform the coercion means 18 of it. Said
coercion means 18 are adapted to modify, in the appropriate way,
the state of the unit 6.
[0360] For the implementation of the principle of protection by
detection and coercion, are also chosen: [0361] at least one software
execution characteristic to monitor, among the software execution
characteristics liable to be monitored, [0362] at least one criterion
to abide by for at least one chosen software execution characteristic,
[0363] in the source of the vulnerable software 2vs, at least one
algorithmic processing for which at least one software execution
characteristic is to be monitored, [0364] and in the source of the
vulnerable software 2vs, at least one portion containing at least
one chosen algorithmic processing.
[0365] At least one chosen portion of the source of the vulnerable
software 2vs is then modified, so as to obtain the source of the
protected software 2ps. This modification is such that, during the
execution of the protected software 2p, among others: [0366] at
least one portion of the first execution part 2pes, which is executed
in the data processing system 3, takes into account that at least
one chosen software execution characteristic is to be monitored,
at least in part in the unit 6, [0367] and the second execution
part 2peu, which is executed in the unit 6, monitors at least in
part, a chosen software execution characteristic.
[0368] During the execution of the protected software 2p, protected
by this principle of protection by detection and coercion, in the
presence of the unit 6: [0369] as long as all the criteria corresponding
to all the monitored execution characteristics of all the modified
portions of the protected software 2p are abided by, said modified
portions of the protected software 2p work nominally, so that said
protected software 2p works nominally, [0370] and if at least one
of the criteria corresponding to a monitored execution characteristic
of a portion of the protected software 2p is not abided by, the
data processing system 3 is informed of it and/or the functioning
of the portion of the protected software 2p is modified, so that
the functioning of the protected software 2p is modified.
[0371] Naturally, in the absence of the unit 6, at least one request
by a portion of the first execution part 2pes of the protected software
2p to use the unit 6 cannot be fulfilled correctly so that at least
said portion is not executed correctly and that consequently the
protected software 2p is not completely functional.
[0372] For the implementation of the principle of protection by
detection and coercion, two types of software execution characteristics
are used preferentially.
[0373] The first type of software execution characteristic corresponds
to a variable of measurement of the execution of a software and
the second type corresponds to a profile of usage of a software.
Said two types of characteristics can be used independently or in
combination.
[0374] For the implementation of the principle of protection by
detection and coercion using, as execution characteristic, a variable
of measurement of software execution, are defined: [0375] in the
memorization means 15, the possibility to memorize at least one
variable of measurement used to quantify the usage of at least one
functionality of a software, [0376] in the detection means 17, the
possibility to monitor at least one threshold associated to each
variable of measurement, [0377] and actualization means enabling
to update each variable of measurement depending on the usage of
the functionality to which it is associated.
[0378] Are also constructed exploitation means implementing, in
addition to the detection means 17 and the coercion means 18, the
actualization means.
[0379] Are also chosen, in the source of the vulnerable software
2vs: [0380] at least one functionality of the vulnerable software
2v whose usage is liable to be monitored using a variable of measurement,
[0381] at least one variable of measurement used to quantify the
usage of said functionality, [0382] at least one threshold associated
to the variable of measurement corresponding to a limit of usage
of said functionality, [0383] and at least one method of update
of the variable of measurement depending on the usage of said functionality.
[0384] The source of the vulnerable software 2vs is then modified,
so as to obtain the source of the protected software 2ps, this modification
being such that, during the execution of the protected software
2p, the second execution 2peu: [0385] actualizes the variable of
measurement depending on the usage of said functionality, [0386]
and takes into account at least one threshold crossing.
[0387] In other words, during the execution of the protected software
2p, the variable of measurement is updated depending on the usage
of said functionality, and when the threshold is crossed, the detection
means 17 inform of it the coercion means 18 which make an adapted
decision to inform the data processing system 3 and/or to modify
the processings carried out by the processing means 16 enabling
to modify the functioning of the portion of the protected software
2p, so that the functioning of the protected software 2p is modified.
[0388] For the implementation of a first preferred variant embodiment
of the principle of protection by detection and coercion using,
as characteristic, a variable of measurement, are defined: [0389]
for at least one variable of measurement, several associated thresholds,
[0390] and different coercion means corresponding to each of said
thresholds.
[0391] Are also chosen, in the source of the vulnerable software
2vs: [0392] at least one variable of measurement used to quantify
the usage of at least one functionality of the software and to which
must be associated several thresholds corresponding to different
limits of usage of said functionalities, [0393] and at least two
thresholds associated to the variable of measurement.
[0394] The source of the vulnerable software 2vs is then modified,
so as to obtain the source of the protected software 2ps, this modification
being such that, during the execution of the protected software
2p, the second execution part 2peu: [0395] actualizes the variable
of measurement depending on the usage of said functionality, [0396]
and takes into account, differently, the crossing of the various
thresholds.
[0397] In other words, classically, during the execution of the
protected software 2p, when the first threshold is crossed, the
unit 6 informs the data processing system 3 enjoining the protected
software 2p not to use said functionality anymore. If the protected
software 2p carries on using said functionality, the second threshold
will potentially be crossed. In the case where the second threshold
is crossed, the coercion means 18 can make the chosen functionality
ineffective and/or make the protected software 2p ineffective.
[0398] For the implementation of a second preferred variant embodiment
of the principle of protection by detection and coercion using,
as characteristic, a variable of measurement, are defined refilling
means enabling to credit at least one software functionality monitored
by a variable of measurement with at least one additional usage.
[0399] Are also constructed exploitation means implementing, in
addition to the detection means 17, the coercion means 18 and the
actualization means, the refilling means.
[0400] Is also chosen, in the source of the vulnerable software
2vs, at least one variable of measurement used to limit the usage
of at least one functionality of the software and which must be
able to be credited with at least one additional usage.
[0401] The source of the vulnerable software 2vs is then modified,
so as to obtain the source of the protected software 2ps, this modification
being such that, during a phase called of refilling, at least one
additional usage of at least one functionality corresponding to
a chosen variable of measurement can be credited.
[0402] Is carried out, during the phase of refilling, the reactualization
of at least one chosen variable of measurement and/or of at least
one associated threshold, so as to allow at least one additional
usage of the corresponding functionality. In other words, it is
possible, during the phase of refilling, to credit additional usages
of at least one functionality of the protected software 2p.
[0403] For the implementation of the principle of protection by
detection and coercion using, as characteristic, a profile of software
usage, is defined as criterion to abide by for said profile of usage,
at least one feature of software execution.
[0404] Are also chosen, in the source of the vulnerable software
2vs: [0405] at least one profile of usage to monitor, [0406] and
at least one feature of execution by which at least one chosen profile
of usage must abide.
[0407] The source of the vulnerable software 2vs is then modified,
so as to obtain the source of the protected software 2ps, this modification
being such that, during the execution of the protected software
2p, the second execution part 2peu abides by all the chosen features
of execution. In other words, the unit 6 itself monitors the way
the second execution part 2peu is executed and can inform the data
processing system 3 and/or modify the functioning of the protected
software 2p, in the case where at least one feature of execution
is not abided by.
[0408] During the execution of the protected software 2p, protected
by this principle, in the presence of the unit 6: [0409] as long
as all the features of execution of all the modified portions of
the protected software 2p are abided by, said modified portions
of the protected software 2p work nominally, so that said protected
software 2p works nominally, [0410] and if at least one feature
of execution of a portion of protected software 2p is not abided
by, the data processing system 3 is informed of it and/or the functioning
of the portion of the protected software 2p is modified, so that
the functioning of the protected software 2p is modified.
[0411] The monitoring of different features of execution can be
considered, like for instance the monitoring of the presence of
instructions including a marker or the monitoring of the execution
chaining for at least one part of the instructions.
[0412] For the implementation of the principle of protection by
detection and coercion using as feature of execution to abide by,
the monitoring of the execution chaining for at least one part of
the instructions, are defined: [0413] an instructions set, whose
instructions are liable to be executed in the unit 6, [0414] a set
of instructions commands for said instructions set, said instructions
commands are liable to be executed in the data processing system
3. The execution of each of said instructions commands in the data
processing system 3 triggers in the unit 6, the execution of the
corresponding instruction, [0415] detection means 17 enabling to
detect that the chaining of the instructions does not correspond
to the expected one, [0416] and coercion means 18 enabling to inform
the data processing system 3 and/or to modify the execution of a
software when the chaining of the instructions does not correspond
to the expected one.
