Protection of software against use without permit

Abstract

An arrangement to protect software, particularly freely distributed application software, against utilization without permission of the copyright holder. By encrypting the software employing a key (k 1 ) which is different from that key (k 2 ) which is employed in the decryption, better protection is obtained against unauthorized utilization when the decryption key is kept secret to the user. Further improved security is achieved by additionally executing scrambling-descrambling of the communication between the computer in which the software is utilized and the external unit in which the decryption key is stored. Also, the external unit is arranged such that it returns to the host computer, the result from its processing of data received from the host, the result then being utilized in the further execution of the respective program.

1 . A method of preventing unauthorized utilization of software in a computer, the method comprising the steps of: 
 encrypting at least a part of said software in accordance with a first algorithm, and    decrypting the encrypted part of the software in accordance with a second algorithm, the second algorithm together with a key to be employed in the decryption of the encrypted part of the software being stored in an external unit adapted to be connected to said computer, the external unit comprising at least a computer readable storage medium and a processor of its own,    characterized in that said decryption in accordance with the second algorithm (g 2 ) is executed by employing a second key (k 2 ) stored in said external unit, the second key being different from a first key (k 1 ) employed in the execution of the encryption of said part of the software in accordance with the first algorithm (g 1 ).    
     
     
         2 . A method according to  claim 1 ,  
       characterized in that the encryption of said part of the software in accordance with the first algorithm (g 1 ) is executed on the source code of the respective software prior to compiling and linking, or during similar processing steps producing an executable program, and at the same time adding to the data library of the executable program an object code with respect of the communication with the external unit.  
     
     
         3 . A method according to  claim 1  or  2 ,  
       charcterized in that said decryption of the encrypted part of the software which is executed in accordance with the second algorithm (g 2 ), takes place when the computer in the execution of said software encounters a call sequence, or a similar instruction, causing a jump to a corresponding entry point to said added object code, whereby a communication channel is established between the computer and the external unit by utilization of the added object code, through which communication channel the encrypted part of the software is transferred in a first transfer session to the external unit to be decrypted by the unit's own processor, the decrypted software part then being processed in the external unit and the result transferred in a second transfer session the opposite direction through the communication channel for the further utilization in the computer.  
     
     
         4 . A method according to  claim 3 ,  
       characterized in that the method further comprises: 
 a step wherein said part of the software which is encrypted in accordance with the first algorithm (g 1 ), prior to said first transfer session, is caused to be scrambled according to a third algorithm (g 3 ) and a third key (k 3 ), said third key (k 3 ) being based on a number which, for the respective transfer session, is selected randomly and preferably produced by the external unit, and  
 a step wherein said part of the software which is encrypted in accordance with the first algorithm (g 1 ), and which is scrambled according to said third algorithm (g 3 ) and transferred to the external unit in said first transfer session, is caused to be descrambled in the external unit in accordance with a fourth algorithm (g 4 ) and a fourth key (k 4 ), said fourth key (k 4 ) being based on said randomly selected number for said third key (k 3 ), and said fourth algorithm (g 4 ) being the inverse algorithm of said third algorithm (g 3 ).  
 
     
     
         5 . A method according to claims  3  and  4 ,  
       characterized in that the method further comprises: 
 a step wherein said result produced in the external unit on the basis of that part of the software which is decrypted in accordance with said second algorithm (g 2 ), prior to said second transfer session, is caused to be scrambled according to a fifth algorithm (g 5 ) and a fifth key (k 5 ), said fifth key (k 5 ) being based on a number which, for the respective transfer session, is randomly selected and preferably provided by the external unit, and  
 a step wherein said result produced in the external unit on the basis of that part of the software which is decrypted in accordance with said second algorithm (g 2 ), and which is scrambled according to the said fifth algorithm (g 5 ) and transferred to the computer in said second transfer session, is caused to be descrambled in the computer in accordance with a sixth algorithm (g 6 ) and a sixth key (k 6 ), said sixth key (k 6 ) being based on said randomly selected number for said fifth key (k 5 ), and said sixth algorithm (g 6 ) being the inverse algorithm of said fifth algorithm (g 5 ).  
 
