Methods and Apparatus for the Protection and Control of Computer Programs

1. Field of the Invention.

My invention relates to methods and apparatus for the protection and control of computer programs, and more particularly to non-cryptographic methods and apparatus for the protection and control of computer programs.

2. Description of the Prior Art.

The term "prior art" as used herein or in any statement made by or for applicant means only that any document or thing referred to as prior art bears or might be contended to bear, directly or inferentially, a date which is earlier than the effective filing date hereof. It is believed that the documents listed immediately below contain information which is or might be considered to be material to the examination of this patent application, since they were discovered by two independently made preliminary patentability searches.

U.S. Pat. No. 3,798,359

U.S. Pat. No. 3,906,460

U.S. Pat. No. 3,909,795

U.S. Pat. No. 3,911,216

U.S. Pat. No. 3,958,081

U.S. Pat. No. 3,978,454

U.S. Pat. No. 4,038,596

U.S. Pat. No. 4,070,702

U.S. Pat. No. 4,107,458

U.S. Pat. No. 4,120,030

U.S. Pat. No. 4,122,519

U.S. Pat. No. 4,157,454

U.S. Pat. No. 4,158,396

U.S. Pat. No. 4,188,789

U.S. Pat. No. 4,278,037.

No representation is made herein that no more pertinent information exists.

Methods and apparatus for the protection and control of computer programs are to be found in the prior art.

Many of the prior art methods and apparatus for the protection and control of computer programs are cryptographic in character, relying upon the encryption of the programs to be protected or controlled or parts thereof, and thus necessitating the incorporation of decrypting means, i.e., special circuits and/or programs and data, into each computer in which such an encrypted program is to be run.

Thus, even the simplest of these prior art cryptographic systems involve considerable cost, both for the encryption of the programs and for the modification of the associated computers to decrypt the encrypted programs. Further, the encryption and decryption of the programs of these systems necessarily produces additional possibilities of error and difficulties in the servicing of the computers thereof.

Non-cryptographic arrangements for the protection of computer-controlled communications and industrial processing equipment against erroneous modifications of their control programs are also known in the prior art, but the operating principles of these arrangements are either inapplicable to general purpose digital computers and their programs or do not appear to have been applied thereto.

Accordingly, it is an object of my invention to provide non-cryptographic methods and apparatus for the protection and control of programs for general purpose digital computers, i.e., digital computers which are not dedicated to particular applications in industrial process control or communications.

Another object of my invention is to provide methods and apparatus for the protection and control of computer programs which are compatible with the running of unprotected programs on the same computers, without modification.

Yet another object of my invention is to provide methods and apparatus for the protection and control of computer programs to which virtually any existing digital computer may be easily adapted by retrofitting.

A further object of my invention is to provide methods and apparatus for the protection and control of computer programs which do not involve the redesign of any basic computer units, or new approaches to the design of basic computer units, but rather involve only the addition to pre-existing computer designs of new and separate units which can be simply and directly connected to the busses of those designs without substantial changes in timing or internal data and instruction handling.

It is a yet further object of my invention to provide methods and apparatus for the protection and control of computer programs which can be adapted to existing, newly designed, or future computers without substantially impairing their operating speeds or other aspects of their functioning.

It is an additional object of my invention to provide methods and apparatus for the protection and control of computer programs which can in some instances increase the speed of operation of the computers to which they are adapted.

It is another object of my invention to provide methods and apparatus for the protection and control of computer programs which include means whereby the protected and controlled programs can only be run on predesignated computers, at predetermined times, on predetermined dates, and/or in the presence or with the consent of predesignated individuals.

It is yet another object of my invention to provide methods and apparatus for the protection and control of computer programs in which at least some of the units added to a computer to adapt it for such protection and control are rendered ineffective or completely destroyed if they are tampered with in an attempt to misappropriate a protected program.

Other objects of my invention will in part be obvious and will in part appear hereinafter.

My invention, accordingly, comprises the several steps and the relations of one or more of such steps with respect to each of the others, and the apparatus embodying features of construction, combinations of elements, and arrangements of parts which are adapted to effect such steps, all as exemplified in the following disclosure, and the scope of my invention will be delineated in the appended claims.

Glossary. It is believed that the following definitions will be helpful to those having ordinary skill in the art in obtaining a full appreciation of the several features and aspects of my invention pointed out hereinbelow.

The term "abridge" is used herein in its sense which is substantially synonymous with the word curtail, meaning to make cuts or deletions which impair completeness.

The term "active restoration unit" as used herein denotes a restoration unit which is itself capable of executing one or more routines of a valid computer program, which routine or routines have been deleted from said valid program in creating the systematically invalidated program which is furnished to the computer equipped with that restoration unit.

The term "augmented program" as used herein denotes an invalidated program which comprises one or more instructions added to the corresponding valid program to invalidate it.

The term "computer" as used herein embraces both large scale digital computers, e.g., mainframes, and small scale digital computers, e.g., microcomputers.

The term "confirmation unit" as used herein denotes a unit added to a computer equipped with a restoration unit of the present invention which serves to confirm that certain prescribed preconditions exist before that restoration unit can be used to restore an inputted invalidated program to a corresponding valid form and may serve to destroy or otherwise incapacitate the restoration unit if an attempt is made to run that particular invalidated program in that particular computer when said prescribed preconditions do not exist or have not been met, or may bring about the production of spurious output data if an attempt is made to run that particular invalidated program in that particular computer when said prescribed preconditions do not exist or have not been met. It is to be understood as part of my invention, however, that in certain embodiments thereof the confirmation unit will cause the equipped computer to produce false results when an invalidated program is inputted thereto and the corresponding prescribed preconditions do not exist, rather than destroying or otherwise incapacitating the restoration unit of the equipped computer. It is also to be understood that in certain embodiments of my invention the data necessary for confirmation, sometimes called the "confirmation code", is manually entered by means of the equipped computer terminal keyboard, rather than being entered by means of a custom made physical device, i.e., confirmation unit, which contains a machine readable representation of the confirmation code.