[0417] Are also constructed exploitation means enabling the unit
6 to also execute the instructions of the instructions set, the
execution of said instructions being triggered by the execution
in the data processing system 3 of the instructions commands.
[0418] Is also chosen, in the source of the vulnerable software
2vs, at least one algorithmic processing which must be remoted in
the unit 6 and for which the chaining of at least one part of the
instructions is to be monitored.
[0419] The source of the vulnerable software 2vs is then modified,
so as to obtain the source of the vulnerable software 2ps, this
modification being such that, during the execution of the protected
software 2p: [0420] the second execution part 2peu executes at least
the functionality of the chosen algorithmic processing, [0421] the
chosen algorithmic processing is split into instructions, [0422]
the chaining by which at least some of the instructions must abide
during their execution in the unit 6 is specified, [0423] and the
first execution part 2pes of the protected software 2p executes
instructions commands which trigger the execution of the instructions
in the unit 6.
[0424] During the execution of the protected software 2p, protected
by this principle, in the presence of the unit 6: [0425] as long
as the chaining of the instructions of all the modified portions
of the protected software 2p, executed in the unit 6 corresponds
to the expected one, said modified portions of the protected software
2p work nominally, so that said protected software 2p works nominally,
[0426] and if the chaining of the instructions of a portion of the
protected software 2p executed in the unit 6 does not correspond
to the expected one, the data processing system 3 is informed of
it and/or the functioning of the portion of protected software 2p
is modified, so that the functioning of the protected software 2p
is modified.
[0427] FIG. 71 illustrates an example of implementation of the
principle of protection by detection and coercion using, as feature
of execution to abide by the monitoring of the execution chaining
of a at least one part of the instructions, in the case where the
expected chaining is abided by.
[0428] The first execution part 2pes of the protected software
2p, executed in the data processing system 3, executes instructions
commands CI.sub.i triggering, in the unit 6 the execution of the
instructions i.sub.i belonging to the instructions set. In said
instructions set, at least some of the instructions each include
a part defining the functionality of the instruction and a part
enabling to verify the expected chaining for the execution of the
instructions. In this example, the instructions commands CI.sub.i
are represented by TRIG(i.sub.i) and the expected chaining for the
execution of the instructions is i.sub.n, i.sub.n+1 and i.sub.n+2.
The execution in the unit 6, of the instruction i.sub.n gives the
result a and the execution of the instruction i.sub.n+1 gives the
result b. The instruction i.sub.n+2 uses as operand, the results
a and b of the instructions i.sub.n and i.sub.n+1 and its execution
gives the result c.
[0429] Taking into account that said chaining of the instructions
executed in the unit 6 corresponds to the expected one, it results
in a normal or nominal functioning of the protected software 2p.
[0430] FIG. 72 illustrates an example of implementation of the
principle of protection by detection and coercion using, as feature
of execution to abide by, the monitoring of the execution chaining
of at least one part of the instructions, in the case where the
expected chaining is not abided by.
[0431] According to this example, the expected chaining for the
execution of the instructions is still i.sub.n, i.sub.n+1 and i.sub.n+2.
However, the execution chaining is modified by the replacement of
the instruction i.sub.n with the instruction i'.sub.n, so that the
chaining actually executed is i'.sub.n, i.sub.n+1 and i.sub.n+2.
The execution of the instruction i'.sub.n gives the result a, i.e.
the same result that the execution of the instruction i.sub.n. However,
at the latest during the execution of the instruction i.sub.n+2,
the detection means 17 detect that the instruction i'.sub.n does
not correspond to the expected instruction to generate the result
a used as operand of the instruction i.sub.n+2. The detection means
17 inform of it the coercion means 18 which modify accordingly,
the functioning of the instruction i.sub.n+2, so that the execution
of the instruction i.sub.n+2 gives the result C' which can be different
than C. Naturally, if the execution of the instruction i'.sub.n
gives a result a' different from the result a of the instruction
i.sub.n, it is clear that the result of the instruction i.sub.n+2
can also be different from c.
[0432] Inasmuch as the execution chaining of the instructions executed
in the unit 6 does not correspond to the expected one, a modification
of the functioning of the protected software 2p can therefore be
obtained.
[0433] FIGS. 73 and 74 illustrates a preferred variant embodiment
of the principle of protection by detection and coercion using,
as feature of execution to abide by, the monitoring of the execution
chaining of at least one part of the instructions. According to
this preferred variant, is defined an instructions set whose at
least some instructions work with registers and use at least one
operand with the intention of returning a result.
[0434] As illustrated in FIG. 73, are defined for at least some
of the instructions working with registers, a part PF defining the
functionality of the instruction and a part PE defining the expected
chaining for the execution of the instructions. The part PF corresponds
to the operation code known by the Man of art. The part PE defining
the expected chaining, includes bits fields corresponding to: [0435]
an identification field of the instruction CII, [0436] and for each
operand k of the instruction, with k varying from 1 to K, and K
number of operands of the instruction: [0437] a flag field CD.sub.k,
indicating whether or not it is appropriate to verify the origin
of the operand k, [0438] and an expected identification field CIP.sub.k
of the operand, indicating the expected identity of the instruction
which has generated the contents of the operand k.
[0439] As illustrated in FIG. 74, the instructions set includes
V registers belonging to the processing means 16, each register
being named R.sub.v, with v varying from 1 to V. For each register
R.sub.v, are defined two fields, namely: [0440] a functional field
CF.sub.v, known by the Man of art and enabling to store the result
of the execution of the instructions, [0441] and a generated identification
field CIG.sub.v enabling to memorize the identity of the instruction
which has generated the contents of the functional field CF.sub.v.
Said generated identification field CIG.sub.v is automatically updated
with the contents of the identification field of the instruction
CII which has generated the functional field CF.sub.v. Said generated
identification field CIG.sub.v is neither accessible, nor modifiable
by any of the instructions and is solely used for the detection
means 17.
[0442] During the execution of an instruction, the detection means
17 carry out for each operand k the following operations: [0443]
the flag field CD.sub.k is read, [0444] if the flag field CD.sub.k
imposes it, the expected identification field CIP.sub.k and the
generated identification field CIG.sub.v corresponding to the register
used by the operand k are both read, [0445] the equality of the
two fields CIP.sub.k and CIG.sub.v is checked, [0446] and if the
equality is false, the detection means 17 consider that the execution
chaining of the instructions is not abided by.
[0447] The coercion means 18 enable to modify the result of the
instructions when the detection means 17 has informed them of an
instructions chaining not abided by. A preferred embodiment is carried
out by modifying the functional part PF of the instruction currently
executed or the functional part PF of subsequent instructions.
[0448] According to another advantageous characteristic of the
invention, the protection process aims at implementing a principle
of protection, called by <<renaming>> a description
of which is carried out in relation to FIGS. 80 to 85.
[0449] For the implementation of the principle of protection by
renaming, are defined: [0450] a set of dependent functions, whose
dependent functions are liable to be executed, by means of the second
execution part 2peu, in the unit 6, and possibly to transfer data
between the data processing system 3 and the unit 6, said set of
dependent functions can be finite or infinite, [0451] a set of triggering
commands for said dependent functions, said triggering commands
being liable to be executed in the data processing system 3 and
to trigger in the unit 6, the execution of corresponding dependent
functions, [0452] for each triggering command, an order corresponding
at least in part to the information transmitted by the first execution
part 2pes, to the second execution part 2peu, so as to trigger the
execution of the corresponding dependent function, said order having
the form of at least one argument of the triggering command, [0453]
a method of renaming of the orders designed to be used during the
modification of the vulnerable software 2v, such a method enabling
to rename the orders so as to obtain triggering commands with renamed
orders enabling to conceal the identity of the corresponding dependent
functions, [0454] and restoring means 20 designed to be used in
the unit 6 during the usage phase and enabling to restore the initial
order, from the renamed order, so as to restore the dependent function
to execute.
[0455] For the implementation of the principle of protection by
renaming, are also constructed exploitation means enabling to transform
a blank unit 60 into a unit 6 implementing at least the restoring
means 20.
