US 6,421,703 B1Grant
Process and system for controlling the use of software
Issue Date:2002-07-16
•14 Claims
•4 Drawing Sheets
Abstract
This is a process and a system for controlling the use of software developed under a specified platform, associated with a device, in which signals are processed in the device and/or are returned from the device to the computer in response to signals transmitted from this computer. The circuit of the device is written to and read from by calling upon a function built into an object file (.OBJ) or a Dynamic Library file (.DLL), the function having the following form: result=cnrm(var1, var2, . . . varn) with n>3. The function is devised so as automatically to detect the type of specified platform, and calculate the software execution context as a function of the platform.
Metadata
Assignee
- Actikey
Inventors
- Daniel Steinmetz
- Michel Evangelou
Application Information
Application Number:US 09/106,358
Filing Date:1998-06-29
Priority Date:1997-06-30
Art Unit:7
Classifications
IPC:
G06F 900
Field of Search:
709100709101709102709103709104709105709106709108709200709205709208709328709330709331
Patent Drawings (4 sheets)
Description
[0002] The present invention relates to a process for controlling the use of software developed under a specified platform, associated with a device provided with an electronic circuit with read/write retentive memory, connected to the terminals of a parallel port between a computer and a peripheral apparatus, in which signals are processed in the device and/or are returned from said device to the computer in response to signals transmitted from this computer.
[0003] The term platform is understood to mean an environment corresponding to a specified operating system, such as the Windows™ environment, the Unix™ environment or other environments (Apple™, for example), which call in particular upon dynamic link libraries (DLL, the initials of Dynamic Lien Librairy
[0004] It is known that dynamic link libraries (DLLs) constitute an important utility within operating systems. DLLs offer the possibility of connecting prewritten modules into the operating system. This makes it possible for the applications to share the common coding, to modularize the regularly used functions and to provide a degree of expandability.
[0005] The present invention also relates to a system for the interactive control of the use of software items.
[0006] It finds a particularly important although nonexclusive application in the field of protection against the copying of software items which is used on microcomputers under a 16-bit and 32-bit Windows™ platform.
[0007] Methods are already known for protecting software items stored, for example, on diskettes making it possible to preclude the copying of these diskettes.
[0008] The first method of protection consists in short-circuiting the microcomputer program portion which reads the diskettes.
[0009] A second method consists in marking the diskette in an irreversible manner by destroying a particular site on the magnetic medium with a laser ray.
[0010] The two methods mentioned above have drawbacks in particular because they prevent the user from making a backup copy of his programs.
[0011] A third method consists in marking the computer by means of an electronic device, sometimes called a key.
[0012] The program, while it is executing, will then verify the presence of this key consisting of an electronic circuit which returns codes when it is requested.
[0013] This circuit can be housed directly in one of the computer's expansion connectors, or more simply be plugged into one of the external sockets or ports, for example that of the printer, without thereby disturbing the operation of the latter.
[0014] It is thus possible to copy the software at will. This system which has been further improved by making the keys directly programmable by virtue of a read/write retentive memory is by far the most effective.
[0015] However, it has a number of drawbacks.
[0016] Thus, in software items which currently operate on a specified platform, and more particularly those which operate on a Windows™ platform (16 and 32 bits), problems arise regarding the compatibility of the systems used during the programming by the programmer of the key as a function of the languages and/or generations of software which it uses.
[0017] The present invention aims to provide a process and a system for controlling the operating of software which is better than those previously known at meeting the requirements of practice, in particular in that it makes it possible to avoid the drawbacks mentioned above, and in that it makes it possible, through simplified installation procedures, henceforth to be unconcerned with the end platform on which the application will operate.
[0018] With said invention, the programmer will therefore authorize or otherwise the operation of the software protected in an optimized manner, this being a particularly advantageous technical result in an era in which the pirating of software is unfortunately on the increase.
