Use of pseudocode to protect software from unauthorized use

Details Use of pseudocode to protect software from unauthorized use Use of pseudocode to protect software from unauthorized use

1998-11-20

2001-12-25

Peeso, Thomas R. (Department: 2132)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

C713S152000, C380S255000, C380S268000

Reexamination Certificate

active

06334189

ABSTRACT:

FIELD OF THE INVENTION
The present invention relates to methods for preventing the unauthorized distribution and use of computer programs. More particularly, the present invention relates to methods for impairing the ability of software pirates to remove or disable the executable copy protection code, or other security code, within a computer program.
BACKGROUND OF THE INVENTION
Software products (applications) are highly vulnerable to unauthorized copying and use (piracy). Illegally copied applications are commonly distributed on a wide-scale basis over the Internet and via recordable CD-ROMs. Software developers lose billions of dollars per year as a result of such unauthorized copying and distribution.
Software developers commonly use a variety of different forms of copy protection to prevent others from illegally copying and using their products. One of the most robust methods involves the use of an Electronic Security Device (ESD) which attaches to a port of the end user's computer and communicates with the application. If the ESD is not attached to the user's computer, the application crashes or otherwise fails to operate properly.
Typically, the ESD is in the form of an electronic circuit which receives a numerical “seed” value from the application, applies a hardware-implemented number calculation algorithm to the seed value, and returns a “response” value to the application. To test for the existence of the ESD, the application's copy protection code sends one or more seed values to the ESD and compares the resulting response values with expected response values. The expected values can be generated by the software developer at development time (such as through experimentation with the ESD), or can be generated “on-the-fly” during execution by implementing the ESD's number calculation algorithm (if known to the software developer) within the copy protection code.
Another type of system for controlling the use of applications involves using a license management server to control the number of copies of an application that can concurrently run on a network. With this type of system, the application will run properly only if it has checked out an authorization certificate from the license management server. When a user launches the application on a workstation of the network, the application requests an authorization certificate from the license server. If less than the maximum authorized number of copies are currently running, the license server dispatches an encrypted certificate to the workstation to unlock the application.
A variety of techniques also exist for making it more difficult for pirates to analyze an application's copy protection or other security code. One such technique involves storing the application's executable code in an encrypted form to hide the details of the security scheme, and decrypting the code as it is executed or loaded into memory. Another technique involves inserting “dummy” machine instructions within the application's machine code to throw-off disassemblers.
Despite the sophistication of modern ESDs, and the significant time dedicated by software developers to writing better copy protection code, software pirates are often able to defeat copy protection schemes with relative ease. This is commonly done by using the latest software development tools to locate and circumvent the application's copy protection code. The modifications needed to remove or circumvent the application's copy protection code are commonly distributed by the pirate as a small, separate piece of code (patch). A user can execute the patch to create a modified (cracked) version of the application which will run without the ESD, or which will otherwise operate without use of the copy protection scheme. Once a cracked version of a product becomes available, the software developer has lost much of its investment in its product.
A stronger form of copy protection is therefore needed. Ideally, software developers should be able to add the copy protection code without considerable time or effort, yet the resulting protection scheme should be extremely difficult and time consuming to analyze and circumvent.
SUMMARY OF THE INVENTION
The present invention provides three methods or “layers” for protecting software applications from unauthorized distribution and use (piracy). Each method can be used independently of the others, although the methods are preferably used in combination.
The first method involves using values generated by a conventional ESD (Electronic Security Device) to encrypt and/or decrypt user data (such as a file) that is generated and used by the application. In a preferred embodiment, the user data is encrypted (such as during a write to memory) using values returned by the ESD, and the user data is later decrypted using like values returned by a software-implemented ESD simulator. An important aspect of this method is that it does not rely on the use of comparisons to determine whether or not the ESD is attached. As a result, a pirate cannot disable the copy protection by simply modifying or removing code that compares response values to expected values. A related benefit is that the application continues to operate (although not properly) when no ESD is attached, making the task of identifying the copy protection code considerably more difficult.
The second and third methods involve the use of special development tools that make the task of analyzing the application's copy protection code (such as the code used to encrypt and/or decrypt user data in method 1) significantly more difficult. Specifically, the second method involves using pseudocode to implement some or all of the application's copy protection or other use-authorization functions. The pseudocode for a given function is generated (preferably in encrypted form) from actual code using a special development tool, and is then imbedded within the application together with a corresponding pseudocode interpreter. The interpreter fetches, decrypts and executes the pseudocode when the function is called. Because no disassemblers or other development tools exist for analyzing the pseudocode, the task of analyzing the copy protection functions becomes significantly more complex.
The third method involves the use of a special obfuscation tool which converts the code for selected copy-protection or other functions into unnecessarily long, relatively inefficient sequences of (obfuscated) machine code. For example, the developer can convert a method 1K block of copy protection code into a method 500K block of code that performs the same function. In one implementation of the obfuscation tool, the developer can control the quantity of code that is generated by specifying one or more control parameters. As with the pseudocode method, the use of the obfuscation tool makes the task of evaluating the application's copy-protection functions considerably more difficult.
The invention also provides various enhancements to the above methods. One such enhancement, for example, involves the intertwining of copy-protection and non-copy-protection functions within a single block of obfuscated code or pseudocode. A non-copy-protection function that is necessary to the proper operation of the application is preferably used for this purpose, so that attempts to remove the block of code from the application will render the application inoperative.


REFERENCES:
patent: 4278837 (1981-07-01), Best
patent: 4446519 (1984-05-01), Thomas
patent: 4465901 (1984-08-01), Best
patent: 4683968 (1987-08-01), Appelbaum et al.
patent: 4685055 (1987-08-01), Thomas
patent: 4757534 (1988-07-01), Matyas et al.
patent: 4817140 (1989-03-01), Chandra et al.
patent: 4959861 (1990-09-01), Howlette
patent: 5081676 (1992-01-01), Chou et al.
patent: 5109413 (1992-04-01), Comerford et al.
patent: 5123045 (1992-06-01), Ostrovsky et al.
patent: 5148534 (1992-09-01), Comerford
patent: 5222134 (1993-06-01), Waite et al.
patent: 5287408 (1994-02-01), Samson
patent: 5390297 (1995-02-01), Barber et

Affiliated with

Also associated with

Rating

Use of pseudocode to protect software from unauthorized use does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Use of pseudocode to protect software from unauthorized use, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Use of pseudocode to protect software from unauthorized use will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-2584414