Method of protecting a software program and hardware component with protected software program

Abstract

NOT VISIBLE DUE TO STATUS OF PATENT

Description

METHOD OF PROTECTING A SOFTWARE PROGRAM AND HARDWARECOMPONENT WITH PROTECTED SOFTWARE PROGRAMTechnical Field

[0001] Various embodiments relate generally to a method of protecting a software program and to a hardware component with protected software program.Background

[0002] Many security features involving a dongle are relying on a possession of a piece of hardware (usually the “dongle”).

[0003] Thus, they only permit using certain features or functions only if the dongle is in possession.

[0004] However, there is some room for cheating, since most of these security systems only check if the dongle is possessed (e. g., provided), but not if it is locally provided / available.

[0005] Thus, one way to cheat is to make the dongle remotely available, which may lead to a situation in which several users, e. g., anywhere in the world, may be able to use the dongle-protected soft- or hardware either simultaneously or directly subsequently, which is usually not the intended business case.

[0006] In one example, a user who owns a single CrypTA dongle may extend its usage via a network connection, such that the dongle can be used for more service cases than would be achievable by the single user travelling around and using it subsequently in different places.Summary

[0007] A method of protecting a software program installed on a first hardware component from unauthorized use is provided. The method includes collecting information on device setting parameters, device drivers and / or software programs installed on and / or presently run by the first hardware component, determining whether the collected information indicates that the first hardware component is configured to establish a data connection only to a local hardware interface that is connectable with a predefined type of hardware component, and only if the establishable data connection only to a local hardware interface is determined: identifying a second hardware component of the predefined type that is locally connected to the first hardware component, retrieving startup information and / or functions from the second hardware component, and starting the protected software program using the retrieved startup information and / or functions.Brief Description of the Drawings

[0008] In the drawings, like reference characters generally refer to the same parts throughout the different views. The drawings are not necessarily to scale, emphasis instead generally being placed upon illustrating the principles of the invention. In the following description, various embodiments of the invention are described with reference to the following drawings, in which:FIG. 1 shows a flow diagram of a method of protecting a software program in accordance with various embodiments; andFIG. 2 shows a schematic illustration of a first hardware component with a protected software program in accordance with various embodiments.Description

[0009] The following detailed description refers to the accompanying drawings that show, by way of illustration, specific details and embodiments in which the invention may be practiced.

[0010] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration". Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs.

[0011] Various aspects of the disclosure are provided for devices, and various aspects of the disclosure are provided for methods. It will be understood that basic properties of the devices also hold for the methods and vice versa. Therefore, for sake of brevity, duplicate description of such properties may have been omitted.

[0012] In various embodiments, a system of hard- and software is provided for protecting a further (e. g., chargeable) software from use by unauthorized persons.

[0013] The embodiments may include that the protected software is installed on a first hardware component (for example, on a personal computer (PC)) or the like, to which a second hardware component (e. g., a dongle) may be connectable, e. g. via a hardware interface. The second hardware component may be configured to provide information (e. g., keys) and / or functions (e. g., cryptographic functions) that may be required for successfully operating the protected software.

[0014] For ensuring that only the first hardware component, to which the second hardware component may be physically connected (e. g., via the hardware interface, as opposed to being remotely connected, e. g., via a network), is able to set the protected software to an executable state, one or more software functions may be employed.

[0015] In various embodiments, a software architecture of the first hardware component may be analyzed to determine whether general drivers that may allow for a remote access are installed on the first hardware component. Such drivers may be entered into a blacklist of forbidden drivers.

[0016] Alsternatively or additionally, drivers assigned to a known interface may be analyzed to determine whether they only include drivers that allow for only a local access to the second hardware component. Such (permitted) drivers may be entered into a whitelist of permitted drivers.

[0017] Further alternatively or additionally, information that may be provided by the second hardware component to the first hardware component, on which the the protected software may be installed, may be analyzed.