The term "data supply instruction" or "data call" as used herein denotes an instruction emitted by an active restoration unit which causes the computer equipped therewith to supply thereto data necessary for correctly executing a routine deleted from the corresponding valid program and stored in that active restoration unit.

The term "diminished program" as used herein denotes an invalidated program which is lacking a withheld element or withheld elements of the corresponding valid program.

The term "element" as used herein with respect to a computer program denotes any part of that program, however small. E.g., an element of a computer program may be a single bit of the machine language expression thereof. E.g., an element of a computer program may be a complete library subprogram.

The term "equipped computer" as used herein denotes a computer which is equipped with a restoration unit, and sometimes with one or more additional units, e.g., confirmation units, of my invention, such that it is adapted to run at least one corresponding furnished, invalidated program.

The term "furnished program" as used herein denotes a systematically invalidated computer program which is or is to be furnished to a user of a computer equipped with a restoration unit embodying my invention, e.g., pursuant to a contract of lease or sale, which restoration unit contains at least part of the specific restoration program or procedure for restoring the furnished program to its original, valid form within the computer.

The term "host computer" as used herein is synonymous with the term "equipped computer" herein.

The term "hybrid program" or "hybrid-invalidated program" is used herein to denote an invalidated program which was invalidated by a plurality of invalidation methods, e.g., diminution and permutation, or augmentation, diminution, and permutation.

The term "incompatible" is used herein in its ordinary acceptation to mean incapable of entering into the same system, theory of practice; incapable of harmonious association or of acting in accord.

The term "interrupt instruction" as used herein denotes an instruction emitted by a restoration unit or included in the corresponding furnished program which causes the corresponding, equipped computer to delay its pending operations (if any) to allow the restoration unit to inject an instruction or instructions or other data into the control unit.

The term "invalidated" is used herein in one of its common acceptations to denote something which has been rendered invalid, i.e., inefficacious, ineffective, or incapable of accomplishing what it is intended to accomplish.

Thus, the term "invalidated program" as used herein denotes an originally valid computer program which has been so modified as to render it invalid.

The term "invalidator" as used herein denotes an instruction or routine which is added to a computer program to systematically invalidate it.

Where the context so requires or admits, the term "part", as used herein, embraces the term "whole", in the manner well known in set theory and systematic logic.

The term "passive restoration unit" as used herein denotes a restoration unit which is not capable of executing a routine of a valid program, but rather is capable only of supplying data and/or instructions to the central processing unit of the computer which is equipped with that restoration unit.

The term "permuted program" is used herein to denote an invalidated program which was invalidated by the displacement of one or more of its elements.

The term "plain" is used here in its common acceptation in the cryptographic arts to mean unencrypted.

The term "plain language" as used herein with reference to a particular program, whether valid or invalidated, denotes the fact that that program is expressed in a common programming language, usually the programming language which is the source language of the compiler of the computer on which that program is intended to be run or in which that program will be restored during the running of the corresponding invalidated program.

The term "program" is used herein in its broadest acceptation as embracing but not limited to all computer programs, whether valid or invalid, and all related collections of computer program instructions or routines, whether or not all of the members of such a collection are arranged to be run on a computer seriatim to accomplish a single result.

The term "program" as used herein also embraces items of data which are part of or are to be operated upon by a computer program.

The term "pseudoprogram" will sometimes be used herein to denote an invalidated program, because, in accordance with the principles of my invention, the invalidated program will be expressed in the same programming language as the corresponding valid program, and thus may be regarded in some sense as a falsified version of the original, valid program.

The term "restoration arithmetic and logic unit" or "RALU" as used herein denotes a computer arithmetic and logic unit which is a part of a restoration unit, wherefrom it will be evident to those having ordinary skill in the art, informed by the present disclosure, that certain restoration units according to my invention are themselves dedicated computers.

The term "restoration control unit" or "RCU" as used herein denotes a computer control unit which is a part of a restoration unit, wherefrom it will be evident to those having ordinary skill in the art, informed by the present disclosure, that certain restoration units according to my invention are themselves dedicated computers.

The term "restoration library address" as used herein denotes the address of a particular instruction or step of a restoration program or procedure as found in a particular restoration library unit.

The term "restoration library unit" as used herein denotes a restoration unit, q.v., which contains the instructions or steps of more than one restoration program or procedure. The term "restoration library", accordingly, denotes herein the contents of a restoration library unit.

The term "restoration memory unit" or "RMU" as used herein denotes a memory unit which is a part of a restoration unit.

The term "restoration program" as used herein denotes a program or procedure for restoring an invalidated program to its original, valid form.

The term "restoration program segment" or "restoration subprogram" as used herein denotes a part of a restoration program which is activated by a single restoration instruction.

The term "restoration timing unit" or "RTU" as used herein denotes a timing unit for the timing of the operations of a restoration unit, which may include synchronizing means for synchronizing itself with the clock pulses of the supplied computer.

The term "restoration unit" as used herein denotes a unit added to a programmable digital computer which is capable of supplying the necessary data and directing the operation of that computer to restore an invalidated program to its original, valid form while running that valid program. Such an original, valid program reconstructed seriatim or instruction-by-instruction within a computer equipped with the correct restoration unit, will be called a "restored program" herein.

The term "restore" is used herein in one of its common acceptations as meaning "to put back into or bring back into a former or original state".