[0456] For the implementation of the principle of protection by
renaming, are also chosen, in the source of the vulnerable software
2vs: [0457] at least one algorithmic processing using at least one
operand and returning at least one result, [0458] and at least one
portion of the source of the vulnerable software 2vs, containing
at least one chosen algorithmic processing.
[0459] The source of the vulnerable software 2vs is then modified,
so as to obtain the source of the protected software 2ps. This modification
is such that, among others: [0460] during the execution of the protected
software 2p, at least one portion of the 25 first execution part
2pes, which is executed in the data processing system 3, takes into
account that the functionality of at least one chosen algorithmic
processing is executed in the unit 6, [0461] during the execution
of the protected software 2p, the second execution part 2peu, which
is executed in the unit 6, executes at least the functionality of
at least one chosen algorithmic processing, [0462] each chosen algorithmic
processing is split so that during the execution of the protected
software 2p, each chosen algorithmic processing is executed, by
means of the second execution part 2peu, using dependent functions.
Preferably, each chosen algorithmic processing is split into dependent
functions fd.sub.n (with n varying from 1 to N), namely: [0463]
possibly one or several dependent functions enabling the placing
of one or several operands at the unit 6's disposal, [0464] dependent
functions, some of which use the operand(s) and execute in combination
the functionality of the chosen algorithmic processing, using said
operand(s), [0465] and possibly, one or several dependent functions
enabling the placing by the unit 6, at the data processing system
3's disposal of the result of the chosen algorithmic processing,
[0466] during the execution of the protected software 2p, the second
execution part 2peu executes the dependent functions fd.sub.n, [0467]
during the execution of the protected software 2p, the dependent
functions are triggered by triggering commands with renamed orders,
[0468] and a sequence of the triggering commands is chosen among
the set of sequences allowing the execution of the protected software
2p.
[0469] The first execution part 2pes of the protected software
2p, executed in the data processing system 3, executes triggering
commands with renamed orders transferring renamed orders to the
unit 6, and triggering in the unit 6 the restoring by means of the
restoring means 20, of the orders, and then the execution by means
of the second execution part 2peu, of each of the previously defined
dependent functions fd.sub.n.
[0470] In other words, the principle of protection by renaming
is carried out by renaming the orders of the triggering commands,
so as to obtain triggering commands with renamed orders whose execution
in the data processing system 3, triggers in the unit 6, the execution
of the dependent functions which would have been triggered by the
triggering commands with not-renamed orders, without however the
examination of the protected software 2p enabling to determine the
identity of the executed dependent functions.
[0471] FIG. 80 illustrates an example of execution of a vulnerable
software 2v. In this example, appears during the execution of the
vulnerable software 2v in the data processing system 3, at a certain
time instant, the calculation of Z.rarw.F(X, Y) corresponding to
the assignment to a variable Z of the result of an algorithmic processing
represented by a function F and using the operands X and Y.
[0472] FIGS. 81 and 82 illustrate an example of implementation
of the invention.
[0473] FIG. 81 illustrates the partial implementation of the invention.
In this example, during the execution in the data processing system
3 of the first execution part 2pes of the protected software 2p
and in the presence of the unit 6, appear: [0474] at time instants
t.sub.1, t.sub.2, the execution of the triggering commands CD.sub.1,
CD.sub.2 triggering in the unit 6, the execution by means of the
second execution part 2peu, of the corresponding dependent functions
fd.sub.1, fd.sub.2 which provide the transfer of data X, Y from
the data processing system 3 to the memorization zones respectively
x, y located in the memorization means 15 of the unit 6, said triggering
commands CD.sub.1, CD.sub.2 being represented respectively by OUT(x,
X), OUT(y, Y), [0475] at time instants t.sub.3 to t.sub.N-1, the
execution of the triggering commands CD.sub.3 to CD.sub.N-1, triggering
in the unit 6, the execution by means of the second execution part
2peu, of the corresponding dependent functions fd.sub.3 to fd.sub.N-1,
said triggering commands CD.sub.3 to CD.sub.N-1 being represented
respectively, by TRIG(fd.sub.3) to TRIG(fd.sub.N-1). The series
of dependent functions fd.sub.3 to fd.sub.N-1 executed in combination
is algorithmically equivalent to the function F. More precisely,
the execution of said triggering commands leads to the execution
in the unit 6, of the dependent functions fd.sub.3 to fd.sub.N-1
which use the contents of the memorization zones x, y and return
the result in a memorization zone z of the unit 6, [0476] and at
time instant t.sub.N, the execution of a triggering command CD.sub.N
triggering in the unit 6, the execution by means of the second execution
part 2peu, of the dependent function fd.sub.N providing the transfer
of the result of the algorithmic processing contained in the memorization
zone z of the unit 6 to the data processing system 3, so as to assign
it to the variable Z, said command being represented by IN(z).
[0477] In this example, to completely implement the invention,
are chosen as orders, the first argument of the triggering commands
OUT and the argument of the triggering commands TRIG and IN. The
orders chosen in this way are renamed using the method of renaming
of the orders. In this manner, the orders of the triggering commands
CD.sub.1 to CD.sub.N i.e. x, y, fd.sub.3, fd.sub.N-1, z are renamed
so as to obtain respectively R(x), R(y), R(fd.sub.3), . . . , R(fd.sub.N-1),
R(z).
[0478] FIG. 82 illustrates the complete implementation of the invention.
In this example, during the execution in the data processing system
3, of the first execution part 2pes of the protected software 2p,
and in the presence of the unit 6, appear:
[0479] at time instants t.sub.1, t.sub.2, the execution of the
triggering commands with renamed orders CDCR.sub.1, CDCR.sub.2,
transferring to the unit 6, the renamed orders R(x), R(y) as well
as the data X, Y triggering in the unit 6 the restoring by means
of the restoring means 20, of the renamed orders to restore the
orders i.e. the identity of the memorization zones x, y, and then
the execution by means of the second execution part 2peu, of the
corresponding dependent functions fdl, fd.sub.2 which provide the
transfer of the data X, Y from the data processing system 3 to the
memorization zones respectively x, y located in the memorization
means 15 of the unit 6, said triggering commands with renamed orders
CDCR.sub.1, CDCR.sub.2 being represented respectively by OUT (R(x),
X), OUT (R(y), Y), [0480] at time instants t.sub.3 to t.sub.N-1,
the execution of the triggering commands with renamed orders CDCR.sub.3
to CDCR.sub.N-1, transferring to the unit 6, the renamed orders
R(fd.sub.3) to R(fd.sub.N-1), triggering in the unit 6 the restoring
by means of the restoring means 20, of the orders, i.e. fd.sub.3
to fd.sub.N-1, and then the execution by means of the second execution
part 2peu, of the dependent functions fd.sub.3 to fd.sub.N-1, said
triggering commands with renamed orders CDCR.sub.3 to CDCR.sub.N-1
being represented respectively by TRIG (R(fd.sub.3)) to TRIG (R(fd.sub.N-1)),
[0481] and at time instant t.sub.N, the execution of the triggering
command with renamed order CDCR.sub.N transferring to the unit 6,
the renamed order R(z) triggering in the unit 6 the restoring by
means of restoring means 20, of the order i.e. the identity of the
memorization zone z, and then the execution by means of the second
execution part 2peu, of the dependent function fd.sub.N providing
the transfer of the result of the algorithmic processing contained
in the memorization zone z of the unit 6 to the data processing
system 3, so as to assign it to the variable Z, said triggering
command with renamed order CDCR.sub.N being represented by IN (R(z)).
[0482] In the illustrated example, the triggering commands with
renamed orders 1 to N are executed successively. It should be observed
that two improvements can be effected: [0483] The first improvement
concerns the case where several algorithmic processings are remoted
to the unit 6 and at least the result of one algorithmic processing
is used by another algorithmic processing. In this case, some triggering
commands with renamed orders used for the transfer, can possibly
be removed. [0484] The second improvement aims at opting for a pertinent
sequence of the triggering commands with renamed orders among the
set of sequences allowing the execution of the protected software
2p. In this respect, it is preferable to choose a sequence of the
triggering commands with renamed orders which dissociate temporally
the execution of the dependent functions, by intercalating, between
them portions of code executed in the data processing system 3 and
including or not triggering commands with renamed orders used of
the determination of other data. FIGS. 83 and 84 illustrate the
principle of such an embodiment.