[0018] The information may for example include information regarding an interface (e. g., USB-related information). The analysis may for example include checking whether the interface information matches in information that is expected if the known (e. g., permitted) interface was used.

[0019] If any of the software functions results in a possiblity that the second hardware component is remotely connected (e. g., rather than a physical direct connection) to the first hardware component, for example by having a blacklisted driver for remote access installed, and / or a driver that is assigned to the interface is not includedin the whitelist, and / or the interface-related information provided together with data does not match the expected information, a predefined action may be taken.

[0020] Predefined actions may include refusing to start execution of the protected software, stopping execution of the protected software, raising an alarm, activating a payment function that provides a possibility for additional payments, etc.

[0021] FIG. 1 shows a flow diagram 100 of a method of protecting a software program in accordance with various embodiments.

[0022] The software program, also referred to as the protected software program or the protected program, may be installed on a first hardware component, and may be protected from unauthorized use.

[0023] Unauthorized use in this context may, besides use without authorization, in particular refer to a use woth an authorization that is provided from a remote location, rather than from a second hardware component that is locally connected to the first hardware component.

[0024] The method includes collecting information on device setting parameters, device drivers and / or software programs installed on and / or presently run by the first hardware component (110).

[0025] Device setting parameters may for example include or consist of any, some, or all of the following: a USB Host Controller, a USB Device Location Info, a USB Device Location, a Location Info of another Human Interface Device, and a Location Paths of another Human Interface Device.

[0026] Device drivers may for example include or consist of entries in a device object tree and / or a driver stack related to the second hardware component.

[0027] Software programs installed on the first hardware component may include executable files of software programs or executable links to software programs that are temporarily or permanently stored on any storage device that is part of or directly connected to the first hardware component, and / or in one or more predefined folders or storage devices. The storage devices may for example include a main memory, e. g., a hard disk or solid state drive, auxiliary internal memory devices, and external memory devices, for example magnetic, optical and / or flash memory devices that may be connected to the first hardware component via an interface, e. g., a port, a bus, etc.

[0028] Software programs presently run by the first hardware component may include any foreground and / or background process or task reported by a (e. g., Windows) task manager or the like as being presently run.

[0029] The method may further include determining whether the collected information indicates that the first hardware component is configured to establish a data connection only to a local hardware interface that is connectable with a predefined type of hardware component (120).

[0030] A local hardware interface in this context may be understood as being integrated into or directly connected (e. g., via a port and / or a cable or the like) to the first hardware component.

[0031] Or, to turn around the analysis, it may be determined whether there is indication that the first hardware component is configured to establish a data connection to a remote hardware interface that is connectable with a predefined type of hardware component.

[0032] A remote hardware interface in this context may be understood as any kind of hardware interface that is not a local hardware interface, in particular a hardware interface that is connected to the first hardware interface via a wireless connection, via a remote server, or the like.

[0033] The determining whether the collected information indicates that the first hardware component is configured to establish a data connection only to a local hardware interface that is connectable with a predefined type of hardware component may include at least one of the following:Comparing the collected information with a whitelist of allowed device setting parameters, device drivers and / or software programs. The whitelist may include at least one device setting parameter and / or at least one program that is used for establishing the data connection to the local hardware interface.It is to be understood that the device setting parameters in the whitelist may be specified as a pattern using wildcards / placeholders, rather than specifying any possible parameter as an individual entry in the list.Comparing the collected information with a blacklist of forbidden device setting parameters, device drivers and / or software programs to indicate that the first hardware component is configured to establish a data connection with an external hardware interface that is connectable with a predefined type of hardware component.It is to be understood that the device setting parameters in the blacklist may be specified as a pattern using wildcards / placeholders, rather than specifying any possible parameter as an individual entry in the list.Comparing location information that is part of the USB information with a pre- defined (expected) pattern.

