Software modification for partial secure memory processing

The technical field of a method for safely distributing software, a processor, a computing device, and a system for safely storing and executing applications

[0001] The present disclosure generally relates to the field of computers. Specifically, the present disclosure relates to the modification of computer software to repackage the code for execution partly from the secure memory on the user equipment.

Background technique

[0002] Application stores are rapidly becoming an important distributor of applications for many platforms, such as smart phones, tablet computers, and conventional computers (eg, notebook computers, desktop computers, etc.). Application stores are often web-based stores that enable users to download software electronically without receiving physical products. There are several reasons for the success of this application of this distribution mechanism. One reason is that developers can use the application store to be able to realize the wide distribution of their applications without the developer's large investment.

[0003] Application stores are quickly establishing themselves as a major software distribution channel. Currently, for popular smart phone and tablet computer operating systems (OS), hundreds of thousands of smart phone applications are available for download. In addition, thousands of conventional computer applications for conventional computers running Windows® operating system (OS) or Apple OS are also available. It is expected that the popularity of application stores will increase and become the dominant distributor of software in the future.

[0004] Although the current application store development is impressive so far, the application store is dealing with or threatening many challenges that prohibit its future development or completely put it in danger. Generally, the challenges of these app stores include: 1) software piracy, 2) counterfeit apps that cause operational, legal, and security issues for app store operators, 3) inability to attract well-known independent software vendors (ISV), and 4) difficulty This distribution mechanism provides "try before you buy" or other shareware versions of the application.

[0005] Since mainstream computing has become widely available to users, software piracy has been a problem for software developers and vendors. Specifically, in the case of easy access to the Internet and ease of copying and sending data through the Internet, although heavy penalties are imposed on those accused of pirating software, software piracy continues to proliferate.

Summary of the invention

[0006] The present disclosure relates to software modifications that can be used to prevent software piracy and prevent unauthorized modifications of applications. In some embodiments, the software supplier can modify the software before it is distributed to the user. The modified software can be sold, rented, or "trialized" by the user who downloaded the software.

[0007] Software vendors that can host application stores can initially receive applications from developers or software companies. Then, the software supplier can remove multiple parts of the software, such as code segments, functions, or other parts of the software, which are referred to herein as "cutouts." The software vendor can encrypt the cutouts and store them as a separate part from the modified version of the application that does not include these cutouts (but including the holes in which the code has been cut out), referred to herein as " Modified application". Then, the software provider can at least transmit the modified application and encrypted cutouts, and possibly other data (such as licenses, user manuals, etc.) to the user device.

[0008] According to some embodiments, the user equipment may store and decrypt the cutouts in a secure memory location (referred to herein as "secure memory"). The secure memory can be external software (such as the operating system running on the users device or its

Other native software) inaccessible memory. The secure memory may include a secure execution environment that enables one or more processors or processor cores to safely execute the content in the secure memory. Secure storage can be restricted to access through the secure execution environment. Therefore, the code contained in the cut block is not disclosed or disclosed to the user of the user device, the software running on the user device, or to other people (for example, hackers, vendors, etc.). The secure memory can store cutouts in a working state (ie, unencrypted). This secure memory and secure execution environment work harmoniously with the modified application to execute the original application.

[0009] As currently executed for an unmodified application, the operating system on the user equipment can load and execute the modified application. When the request part of the modified application includes one of these cutouts, the redirection code can direct the processing to the safe execution environment to execute the corresponding cutout, and then return the result data to the modified application, which can be used The result data does not require actual processing of the code in the cut block to restart the operation.

[0010] In some embodiments, the user equipment may include a single "frame" secure execution environment for different applications including cutouts. The secure execution environment can load the cutout of the application along with any appropriate metadata (for example, inputs, variables, etc.).

[0011] For example, an application may have two cutouts. The loader stack may load the encrypted code of at least one of these cutouts into the secure execution environment, and include any metadata associated with this cutout(s). Into the secure execution environment, the cutouts are decrypted and can be called by the modified application to execute the operations of these parts of the application that are removed from the application and stored in the secure memory for processing through the secure execution environment (for example, , Functions, calculations, etc.).