[0485] FIG. 83 shows an example of execution of a vulnerable software
2v. In this example, appears, during the execution of the vulnerable
software 2v, in the data processing system 3, the execution of two
algorithmic processings leading to the determination of Z and Z',
such as Z.rarw.F (X, Y) and Z' .rarw. F' (X', Y').
[0486] FIG. 84 illustrates an example of implementation of the
process according to the invention for which the two algorithmic
proccesings chosen in FIG. 83 are remoted to the unit 6. According
to such an example, during the execution in the data processing
system 3 of the first execution part 2pes of the protected software
2p and in the presence of the unit 6, appear, as explained above,
the execution of the triggering commands with renamed orders CDCR,
to CDCR.sub.N corresponding to the determination of Z and the execution
of the triggering commands with renamed orders CDCR'.sub.1 to CDCR'.sub.M
corresponding to the determination of Z'. As illustrated, the triggering
commands with renamed orders CDCR.sub.1 to CDCR.sub.N are not executed
consecutively, inasmuch as the triggering commands with renamed
orders CDCR'.sub.1 to CDCR'.sub.M as well as other portions of code
are intercalated. In the example, the following sequence is thus
carried out: CDCR.sub.1, portion of intercalated code, CDCR'.sub.1,
CDCR.sub.2, portion of intercalated code, CDCR'.sub.2, CDCR'.sub.3,
portion of intercalated code, CDCR'.sub.4, CDCR.sub.3, CDCR.sub.4,
. . . , CDCR.sub.N, CDCR'.sub.M.
[0487] It should be observed that, during the execution of a portion
of the first execution part 2pes of the protected software 2p, the
triggering commands with renamed orders executed in the data processing
system 3, trigger in the unit 6 the restoring of the identity of
the corresponding dependent functions and then their execution.
Thus, it appears that in the presence of the unit 6, said portion
is executed correctly and that, consequently, the protected software
2p is completely functional.
[0488] FIG. 85 illustrates an example of an attempt of execution
of the protected software 2p, when the unit 6 is missing. In this
example, during the execution in the data processing system 3 of
the first execution part 2pes of the protected software 2p, at every
time instant, the execution of a triggering command with renamed
order can trigger neither the restoring of the order nor the execution
of the corresponding dependent function, because of the absence
of the unit 6. The value to assign to the variable Z cannot therefore
be determined correctly.
[0489] It therefore appears, that in the absence of the unit 6,
at least one request by a portion of the first execution part 2pes
of the protected software 2p, to trigger the restoring of an order
and the execution of a dependent function in the unit 6 cannot be
fulfilled correctly, so that at least said portion is not executed
correctly and that, consequently, the protected software 2p is not
completely functional.
[0490] Thanks to this principle of protection by renaming, the
examination in the protected software 2p of the triggering commands
with renamed orders does not enable to determine the identity of
the dependent functions which have to be executed in the unit 6.
It should be observed that the renaming of the orders is carried
out during the modification of the vulnerable 2v to a protected
software 2p.
[0491] According to a variant of the principle of protection by
renaming, is defined for at least one dependent function, a family
of dependent functions algorithmically equivalent but triggered
by different triggering commands with renamed orders. According
to this variant, for at least one algorithmic processing using dependent
functions, said algorithmic processing is split into dependent functions
which for at least one of them is replaced with a dependent function
of the same family instead of keeping several occurrences of the
same dependent function. To this end, triggering commands with renamed
orders are modified to take into account the replacement of dependent
functions with dependent functions of the same family. In other
words, two dependent functions of the same family have different
orders and consequently different triggering commands with renamed
orders and, it is not possible, by examining the protected software
2p, to discover that the dependent functions called are algorithmically
equivalent.
[0492] According to a first preferred embodiment of the variant
of the principle of protection by renaming, is defined for at least
one dependent function, a family of algorithmically equivalent dependent
functions, by concatenating a noise field to the information defining
the functional part of the dependent function to execute in the
unit 6.
[0493] According to a second preferred embodiment of the variant
of the principle of protection by renaming, is defined for at least
one dependent function, a family of algorithmically equivalent dependent
functions by using identification fields.
[0494] According to a preferred variant embodiment of the principle
of protection by renaming, is defined as method of renaming of the
orders a ciphering method enabling to cipher the orders to transform
them into renamed orders. Remember that the renaming of the orders
is carried out during the phase of protection P. For this preferred
variant, the restoring means 20 are means implementing a deciphering
method enabling to decipher the renamed orders and thus to restore
the identity of the dependent functions to execute in the unit 6.
Said restoring means are implemented in the unit 6 and can be of
software or hardware nature. Said restoring means 20 are appealed
to during the usage phase U each time a triggering command with
renamed order is executed in the data processing system 3 with the
intention of triggering in the unit 6, the execution of a dependent
function.
[0495] According to another advantageous characteristic of the
invention, the protection process aims at implementing a principle
of protection called by <<conditional branch>> a description
of which is carried out in relation to FIGS. 90 to 92.
[0496] For the implementation of the principle of protection by
conditional branch, is chosen in the source of the vulnerable software
2vs, at least one conditional branch BC. Is also chosen at least
one portion of the source of the vulnerable software 2vs containing
at least one chosen conditional branch BC.
[0497] At least one chosen portion of the source of the vulnerable
software 2vs is then modified, so as to obtain the source of the
protected software 2ps. This modification is such that, during the
execution of the protected software 2p, among others: [0498] at
least one portion of the first execution part 2pes, which is executed
in the data processing system 3, takes into account that the functionality
of at least one chosen conditional branch BC is executed in the
unit 6, [0499] and the second execution part 2peu, which is executed
in the unit 6, executes at least the functionality of at least one
chosen conditional branch BC and puts at the data processing system
3's disposal, a piece of information enabling the first execution
part 2pes, to carry on its execution at the chosen spot.
[0500] The first execution part 2pes of the protected software
2p, executed in the data processing system 3, executes conditional
branches commands, triggering in the unit 6, the execution by means
of the second execution part 2peu, of remoted conditional branches
be whose functionality is equivalent to the functionality of the
chosen conditional branches BC.
[0501] FIG. 90 illustrates an example of execution of a vulnerable
software 2v. In this example, appears, during the execution of the
vulnerable software 2v in the data processing system 3 at a certain
time instant, a conditional branch BC indicating to the vulnerable
software 2v the spot where to carry on its execution, i.e. one of
the three possible spots B.sub.1, B.sub.2 or B.sub.3. It must be
understood that the conditional branch BC takes the decision to
carry on the execution of the software at spot B.sub.1, B.sub.2
or B.sub.3.
[0502] FIG. 91 illustrates an example of implementation of the
invention for which the conditional branch chosen to be remoted
to the unit 6, corresponds to the conditional branch BC. In this
example, during the execution in the data processing system 3 of
the first execution part 2pes of the protected software 2p and in
the presence of the unit 6, appear: [0503] at time instant t.sub.1,
the execution of the conditional branch command CBC.sub.1 triggering
in the unit 6, the execution by means of the second execution part
2peu, of the remoted conditional branch be algorithmically equivalent
to the conditional branch BC, said conditional branch command CBC,
being represented by TRIG(bc), [0504] and at time instant t.sub.2,
the transfer from the unit 6 to the data processing system 3, of
the information enabling the first execution part 2pes, to carry
on its execution at the chosen spot, i.e. the spot B.sub.1, B.sub.2
or B.sub.3.
[0505] It should be observed that during the execution of a portion
of the first execution part 2pes of the protected software 2p, the
conditional branches commands executed in the data processing system
3 trigger the execution of the corresponding remoted conditional
branches in the unit 6. Thus, it appears, that in the presence of
the unit 6, said portion is executed correctly and that, consequently,
the protected software 2p is completely functional.
[0506] FIG. 92 illustrates an example of an attempt of execution
of the protected software 2p, when the unit 6 is missing. In this
example, during the execution in the data processing system 3 of
the first execution part 2pes of the protected software 2p: [0507]
at time instant t.sub.1, the execution of the conditional branch
command CBC.sub.1, cannot trigger the execution of the remoted conditional
branch bc, taking into account the absence of the unit 6, [0508]
and at time instant t.sub.2, the transfer of the piece of information
enabling the first execution part 2pes to carry on at the chosen
spot fails taking into account the absence of the unit 6.