[0019] To this end, the invention proposes in particular a process for controlling the use of software developed under a specified platform, associated with a device provided with an electronic circuit with read/write retentive memory, connected to the terminals of a parallel port between a computer and a peripheral apparatus, in which signals are processed in the device and/or are returned from said device to the computer in response to signals transmitted from this computer, characterized in that
[0020] the circuit of the device is written to or read from by calling upon a function built into an object file (.OBJ) or a Dynamic Library file (.DLL) previously inserted into said software, said function having the following form:
[0021] result=cnrm(var1, var2, . . . varn) with n>3
[0022] in which var1 to varn correspond to particular values depending on what it is desired to execute with the device and to at least one specific value corresponding to a specified user,
[0023] said function being devised so as automatically to detect the type of specified platform, and calculate the software execution context as a function of said platform.
[0024] After the call, var1 to varn contain result values dependent on the action executed and hence on the values given during the call. Result will contain the value of var1 after the call.
[0025] More precisely the software interface which makes it possible to read from and write to the key takes the following forms:
[0026] an object file (.OBJ) to be used for the programs written in compiled languages such as C or pascal, for which calling complies with what is described above, or
[0027] a dynamic library (.DLL) to be used by the programs written in interpreted or semicompiled languages (VISUAL BASIC, WINDEV), but also in certain cases with compiled languages.
[0028] Advantageously, during the implementation of the linking function (Login) between the software and the device, the key and/or its position are identified by way of a specific value (cfgFun or cfgKey), for example given by the software, or obtained while exploring the successive keys, and this specific value is stored in memory and used later as a constant when operating said software.
[0029] In an advantageous embodiment the function cnrm is devised (function cnrmcb) so as to recall the software at least once while operating, so as to verify that it is indeed the original function cnrm which has been called.
[0030] The term original function cnrm is understood to mean the function which has been designed and provided to operate originally with the device, by the constructor of the device.
[0031] In an advantageous embodiment, the specified platform is a Windows™ platform, said function cnrm being devised so as to allow automatic recognition of the type of passing of parameters by reference or by value implemented within the software.
[0032] Let us recall that in this case, by virtue of the nature of certain programming languages, the dynamic library is in reality constructed in the form of two dynamic libraries:
[0033] a dynamic library with passing of parameters by reference, for which calling complies with what is described above, that is to say for which Result contains the value var1 after the call (i.e. a first DLL file for 16-bit application and a second DLL file for 32-bit application),
[0034] a dynamic library with passing of parameters by value for which an additional parameter makes it possible to define which value from var1 to varn is to be placed in Result after the call. (i.e. a third DLL file for 16-bit applications and a fourth DLL file for 32-bit applications).
[0035] Prior to the invention, additional mechanisms were necessary during operation under the WINDOWS NT operating system for a 16-bit application (written for WINDOWS 3.xx).
[0036] The programmer was in effect obliged to use a dynamic library even for a compiled language, this being so that the first DLL file can be replaced by a fifth DLL file specific to the WINDOWS NT environment.
[0037] This fifth specific DLL file then itself called a sixth 32-bit DLL file specific to WINDOWS NT which in turn called the peripheral/central processing unit interface module (or driver) responsible for the inputs/outputs to the key.
[0038] The same type of mechanism had to be used for the third DLL file in the case of the passing of parameters by reference.
[0039] To summarize, the following cases in point existed under the Windows™ platform before the invention:
[0040] With a 16-bit application with compiled programs when using the .OBJ library, operations were performed exclusively under 16-bit WINDOWS.
[0041] When using the first DLL file (16-bit WINDOWS version) it was however necessary to replace this first DLL file by a special NT version to provide a sixth special DLL file for WINDOWS NT and to install the NT driver.
[0042] With a 16-bit application with semicompiled or interpreted programs, if the application allows the passing of parameters by references, when using the first DLL file (16-bit WINDOWS version) to operate under WINDOWS NT it was necessary to replace this first DLL file by a special NT version, to provide a fifth special file for WINDOWS NT and to install the NT driver.