[0012] In various embodiments, each application can use a different copy of the secure memory and the framework of the secure execution environment, because the secure execution environment can be mapped to the address space of its corresponding application.

[0013] The techniques, devices, and systems described herein can be implemented in a variety of ways. Example embodiments are provided below with reference to the following drawings.

Description of the drawings

[0014] The detailed description is described with reference to the accompanying drawings. In the figure, the leftmost number (or numbers) of the reference number identifies the figure in which the reference number first appears. The same reference numbers in different figures indicate similar or identical items.

[0015] FIG. 1 is a schematic diagram of an illustrative computing environment for securely providing modified software from an application store to a user device in order to execute the software.

[0016] FIG. 2 is a block diagram of an illustrative application store server.

[0017] FIG. 3 is a block diagram of an illustrative user equipment.

[0018] FIG. 4 is a flowchart of an illustrative process for modifying software and securely providing the modified software to a user device for executing the software.

[0019] FIG. 5 is a schematic diagram showing the transmission of the secure stack key from the application store server to the user equipment.

[0020] FIG. 6 is a schematic diagram showing the transmission of an application to an application store server, which then modifies the application to create a cutout.

[0021] FIG. 7 is a schematic diagram showing the transmission of modified applications and cutouts to user equipment.

[0022] FIG. 8 is a schematic diagram showing the execution of the modified application by the user equipment.

[0023] FIG. 9 is a flowchart of an illustrative process for a user equipment to execute a modified application.

[0024] FIG. 10 is a block diagram of another illustrative user equipment.

Detailed ways

[0025] FIG. 1 is a schematic diagram of an illustrative computing environment 100 for securely providing modified software from an application store to a user device. The environment includes a developer 102 (such as an independent software vendor (ISV)), an application store 104, and a user 106. In some instances, the developer 102 and the application store 104 may be the same entity. The developer can create and develop an application 108 that can be stored and/or accessed by the developer server 110. The application store (AS) 104 can use the AS server 112 to receive applications. The AS server 112 may modify the application 108 to create the cutouts discussed above, and store the encrypted cutout 114 and the modified application 116 that does not include these cutouts._OThe AS server 112 may enable the user 106 to download software to the user device 118 through the encrypted cutout 114 and the modified application 116. The user equipment 118 may store the encrypted cutouts 114 in a secure memory, and execute these cutouts in a secure execution environment after decryption. The developer server 110, the AS server 112, and the user equipment 118 may exchange data through one or more networks 120.

[0026] The user equipment 118 may include a personal computer, a tablet computer, a mobile phone (including a smart phone), a personal digital assistant (PDA), a television, a set-top box, a game controller, or another electronic, portable or handheld device. This network(s) 120 may include wired and/or wireless networks capable of enabling communication between the different computing devices described in the environment 100. In some embodiments, the network(s) 120 may include a local area network (LAN), a wide area network (WAN), a mobile phone network (MTN), and other types of networks, possibly in combination with each other to facilitate different computing devices ( That is, the communication between the developer server(s) 110, the AS server 112, and/or the user equipment 118). The AS server 112 and the user equipment 118 are described in more detail with reference to FIGS. 2 and 3, respectively.

[0027] FIG. 2 shows an illustrative computing architecture 200 of the AS server 112. The architecture may include a processor(s) 202 and a memory 204. The memory 204 may store various modules, applications, programs, or other data. The memory 204 may include instructions that, when executed by the processor(s) 202, cause these processors to perform operations as described herein for the AS server 112. In some embodiments, the memory 204 may store the application converter 206, the client registration manager 208, and the download manager 210. Then discuss each module.

[0028] The application converter 206 may be a software engine that takes an application uploaded by a developer as input and extracts multiple fragments of the application as cutouts. These cutouts can be selected as important parts of the code to make the application inoperable when extracted from the application. Furthermore, when extracted, these cutouts prevent another person from reconstructing the complete application, thereby thwarting piracy attempts. After the application is uploaded, the application converter can analyze the application binary and automatically identify the most relevant fragments for the correct execution of the application. In some instances, the developer can indicate the segments to be used as cutouts. Then, the application converter 206 can replace the extracted fragments with redirection codes, which are calls to external locations and can be based on tables. Cutouts can be aggregated with certain metadata (for example, return values, parameters, etc.) in separate files. This file can be encrypted.