[0509] It therefore appears that in the absence of the unit 6,
at least one request by a portion of the first execution part 2pes
to trigger the execution of a remoted conditional branch in the
unit 6, cannot be fulfilled correctly, so that at least said portion
is not executed correctly and that, consequently, the protected
software 2p is not completely functional.
[0510] In the previous description in relation to FIGS. 90 to 92,
the subject of the invention aims at remoting in the unit 6, a conditional
branch. Naturally, a preferred embodiment of the invention can be
carried out by remoting in the unit 6, a series of conditional branches
whose overall functionality is equivalent to all the functionalities
of the conditional branches which have been remoted. The execution
of the overall functionality of said series of remoted conditional
branches leads to the placing at the data processing system 3's
disposal of a piece of information enabling the first execution
part 2pes of the protected software 2p to carry on its execution
at the chosen spot.
[0511] In the previous description in relation to FIGS. 40 to 92,
six different principles of software protection have been made explicit
generally speaking independently of one another. The protection
process in accordance with the invention, is implemented by using
the principle of protection by temporal dissociation, possibly combined
with one or several other principles of protection. In the case
where the principle of protection by temporal dissociation is complemented
by the implementation of at least another principle of protection,
the principle of protection by temporal dissociation is advantageously
complemented by the principle of protection by variable and/or the
principle of protection by elementary functions and/or the principle
of protection by conditional branch.
[0512] And when the principle of protection by variable is also
implemented, it can be complemented in its turn by the principle
of protection by elementary functions and/or the principle of protection
by conditional branch.
[0513] And when the principle of protection by elementary functions
is also implemented, it can be complemented in its turn by the principle
of protection by detection and coercion and/or the principle of
protection by renaming and/or the principle of protection by conditional
branch.
[0514] And when the principle of protection by detection and coercion
is also implemented, it can be complemented in its turn by the principle
of protection by renaming and/or the principle of protection by
conditional branch.
[0515] And when the principle of protection by renaming is also
implemented, it can be complemented in its turn by the principle
of protection by conditional branch.
[0516] According to the preferred variant embodiment, the principle
of protection by temporal dissociation is complemented by the principle
of protection by variable, complemented by the principle of protection
by elementary functions, complemented by the principle of protection
by detection and coercion, complemented by the principle of protection
by renaming, complemented by the principle of protection by conditional
branch.
[0517] In the case where a principle of protection is applied,
in complement to the principle of protection by temporal dissociation,
its previously carried out description must include, to take into
account its combined implementation, the following modifications:
[0518] the notion of vulnerable software must be understood as software
vulnerable towards the principle of protection being described.
Thus, in the case where a principle of protection has already been
applied to the vulnerable software, the expression "vulnerable
software" must be interpreted by the reader as the expression
"software protected by the principle(s) of protection already
applied"; [0519] the notion of protected software must be understood
as software protected towards the principle of protection being
described. Thus, in the case where a principle of protection has
already been applied, the expression "protected software"
must be interpreted by the reader as the expression "new version
of the protected software"; [0520] and the choice(s) made for
the implementation of the principle of protection being described
must take into account the choice(s) made for the implementation
of the principle(s) of protection already applied.
[0521] The rest of the description enables to have a better understanding
of the implementation of the protection process in accordance with
the invention. This protection process according to the invention
is composed, as shown more precisely in FIG. 100: [0522] first,
of a protection phase P during which a vulnerable software 2v is
modified to become a protected software 2p, [0523] then, of a usage
phase U during which the protected software 2p is used.
[0524] During this usage phase U: [0525] in the presence of the
unit 6 and each time a portion of the first execution part 2pes
executed in the data processing system 3 imposes it, an imposed
functionality is executed in the unit 6, so that said portion is
executed correctly and that, consequently, the protected software
2p is completely functional, [0526] in the absence of the unit 6
and in spite of the request by a portion of the first execution
part 2pes to execute a functionality in the unit 6, said request
cannot be fulfilled correctly, so that at least said portion is
not executed correctly and that consequently, the protected software
2p is not completely functional, [0527] and possibly of a phase
of refilling R during which is credited at least one additional
usage of a functionality protected by the implementation of the
second preferred variant embodiment of the principle of protection
by detection and coercion using as characteristic, a variable of
measurement.
[0528] The protection phase P can be split into two protection
sub-phases P.sub.1 and P.sub.2. The first one, called prior protection
sub-phase P.sub.1, takes place independently of the vulnerable software
2v to protect. The second one, called subsequent protection sub-phase
P.sub.2 is dependent of the vulnerable software 2v to protect. It
should be observed that the prior protection sub-phase P.sub.1 and
the subsequent protection sub-phase P.sub.2 can be carried out advantageously
by two different persons or two different teams. For instance, the
prior protection sub-phase P.sub.1 can be carried out by a person
or a company providing the development of software protection systems,
while the subsequent protection sub-phase P.sub.2 can be carried
out by a person or a company providing the development of software
requiring to be protected. Naturally, it is clear that the prior
protection sub-phase P.sub.1 and the subsequent protection sub-phase
P.sub.2 can also be carried out by the same person or team.
[0529] The prior protection sub-phase P.sub.1 is composed of several
stages S.sub.11, . . . , S.sub.11 for each of which various tasks
or jobs are to be carried out.
[0530] The first stage of this prior protection sub-phase P.sub.1
is called "definitions stage S.sub.11''. During this definitions
stage S.sub.11: [0531] are chosen: [0532] the type of the unit 6.
As an illustrative example, can be chosen as unit 6, a chip card
reader 8 and the chip card 7 associated to the reader, [0533] and
the transfer means 12, 13 designed to be implemented respectively
in the data processing system 3 and in the unit 6, during the usage
phase U and capable of providing the transfer of data between the
data processing system 3 and the unit 6, [0534] and in the case
where the protection process according to the invention implements
the principle of protection by elementary function, are also defined:
[0535] a set of elementary functions whose elementary functions
are liable to be executed in the unit 6, [0536] and a set of elementary
commands for said set of elementary functions, said elementary commands
being liable to be executed in the data processing system 3 and
to trigger the execution in the unit 6, of the elementary functions,
[0537] and in the case where the protection process according to
the invention implements the principle of protection by detection
and coercion, are also defined: [0538] at least one software execution
characteristic, liable to be monitored at least in part in the unit
6, [0539] at least one criterion to abide by for at least one software
execution characteristic, [0540] detection means 17 to implement
in the unit 6 and enabling to detect that at least one software
execution characteristic does not abide by at least one associated
criterion, [0541] and coercion means 18 to implement in the unit
6 and enabling to inform the data processing system 3 and/or modify
the execution of a software, when at least one criterion is not
abided by, [0542] and in the case where the protection process according
to the invention implements the principle of protection by detection
and coercion using as characteristic a variable of measurement of
the software execution, are also defined: [0543] as software execution
characteristic liable to be monitored, a variable of measurement
of the usage of a functionality of a software, [0544] as criterion
to abide by, at least one threshold associated to each variable
of measurement, [0545] and actualization means enabling to update
at least one variable of measurement, [0546] and in the case where
the protection process according to the invention also implements
a first preferred variant embodiment of the principle of protection
by detection and coercion using as characteristic a variable of
measurement of the software execution, are also defined: [0547]
for at least one variable of measurement, several associated thresholds,
[0548] and different coercion means corresponding to each of said
thresholds, [0549] and in the case where the protection process
according to the invention implements a second preferred variant
embodiment of the principle of protection by detection and coercion
using as characteristic a variable of measurement of the software
execution, are also defined refilling means enabling to add at least