[0034] The whitelist may include the following:Examples of strings that would be identified as compatible with whitelist values of the corresponding parameters include the following:USB Host Controller:Device path: \\?\pci#ven_8086&dev_02ed&subsys_09al 1028&rev_00#...Dongle as mass storage device (MSD):Location Info: Port#0004.Hub_#0004Location Paths: PCIROOT(0)#PCI(1400)#USBROOT(0)#USB(3)Dongle as human interface device (HID):Location Info: Port#0004.Hub_#0004Location Paths: PCIROOT(0)#PCI(1400)#USBROOT(0)#USB(3)Other local HID devices:Location Info: 0000.0014.0000.001.002.003.000.000.000Location Paths: PCIROOT(0)#PCI(1400)#USBROOT(0)#USB(3)

[0035] The blacklist may include the following:Comparing location information that is part of the USB information with a pre-defined (expected) pattern may in some cases be a straightforward way for identifying an unauthorized use of the protected software, because a certain pattern may be expected for the given hardware / software setup. For example, in the intended usage inside the product ProBase / C, the location information that is part of the USB information will be expected to have a certain pre-defined pattern / value / string. The dongle will only be accepted if the location information matches this particular pattern / value / string.

[0036] The method may further include, only if the establishable data connection only to a local hardware interface is determined (130): identifying a second hardware component of the predefined type that is locally connected to the first hardware component (140), retrieving startup information and / or functions from the secondhardware component (150), and starting the protected software program using the retrieved startup information and / or functions (160).

[0037] Processes 140 to 160 may essentially be similar or identical to state-of-the-art processes that may be executed when a software is not protected by the method of various embodiments. In other words, once it is determined that the second hardware component is actually locally connected to the first hardware component, the protected software may be started and used like in the prior art, e. g., by determining where startup information (e. g., an authorization for using the software) is to be retrieved, e. g. from the second hardware device, e. g., a USB dongle or for example a DVD, a chip card, or another type of storage device, retrieving the startup information, e. g., an authorization like for example a key, from the second hardware device, and finally starting the protected software program.

[0038] If, on the other hand, it is determined that the second hardware component may be remotely connected, or if it is indeterminable whether the second hardware component is remotely or locally connected, a predetermined action may be taken. For example, an execution of the protected software may be prohibited, a warning may be issued and / or a payment scheme may be activated that may allow a temporary access to the software upon payment of a fee.

[0039] FIG. 2 shows a schematic illustration of a hardware component 200 with a protected software program in accordance with various embodiments.

[0040] The hardware component 200 may be configured to collect information on device setting parameters, device drivers and / or software programs installed on and / or presently run by the hardware component 200.

[0041] The hardware component 200 may for example include or consist of a personal computer like for example a desktop computer or a laptop, a tablet, or the like. The hardware component 200 may correspond to the above first hardware component.

[0042] The hardware component 200 may for example include at least one processor 220, for example a central processor or a group of processors, configured for the following: determining whether the collected information indicates that the hardware component is configured to establish a data connection only to a local hardware interface that is connectable with a predefined type of second hardware component 224, e. g., via an interface 222, and only if the establishable data connection only to a local hardware interface is determined: to identify a second hardware component of the predefined type that is locally connected to the hardware component, to retrieve startup information and / or functions from the second hardware component, and to start the protected software program using the retrieved startup information and / or functions, for example as described above.

[0043] The second hardware component 220 may for example be or include a USB dongle, a DVD, a chip card, or any other locally provided storage device that may be configured to locally provide an authorization for using the protected software.

[0044] Various examples will be illustrated in the following:

[0045] Example 1 is a method of protecting a software program installed on a first hardware component from unauthorized use, the method including collecting information on device setting parameters, device drivers and / or software programs installed on and / or presently run by the first hardware component, determining whether the collected information indicates that the first hardware component is configured to establish a dataconnection only to a local hardware interface that is connectable with a predefined type of hardware component, and only if the establishable data connection only to a local hardware interface is determined: identifying a second hardware component of the predefined type that is locally connected to the first hardware component, retrieving startup information and / or functions from the second hardware component, and starting the protected software program using the retrieved startup information and / or functions.