     
     
         6 . A method according to claims  4  and  5 ,  
       characterized in that said randomly selected number for the third and fourth keys (k 3 , k 4 ) and said randomly selected number for fifth and sixth keys (k 5 , k 6 ) being the same number.  
     
     
         7 . A method of preparing software, particularly software intended for free distribution, for the utilization in a computer only with a corresponding authorization, the method comprising encrypting in accordance with a first algorithm at least a part of said software which by the utilization in said computer is decrypted in accordance with a second algorithm,  
       characterized in that a key which is employed for said encryption in accordance with the first algorithm (g 1 ), is a first key (k 1 ) which is different from a second key (k 2 ) which is employed in the execution of the decryption in accordance with the second algorithm (g 2 ) of that part of the software which is encrypted in accordance with the first algorithm and first key.  
     
     
         8 . A method according to  claim 7 ,  
       characterized in that said encryption of said part of the software in accordance with the first algorithm (g 1 ) is executed on the source code itself for the respective software prior to compiling and linking to an executable program, or in similar processing steps producing an executable program, and at the same time adding an object code to the data library of the executable program with the respect of the communication with an external unit adapted to be connected to said computer.  
     
     
         9 . A method according to  claim 7  or  8 ,  
       characterized in that in said compiling and/or linking of the source code to an executable program, or in similar processing steps producing an executable program, call sequences, or similar instructions, are inserted which in the execution in a computer of the executable program causes a jump to a corresponding entry point to said added object code, the object code being used to establish a communication channel between the computer and an external unit in which said decryption takes place in accordance with the second algorithm (g 2 ).  
     
     
         10 . A method according to  claim 9 ,  
       characterized in that it further comprises a step wherein a third key (k 3 ) is inserted in said part of the software which is encrypted in accordance with the first algorithm (g 1 ), said third key (k 3 ) being intended to be employed in a third algorithm (g 3 ) for the scrambling of said part of the software prior to its transfer to said external unit.  
     
     
         11 . A method of making authorized utilization possible in a computer, of software, particularly freely distributed software, prepared according to  claim 9 , the method comprising connecting an external unit to said computer, the external unit at least comprising a computer readable storage medium and a processor of its own, and a second algorithm and a key to be employed in the decryption of the encrypted part of the software being stored in said external unit,  
       characterized in that when the computer in the execution of that part of the software which is encrypted in accordance with the first algorithm (g 1 ) encounters a call sequence, or a similar instruction, causing a jump to a corresponding entry point to said added object code, this object code is utilized by the computer to establish a communication channel to the external unit through which channel the encrypted part of the software is transferred in a first transfer session to the external unit to be decrypted by the unit's own processor in accordance with a second algorithm (g 2 ) and a second key (k 2 ) both of which being stored in said external unit, this second key (k 2 ) being different from the first key (k 1 ) employed in the execution of the encryption of said part of the software in accordance with the first algorithm (g 1 ), and the decrypted software part then being processed in the external unit and the result transferred in a second transfer session the opposite direction through the communication channel for the further utilization in the computer.  
     
     
         12 . A method according to  claim 11 , which makes authorized utilization possible of software prepared according to  claim 10 ,  
       characterized in that: 
 prior to said first transfer session to the connected external unit, that part of the software which is encrypted in accordance with the first algorithm (g 1 ) is caused to be scrambled according to said third algorithm (g 3 ) and said third key (k 3 ), the third key (k 3 ) being based on a number randomly selected for the respective transfer session and preferably provided by the external unit, and  
 said part of the software which is encrypted in accordance with the first algorithm (g 1 ), and which is scrambled according to said third algorithm (g 3 ) and transferred to the external unit in said first transfer session, is caused to be descrambled in the external unit in accordance with a fourth algorithm (g 4 ) and a fourth key (k 4 ), said fourth key (k 4 ) being based on said randomly selected number for said third key (k 3 ), and said fourth algorithm (g 4 ) being the inverse algorithm of said third algorithm (g 3 ).  
 