one additional usage to at least one software functionality monitored
by a variable of measurement, [0550] and in the case where the protection
process according to the invention implements the principle of protection
by detection and coercion using as characteristic a profile of software
usage, are also defined: [0551] as software execution characteristic
liable to be monitored, a profile of software usage, [0552] and
as criterion to abide by, at least one feature of software execution,
[0553] and in the case where the protection process according to
the invention implements the principle of protection by detection
and coercion using as feature of execution to abide by, the monitoring
of the execution chaining, are also defined: [0554] an instructions
set whose instructions are liable to be executed in the unit 6,
[0555] a set of instructions commands for said instructions set,
said instructions commands being liable to be executed in the data
processing system 3 and to trigger in the unit 6 the execution of
the instructions, [0556] as profile of usage, the chaining of the
instructions, [0557] as feature of execution, an expected chaining
for the execution of the instructions, [0558] as detection means
17, means enabling to detect that the chaining of the instructions
does not correspond to the expected one, [0559] and as coercion
means 18, means enabling to inform the data processing system 3
and/or to modify the functioning of the portion of protected software
2p when the chaining of the instructions does not correspond to
the expected one, [0560] and in the case where the protection process
according to the invention implements a preferred variant embodiment
of the principle of protection by detection and coercion using as
feature of execution to abide by, the monitoring of the execution
chaining, are also defined: [0561] as instructions set, an instructions
set whose at least some instructions work with registers and use
at least one operand with the intention of returning a result, [0562]
for at least some of the instructions working with registers: [0563]
a part PF defining the functionality of the instruction, [0564]
and a part defining the expected chaining for the execution of the
instructions and including bits fields corresponding to: [0565]
an identification field of the instruction CII, [0566] and for each
operand of the instruction: [0567] a flag field CD.sub.k, [0568]
and an expected identification field CIP.sub.k of the operand, [0569]
for each register belonging to the exploitation means and used by
the instructions set, a generated identification field CIG.sub.v
in which is automatically memorized the identification of the last
instruction which has returned its result in said register, [0570]
as detection means 17, means enabling, during the execution of an
instruction, for each operand, when the flag field CD.sub.k imposes
it, to check the equality of the generated identification field
CIG.sub.v corresponding to the register used by said operand, and
the expected identification field CIP.sub.k of the origin of said
operand, [0571] and as coercion means 18, means enabling to modify
the result of the instructions, if at least one of the checked equalities
is false. [0572] and in the case where the protection process according
to the invention implements the principle of protection by renaming,
are also defined: [0573] as a triggering command, an elementary
command or an instruction command, [0574] as a dependent function,
an elementary function or an instruction, [0575] as an order, at
least one argument for a triggering command, corresponding at least
in part to the information transmitted by the data processing system
3 to the unit 6, so as to trigger the execution of the corresponding
dependent function, [0576] a method of renaming of the orders enabling
to rename the orders so as to obtain triggering commands with renamed
orders, [0577] and restoring means 20 designed to be used in the
unit 6 during the usage phase U, and enabling to restore the dependent
function to execute, from the renamed order, [0578] and in the case
where the protection process according to the invention implements
a variant of the principle of protection by renaming, is also defined
for at least one dependent function, a family of dependent functions
algorithmically equivalent, but triggered by triggering commands
whose renamed orders are different, [0579] and in the case where
the protection process according to the invention implements one
of the preferred embodiments of the variant of the principle of
protection by renaming, are also defined for at least one dependent
function, a family of algorithmically equivalent dependent functions:
[0580] by concatenating a field of noise to the information defining
the functional part of the dependent function to execute in the
unit 6, [0581] or by using the identification field of the instruction
CII and the expected identification fields CIP.sub.k of the operands.
[0582] and in the case where the protection process according to
the invention implements a preferred variant of the principle of
protection by renaming, are also defined: [0583] as method of renaming
of the orders, a ciphering method to cipher the orders, [0584] and
as restoring means 20, means implementing a deciphering method to
decipher the renamed orders and thus restore the identity of the
dependent functions to execute in the unit 6.
[0585] During the prior protection sub-phase Pl.sub.1the definitions
stage S.sub.11 is followed by a stage called "construction
stage S.sub.12". During such a stage S.sub.12, are constructed
the transfer means 12, 13 and the exploitation means corresponding
to the definitions of the definitions stage S.sub.11.
[0586] During this construction stage S.sub.12, are therefore carried
out: [0587] the construction of the transfer means 12, 13 enabling,
during the usage phase U, the transfer of data between the data
processing system 3 and the unit 6, [0588] and when the principle
of protection by elementary functions is also implemented, the construction
of the exploitation means also enabling the unit 6, during the usage
phase U to execute the elementary functions of the set of elementary
functions, [0589] and when the principle of protection by detection
and coercion is also implemented, the construction: [0590] of the
exploitation means enabling the unit 6, during the usage phase U
to also implement the detection means 17 and the coercion means
18, [0591] and possibly of the exploitation means enabling the unit
6, during the usage phase U to also implement the actualization
means, [0592] and possibly of the exploitation means enabling the
unit 6, during the usage phase U to also implement the refilling
means, [0593] and possibly of the exploitation means also enabling
the unit 6, during the usage phase U to execute the instructions
of the instructions set, [0594] and when the principle of protection
by renaming is also implemented, the construction of the exploitation
means enabling the unit 6, during the usage phase U to also implement
the restoring means.
[0595] The construction of the exploitation means is carried out
classically, through a program development unit and taking into
account the definitions intervened in the definitions stages SI,.
Such a unit is described in the rest of the description in FIG.
110.
[0596] During the prior protection sub-phase P.sub.1, the construction
stage S.sub.12 can be followed by a stage called "pre-customization
stage S.sub.13''. During this pre-customization stage S.sub.13,
at least a part of the transfer means 13 and/or the exploitation
means are uploaded to at least one blank unit 60, with the intention
of obtaining at least one pre-customized unit 66. It should be observed
that part of the exploitation means, once transferred to a pre-customized
unit 66, is no longer directly accessible outside said pre-customized
unit 66. The transfer of the exploitation means to a blank unit
60 can be carried out through an adapted pre-customization unit,
which is described in the rest of the description in FIG. 120. In
the case of a pre-customized unit 66, constituted by a chip card
7 and its reader 8, the pre-customization concerns only the chip
card 7.
[0597] During the prior protection sub-phase P.sub.1, after the
definitions stage S.sub.11 and, possibly after the construction
stage S.sub.12, a stage called "tools making stage S.sub.14"
can take place. During this tools making stage S.sub.14 are made
tools enabling to help generate protected software or automate the
protection of software. Such tools enable: [0598] to help choose
or to choose automatically in the vulnerable software 2v to protect:
[0599] the algorithmic processing(s) liable to be split into steps
remotable in the unit 6, [0600] the portion(s) liable to be modified,
[0601] and when the principle of protection by variable is also
implemented, the variable(s) liable to be remoted in the unit 6,
[0602] and when the principle of protection by elementary functions
is also implemented, the algorithmic processing(s) liable to be
split into elementary functions remotable in the unit 6, [0603]
and when the principle of protection by detection and coercion is
also implemented, the software execution characteristic(s) to monitor
and, possibly, the algorithmic processing(s) liable to be split
into instructions remotable in the unit 6, [0604] and when the principle
of protection by renaming is also implemented, the algorithmic processing(s)
liable to be split into dependent functions remotable in the unit
6 and for which the orders of the triggering commands can be renamed,
[0605] and when the principle of protection by conditional branch
is also implemented, the conditional branch(es) whose functionality
is liable to be remoted in the unit 6, [0606] and, possibly, to
help generate protected software or to automate the protection of
software.
[0607] These different tools can be carried out independently or
in combination and each tool can have various forms, such as for
instance pre-processor, assembler, compiler, etc.