More particularly, the term "restore" as applied to an invalidated program herein means to put back or bring back that program to its original, valid state or form, or to reconstruct the corresponding original, valid program from the invalidated program and the contents or certain selected contents of the restoration unit, q.v., supra, of the unique computer which is adapted to successfully run the invalidated program by reason of incorporation in it of a corresponding restoration unit.

The term "restore instruction" or "restoration instruction" as used herein denotes an instruction contained in a furnished program which, when the furnished program is run on the computer to which it is furnished, causes the restoration unit of that computer to carry out the corresponding part of the restoration program or procedure for that furnished program. In many embodimants of my invention at least some of the restoration instructions will include restoration library addresses. In some embodiments of my invention the operating program of the computer is so designed as to cause the control unit to be nonresponsive to any restore instruction.

The term "revalidated" will sometimes be used herein as synonymous with the term "restored", as applied herein to an invalidated program or programs.

The term "revalidator" as used herein denotes an instruction or routine which may be inserted into a restored program by a restoration unit to cancel the invalidating effect of a preceding invalidator.

The term "routine" is used herein in its broadest acceptation to denote any related set of one or more instructions. Thus, the term "routine" as used herein generically embraces the term "subroutine" as a particular type of routine, and also generically embraces the term "instruction".

The term "run" is used herein to denote the running of a systematically invalidated program on a computer embodying my invention, although, as will be made apparent herein to those having ordinary skill in the art, the result will be that of running the corresponding valid program on a computer not embodying my invention.

The term "singulatization" as used herein denotes the process of so modifying a particular systematically invalidated program, which is intended to be supplied to a particular computer embodying my invention, as to render it unique, i.e., different from all of the versions of that same systematically invalidated program which are to be supplied to other computers embodying my invention.

The term "supplied computer" as used herein denotes a computer to which a furnished program, q.v., is furnished.

The term "suppressor" as used herein denotes an instruction which causes a computer embodying my invention to make no response to an instruction which was added to the corresponding valid program to invalidate it.

The term "systematically" is used herein in one of its common acceptations to mean "marked by or manifesting system or orderly procedure", or "following or observing a plan, scheme, or design".

Thus, the term "systematically invalidated program" as used herein denotes an invalidated computer program which has been derived from a corresponding valid computer program in a systematic way, i.e., in accordance with a predetermined orderly method or procedure, or by following or observing a predetermined plan, which may be called an "invalidating plan" or "invalidating procedure".

The term "valid" is used herein in one of its common acceptations to denote something which is capable of accomplishing what it is intended to accomplish.

Thus, for example, the expression "valid program" as used herein denotes a computer program which when run on a suitable digital computer is capable of accomplishing the function intended for it by its designer. Accordingly, the term "invalid" can be seen to be used herein to denote something which is not capable of accomplishing what it is intended to accomplish. It follows, then, that the expression "invalid program" as used herein denotes a computer program which when run on a computer for which it is intended will not produce the result intended by the designer of the corresponding valid program.

The term "withheld element" as used herein with respect to an invalidated program denotes an element of the corresponding valid program which is not included in the invalidated program.

In accordance with a principal feature of my invention a valid computer program which is to be run on a particular computer embodying my invention is first systematically invalidated in accordance with a particular, unique invalidation program or procedure, and the corresponding restoration program or procedure for restoring the systematically invalidated program to its original, valid form is furnished to that computer. A different invalidation program or procedure is adopted for each computer of my invention which is to be furnished with said valid computer program, so that the particular invalidated version of the valid program which is furnished to any one computer of my invention is different from the particular invalidated version of the valid program which is furnished to any other computer of my invention.

In accordance with another principal feature of my invention each computer embodying my invention comprises a restoration unit containing at least part of at least one restoration program or procedure for restoring a systematically invalidated program to its valid form.

In accordance with yet another principal feature of my invention at least some of the computers embodying my invention comprise confirmation units which serve to confirm that certain prescribed preconditions, e.g., the existence of a certain code or password at a certain memory location, exist before their associated restoration units can be used to restore a furnished, systematically invalidated program to its original, valid form.

In accordance with a further principal feature of my invention the busses of at least some of the computers embodying my invention are subdivided into an external bus, to which are connected the input devices, the output devices, and additional peripheral device connection receptacles, and an internal bus, which is not accessible directly or indirectly without invading the computer housing.

In accordance with a yet further principal feature of my invention each of such external busses is interconnected with its associated internal bus by means of a program-controllable switching unit, called an "external bus access control unit", which responds to each restore instruction in each furnished program by disconnecting the external bus from the internal bus, so that no instruction or data word contained in the restoration unit can be read out by any device attached to the external bus.

In accordance with another principal feature of my invention a confirmation unit in a computer embodying my invention is capable of incapacitating or destroying the restoration unit of that computer, or causing the production of false computational results, when it is not provided with signals indicating the existence of certain prescribed preconditions and an attempt is made to run a furnished program on that computer.

In accordance with yet another principal feature of my invention one of the prescribed precondition signals for use by the confirmation unit of a computer embodying my invention may be supplied by a precondition signal generating unit which is structurally incorporated into the computer, inaccessible from outside the computer, and arranged to destroy itself if an attempt is made to remove it from the computer.

In accordance with still another principal feature of my invention one of the prescribed precondition signals for use by the confirmation unit of a computer embodying my invention may be supplied by a precondition signal generating module which is capable of being carried by a particular person concerned with the operation of that computer, and of being inserted into a receptacle which is, e.g., part of the confirmation unit when made available by said particular person.

In accordance with another principal feature of my invention a prescribed precondition signal for use by the confirmation unit of a computer embodying my invention may be a code or password which is manually entered into a keyboard of the computer, or a keyboard of its restoration unit or confirmation unit, or combined restoration/confirmation unit.