     
     
         13 . A method according to  claim 12 ,  
       characterized in that the method further comprises: 
 a step wherein said result produced in the external unit on the basis of that part of the software which is decrypted in accordance with said second algorithm (g 2 ), prior to said second transfer session, is caused to be scrambled according to a fifth algorithm (g 5 ) and a fifth key (k 5 ), said fifth key (k 5 ) being based on a number randomly selected number for the respective transfer session and preferably provided by the external unit, and  
 a step wherein said result produced in the external unit on the basis of that part of the software which is decrypted in accordance with said second algorithm (g 2 ), and which is scrambled according to said fifth algorithm (g 5 ) and transferred in said second transfer session to the computer, is caused to be descrambled in the computer in accordance with a sixth algorithm (g 6 ) and a sixth key (k 6 ), said sixth key (k 6 ) being based on said randomly selected number for said fifth key (k 5 ), and said sixth algorithm (g 6 ) being the inverse algorithm of said fifth algorithm (g 5 ).  
 
     
     
         14 . A method according to any preceding claim,  
       characterized in that said first and second algorithms (g 1 , g 2 ) and said first and second keys (k 1 , k 2 ) are determined in accordance with an unsymmetric, dual key crypto arrangement (public-key/private-key crypto system), such as RSA crypto system, the first key (k 1 ) preferably being the known key (public key) and the second key (k 2 ) being the secret key (private key) of the crypto arrangement.  
     
     
         15 . A method according to any preceding claim,  
       characterized in that said part of the software to be encrypted in accordance with said first algorithm (g 1 ) is selected by being fully decisive for the use of the respective software by a computer, and preferably comprising one or more instructions in a command or execution file, such as in a .COM or .EXE file.  
     
     
         16 . A device for the preparation of software, particularly software intended for free distribution, to be utilized in a computer only with a corresponding authorization, the device comprising: 
 crypto means effecting the encryption of at least a part of said software in accordance with a first algorithm and a first key, and    an external unit adapted to be connected to said computer, the external unit at least comprising a processor of its own and a computer readable storage medium for storing a second algorithm and a key, and being disposed to execute decryption of the encrypted part of the software in accordance with said second algorithm and key,    characterized in that the device further comprises generator means to provide said second algorithm (g 2 ) and a second key (k 2 ) intended to be employed in said decryption in accordance with the second algorithm (g 2 ), the second key being different from the first key (k 1 ) employed by said crypto means in the execution of the encryption of said part of the software in accordance with the first algorithm (g 1 ).    
     
     
         17 . A device according to  claim 16 ,  
       characterized in that said crypto means is adapted to execute said encryption of said part of the software in accordance with the first algorithm (g 1 ) on the source code itself of the respective software before it is compiled and linked, or in any other way is transformed to an executable program, and that said crypto means at the same time effects the addition to the data library of the executable program, of an object code with respect of the communication with said external unit  
     
     
         18 . A device according to  claim 16  or  17 ,  
       characterized in that said crypto means is adapted to insert during said compiling and/or linking of the source code to an executable program, or during a similar processing producing an executable program, call sequences, or similar instructions, which in the execution of the executable program in said computer provide for a jump to a corresponding entry point to said added object code which the computer then utilizes to establish a communication channel to the connected external unit.  
     
     
         19 . A device according to  claim 18 ,  
       characterized in that said crypto means is adapted to enter into said part of the software which is encrypted in accordance with the first algorithm (g 1 ), a third key (k 3 ) intended to be employed in a third algorithm (g 3 ) for scrambling of said part of the software prior to its transfer to said external unit.  
     
     
         20 . A device for making authorized utilization of software possible, particularly freely distributed software, prepared by means of a device according to  claim 16 , the device comprising a computer adapted to serve as a host computer for an external unit which at least comprises a processor of its own and a computer readable storage medium, and being intended to be connected to the host computer for the communication therewith,  
       characterized in that said external unit comprises decryption means adapted to execute decryption in accordance with said second algorithm (g 2 ) and said second key (k 2 ) produced by said generator means, the second key being different from the first key (k 1 ) used by said crypto means in the execution of the encryption of said part of the software in accordance with the first algorithm (g 1 ).  
     