[0046] In Example 2, the subject-matter of Example 1 may optionally include that the determining includes comparing the collected information with a whitelist of allowed device setting parameters, device drivers and / or software programs.

[0047] In Example 3, the subject-matter of Example 2 may optionally include that the whitelist includes at least one device setting parameter and / or at least one program that is used for establishing the data connection to the local hardware interface.

[0048] In Example 4, the subject-matter of Example 3 may optionally include that the whitelist includes at least one of a group of device setting parameters, the group including or consisting of the USB Host Controller Device Path matching the pattern: \\?\pci#ven_xxxx&dev_yyyy&subsys_zzzz&rev_nn#...; the USB Device Location Info matching the pattern: Port_#xxxx.Hub_#yyyy, the USB Device Location Info matching the pattern: aaaa.bbbb.cccc.ddd.eee.fffggg.hhh.iii, and the USB Device Location Paths matching the pattern: PCIROOT(w)#PCI(x)#USBROOT(y)#USB(z)..

[0049] In Example 5, the subject matter of any of Examples 1 to 4 may optionally include that the determining includes comparing the collected information with a blacklist of forbidden device setting parameters, device drivers and / or software programs to indicate that the first hardware component is configured to establish a data connectionwith an external hardware interface that is connectable with a predefined type of hardware component.

[0050] In Example 6, the subject-matter of Example 5 may optionally include that the blacklist includes at least one device setting parameter and / or at least one program that is used for establishing the data connection to a remote or virtual hardware interface.

[0051] In Example 7, the subject-matter of Example 5 or 6 may optionally include that the blacklist includes at least one of a group of device setting parameters, the group including or consisting of the USB Host Controller Device Path string including “\\?\root...”, the USB Device Location Info being set to: SEH myUTN,CodeMeter-Stick M, and the USB Device Location Info being set to: WIBU-Systems AG CodeMeter-Stick M.

[0052] In Example 8, the subject matter of any of Examples 5 to 7 may optionally include that the blacklist includes at least one of a group of programs, the group including or consisting of: SEH UTN Manager, and Fabula Tech.

[0053] In Example 9, the subject matter of any of Examples 1 to 8 may optionally include that the determining includes comparing a USB Host Controller Device Path as the collected information with a predefined pattern for a local USB Host Controller, for example with the pattern \\?\pci#ven_xxxx&dev_yyyy&subsys_zzzz&rev_nn#..., and / or with a predefined pattern for a remote or virtual USB Host Controller, for example with the pattern \\?\root....

[0054] In Example 10, the subject-matter of Example 8 or 9 may optionally further include comparing a USB Location Info and / or a Location Paths as the collected information with a respective predefined pattern for a local USB Host Controller, forexample with the pattern Port_#xxxx.Hub_#yyyy and / or with the pattern aaaa.bbbb.cccc.ddd.eee.fff.ggg.hhh.iii, and / or with a predefined pattern for a remote or virtual USB Device, for example with the string SEH myUTN;CodeMeter-Stick M and / or with the string WIBU-Systems AG CodeMeter- Stick M.

[0055] In Example 11, the subject matter of any of Examples 1 to 10 may optionally include that the local hardware interface is integrated into or directly connected to the first hardware component.

[0056] In Example 12, the subject matter of any of Examples 1 to 11 may optionally include that the startup information includes an access key to the protected software program.

[0057] Example 13 is a hardware component with a protected software program, configured to collect information on device setting parameters, device drivers and / or software programs installed on and / or presently run by the hardware component, determine whether the collected information indicates that the hardware component is configured to establish a data connection only to a local hardware interface that is connectable with a predefined type of second hardware component, and only if the establishable data connection only to a local hardware interface is determined: to identify a second hardware component of the predefined type that is locally connected to the hardware component, to retrieve startup information and / or functions from the second hardware component, and to start the protected software program using the retrieved startup information and / or functions.