In accordance with another principal feature of my invention one of the prescribed precondition signals for use by the confirmation unit of a computer embodying my invention may be supplied by a calendar-clock circuit contained within the confirmation unit and powered by a battery contained within the confirmation unit, whereby the confirmation unit may be made to permit the running of furnished, systematically invalidated programs only at predetermined times, and/or on predetermined dates.

In accordance with another principal feature of my invention certain ones of said precondition signal generating modules may be provided with self-destruction interlocks, whereby they are destroyed when removed from their receptacles unless removed by authorized service persons with access to the interior of the computer.

In accordance with another principal feature of my invention the restoration unit of a computer embodying my invention may be completely separable from its associated computer, and thus may be separated from its associated computer and transported to a bank vault or the like when not in use.

In accordance with another principal feature of my invention such a separable restoration unit may be completely physically separate from its associated computer when in use, and connected thereto only by a cable or the like, or may take the form of a module which can be inserted into a suitable receptacle or cavity in a face of the computer.

In accordance with yet another principal feature of my invention the restoration units of certain computers embodying my invention may themselves comprise one or more microcomputers programmed to execute certain instructions or routines of the valid programs corresponding to the invalidated programs with which those computers are furnished. A restoration unit of my invention which comprises a microcomputer or the like thus programmed will sometimes be called an "active restoration unit" herein, to distinguish it from the "passive restoration units" described hereinabove.

In accordance with another principal feature of my invention such an active restoration unit may be adapted to derive data from the main memory or memories or accumulator or accumulators of the computer and programmed to carry on certain program operations simultaneously with the carrying out of certain other program operations by the computer itself, whereby the computing speed of the computer can actually be increased over the computer speed of the computer alone by the aid of an active restoration unit.

In accordance with another principal feature of my invention any furnished, systematically invalidated program embodying my invention may be provided with one or more self-cancelling invalidator-revalidator instruction pairs, by means of which it may be possible to prove copying if a copyrighted program embodying my invention is misappropriated and publicly sold.

In accordance with another principal feature of my invention a restoration module embodying my invention may be provided with an externally accessible key pad or like data entry means, and access to certain data storage areas thereof blocked until a particular code is manually entered into the restoration module via the key pad or the like, whereby access to program enhancements built into the restoration module may be denied until the corresponding code to be entered into the key pad or the like is determined from the program furnisher, e.g., for a stated fee.

In accordance with yet another principal feature of my invention, a restoration program may be written to withdraw data used in the restoration process (1) from the same memory unit which contains that restoration program, (2) from a different memory unit contained in the same restoration unit, (3) from a separate memory module connected to the bus of the computer supplied with the restoration unit containing that restoration program, or (4) from a memory unit which is part of the computer supplied with the restoration unit containing that restoration program, or from a combination of selected ones of these sources.

For a fuller understanding of the nature and objects of my invention, reference should be had to the following detailed description, taken in connection with the accompanying drawings.

FIG. 1 is a schematic block diagram of a first type of computer embodying my invention;

FIG. 2 is a schematic block diagram of a second type of computer embodying my invention;

FIG. 3 is a schematic block diagram of a third type of computer embodying my invention; and

FIG. 4 is a schematic diagram of a computer program protection and control system of my invention.

Referring now to FIG. 1, there is shown a schematic block diagram of a first type of digital computer 10 of my invention, which is equipped with a restoration unit 12 of my invention and a confirmation unit 14 of my invention, whereby computer 10 is enabled to run a systematically invalidated program of my invention, and thereby to produce the same results as would be produced if the corresponding valid program were run on the same digital computer unequipped with restoration unit 12 and confirmation unit 14 but provided with the same input data.

As seen in FIG. 1, digital computer 10 comprises a central processing unit 16, a main memory 18, a mass storage unit 20, one or more input devices 22, one or more output devices 24, and a bus 26 interconnecting all of these units. As is well known to those having ordinary skill in the art, such units, and a bus interconnecting them, are generally found in all modern digital computers.

As further seen in FIG. 1, restoration unit 12 and confirmation unit 14, which are characteristic features of many embodiments of my invention, are both connected to bus 26. Restoration unit 12 and confirmation unit 14 are connected to bus 26 in substantially the same manner in which the several conventional units, 16, 18, 20, 22, 24, of computer 10 are connected to bus 26, and thus restoration unit 12 and confirmation unit 14 can communicate with each other, and with the several conventional units of computer 10, via bus 26.

As indicated by dashed line 28, the restoration units of certain embodiments of my invention comprise a restoration module 30 and a restoration module receiver 32, which itself comprises a receptacle of well-known type for receiving the restoration module.

In accordance with the teachings of my invention, it may be preferable for reasons of program protection to physically incorporate restoration module receiver 32 into the physical structure of computer 10 so that only the receptacle for receiving restoration module 30 is accessible from outside the housing of computer 10.

As indicated by dashed line 34, it will be found desirable in certain embodiments of my invention to employ a restoration unit which is structurally completely separate from computer 10 and is connected to bus 26 thereof by means of a suitable cable terminating in a suitable plug and jack arrangement, which plug and jack arrangement may be understood to be represented by dashed line 34.

Similarly, as indicated by dashed line 36, in certain embodiments of my invention confirmation unit 14 comprises one or more confirmation modules 38, and a confirmation module receiver 40. In some of these embodiments of my invention it may be preferred to physically incorporate confirmation module receiver 40 into the housing of computer 10 such that only the receptacle for receiving confirmation module 38 is accessible from outside the housing of computer 10.

