Systems and methods for watermarking software and other media
View Patent ↗Systems and methods are disclosed for embedding information in software and/or other electronic content such that the information is difficult for an unauthorized party to detect, remove, insert, forge, and/or corrupt. The embedded information can be used to protect electronic content by identifying the content's source, thus enabling unauthorized copies or derivatives to be reliably traced, and thus facilitating effective legal recourse by the content owner. Systems and methods are also disclosed for protecting, detecting, removing, and decoding information embedded in electronic content, and for using the embedded information to protect software or other media from unauthorized analysis, attack, and/or modification.
1. A method for marking computer code, the method performed by a computer system comprising a processor and a memory encoded with program instructions that, when executed by the processor, cause the system to perform the method, the method comprising:
generating a plurality of marks, each mark of the plurality of marks comprising a payload and extra information, the extra information being different for each mark of the plurality of marks;
encrypting the plurality of marks to create a plurality of encrypted marks; and
inserting the plurality of encrypted marks into the computer code;
wherein the extra information comprises S bits, and wherein the plurality of marks comprise 2 S marks.
2. The method of claim 1 , wherein each mark of the plurality of marks further comprises a digital signature.
3. The method of claim 1 , wherein the extra information is randomly generated.
4. The method of claim 1 , further comprising associating each encrypted mark of the plurality of encrypted marks with the extra information included in the respective encrypted marks, and wherein inserting the plurality of encrypted marks further comprises inserting the associated extra information into the computer code.
5. The method of claim 4 , wherein the extra information associated with each encrypted mark of the plurality of the encrypted marks comprises plaintext information.
6. A method for processing marked computer code, the method performed by a computer system comprising a processor and a memory encoded with program instructions that, when executed by the processor, cause the system to perform the method, the method comprising:
receiving marked computer code, the marked computer code comprising a plurality of encrypted marks;
decrypting the plurality of encrypted marks to generate a plurality of unencrypted marks, wherein each unencrypted mark of the plurality of unencrypted marks comprises a payload and extra information; and
determining, based on an analysis of each of the plurality of unencrypted marks, whether the marked computer code has been compromised;
wherein unencrypted marks included in a first subset of the plurality of unencrypted marks comprise the same extra information and unencrypted marks included in a second subset of the plurality of unencrypted marks comprise different extra information.
7. The method of claim 6 , wherein the extra information is randomly-generated.
8. The method of claim 6 , wherein determining whether the marked computer code has been compromised further comprises determining whether the unencrypted marks of the first subset comprise the same extra information.
9. The method of claim 6 , wherein the method further comprises:
determining that the unencrypted marks included in the second subset each comprise different extra information; and
identifying the payloads included in the unencrypted marks of the second subset as authentic payloads.
10. The method of claim 6 , wherein the method further comprises taking protective action based on a determination that the computer code has been compromised.
11. A method for processing marked computer code, the method performed by a computer system comprising a processor and a memory encoded with program instructions that, when executed by the processor, cause the system to perform the method, the method comprising:
receiving marked computer code, the marked computer code comprising a plurality of encrypted marks;
decrypting the plurality of encrypted marks to generate a plurality of unencrypted marks, wherein each unencrypted mark of the plurality of unencrypted marks comprises a payload and extra information; and
determining, based on an analysis of each of the plurality of unencrypted marks, whether the marked computer code has been compromised;
wherein unencrypted marks included in a first subset of the plurality of unencrypted marks each comprise a first payload and unencrypted marks included in a second subset of the plurality of unencrypted marks each comprise a second payload different from the first payload, and the method further comprises:
determining that a number of unencrypted marks included in the first subset is larger than a number of unencrypted marks included in the second subset; and
identifying, based on the determination, the first payload as an authentic payload.
12. A method for processing marked computer code, the method performed by a computer system comprising a processor and a memory encoded with program instructions that, when executed by the processor, cause the system to perform the method, the method comprising:
receiving marked computer code, the marked computer code comprising a plurality of encrypted marks;
decrypting the plurality of encrypted marks to generate a plurality of unencrypted marks, wherein each unencrypted mark of the plurality of unencrypted marks comprises a payload and extra information; and
determining, based on an analysis of each of the plurality of unencrypted marks, whether the marked computer code has been compromised;
wherein the extra information comprises S bits, and wherein the plurality of unencrypted marks comprise 2 S marks.
13. A method for processing marked computer code, the method performed by a computer system comprising a processor and a memory encoded with program instructions that, when executed by the processor, cause the system to perform the method, the method comprising;
receiving marked computer code, the marked computer code comprising a plurality of encrypted marks;
decrypting the plurality of encrypted marks to generate a plurality of unencrypted marks, wherein each unencrypted mark of the plurality of unencrypted marks comprises a payload and extra information; and
determining, based on an analysis of each of the plurality of unencrypted marks, whether the marked computer code has been compromised:
wherein each encrypted mark of the plurality of encrypted marks is further associated with unencrypted extra information and the method further comprises:
comparing unencrypted extra information associated with an encrypted mark of the plurality of encrypted marks with the extra information included in an associated unencrypted mark; and
determining that the unencrypted extra information matches the extra information included in the associated unencrypted mark and that the unencrypted mark has not been modified.
14. A non-transitory computer-readable storage medium storing instructions that, when executed by a processor included in a computer system, cause the computer system to:
generate a plurality of marks, each mark of the plurality of marks comprising a payload and extra information, the extra information being different for each mark of the plurality of marks;
encrypt the plurality of marks to create a plurality of encrypted marks;
insert the plurality of encrypted marks into computer code; and
transmit the computer code including the inserted plurality of encrypted marks to a receiving computer system;
wherein the extra information comprises S bits, and wherein the plurality of marks comprise 2 S marks.
15. The non-transitory computer-readable storage medium of claim 14 , wherein each mark of the plurality of marks further comprises a digital signature.
16. The non-transitory computer-readable storage medium of claim 14 , wherein the extra information is randomly generated.
17. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions are further configured to cause the computer system to associate each encrypted mark of the plurality of encrypted marks with the extra information included in the respective encrypted marks, and wherein inserting the plurality of encrypted marks further comprises inserting the associated extra information into the computer code.