[0058] In Example 14, the subject-matter of Example 13 may optionally include that to determine whether the collected information indicates the establishable data connectiononly to the local hardware interface includes to compare the collected information with a whitelist of allowed device setting parameters, device drivers and / or software programs.

[0059] In Example 15, the subject-matter of Example 14 may optionally include that the whitelist includes at least one device setting parameter and / or at least one program that is used for establishing the data connection to the local hardware interface.

[0060] In Example 16, the subject-matter of Example 14 or 15 may optionally include that the whitelist includes at least one of a group of device setting parameters, the group including or consisting of: the USB Host Controller being set to:“\\?\pci#ven_8086&dev_02ed&subsys_09al 1028&rev_00#...”, the USB Device Location Info being set to: Port#0004.Hub_#0004, the USB Device Location Paths being set to: PCIROOT(0)#PCI(1400)#USBROOT(0)#USB(3), the Location Info of another Human Interface Device being set to: 0000.0014.0000.001.002.003.000.000.000, the Location Paths of another Human Interface Device being set to: PCIROOT(0)#PCI(1400)#USBROOT(0)#USB(3).

[0061] In Example 17, the subject matter of any of Examples 13 to 16 may optionally include that to determine whether the collected information indicates the establishable data connection only to the local hardware interface includes comparing the collected information with a blacklist of forbidden device setting parameters, device drivers and / or software programs to indicate that the first hardware component is configured to establish a data connection with an external hardware interface that is connectable with a predefined type of hardware component.

[0062] In Example 18, the subject-matter of Example 17 may optionally include that the blacklist includes at least one device setting parameter and / or at least one program that is used for establishing the data connection to a remote or virtual hardware interface.

[0063] In Example 19, the subject-matter of Example 17 or 18 may optionally include that the blacklist includes at least one of a group of device setting parameters, the group including or consisting of: the USB Host Controller Device Path string including “\\?\root...”, the USB Device Location Info being set to: SEH myUTN,CodeMeter-Stick M, the USB Device Location Info being set to: WIBU-Systems AG CodeMeter-Stick M.

[0064] In Example 20, the subject matter of any of Examples 17 to 19 may optionally include that the blacklist includes at least one of a group of programs, the group including or consisting of: SEH UTN Manager and Fabula Tech.

[0065] In Example 21, the subject matter of any of Examples 13 to 20 may optionally include that the determining includes comparing a USB Host Controller Device Path as the collected information with a predefined pattern for a local USB Host Controller, for example with the pattern \\?\pci#ven_xxxx&dev_yyyy&subsys_zzzz&rev_nn#..., and / or with a predefined pattern for a remote or virtual USB Host Controller, for example with the pattern \\?\root....

[0066] In Example 22, the subject-matter of Example 21 is optionally further configured to compare a USB Location Info and / or a Location Paths as the collected information with a respective predefined pattern for a local USB Host Controller, for example with the patterns aaaa.bbbb.cccc.ddd.eee.fffggg.hhh.iii and / or Port_#xxxx.Hub_#yyyy for the USB Location Info and / orPCIROOT(w)#PCI(x)#USBROOT(y)#USB(z) for the Location paths, and / or with apredefined patern for a remote or virtual USB Device, for example with the string SEH myUTN;CodeMeter- Stick M and / or the string WIBU-Systems AG CodeMeter-Stick M.

[0067] In Example 23, the subject matter of any of Examples 13 to 22 may optionally include that the local hardware interface is integrated into or directly connected to the hardware component.

[0068] In Example 24, the subject matter of any of Examples 13 to 22 may optionally include that the startup information includes an access key to the protected software program.