Referring again to FIG. 1, and comparing the showing of restoration unit 12 with the showing of confirmation unit 14, it will be seen that dashed line 42 indicates that in certain embodiments of my invention the confirmation unit may be physically separate from the associated computer, and be interconnected therewith by means of a suitable cable comprising a suitable plug and jack arrangement, represented by dashed line 42.

In certain other embodiments of my invention the confirmation unit may be dispensed with in favor of a "password", entered via one of the input devices 22 or a keyboard which is a part of the restoration unit or the confirmation unit, or a combined restoration/confirmation unit.

Also, in certain preferred embodiments of my invention, the restoration unit may be physically combined with the confirmation unit to constitute a unitary device called the "restoration/confirmation unit" or "RESCON Unit". Such restoration/confirmation units will in general be physically separate from the associated computer, and interconnected therewith only by a suitable cable comprising a suitable plug and jack arrangement.

In certain embodiments of my invention the restoration/confirmation unit may comprise receptacles for receiving one or more restoration modules and one or more confirmation modules, while in other embodiments the restoration program and the confirmation data may be contained in devices integral with the restoration/confirmation unit. In other embodiments, the confirmation data may be manually entered via a keyboard.

Referring now to FIG. 2, there is shown a schematic block diagram of a second type of digital computer 50 embodying my invention.

Many elements of the computer 50 of FIG. 2 are similar or substantially identical to corresponding elements of the computer 10 of FIG. 1, and thus reference should be had to the description of FIG. 1 for an understanding of the parts of FIG. 2 which have corresponding legends.

Comparing FIGS. 1 and 2, then, it will be seen that computer 50 of FIG. 2 comprises a central processing unit 52, a main memory unit 54, a mass storage unit or units 56, an input device or devices 58, and an output device or devices 60, which are similar or substantially identical, respectively, to the elements of FIG. 1 identified by the reference numerals 16, 18, 20, 22, and 24.

Similarly, the restoration unit 62 and the confirmation unit 64 of FIG. 2, and the various embodiments thereof which fall within the scope of my invention, and the several parts of each of them, will best be understood by reference to the parts of the description of FIG. 1 relating to the corresponding parts of FIG. 1. Thus, for example, the dashed line 66 of FIG. 2 has the same significance as the dashed line 28 of FIG. 1; the portion 68 of the representation of restoration unit 62 in FIG. 2 has the same significance as the portion 30 of the representation of restoration unit 12 in FIG. 1; etc.

Further, the elements or units 52, 54, 56, 58, 60 of computer 50 of FIG. 2 are interconnected by means of a bus in the same manner in which the corresponding elements or units of FIG. 1 are interconnected by means of bus 26.

As may be seen from FIG. 2, however, the bus of computer 50 is subdivided into two parts, called respectively the "outer bus" 70 and the "inner bus" 72.

Outer bus 70 and inner bus 72 are both connected to an electrical circuit device 74 which is called the "inner bus access control unit" herein.

Inner bus access control unit 74 is operated under the control of restoration unit 62 to isolate outer bus 70 from inner bus 72, and prevent the transmission of signals therebetween, whenever restoration unit 62 is supplying information signals to inner bus 72.

As also seen in FIG. 2, a suitable conductor or conductor set 76 is provided to transmit the clock signal or signals of computer 50 between the clock signal line or lines of inner bus 72 and the corresponding clock signal line or lines of outer bus 70 at all times, i.e., even when the inner bus access control unit 74 is isolating the other conductors or lines of inner bus 72 from the corresponding conductors or lines of outer bus 70. Further, a conductor or conductor set 78 is provided for the purpose of transsmitting control signals from restoration unit 62 to inner bus access control unit 74, although in some embodiments of my invention these control signals may be transmitted via inner bus 72.

Referring now to FIG. 3, there is shown a schematic block diagram of an equipped computer 80 which is a particular embodiment of a third type of computer embodying my invention.

As seen in FIG. 3, equipped computer 80 generally comprises a central processing unit 84, an input device or devices 86, a mass storage unit 88, an output device or devices 90, a main memory unit 92, a bus 94, and a restoration/confirmation unit 96. Block 96 also represents a DL11J quad asynchronous serial interface 91.

In computer 80, central processing unit 84 is a central processing unit of the type made and sold by the Digital Equipment Corporation under the commercial designation LSI11. Block 84 also represents a DL11J quad asynchronous serial interface 89.

A Digital Equipment Corporation RXV21 double density floppy disk controller, having two disk drives, serves as one of the input devices 86 of FIG. 3, and also serves as one of the output devices 90 of FIG. 3.

A VT-100 video terminal serves as one of the input devices 86 of FIG. 3, and also serves as one of the output devices 90 of FIG. 3.

Said RXV21 double density floppy disk controller also serves as the mass storage unit 88 of FIG. 3.

A Digital Equipment Corporation 11/03 main frame provides the bus 94 of FIG. 3, which is a Digital Equipment Corporation Q-bus, and further provides the power supply and power connections of equipped computer 80, and the logic and control connections thereof which are not part of Q-bus 94. This Digital Equipment Corporation 11/03 main frame also includes a card cage adapted to receive, support, and provide the electrical connections for other units of computer 80, in the well-known manner.

A Digital Equipment Corporation MSV11D 64 kilobyte memory unit serves as the main memory 92 of computer 80 of FIG. 3.

Equipped computer 80 (FIG. 3) further comprises a Digital Equipment Corporation DL11J quad asynchronous serial interface 89 which is of factory standard configuration, with channels 1 and 2 set to 300 Baud and channel 3 configured for the system console.