[0608] The prior protection sub-phase P.sub.1 is followed by a
subsequent protection sub-phase P.sub.2 which depends on the vulnerable
software 2v to protect. This subsequent protection sub-phase P.sub.2
is composed of several stages as well. The first stage corresponding
to the implementation of the principle of protection by temporal
dissociation is called "creation stage S.sub.21''. During this
creation stage S.sub.21, the choices made during the definition
stage S.sub.11 are used. With the aid of said choices and possibly
of tools constructed during the tools making stage S.sub.14, the
protected software 2p is created: [0609] by choosing, at least one
algorithmic processing which, during the execution of the vulnerable
software 2v, uses at least one operand and enables to obtain at
least one result, [0610] by choosing at least one portion of the
source of the vulnerable software 2vs containing, at least one chosen
algorithmic processing, [0611] by producing a source of the protected
software 2ps from the source of the vulnerable software 2vs, by
modifying at least one chosen portion of the source of the vulnerable
software 2vs to obtain at least one modified portion of the source
of the protected software 2ps, this modification being such that:
[0612] during the execution of the protected software 2p a first
execution part 2pes is executed in the data processing system 3
and a second execution part 2peu is executed in a unit 6, obtained
from the blank unit 60 after upload of information, [0613] the second
execution part 2peu executes at least the functionality of at least
one chosen algorithmic processing, [0614] at least one chosen algorithmic
processing is split so that during the execution of the protected
software 2p appear by means of the second execution part 2peu, several
distinct steps, namely: [0615] the placing of at least one operand
at the unit 6's disposal, [0616] the carrying out by the unit 6,
of the algorithmic processing's functionality on at least said operand,
[0617] and possibly, the placing at the data processing system 3's
disposal of at least one result by the unit 6, [0618] for at least
one chosen algorithmic processing, steps commands are defined so
that during the execution of the protected software 2p, each step
command is executed by the first execution part 2pes and triggers,
in the unit 6, the execution by means of the second execution part
2peu, of a step, [0619] and a sequence of the steps commands is
chosen among the set of sequences allowing the execution of the
protected software 2p, [0620] and by producing: [0621] a first object
part 2pos of the protected software 2p, from the source of the protected
software 2ps, said first object part 2pos being such that during
the execution of the protected software 2p, appears a first execution
part 2pes which is executed in the data processing system 3 and
whose at least a portion takes into account that the steps commands
are executed according to the chosen sequence, [0622] and a second
object part 2pou of the protected software 2p, said second object
part 2pou being such that, after being uploaded to the blank unit
60 and during the execution of the protected software 2p, appears
the second execution part 2peu by means of which the steps triggered
by the first execution 2pes are executed.
[0623] Naturally, the principle of protection by temporal dissociation
according to the invention can be applied directly during the development
of a new software without requiring the prior realization of a vulnerable
software 2v. In this way, a protected software 2p is obtained directly.
[0624] During the subsequent protection sub-phase P.sub.2, and
when at least another principle of protection is applied in addition
to the principle of protection by temporal dissociation, a "modification
stage S.sub.22" takes place. During this modification stage
S.sub.22, are used the definitions intervened in the definitions
stage S.sub.11. Using said definitions and possibly tools constructed
during the tools making stage S.sub.14, the protected software 2p
is modified to allow the implementation of the principles of protection
according to one of the arrangements herebefore defined.
[0625] When the principle of protection by variable is implemented,
the protected software 2p is modified: [0626] a by choosing at least
one variable used in at least one chosen algorithmic processing,
which during the execution of the protected software 2p, partially
defines the state of the protected software 2p, [0627] by modifying
at least one chosen portion of the source of the protected software
2ps, this modification being such that during the execution of the
protected software 2p, at least one chosen variable or at least
one copy of chosen variable resides in the unit 6, [0628] and by
producing: [0629] the first object part 2pos of the protected software
2p, said first object part 2pos being such that during the execution
of the protected software 2p, at least one portion of the first
execution part 2pes takes also into account that at least one variable
or at least one copy of variable resides in the unit 6, [0630] and
the second object part 2pou of the protected software 2p, said second
object part 2pou being such that, after upload to the unit 6 and
during the execution of the protected software 2p, appears the second
execution part 2peu by means of which at least one chosen variable,
or at least one copy of chosen variable resides too in the unit
6.
[0631] When the principle of protection by elementary functions
is implemented, the protected software 2p is modified: [0632] by
modifying at least one chosen portion of the source of the protected
software 2ps, this modification being such that: [0633] at least
one step is split so that during the execution of the protected
software 2p, said step is executed by means of the second execution
part 2peu, using elementary functions, [0634] for at least one split
step, elementary commands are integrated to the source of the protected
software 2ps, so that during the execution of the protected software
2p, each elementary command is executed by the first execution part
2pes and triggers in the unit 6, the execution by means of the second
execution part 2peu, of an elementary function, [0635] and a sequence
of the elementary commands is chosen among the set of sequences
allowing the execution of the protected software 2p, [0636] and
by producing: [0637] the first object part 2pos of the protected
software 2p, said first object part 2pos being such that during
the execution of the protected software 2p, at least one portion
of the first execution part 2pes also executes the elementary commands
according to the chosen sequence, [0638] and the second object part
2pou of the protected software 2p also containing the exploitation
means, said second object part 2pou being such that, after upload
to the unit 6 and during the execution of the protected software
2p, appears the second execution part 2peu by means of which are
also executed the elementary functions triggered by the first execution
part 2pes.
[0639] When the principle of protection by detection and coercion
is implemented, the protected software 2p is modified: [0640] by
choosing at least one software execution characteristic to monitor,
among the software execution characteristics liable to be monitored,
[0641] by choosing at least one criterion to abide by for at least
one chosen software execution characteristic, [0642] by choosing
in the source of the protected software 2ps, elementary functions
for which at least one chosen software execution characteristic
is to be monitored, [0643] by modifying at least one chosen portion
of the source of the protected software 2ps, this modification being
such that during the execution of the protected software 2p, at
least one chosen execution characteristic is monitored by means
of the second execution part 2peu, and the fact that a criterion
is not abided by leads to the data processing system 3 being informed
and/or to a modification of the execution of the protected software
2p, [0644] and by producing the second object part 2pou of the protected
software 2p containing the exploitation means also implementing
the detection means 17 and the coercion means 18, said second object
part 2pou being such that, after upload to the unit 6 and during
the execution of the protected software 2p, at least one software
execution characteristic is monitored and the fact that a criterion
is not abided by leads to the data processing system 3 being informed
and/or to a modification of the execution of the protected software
2p.
[0645] For the implementation of the principle of protection by
detection and coercion using as characteristic a variable of measurement
of the software execution, the protected software 2p is modified:
[0646] by choosing as software execution characteristic to monitor,
at least one variable of measurement of the usage of at least one
functionality of a software, [0647] by choosing: [0648] at least
one functionality of the protected software 2p whose usage is liable
to be monitored using a variable of measurement, [0649] at least
one variable of measurement used to quantify the usage of said functionality,
[0650] at least one threshold associated to a chosen variable of
measurement corresponding to a limit of usage of said functionality,
[0651] and at least one method of update of a chosen variable of
measurement depending on the usage of said functionality, [0652]
and by modifying at least one chosen portion of the source of the
protected software 2ps, this modification being such that, during
the execution of the protected software 2p, the variable of measurement
is actualized by means of the second execution part 2peu depending
on the usage of said functionality, and at least one threshold crossing
is taken into account.
[0653] For the implementation of a first preferred variant embodiment
of the principle of protection by detection and coercion using,
as characteristic, a variable of measurement, the protected software
2p is modified: [0654] by choosing in the source of the protected
software 2ps, at least one chosen variable of measurement to which
must be associated several thresholds corresponding to different
limits of usage of the functionality, [0655] by choosing at least
two thresholds associated to the chosen variable of measurement,
[0656] and by modifying at least one chosen portion of the source
of the protected software 2ps, this modification being such that,
during the execution of the protected software 2p, the crossings
of the various thresholds are taken into account differently, by
means of the second execution part 2peu.
[0657] For the implementation of a second preferred variant embodiment
of the principle of protection by detection and coercion using as
characteristic, a variable of measurement, the protected software
2p is modified: [0658] by choosing in the source of the protected
software 2ps, at least one chosen variable of measurement enabling
to limit the usage of a functionality and which must be able to
be credited with at least one additional usage, [0659] and by modifying
at least one chosen portion, this modification being such that during
a phase called of refilling, at least one additional usage of at
least one functionality corresponding to a chosen variable of measurement
can be credited.
[0660] For the implementation of the principle of protection by
detection and coercion using as characteristic, a profile of software
usage, the protected software 2p is modified: [0661] by choosing
as software execution characteristic to monitor at least one profile
of software usage, [0662] by choosing at least one feature of execution
by which at least one chosen profile of usage must abide, [0663]
and by modifying at least one chosen portion of the source of the
protected software 2ps, this modification being such that, during
the execution of the protected software 2p, the second execution
part 2peu abides by all the chosen features of execution.
[0664] For the implementation of the principle of protection by
detection and coercion using as feature of execution to abide by,
the monitoring of the execution chaining, the protected software
2p is modified: [0665] by modifying at least one chosen portion
of the source of the protected software 2ps: [0666] by transforming
the elementary functions into instructions, [0667] by specifying
the chaining by which must abide at least some of the instructions
during their execution in the unit 6, [0668] and by transforming
the elementary commands into instructions commands corresponding
to the instructions used.
