Secure software system and related techniques

Abstract

A secure software system includes a transformation processor for transforming an original program capable of being executed on a lessee site into a vendor server program, a first program intended to be executed at the lessee site which lacks some of the functionality of the original program and a second program. The first program provides some of the computation of the original program but is unable to provide all of the functionality of the Original Program and requires cooperation with the second program which corresponds to an excised portion of the original program to provide the functionality of original program. The excised program is executed or otherwise utilized by a vendor server program which, in one embodiment, is generated by the transformation processor. With this arrangement, the lessee obtains the total functionality of the original program without having access to the original program code and the excised program is selected such that it would be relatively difficult to recreate the total functionality of the original program.

What is claimed is:  
     
         1 . A processing system for executing an original computer program with a first portion of the original computer program executing in a first processor located at a first processing site and a second portion of the original computer program executing in a second different processor located at a second different processing site wherein the first and second processing sites are physically separate and adapted to communicate over a network, the second processor at the second processing site comprising: 
 (a) a code extraction processor to receive the original computer program and to parse the original computer program to provide a first program for execution at the first processing site and an associated second program for execution at the second processing site, wherein said code extraction processor provides the second program such that the second program does not by itself constitute an executable computer program and wherein the second program includes portions of the original computer program selected to render it difficult to re-create the functionality of the original computer program from information stored at or otherwise available at the first processing site;    (b) a storage device having stored therein a server program which utilizes the second program and wherein in response to communications provided thereto by the first program executing at the first processing site, the server program provides information over the network to the first processing site which allows the first program executing at the first processing site to re-create the functionality of the original computer program at the first processing site; and    (c) an execution processor to execute the server program and the second program at the second processing site.    
     
     
         2 . The system of    claim 1    wherein: said code extraction processor processes the original computer program to extract a plurality of different second programs from the original computer program to provide a like plurality of different first programs with each of the plurality of first programs intended to be transmitted to a different one of a plurality of first processing sites and each of the second program portions intended to be utilized by the server program and executed by the execution processor at the second processing site, wherein the server program provides information to each particular one of the plurality of first processing sites utilizing the second program associated with the particular first program executing at the particular one of the plurality of first processing sites and said system further comprises: 
 a plurality of communication paths, each of the communication paths coupled between a particular one of the plurality of first processing sites and the particular server program utilizing the associated second program portion and wherein the server program manages the communication between the first program and the second program associated with the particular first program during execution of the first program.  
 
     
     
         3 . A processing system for executing an original software program, the processing system comprising: 
 (a) a first processor located at the first processing site, to execute a first program which corresponds to a first portion of an original software program;    (b) a second processor located at the second processing site which is physically separated from the first processing site, the second processor for executing a second program which corresponds to a second portion of the original software program where the first and second programs combined correspond to the entire original software program,    (c) a communications network coupled between the first and second processing sites and through which said first processor communicates with said second processor; and    (d) means for transmitting information between said first processor and said second processor over said communications network.    
     
     
         4 . The system of    claim 3    further comprising a processor for executing a vendor server program which utilizes the second program and communicates with the first program.  
     
     
         5 . The system of    claim 4    wherein: 
 the first processing site corresponds to a first lessee site with the first lessee site corresponding to a first one of a plurality of lessee sites, each of the plurality of lessee sites having a first program adapted to execute thereon;  
 the second processing site corresponds to a vendor site; and  
 the vendor server program communicates with the first program in each of the plurality of lessee sites.  
 
     
     
         6 . The system of    claim 3    wherein said second processing site comprises means for controlling the first program executing at the first processing site by stopping and starting communications between the first and second programs.  
     
     
         7 . The system of    claim 6    wherein said means for controlling the first program executing at the first processing site comprises means for halting the execution of the first program at the first processing site by not providing the functionality necessary for the first program to execute.  
     
     
         8 . The system of    claim 3    wherein communication between the first program and the second program across said communications network is input dependent.  
     
     
         9 . A processing system for executing an original software program, the processing system comprising: 
 (a) a first processor located at the first processing site, to execute a first program which corresponds to a first portion of an original software program, said first processor having a bus operating at a first bus speed;    (b) a second processor located at the second processing site which is physically separated from the first processing site, the second processor for executing a second program which corresponds to a second portion of the original software program where the first and second programs combined correspond to the entire original software program, said first processor having a bus operating at a second bus speed;    (c) a communications network coupled between the first and second processing sites and through which said first processor communicates with said second processor, said communications network operating at a third speed wherein the third speed is slower than the speed at which the fist and second buses operate; and    (d) means for transmitting information between said first processor and said second processor over said communications network.    
     
     
         10 . The system of    claim 9    wherein said second processing site comprises means for controlling the first program executing at the first processing site by stopping and starting communications between the first and second programs.  
     
     
         11 . The system of    claim 10    wherein said means for controlling the first program executing at the first processing site comprises means for halting the execution of the first program at the first processing site.  
     
     
         12 . The system of    claim 10    wherein communication between the first program and the second program across said communications network is input dependent.  
     
     
         13 . The system of    claim 10    further comprising a code extraction processor to receive the original software program and to parse the original software program to provide the first program and the second program.  
     
     
         14 . The system of    claim 10    further comprising a processor for executing a vendor server program which utilizes the second program and communicates with the first program.  
     
     
         15 . The system of    claim 14    wherein: 
 the first processing site corresponds to a first lessee site with the first lessee site corresponding to a first one of a plurality of lessee sites, each of the plurality of lessee sites having a first program adapted to execute thereon;  
 the second processing site corresponds to a vendor site; and  
 the vendor server program communicates with the first program in each of the plurality of lessee sites.