[0029] The client registration manager 208 may configure a unique client key for each new client that is running the client registration process. This process can be classified into the secure storage and the secure execution environment technology used by the user equipment 118. In some embodiments, as discussed below with reference to FIG. 3, the same entity that delivers the protected software distribution technology client software stack provides the client registry manager 208.

[0030] The download manager 210 may create a license and encrypt the cutout of the application. For example, for all clients, if the binary will be different on a per platform basis instead of a single encryption key per application, the download manager 2110 may encrypt the cutout. The download manager 210 can use a specific client key (which is used by the client

The registration manager 208 (configured during registration) encrypts the license and can use the application and the encrypted cutout to transmit the specific client key.

[0031] FIG. 3 shows an illustrative computing architecture 300 for user equipment 118. The architecture may include public memory 302, processor(s) 304, and secure memory 306. The public memory 302 can store various modules, applications, programs, or other data. The public memory 302 may include instructions that, when executed by the processor(s) 304, cause these processors to perform certain operations as described herein for the user equipment 118. The public memory may be conventional memory, such as flash memory, RAM, or other types of conventional memory. In some embodiments, the public memory 304 may store an operating system (OS) 308, a modified application (modified app) 114, an application store client 310, and other native applications or programs.

[0032] The application store client 310 may support secure downloads from the application store 204. The application store client 310 can use the secure memory 306 of the client device 118 to store the encrypted cutout 116. The application store client 310 can also activate the secure memory and secure execution environment on the user device 118.

[0033] According to various embodiments, the secure memory 306 can store a protected software distribution license secure environment (PLN) 312, which can be used to register into the application store 104 once and can later be used every time the user 106 wants to start Used in safety applications (with cutouts). The PLN 312 can manage the keying material of the protected software distribution technology and can parse the license. The PLN 312 can be stored in the secure memory 306 and can act as a single element collection on the client platform (user device 118) for any given online application store with which the platform works. In some instances, PLN 312 can support multiple application stores at the same time. As discussed below, PLN 312 can participate in user registration and application execution.

[0034] In some embodiments, the secure memory 306 may store a protected software distribution execution environment (PXN) 314 (which may be a secure execution environment) as a security for storing the decrypted content of the application (cutout) Execution environment. A PXN314 can be created for each security application executed on the user device 118. Cutouts from different applications can be different in size. In some embodiments, the PXN 312 is loaded with a minimum size in order to be able to execute and correctly accommodate cutouts from the modified application. This can be done as described below.

[0035] The static PXN binary that will be part of the software stack can be built to the full maximum supported size. The PXN binary can be partially loaded to suit any smaller needs of a specific application. For example, the maximum size of each application can be a 2MB cutout (this makes a slightly larger maximum size PXN); however, for a given application that uses only 0.5MB cutouts, the software stack can Load PXN 314 of that size. A measurement table that is part of the stack can provide its corresponding measurement for a collection of possible sizes. When the stack loads the PXN 314 for a specific application, it may be using embedded protected software distribution metadata that is part of the application to determine the size. Loading the stack can build a PXN 314 with the correct size. Since this architecture can pay for this overhead of each running application, the implementation consideration for PXN 314 is to design a PXN with the smallest overhead size.

[0036] Illustrative operation

[0037] FIGS. 4-9 show an illustrative process for modifying the software and safely providing the modified software to the user equipment for safe execution by the user equipment. Show these processes as a set of blocks in a logic flow chart or schematic diagram, which represents a sequence of operations that can be implemented in hardware, software, or a combination thereof. In some instances, the set of boxes is organized by corresponding entities that can perform the operations described in the boxes. In the context of software, these blocks represent computer-executable instructions stored on one or more computer-readable storage media, so that when executed by one or more processors, the described operations are performed. Generally, computer-executable instructions include examples that perform specific functions or implement specific abstract data types.

Procedures, procedures, objects, components, data structures, etc. It is not intended to interpret the order in which these operations are described as limitations, and any number of the described blocks can be combined and/or juxtaposed in any order to implement these processes. These processes are described with reference to Figures 1 to 3. Of course, these processes can be performed in other similar and/or different environments.