     
         21 . A device according to  claim 20 ,  
       characterized in that said decryption means is adapted to execute said decryption in accordance with the second algorithm (g 2 ) when said host computer in the execution of that part of the software which is encrypted in accordance with the first algorithm (g 1 ) encounters a call sequence, or the like, which provides for a jump to a corresponding entry point to said added object code, whereby the host computer then uses this object code to establish a communication channel to the external unit through which the host computer effects that the encrypted part of the software is transferred in a is first transfer session to the external unit and subjected to said decryption, and that said external unit's own processor is adapted to process the decrypted part of the software and effect that the result is transferred the opposite direction in a second transfer session through the communication channel for the further utilization of the result in the computer.  
     
     
         22 . A device according to  claim 21 , and being adapted to make authorized utilization possible of software prepared by means of a device according to  claim 19 ,  
       characterized in that the external unit comprises descrambling means to descramble in accordance with a fourth algorithm (g 4 ) and a fourth key (k 4 ) said part of the software being encrypted in accordance with the first algorithm (g 1 ), and which, prior to the first transfer session, is scrambled by the host computer according to said third algorithm (g 3 ) and transferred to the external unit in said first transfer session, said third key (k 3 ) used by the host computer in this scrambling being based on a number randomly selected for the respective transfer session and preferably provided by a number generator in the external unit, and said fourth key (k 4 ) used by the descrambler means in the external unit being based on the same randomly selected number as that for said third key (k 3 ), said fourth algorithm (g 4 ) being the inverse algorithm of said third algorithm (g 3 ).  
     
     
         23 . A device according to  claim 21  or  22 ,  
       characterized in that the external unit further comprises scrambler means to scramble, prior to the second transfer session, in accordance with a fifth algorithm (g 5 ) and a fifth key (k 5 ) said result produced in the external unit on the basis of that part of the software which the unit has decrypted in accordance with said second algorithm (g 2 ), said fifth key (k 5 ) used by the scrambler means in this scrambling being based on a number which is randomly selected for the respective transfer session and preferably produced by a number generator in the external unit, the host computer being capable of descrambling in accordance with a sixth algorithm (g 6 ) and a sixth key (k 6 ) said result produced in the external unit for further utilization in the host computer, the result prior to said second transfer session being scrambled according to said fifth algorithm (g 5 ) by means of the scrambler means in the external unit and transferred to the computer in the second transfer session, said sixth key (k 6 ) being based on the same randomly selected number as that for the fifth key (k 5 ), and said sixth algorithm (g 5 ) being the inverse algorithm of said fifth algorithm (g 5 ).  
     
     
         24 . A device according to any of  claims 16  to  23 ,  
       characterized in that said external unit comprises adapter means and a separate article, preferably being made tamper-proof, in or on which electronic circuits are disposed which at least comprise the external unit processor and computer readable memory and which is arranged such that a communication channel can be established between the circuits of the separate article and said host computer when the article is inserted into a slot in the adapter means, or in any other way is connected to the adapter means, said second algorithm (g 2 ) and said second key (k 2 ) preferably being stored in such a way in said memory that they cannot be read by other means than the processor of the separate article and never become available outside the separate article.  
     
     
         25 . A device according to  claim 24 ,  
       characterized in that said separate article takes the form of a small substrate plate, such as a plastic card, having the size of a usual credit card, or Smart Card, the adapter means then comprising a card reader station for said substrate plate which optionally may be incorporated with the host computer or a peripheral unit connected thereto.  
     
     
         26 . A device according to  claim 24 ,  
       characterized in that said separate article takes the form of an electronic circuit card adapted to be placed in a card position or slot provided in the host computer for extension cards, the circuit card, in the case of a portable host computer, being configured in accordance with one of the standard designs used for such insertable cards, such as the PCMCIA standard.  
     
     
         27 . A device according to  claim 24 ,  
       characterized in that said separate article takes the form of an electronic blind plug, or the like, said adapter means then comprising an input-output terminal of the host computer.