[0069] In Example 25, the subject matter of any of Examples 13 to 24 may optionally include that the predefined hardware device is a Universal Serial Bus, USB, dongle.

[0070] Example 26 is a on-transitory computer readable medium including instructions that, if executed by one or more processors of a hardware component, realize any of the Examples 1 to 12.

[0071] Example 27 is a machine-readable storage device including machine-readable instructions that, when executed, realize any of the Examples 1 to 12.

[0072] While the invention has been particularly shown and described with reference to specific embodiments, it should be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. The scope of the invention is thus indicated by the appended claims and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced.

Claims

ClaimsWhat is claimed is:

1. A method of protecting a software program installed on a first hardware component from unauthorized use, the method comprising: collecting information on device setting parameters, device drivers and / or software programs installed on and / or presently run by the first hardware component; determining whether the collected information indicates that the first hardware component is configured to establish a data connection only to a local hardware interface that is connectable with a predefined type of hardware component; and only if the establishable data connection only to a local hardware interface is determined:• identifying a second hardware component of the predefined type that is locally connected to the first hardware component;• retrieving startup information and / or functions from the second hardware component; and• starting the protected software program using the retrieved startup information and / or functions.

2. The method of claim 1 , wherein the determining comprises comparing the collected information with a whitelist of allowed device setting parameters, device drivers and / or software programs.

3. The method of claim 2, wherein the whitelist comprises at least one device setting parameter and / or at least one program that is used for establishing the data connection to the local hardware interface.

4. The method of claim 2 or 3,wherein the whitelist comprises at least one of a group of device setting parameters, the group comprising or consisting of:• an USB Host Controller Device Path matching the pattern: \\?\pci#ven_xxxx&dev_yyyy&subsys_zzzz&rev_nn#... ;• an USB Device Location Info matching the pattern:Port_#xxxx. Hub_#yyyy ;• an USB Device Location Info matching the pattern: aaaa. bbbb. cccc. ddd. eee. fff. ggg. hhh. iii;• an USB Device Location Paths matching the pattern: PCIROOT(w)#PCI(x)#USBROOT(y)#USB(z).

5. The method of any of claims 1 to 4, wherein the determining comprises comparing the collected information with a blacklist of forbidden device setting parameters, device drivers and / or software programs to indicate that the first hardware component is configured to establish a data connection with an external hardware interface that is connectable with a predefined type of hardware component.

6. The method of claim 5, wherein the blacklist comprises at least one device setting parameter and / or at least one program that is used for establishing the data connection to a remote or virtual hardware interface.

7. The method of any of claims 1 to 6, wherein the determining comprises comparing a USB Host Controller Device Path as the collected information with a predefined pattern for a local USB Host Controller, and / or with a predefined pattern for a remote or virtual USB Host Controller.

8. The method of claim 7, further comprising:comparing a USB Location Info and / or a Location Paths as the collected information with a respective predefined pattern for a local USB Host Controller, and / or with a predefined pattern for a remote or virtual USBDevice.

9. The method of any of claims 1 to 8, wherein the local hardware interface is integrated into or directly connected to the first hardware component.

10. The method of any of claims 1 to 9, wherein the startup information includes an access key to the protected software program.

11. Hardware component with protected software program, configured to: collect information on device setting parameters, device drivers and / or software programs installed on and / or presently run by the hardware component; determine whether the collected information indicates that the first hardware component is configured to establish a data connection only to a local hardware interface that is connectable with a predefined type of hardware component; and only in a case that the establishable data connection only to a local hardware interface is determined:• to identify a second hardware component of the predefined type that is locally connected to the hardware component;• to retrieve startup information and / or functions from the second hardware component; and• to start the protected software program using the retrieved startup information and / or functions.

12. The hardware component of claim 11,wherein the startup information includes an access key to the protected software program.

13. The hardware component of claim 11 or 12, wherein the predefined hardware device is a Universal Serial Bus, USB, dongle.