[0038] FIG. 4 is a flowchart of an illustrative process 400 for modifying software and safely providing the modified software to a user device for safe execution by the user device.

[0039] At 402, the AS server 112 may initially register the user 106 and the user device 118 with the application store 104. This registration may include the exchange of encryption keys. According to various embodiments, this registration may enable the PLN 312 to be established or used on the user equipment 118. With regard to Figure 5, operation 402 is described in more detail.

[0040] At 404, the developer server(s) 102 may upload the application to the AS server 112. The AS server 112 may remove the cutout 116 from the application to create a modified application 114_OThe AS server 112 may also encrypt these cutouts in operation 404. With regard to Figure 6, operation 404 is described in more detail.

[0041] In 406, the AS server 112 may download the modified application 114 and the encrypted cutout 116 to the user device 118. The AS server 112 may also provide the user 118 with a license in operation 406. With regard to Figure 7, operation 406 is described in more detail.

[0042] At 408, the user equipment 118 may execute the modified application. When applicable, the user equipment 118 may execute one or more of the cutouts in the PXN 314 to hide the code in the cutouts and pass the resultant data back to the modified application running on the user equipment 118. Therefore, even after modification and creation of cutouts by the AS server 112, the application can run as designed by the developer. It is possible to pre-test and pass the use of the secure memory 306 and the PXN 314 to hide the code used in the cutout from users, operating systems, native software, hackers, and others. With respect to Figure 8, operation 408 is described in more detail.

[0043] FIG. 5 is a schematic diagram depicting an environment 500 that shows the transfer of the secure stack key from the AS server 112 to the user device 118. According to various embodiments, the user 106 may request to register a relationship with the application store 104, such as by establishing an account. The user 106 may provide user information, payment information, contact information, information of the user device 118, and/or other data to the application store 104. In return, the AS server 112 may provide the secure stack key 502 to the PLN 312 stored in the secure memory 306 of the user equipment 118. The secure stack key 502 can be used to decrypt the cutout 116, the modified application 114, the license of the application, or a combination thereof. When transmitting data from the AS server 112 to the user equipment 118, other encryption may also be used. When decrypting at least some information or data from the AS server 112, the user device 118 can use the secure stack key 502 (or just the "key" or "encryption key").

[0044] FIG. 6 is a schematic diagram depicting an environment 600 that shows the transfer of an application to the application store server 104, which then modifies the application to create cutouts. The developer communicator 602 can transmit the unmodified application 108 including the complete code set to the AS server 112. Therefore, from the developer's point of view, the application development itself has not changed. The process of building at the developer's website is the same as that of any other application.

[0045] For a secure application (for example, when the application is not free), after uploading to the application store 104, the application converter 206 may analyze the application (for example, application binary) and generate a cutout list . Cutouts can be identified by designation from the developer, from the detection of discrete parts of the code by the AS server 112, or a combination of the two. The output of the application converter 206 is the modified application 114 (eg, application binary) that includes the correct invocation (redirect code) to the secure execution environment of the user device 118 (ie, the PXN 314). The output also includes cutouts that have been encrypted by the AS server 112. The output can also include metadata that correctly loads and executes the application as a modified application with cutouts. The metadata may further include the size of the cutout and other possible parameters.

[0046] In some embodiments, the application converter 206 may execute an algorithm similar to the following illustrative algorithm. Given application A consisting of code sequence c= (c0,cl,c2---Ccn) and data area (do,dl,d2···,ddn), the process can extract the sequence code E= (el ,.-,En) (where ei= (cii, ···, Ci2)) n fragments: (1) When A is executed together with the extracted E fragment (denoted by AE), this operation is no different from A. (2) The E segment is an excerpt from the linear code of the sequence (that is, there is no jump from within ei to within ej, that is, i<>j, and there is no jump between ei and A). (3) The E segment does not include a subset of software interrupts. In the process of staggered operation, you can select cut-outs in the following ways: carefully check the application execution flow of A and E (where the execution of E is opaque, but it can be single-step execution, etc.), so that the observer does not have reverse construction E-segment efficient way. Optionally, the E segment also includes a D subset, which is especially unimportant when only Ei runs on a certain D subset, and that subset can be within Ei. In some embodiments, the cutout 116 may be a complete function from the application. The cutout 116 may also be a leaf function that is not calling an external function or a system call, thereby protecting the partial data of the extracted function from being leaked. In some embodiments, the cutout 116 is limited in size to the threshold size (bytes) of the memory.

