System and method for regulating execution of computer software
View Patent ↗A method for regulating execution of an application program includes a process for preparing the application and a process for executing the application. The preparation process divides the application program into related segments and encrypts instructions of at least one segment. The preparation process positions encrypted instructions in at least two discontiguous regions within an executable file and associates header information with at least one discontiguous region. The header identifies a decryption key and the location of the other discontiguous region. The resulting execution file thus has portions that would not execute and would cause an operating system to call a responsive process. The execution process initiates execution of the protected application when at least a portion of the application instructions are available to the computer only in encrypted form. The user is authenticated, after which the encrypted portions can be decrypted and execution resumed. The processes may also include capability to detect and respond to tampering, or the ability to block execution snooping via a debugger.
1. A process for modifying an application computer program that includes a plurality of subsections having boundaries, said application computer program configured to run under the control of an operating system, said process steps comprising:
substituting an operating system instruction that causes an interrupt for one or more bytes of at least one subsection;
relocating the substituted bytes to a location in the application computer program that is distinct from the boundaries of the subsection; and
adding an execution controller computer program into the application computer program;
where the execution controller computer program is configured to be launched by the application computer program, and where the execution controller computer program, once launched, uses an operating system debugger interface to attach the execution controller computer program to the application computer program and restores the operating system instruction that causes an interrupt with the substituted bytes.
2. The process of claim 1 , further comprising the step of:
identifying the boundaries of the at least one subsection.
3. The process of claim 2 , where one of the boundaries is a flow control instruction.
4. The process of claim 1 , further comprising the step of: encrypting at least a portion of at least one subsection.
5. The process of claim 4 , further comprising the step of:
adding information used to decrypt the encrypted portion to the application computer program.
6. The process of claim 1 , further comprising the step of:
adding tamper detection instructions and data to the application computer program file.
7. A process for executing an application computer program defining a plurality of subsections, said application computer program configured to run under the control of an operating system and incorporating an execution controller computer program, said process steps comprising:
substituting an operating system instruction that causes an interrupt for one or more bytes of at least one subsection;
launching the application computer program;
launching the execution controller computer program, where the execution controller computer program is launched by the application computer program;
attaching the execution controller computer program to the application computer program using the operating system debugger interface; and
executing the application computer program until an operating system instruction that causes an interrupt is encountered;
after an operating system instruction that causes an interrupt is encountered, restoring the operating system instruction that causes an interrupt with the substituted bytes; and
resuming execution of the application computer program, starting at the restored bytes.
8. The process of claim 7 , further comprising the step of:
after an operating system instruction that causes an interrupt is encountered, resuming execution of the application computer program.
9. The process of claim 7 , further comprising the step of:
after an operating system instruction that causes an interrupt is encountered, terminating the execution of the application computer program.
10. The process of claim 7 , further comprising the step of:
after an operating system instruction that causes an interrupt is encountered, authorizing a continued execution of the application computer program.
11. The process of claim 10 , where the step of authorizing a continued execution of the application computer program comprises authenticating a user of the application computer program.
12. The process of claim 7 , where at least a portion of the at least one subsection has been encrypted, further comprising the steps of:
after an operating system instruction that causes an interrupt is encountered, decrypting the encrypted portion; and
executing the decrypted subsection.
13. The process of claim 12 , further comprising the step of:
re-encrypting the decrypted subsection.
14. The process of claim 12 , where at least a portion of the information used to decrypt the encrypted portion is obtained from a key server computer program.
15. The process of claim 12 , where at least a portion of the information used to decrypt the encrypted portion is obtained from a location in the application computer program.
16. The process of claim 7 , further comprising the steps of:
after an operating system instruction that causes an interrupt is encountered, detecting if there has been tampering of the application computer program; and
if tampering has been detected, reporting information related to the tampering to a user of the application computer program.
17. The process of claim 7 , further comprising the steps of:
after an operating system instruction that causes an interrupt is encountered, detecting if there has been tampering of the application computer program; and
if tampering has not been detected, resuming execution of the application computer program.
18. A process for executing an application computer program that includes a plurality of subsections having boundaries, said application computer program configured to run under the control of an operating system, said process steps comprising:
substituting an operating system instruction that causes an interrupt for one or more bytes of at least one subsection;
relocating the substituted bytes to a location in the application computer program this is distinct from the boundaries of the subsection;
adding an execution controller computer program into the application computer program;
launching the application computer program;
launching the execution controller computer program, where the execution controller computer program is launched by the application computer program;
attaching the execution controller computer program to the application computer program using the operating system debugger interface;
executing the application computer program until an operating system instruction that causes an interrupt is encountered;
after an operating system instruction that causes an interrupt is encountered, restoring the operating system instruction that causes an interrupt with the substituted bytes; and
resuming execution of the application computer program, starting at the restored bytes.
19. The process of claim 18 , further comprising the steps of:
encrypting at least a portion of at least one subsection of the application computer program; and
after an operating system instruction that causes an interrupt is encountered, decrypting the encrypted portion.
20. The process of claim 18 , further comprising the steps of:
adding tamper detection instructions and data into the application computer program;
after an operating system instruction that causes an interrupt is encountered, detecting if there has been tampering of the application computer program; and
if tampering has been detected, terminating the execution of the application computer program.
21. The process of claim 18 , further comprising the steps of:
adding tamper detection instructions into the application computer program;
after an operating system instruction that causes an interrupt is encountered, detecting if there has been tampering of the application computer program; and
if tampering has been detected, reporting the tampering to a user of the application computer program.
22. The process of claim 18 , further comprising the steps of:
after an operating system instruction that causes an interrupt is encountered, authenticating a user of the application computer program; and
if the user of the application computer program is authenticated, resuming the execution of the application computer program.
23. The process of claim 18 , further comprising the steps of:
after an operating system instruction that causes an interrupt is encountered, authenticating a user of the application computer program; and
if the user of the application computer program is not authenticated, terminating the execution of the application computer program.