Systems and methods for the prevention of unauthorized use and manipulation of digital content
A number of systems and methods, alone, or in combination, achieve various levels of protection against unauthorized modification and distribution of digital content. This encompasses at least unauthorized study, modification, monitoring, reconstruction, and any other means for subversion from the originally intended purpose and license model of the digital content. The invention combines a number of techniques that in whole, or in part, serve to protect such content from unauthorized modification, reconstructive engineering, or monitoring by third parties. This is accomplished by means of methods which protect against subversion by specific tools operating on specific platforms as well as general tools operating on general platforms. Specific time domain attacks are identified, code modification can be identified and reversed, and virtual and emulated systems are identified. In addition, identification of in-circuit emulator tools (both software and hardware), debuggers, and security threats to running programs can be achieved.
1. A method for preventing unauthorized use of digital content data in a computer system comprising:
executing protected digital content data;
reading an area of a memory in the computer system, in response to the executing of the protected digital content data;
comparing the read area to at least one known signature of an emulated or virtual environment;
determining whether the computer system includes the emulated or virtual environment based on a result of the comparing; and
initiating a defensive action in response to a determination by the determining that the computer system includes the emulated or virtual environment.
2. The method of claim 1 , wherein data in the area of the memory is allocated when the system is started up.
3. The method of claim 1 , wherein the area of the memory that is read by the reading is predetermined.
4. The method of claim 1 , wherein the area of the memory that is read by the reading includes both static and dynamic data contents.
5. The method of claim 1 , wherein the area of the memory that is read by the reading is predetermined based on system usage.
6. The method of claim 1 , wherein the area of the memory that is read by the reading excludes portions of the memory.
7. An apparatus for preventing unauthorized use of digital content data comprising:
an executing portion configured to execute protected digital content data;
a reading portion configured to read an area of a memory in the computer system, in response to the executing portion executing the protected digital content data;
a comparing portion configured to compare the read area to at least one known signature of an emulated or virtual environment;
a determining portion configured to determine whether the computer system includes the emulated or virtual environment based on a result of processing by the comparing portion; and
an initiating portion configured to initiate a defensive action in response to a determination by the determining portion that the computer system includes the emulated or virtual environment.
8. The apparatus of claim 7 , wherein data in the area of the memory is allocated when the system is started up.
9. The apparatus of claim 7 , wherein the area of the memory that is read by the reading is predetermined.
10. The apparatus of claim 7 , wherein the area of the memory that is read by the reading includes both static and dynamic data contents.
11. The apparatus of claim 7 , wherein the area of the memory that is read by the reading is predetermined based on system usage.
12. The apparatus of claim 7 , wherein the area of the memory that is read by the reading excludes portions of the memory.
13. A non-transitory computer readable medium having stored thereon instructions that when executed by a computer cause the computer to implement a method for preventing unauthorized use of digital content data in a computer system comprising:
executing protected digital content data;
reading an area of a memory in the computer system, in response to the executing of the protected digital content data;
comparing the read area to at least one known signature of an emulated or virtual environment;
determining whether the computer system includes the emulated or virtual environment based on a result of the comparing; and
initiating a defensive action in response to a determination by the determining that the computer system includes the emulated or virtual environment.