The above-described 11/03 main frame, LSI11 central processing unit, MSV11D memory unit, RXV21 double density floppy disk controller, DL11J quad asynchronous serial interface, and VT-100 video terminal are assembled and interconnected in the manner well known to those having ordinary skill in the art, and taught in the instructional materials, provided by the Digital Equipment Corporation, in order to provide a working embodiment of computer 80.

The restoration/confirmation unit 96 of the computer 80 of FIG. 3 is substantially identical to the unequipped computer 80' described immediately hereinabove.

That is to say, restoration/confirmation unit 96 comprises a Digital Equipment Corporation 11/03 main frame, including card cage, Q-bus, back plane, and power supply; a Digital Equipment Corporation LSI11 central processing unit; a Digital Equipment Corporation MSV11D memory unit; a Digital Equipment Corporation RXV21 double density floppy disk controller, including two disk drives; a Digital Equipment Corporation DL11J quad asynchronous serial interface 91, which is of factory standard configuration, with channels 1 and 2 set to 300 Baud, and channel 3 configured for the system console; and a VT-100 video terminal, all assembled and interconnected in the manner well known to those having ordinary skill in the art, and taught in the instructional materials, etc., provided by the Digital Equipment Corporation.

Thus, as will now be seen by those having ordinary skill in the computer and computer programming arts, informed by the present disclosure, the equipment which makes up the restoration/confirmation unit 96 of the embodiment 80 of my invention shown in FIG. 3 is the same equipment, interconnected in the same way, as the equipment which makes up the unequipped computer 80' of FIG. 3, i.e., everything shown in FIG. 3 but restoration/confirmation unit 96 and the interconnection cable 98, which interconnects restoration/confirmation unit 96 and the unequipped computer 80', which unequipped computer 80' comprises central processing unit 84, input device or devices 86, mass storage unit 88, output device or devices 90, main memory unit 92, and bus 94.

As will also be evident to those having ordinary skill in the art, informed by the present disclosure, the difference between restoration/confirmation unit 96 and unequipped computer 80' lies not in their respective physical structures, but rather in their respective programming and memory contents, as described hereinbelow.

As also seen in FIG. 3, restoration/confirmation unit 96 is interconnected with unequipped computer 80' by means of a cable 98. Cable 98 is a serial information transfer cable of the kind sold by the Digital Equipment Corporation under the commercial designation RS232.

As also shown in FIG. 3, cable 98 is connected between the channel 1 port of unequipped computer 80' and the channel 2 port of restoration/confirmation unit 96.

The operating system of the unequipped computer 80' is substantially identical to the operating system of the restoration/confirmation unit 96. Each of these operating systems is a Digital Equipment Corporation RT11, version 3B, operating system, custom-generated to include multi-support for four DL11 asynchronous serial interfaces and Digital Equipment Corporation standard vectors and registers.

The program contained in restoration/confirmation unit 96 is the restoration program listed in detail in the Computer Program Listing which was filed with and constitutes a part of this specification. This restoration program was derived from a valid computer program, listed in detail in said Computer Program Listing, which is entitled "Exposure Calculation Program for Color Photo Enlarging". Thus, said valid program will sometimes be called the "Valid Exposure Program" herein, and said restoration will sometimes be called the "Exposure Program Restoration Program" herein.

The program furnished to equipped computer 80 and contained in mass storage unit 88, is the furnished program listed in detail in the Computer Program Listing which was filed with and constitutes a part of the present specification. Thus, the program contained in mass storage unit 88 when utilizing this embodiment of my invention will sometimes be called the "Furnished Exposure Program" herein.

It is to be particularly noted that the confirmation that certain prescribed preconditions for the running of the furnished program exist is achieved herein by the inclusion of two singularities in the programs generated from the Valid Exposure Program, viz., a password, "SHAZZAAM", and a spurious constant, viz., "82.5". In order to run the equipped computer 80 to provide valid results for any set of valid input data, the password "SHAZZAAM" must be manually entered into the keyboard of one of the VT-100 video terminals when "called for" on the screen thereof, and the spurious constant "82.5" must be properly entered as part of the input data in connection with the furnished program. It is to be particularly noted, however, that in accordance with a feature of my invention, the entry of an incorrect password does not cause equipped computer 80 to "crash", but rather permits computer 80 to continue running, to an incorrect tabulated result.

By way of example only, and in no sense limiting the scope of my invention, a Computer Program Listing was filed with and constitutes a part of this specification. This Computer Program Listing includes a valid program sometimes called the "Exposure Calculation Program for Color Photo Enlarging" or "Valid Exposure Program" herein; a corresponding furnished program, sometimes called the "Furnished Exposure Program" herein; and a corresponding restoration program, sometimes called the "Exposure Program Restoration Program" herein.

This Computer Program Listing comprises twenty-two (22) computer printout sheets, each of which pages bears the heading "FORTRAN IV V02.04", since the three programs contained in this Computer Program Listing are expressed in the high-level programming language promulgated by the Digital Equipment Corporation, and known as Fortran IV, Digital Equipment Corporation, or "DEC", version 02.04.

The Furnished Exposure Program and the Exposure Program Restoration Program were derived from the Valid Exposure Program by eliminating from the Valid Exposure Program the exposure calculating algorithm thereof, i.e., the part of the Valid Exposure Program which is to be protected from misappropriation by my invention; and placing that exposure calculating algorithm in the Exposure Program Restoration Program, all of which is within the scope of one having ordinary skill in the computer programming art, informed by the present disclosure.

Further as seen in the Computer Program Listing, line 0006, the Exposure Program Restoration Program is adapted to check for a password, viz., SHAZZAAM, and to permit equipped computer 80 to run to a correct result only if that password has been correctly keyed into the keyboard of input device 86, and otherwise to run to an incorrect result (line 0006, restoration program), but not to a "crash".