[0047] FIG. 7 is a schematic diagram depicting an environment 700 that shows the transmission of the modified application 114 to the user equipment 118. In some embodiments, the AS server 112 may generate a unique key for the application of a specific user 106 and use that key to encrypt the cut blocks. The AS server 112 may also generate a unique user license 702 for the user. The user license 702 may include optional policies for the activation of applications by the user and unique application keys. In some embodiments, the license may only allow limited use of the application (for example, trial implementation based on usage time and quantity, etc.) or allow rental of the application (for example, software as a service). The AS server 112 may encrypt the license with a unique client key (which is configured during the registration process). The AS server 112 can create a download package 704 including the modified application 114, the encrypted cutout 116, and the user license 702, which can then be transmitted to the user device 118.

[0048] FIG. 8 is a schematic diagram depicting an environment 800 that shows the execution of the modified application 114 by the user equipment 118. According to various embodiments, the user equipment 118 may load the modified application 114 for execution. Then, the PXN 314 having a size suitable for the cutout 116 can be loaded. The license 702 can be sent to the PLN 312 for decryption of the PXN 314, which can occur after verification or notification that the application operates under the terms and policies of the license. The cutout 116 can be streamed into the PXN 314. The modified application 114 and the cutout 116 can be used to activate the application. In addition, in addition to other functions, when the application is terminated, the stack can clear the EPC.

[0049] In some embodiments, the PXN 314 can operate as a buffer and can load additional code for cutouts that cannot be stored in the PXN 314 due to size constraints. Therefore, the PXN 314 can retrieve and possibly decrypt some additional codes and/or the cutout (or parts thereof) during the processing of the cutout.

[0050] FIG. 9 is a flowchart of an illustrative process 900 for user equipment 118 to execute a modified application.

[0051] At 902, the user equipment 118 may process the code from the modified application 114 stored in the public memory 302.

[0052] At 904, the user device 118 may determine whether a redirect code has been reached in the code from the modified application 114. The redirect code (or redirect code, skip code, etc.) may be a code linked to the corresponding cutout stored in the PXN 314. When no redirect code is found (along the "No" route), then the process proceeds to operation 902. However, when a redirect code is found (following the "yes" route from decision operation 904), then processing can continue at 906.

[0053] In 906, the user equipment 118 may send a request for processing the corresponding cutout to the PN 314. The request may include metadata, parameters, and/or other data. For example, the request may include variables used by the code in the cutout.

[0054] In 908, the user equipment 118 may process the code in the cutout in the PXN 314. The processing of cutouts can be hidden from the operating system, other applications, other users, users 106, and so on.

[0055] At 910, the user equipment 119 may determine whether the code has been processed. When the code is incomplete (still processing), then the process can continue at 908 along the "no" route from decision operation 910. When the code from the cutout is complete (following the "yes" route from decision operation 910), then the process can continue at operation 912.

[0056] At 912, the PXN 314 may pass the parameters back to the public memory 302 so that the modified application 114 can continue to run. For example, without revealing the underlying code and by obscuring the underlying logic of the code in the cutout to the extent possible, the output of the code can be passed back to the public memory 302. Except for the processor thread or processor core thread that is executing the cut, the decrypted cut may not be readable by any software or hardware on the user's device. In various embodiments, operation 912 may not include the PXN 314 that transmits information back to the main application, because the PXN can only change the state of the public memory 302 and/or return data through registers.

[0057] In some embodiments, the user equipment 118 may announce or otherwise provide available information indicating that the legal or valid license of the modified application and the status of the application are modified. Therefore, the user equipment 118 may instruct the application to include cutouts as described herein.