[0669] When the principle of protection by renaming is implemented,
the protected software 2p is modified: [0670] by choosing in the
source of the protected software 2ps, triggering commands, [0671]
by modifying at least one chosen portion of the source of the protected
software 2ps by renaming the orders of the chosen triggering commands,
so as to conceal the identity of the corresponding dependent functions,
[0672] and by producing: [0673] the first object part 2pos of the
protected software 2p, said first object part 2pos being such that
during the execution of the protected software 2p, the triggering
commands with renamed orders are executed, [0674] and the second
object part 2pou of the protected software 2p containing the exploitation
means also implementing the restoring means 20, said second object
part 2pou being such that, after upload to the unit 6 and during
the execution of the protected software 2p, the identity of the
dependent functions whose execution is triggered by the first execution
part 2pes is restored by means of the second execution part 2peu,
and the dependent functions are executed by means of the second
execution part 2peu.
[0675] For the implementation of a variant of the principle of
protection by renaming, the protected software 2p is modified: [0676]
by choosing, in the source of the protected software 2ps at least
one triggering command with renamed order, [0677] and by modifying
at least one chosen portion of the source of the protected software
2ps by replacing at least the renamed order of one chosen triggering
command with renamed order, with another renamed order, triggering
a dependent function of the same family.
[0678] When the principle of protection by conditional branch is
implemented, the protected software 2p is modified: [0679] by choosing,
in the source of the protected software 2ps, at least one conditional
branch carried out in at least one chosen algorithmic processing,
[0680] by modifying at least one chosen portion of the source of
the protected software 2ps, this modification being such that during
the execution of the protected software 2p, the functionality of
at least one chosen conditional branch is executed, by means of
the second execution part 2peu, in the unit 6, [0681] and by producing:
[0682] the first object part 2pos of the protected software 2p,
said first object part 2pos being such that during the execution
of the protected software 2p, the functionality of at least one
chosen conditional branch is executed in the unit 6, [0683] and
the second object part 2pou of the protected software 2p, said second
object part 2pou being such that, after upload to the unit 6 and
during the execution of the protected software 2p, appears the second
execution part 2peu by means of which the functionality of at least
one chosen conditional branch is executed.
[0684] For the implementation of a preferred embodiment of the
principle of protection by conditional branch, the protected software
2p is modified: [0685] by choosing, in the source of the protected
software 2ps, at least one series of chosen conditional branches,
[0686] by modifying at least one chosen portion of the source of
the protected software 2ps, this modification being such that during
the execution of the protected software 2p, the overall functionality
of at least one chosen series of conditional branches is executed,
by means of the second execution part 2peu, in the unit 6, [0687]
and by producing: [0688] the first object part 2pos of the protected
software 2p, said first object part 2pos being such that during
the execution of the protected software 2p, the functionality of
at least one chosen series of conditional branches is executed in
the unit 6, [0689] and the second object part 2pou of the protected
software 2p, said second object part 2pou being such that, after
upload to the unit 6 and during the execution of the protected software
2p, appears the second execution part 2peu by means of which the
overall functionality of at least one chosen series of conditional
branches is executed.
[0690] Naturally, the principles of protection according to the
invention can be applied directly during the development of a new
software without requiring the prior carrying out of intermediate
protected pieces of software. In this way, the creation stage S.sub.21,
and the modification stage S.sub.22 can be carried out concomitantly
so as to obtain directly the protected software 2p.
[0691] During the subsequent protection sub-phase P.sub.2, after
the creation stage S.sub.21 of the protected software 2p, and possibly
after the modification stage S.sub.22, a stage called "customization
stage S.sub.23" takes place. During this customization stage
S.sub.23, the second object part 2pou possibly containing the exploitation
means is uploaded to at least one blank unit 60, with the intention
of obtaining at least one unit 6, or a part of the second object
part 2pou possibly containing the exploitation means is uploaded
to at least one pre-customized unit 66, with the intention of obtaining
at least one unit 6. The uploading of this customization information
enables to make operational at least one unit 6. It should be observed
that part of said information, once transferred to a unit 6, is
not directly accessible outside said unit 6. The transfer of the
customization information to a blank unit 60 or a pre-customized
unit 66 can be carried out through an adapted customization unit
which is described in the rest of the description in FIG. 150. In
the case of a unit 6, constituted by a chip card 7 and its reader
8, the customization concerns only the chip card 7.
[0692] For the implementation of the protection phase P, various
technical means are described more precisely in relation to FIGS.
110, 120, 130, 140 and 150.
[0693] FIG. 110 illustrates an embodiment of a system 25 enabling
to implement the construction stage S.sub.12 which takes into account
the definitions intervened during the definitions stage S.sub.11
and during which are constructed the transfer means 12, 13 and possibly,
the exploitation means intended for the unit 6. Such a system 25
includes a program development unit or workstation which has classically
the form of a computer comprising a system unit, a screen, peripherals
such as keyboard-mouse, and including, among others, the following
programs: file editors, assemblers, pre-processors, compilers, interpreters,
debuggers and link editors.
[0694] FIG. 120 illustrates an embodiment of a pre-customization
unit 30 enabling to upload at least in part the transfer means 13
and/or the exploitations means to at least one blank unit 60 with
the intention of obtaining a pre-customized unit 66. Said pre-customization
unit 30 includes reading and writing means 31 enabling to electrically
pre-customize, a blank unit 60 so as to obtain a pre-customized
unit 66 to which the transfer means 13 and/or the exploitations
means have been uploaded. The pre-customization unit 30 can also
include physical customization means 32 of the blank unit 60 which
can for instance, have the form of a printer. In the case where
the unit 6 is constituted by a chip card 7 and its reader 8, the
pre-customization generally concerns only the chip card 7.
[0695] FIG. 130 illustrates an embodiment of a system 35 enabling
to carry out the making of the tools enabling to help generate protected
software or to automate software protection. Such a system 35 includes
a program development unit or workstation which has classically
the form of a computer comprising a system unit, a screen, peripherals
such as keyboard-mouse, and including, among others, the following
programs: file editors, assemblers, pre-processors, compilers, interpreters,
debuggers and link editors.
[0696] FIG. 140 illustrates an embodiment of a system 40 enabling
to create directly a protected software 2p or to modify a vulnerable
software 2v with the intention of obtaining a protected software
2p. Such a system 40 includes a program development unit or workstation
which has classically the form of a computer comprising a system
unit, a screen, peripherals such as keyboard-mouse, and including,
among others, the following programs: file editors, assemblers,
pre-processors, compilers, interpreters, debuggers and link editors,
as well as tools enabling to help generate protected software or
to automate software protection.
[0697] FIG. 150 illustrates an embodiment of a customization unit
45 enabling to upload the second object part 2pou to at least one
blank unit 60 with the intention of obtaining at least one unit
6 or to upload a part of the second object part 2pou to at least
one pre-customized unit 66 with the intention of obtaining at least
one unit 6. Said customization unit 45 includes reading and writing
means 46 enabling to electrically customize, at least one blank
unit 60 or at least one pre-customized unit 66, so as to obtain
at least one unit 6. At the close of this customization, a unit
6 includes the information necessary to the execution of the protected
software 2p. The customization unit 45 can also include physical
customization means 47 for at least one unit 6 which can for instance,
have the form of a printer. In the case where a unit 6 is constituted
by a chip card 7 and its reader 8, the customization generally concerns
only the chip card 7.
[0698] The protection process according to the invention can be
implemented with the following improvements: [0699] It can be planned
to use jointly several processing and memorizing units between which
is divided out the second object part 2pou of the protected software
2p so that their joint use enables to execute the protected software
2p, the absence of at least one of said processing and memorizing
units preventing the usage of the protected software 2p. [0700]
In the same way, after the pre-customization stage S.sub.13 and
during customization stage S.sub.23, the part of the second object
part 2pou necessary to transform the pre-customized unit 66 into
a unit 6 can be contained in a processing and memorizing unit used
by the customization unit 45 so as to limit the access to said part
of the second object part 2pou. Naturally, said part of the second
object part 2pou can be divided out between several processing and
memorizing units so that said part of the second object part 2pou
is accessible only during the joint use of said processing and memorizing
units. |