Yet further, as seen in the Computer Program Listing, line 0008, the Exposure Program Restoration Program is adapted to check for a spurious embedded constant, not actually a part of the data necessary to the algorithm. As there seen, equipped computer 80 is permitted to run to a correct result only if the embedded spurious constant is correct, i.e., 82.5, and otherwise is constrained to run to an incorrect result, but not to a "crash".

As will now be evident to those having ordinary skill in the art, informed by the present disclosure, the Valid Exposure Program is itself kept only by the program supplier, the Furnished Exposure Program is furnished to the equipped computer installation via ordinary commercial program supply channels, and the Exposure Program Restoration Program is supplied to the equipped computer installation either as part of the restoration/confirmation unit or by a highly secure supply channel, e.g., program supply company courier. Further, the equipped computer cannot be successfully run to a valid result unless a custodian of the equipped computer installation knows and properly enters the password SHAZZAAM.

As an example only of the operation of equipped computer 80, constructed and programmed as described hereinabove, let it be considered that it is desired to produce an enlarged color photo by the use of a Besseler 23C enlarger, using Ciba-chrome paper, making an 8.times.10 enlargement from 35 millimeter film, and that the values entered into the keyboard of input device 86 are as follows: Enlarger Offset, 10.0; Brightness Constant, 100; Focal Length, 50; ANSI Paper Speed, 85; Zero Pack, 60, 70, 0; Paper Pack (arbitrary), 0, 10, 5; Filter Changes to correct for minor color change due to particular film, xxx; Exposure Factor, changed to compensate for a thin or a dense negative, 1.00; Lens f-stop, 5.6; and Enlarger Scale Setting, 11.5. Typical corresponding results outputted by way of an output device 90, Yellow, 55; Magenta, 75; Cyan, 0; f-stop, 5.6; Time, 8.8 seconds.

An additional embodiment of my invention attaches directly to the input/output or I/O channel of a digital computer. This channel may either be multiplexed or may be a dedicated "selector channel" and may be a high speed channel or a low speed channel.

A valid program to be employed in connection with this embodiment is modified to remove one or more selected subroutines which are considered by the program supplier, or the supplier's customer, to be critical, and which thus must be protected from unauthorized use. The thus selected subroutine or subroutines may perform any valid function of the program, e.g., may be the entire algorithm of the program, as in the embodiment of my invention described in connection with FIG. 3. The removed subroutine or subroutines may be referred to as "privileged". The remainder of this valid program may correspondingly be called "clear".

The privileged subroutine or subroutines may be activated or employed in one of at least two modes, provided that the corresponding confirmation unit requirements are satisfied, designated below as A and B.

A. Data Mode. When the clear portion of the valid program has proceeded in processing to the point where a privileged subroutine must be called or activated, the clear portion is arranged in such a manner than an I/O requirement is generated. An output is first generated which contains the data required by the privileged subroutine in order to function. Also generated for output is an access code or set of codes used by the confirmation module to verify that access is allowed. Such codes may be automatically generated or may be entered as a part of initiating program processing. Various transformations of access codes may take place in either the clear or the privileged portion of the program as processing progresses.

When access is allowed, the restoration unit accepts and processes the data generated as output by the clear portion of the program. When the privileged processing is complete, the data generated is returned to the clear portion of the program, and host processing continues. This case requires that a privileged processor be used to process the privileged routines. No access to the privileged processor is available without the appropriate confirmation codes.

B. Instruction Mode. When the clear portion of the program has proceeded in processing to the point where a privileged subroutine may be activated, the clear portion is arranged in such a manner that a subroutine call is issued to the confirmation unit. The call contains the access code or set of codes required for access to the privileged subroutine. Alternatively, the confirmation unit may be completely or partially conditioned when processing is initiated to respond to subroutine calls. When access is allowed, the restoration unit supplies the subroutine, in normal form, to the host processor.

Variations of instruction mode may apply any combination of substitution, replacement, deletion or alteration techniques. Such combination may be varied by application of predetermined codes or computed factors, and may vary from one processing run to another. The restoration unit may be set up to apply one or many combinations of instruction mode or data mode techniques to the same program in the same processing run.

Computations in the clear portion of the program may condition the confirmation unit or effect the procedural operation of the restoration unit.

Both the confirmation unit and the restoration unit may be physically protected from access by various means already taught and practiced in the art.

A further and different embodiment of my invention may be retrofitted to existing digital computer designs or be included in the original design of a digital computer. In accordance with this embodiment of my invention, the valid program is modified to remove selected subroutines as in the embodiment of my invention described immediately hereinabove.

The confirmation unit and the restoration unit may be interconnected to the various buses internal to the host computer. Separate processors may or not be required. Both the confirmation unit and the restoration unit may be physically protected by various means already taught and practiced in the art.

The standard operating system of the host computer may be modified in this embodiment, either permanently or dynamically, by the restoration unit. Such modification may render inoperative (or provide) functions, included but not limited to, analytic and/or diagnostic functions while the protected program is being processed.

Referring now to FIG. 4, there is shown a schematic diagram of a computer program protection and control system embodying my invention.

As there seen, the complete area of FIG. 4 is divided into three subareas 100, 102, 104 by vertical lines 106 and 108.

Area 100 represents a facility of a computer program supplier wherein a particular valid program, originating there or elsewhere, is processed for protection and control thereof in accordance with the teachings of my invention.

In accordance with the teachings of my invention, valid program 110 remains within facility 100, and is not at any time sold to any program purchaser, or leased to any program lessee. Rather, valid program 110 is maintained in facility 100 under strict security conditions.

In facility 100, valid program 110 is, e.g., stripped of its most commercially valuable elements, i.e., is made into a diminished program, or has invalidators added to it, i.e., is made into an augmented program, or both.