[0058] FIG. 10 is a block diagram of another illustrative user device 1000 that can perform the processes and functionality described herein. The user equipment 1000 may include one or more processors 1002-1,..., 1002-N (where N is a positive integer greater than or equal to 1), and each of these processors may include one or more Processor cores 1004-1,..., 1004-M (where M is a positive integer greater than or equal to 1). In some embodiments, as discussed above, the processor(s) 1002 may be a single-core processor, while in other embodiments, the processor(s) 1002 may have a large number of processor cores. Each core in the processor core may include some or all of the components shown in FIG. 10. For example, each processor core 10041,..., 1004-M may include a register file 1008-1,..., 1008-M for interacting with and/or performing at least some of the operations discussed herein An instance of the logic 1006. The logic 1006 may include one or more of dedicated circuits, logic units, microcode, and so on.

[0059] The processor(s) 1002 and the processor core(s) 1004 can be operated through the integrated memory controller (IMC) 1010 in combination with the local interconnect 1016, thereby reading and writing to the memory 1012. The processor(s) 1002 and the processor core(s) 1004 may also execute computer-readable instructions stored in the memory 1012 or other computer-readable media. The memory 1012 may include volatile and non-volatile memory and/or removable and non-removable media implemented in any type of technology for information storage, such as computer readable instructions, data structures, and program modules Or other data. Such memory may include, but is not limited to, RAM, ROM, EEPROM, flash memory, or other memory technologies. In the case where there are multiple processor cores 1004, in some embodiments, the multiple processor cores 1004 may share a cache 1014, and the shared cache may be accessible through a local interconnect 1016. In addition, a storage 1018 may be provided for storing data, codes, programs, logs, and so on. Storage 1018 may include solid-state storage, magnetic disk storage, redundant array of inexpensive disks (RAID) storage system, storage array, network attached storage, storage area network, cloud storage, CDROM, digital versatile disc (DVD) Or other optical storage, magnetic cassette, magnetic tape, or can be used to store the desired information and Any other medium that can be accessed by a computing device. Depending on the configuration of the user equipment 1000, the memory 1012 and/or the storage 1018 may be a type of computer-readable storage medium and may be a non-transitory medium.

[0060] According to various embodiments, the processor 1102 may communicate with the secure memory 1019 through the IMC 1010. The secure memory 1019 may include PLN 312 and/or PXN 314. The processor 1002-1 or another processor or processor core may be used to at least partially store the secure memory 1019_o

[0061] In various embodiments, the local interconnect 1016 may also communicate with a graphics controller (GFX) 1020 to provide graphics processing. In some embodiments, the local interconnect 1016 may communicate with the system agent 1022. System agent 1022 can

Communicate with the hub 1024, which is connected to the display engine 1026, PCIe 1028, and DMI 1030.

[0062] The memory 1012 may store functional components that can be executed by the processor(s) 1002. In some implementations, these functional components include instructions or programs 1032 that can be executed by the processor(s) 1002. The example functional components shown in FIG. 10 further include an operating system (OS) 1034 for managing the operation of the user equipment 1000.

[0063] The user equipment 1000 may include one or more communication devices 1036, and this or these communication devices may include one or more communication devices capable of communicating with various other devices through a communication link (such as one or more networks 1038). Interfaces and hardware components. For example, the communication device 1036 may facilitate communication via the Internet, cable network, cellular network, wireless network (eg, Wi-Fi, cellular), and wired network. The components used for communication may depend, at least in part, on the type of network and/or environment selected. The protocols and components used to communicate over such networks are well known and will not be discussed in detail here.

[0064] The user equipment 1000 may be further equipped with various input/output (I/O) devices 1040. Such an I/O device 1040 may include a display, various user interface controls (for example, buttons, joysticks, keyboards, touch screens, etc.), speakers, connection ports, and so on. An interconnection 1024 that may include a system bus, a point-to-point interface, a chipset, or other suitable connections and components can be provided, so that the processor 1002, the memory 1012, the storage 1018, the communication device 1036, and the I/O device can be realized Communication between 1040.

[0065] Conclusion

[0066] Although the subject matter is described in language dedicated to structural features and/or method actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described. On the contrary, as an illustrative form of implementing the claims, these specific features and actions are disclosed.