These steps can be accomplished by programmers of ordinary skill, without the exercise of invention or more than ordinary programming skill, in view of the teachings of this specification, and may in large part be mechanized on ordinary computers without exceeding the scope of those having ordinary skill in the programming arts. The selection of the elements to be stripped out of valid program 110 is, of course, a matter of human judgment, but does not exceed the level of ordinary programming skill, in view of the teachings of the present specification.

As indicated by line 112 of FIG. 4, valid program 110, after being processed as described immediately above to systematically invalidate it, may also be provided with identifying elements, such as added machine-language code numbers or the like, or may be provided with singularizing elements, i.e., added elements which are unique to only one of the furnished programs corresponding to particular valid program 110, whereafter it is a corresponding furnished program 114.

Furnished program 114 is then loaded onto a furnished medium 116, such as a floppy disk, in the well-known manner. By the term "furnished" is meant that the medium 116 will ultimately be furnished to a purchaser or lessee, and is not meant that the customer of the computer program supplier furnishes the medium.

It is to be particularly noted that the term "XYZ" represents the unique identifying number which may be added to furnished program 114, either explicitly or implicitly. Identifying number XYZ may, in accordance with the teachings of my invention, be permanently marked on the furnished medium, in machine-language, or on the shipping carton of the furnished medium, in human language.

Referring again to FIG. 4, line 118 thereof will be seen to designate the process of generating the corresponding restoration program 120 from the elements stripped from valid program 110. At the same time, restoration program 120 is provided with restoration codes and the like, whereby the equipped computer will be instructed to correctly reassemble the data found on furnished medium 116 and in the corresponding restoration unit 122 into a valid program, during the running of the valid program thereon, by means of furnished medium 116 and corresponding restoration unit 122.

As further seen in FIG. 4, the confirmation data 124 corresponding to a valid program XYZ is loaded into a corresponding confirmation unit XYZ, which is also identified by the reference numeral 126.

The word "loaded" is used in a very broad sense herein, to denote that the XYZ confirmation data may not only be stored in a magnetic storage medium, such as a floppy disk, but may even be printed or typewritten on a sheet of paper which is to be communicated to a custodian who is regularly employed at the XYZ equipped computer installation and can there enter the confirmation data on a keyboard of the equipped computer.

Going to the central area 102 of FIG. 4, it will now be understood by those having ordinary skill in the art, informed by the present disclosure, that channels A, B and C are ordinary channels of commerce, such as freight, express, air cargo, parcel post, and the like.

It is to be particularly understood, then, that the showing of the area 102 of FIG. 4 is to indicate that the restoration unit 122 of the equipped computer XYZ, the confirmation unit 126 of the equipped computer, and the furnished medium 116 whereby the furnished program 114 corresponding to valid program 110 is furnished to the equipped computer XYZ are all supplied to the equipped computer installation XYZ by separate channels of commerce in accordance with the principles of my invention.

It is further to be particularly noted that channel A, channel B, or channel C may, in some instances, be a courier route, or a telephone line, or a microwave transmission link.

Reference is now had to area 104 of FIG. 4, which represents the equipped computer installation XYZ which is supplied with restoration unit 122, confirmation unit 126, and furnished medium 116 by the program supplier which is the proprietor of facility 100.

As seen in FIG. 104, furnished program No. XYZ is supplied to the input device of equipped computer 130, wherein it is stored in mass storage unit 132.

As also there seen, the confirmation data corresponding to furnished program No. XYZ is furnished, by way of a separate commercial channel, to a custodian of equipped computer 130, and not to the input device or devices 134 of equipped computer 130.

The said custodian might, in some instances, key the confirmation data into equipped computer 130; while, in accordance with other embodiments of my invention, the XYZ confirmation data may be contained in a physical device, such as a PROM or a tape cassette, which device is inserted into a confirmation unit receptacle 136 by the custodian, who normally has sole custody of that device and leaves that device in confirmation unit receptacle 136 only long enough to permit the running of furnished program XYZ.

As further seen in FIG. 4, it is contemplated as part of my invention that restoration program XYZ will be loaded into a restoration unit designated and marked as restoration unit No. XYZ, and that restoration unit No. XYZ will, after being carried to equipped computer installation 104 over a separate commercial channel, and remaining in the hands of the computer program supplier or its appointees or personnel, be installed in an internal restoration unit receptacle 138 in equipped computer 130, which receptacle is only accessible to equipped computer installation personnel, as distinct from the computer program supplier's personnel, by forceful methods or means which leave a clear indication of this intrusion into equipped computer 130.

Given that furnished program No. XYZ has been loaded into equipped computer 130, that confirmation data XYZ has been supplied to equipped computer 130, and that restoration program No. XYZ has been installed in equipped computer 130, all as described above, it follows that when input data for a particular run of valid program No. XYZ, designated by reference numeral 140, is supplied to equipped computer 130 for processing, the valid results for that particular run will be outputted by output device 142, the valid results being the results which would have been outputted by an unequipped computer 130' corresponding to equipped computer 130 when executing the corresponding valid program.

It will thus be seen that the objects set forth above, among those made apparent from the preceding description, are efficiently attained, and since certain changes may be made in the above constructions and the methods carried out thereby without departing from the scope of my invention, it is intended that all matter contained in the above description or shown in the accompanying drawings shall be interpreted as illustrative only, and not in a limiting sense.

It is also to be understood that the following claims are intended to cover all of the generic and specific features of my invention herein described, and all statements of the scope of my invention which, as a matter of language, might be said to fall therebetween.

VALID PROGRAM

FURNISHED PROGRAM

RESTORATION PROGRAM ##SPC1##