[0043] However, if the application did not allow the passing of parameters by references when using the third DLL file (16-bit WINDOWS version) to operate under WINDOWS NT it was necessary to replace this third DLL file by a special NT version, to provide another special DLL for WINDOWS NT and to install the NT driver.
[0044] With a 32-bit application with compiled programs, when using the .OBJ library, operations were on the other hand performed exclusively under 32-bit WINDOWS (WINDOWS 95 or WIN32S). Operations were not carried out under NT, in which case a specific .OBJ is necessary and hence two different programs are necessary for the 32 bits.
[0045] When using the second DLL file (32-bit WINDOWS version) to operate under WINDOWS NT it was, on the other hand, necessary to replace the second DLL file by a special NT version and to install the NT driver.
[0046] Finally, with a 32-bit application with semicompiled or interpreted programs, if the application allowed the passing of parameters by references, when using the second DLL file (32-bit WINDOWS version) to operate under WINDOWS NT it was necessary here again to replace the second DLL file by a special NT version and to install the NT driver.
[0047] On the other hand, if the application did not allow the passing of parameters by references, when using the fourth DLL file (32-bit WINDOWS version) to operate under WINDOWS NT it was necessary to replace this fourth DLL file by a special NT version and obligatory to install the NT driver.
[0048] Such processes therefore have drawbacks.
[0049] Indeed the number of DLLs and the differentiation between DLLs depending on the execution platform oblige the users to consider all the cases in point and to have a complex installation procedure.
[0050] The compiled programs are compelled to use obligatorily a DLL so that they can be ported to NT without compilation.
[0051] An understanding of the various possible cases is therefore not obvious and led programmers to make errors, and this increased the costs of intervention when installing and using softwares and thereby gave rise to unsatisfactory technical effects.
[0052] Since the specified platform is a Windows platform, and/or said function cnrm is devised so as to allow automatic recognition of the type of passing of parameters by reference or by value implemented within the software, these various drawbacks are alleviated.
[0053] Conventionally, before any key manipulation, it is known that an operation referred to hereafter as Login is performed.
[0054] Login is in effect an action which is necessary in order to be certain of reading from and writing to the correct key.
[0055] According to one embodiment of the invention, with each call of cnrm, the editor codes will thus, for example, be passed in the variables var2, var3 so as to validate the correct key.
[0056] During key login, a memory area (stack) associated with login is then allocated and will store the return values of var1 to varn and also the elements of the platform-specific execution context.
[0057] To allow the recognition and automatic passing of parameters by reference and by value, the call to the cnrm function is supplemented with a function cnrmvar whose objective is to retrieve the post-call contents of var1 to varn.
[0058] Its form is as follows:
[0059] Result=cnrmvar(login handle, index of the variable (1 to n)).
[0060] It will be used instead of the corresponding variable.
[0061] For example, in an advantageous embodiment of the invention where the value n is equal to 8, instead of using a method of the type:
[0062] var1=12; {register read}
[0063] var2=code0; {editor cord}
[0064] var3=code1; {editor code}
[0065] var4=key 0; {editor password}
[0066] var5=0;
[0067] var6=0;
[0068] var7=5; {index of the register to be read}
[0069] var8=0;
[0070] res=cnrm (var1, var2, var3, var4, var5, var6,
[0071] var7, var8);
[0072] if (var1==True {
[0073] . . .
[0074] }
[0075] An assignment is provided as follows:
[0076] var1=12; {register read)
[0077] var2=code0; {editor code}
[0078] var3=code1; {editor code}
[0079] var4=key 0; {editor password}
[0080] var5=0;
[0081] var6=0;
[0082] var7=5; {index of the register to be read}
[0083] var8=0;
[0084] res=cnrm (var1, var2, var3, var4, var5, var6,
[0085] var7, var8);
[0086] if (cnrmvar(cfgLog, 1)==True {
[0087] . . .
[0088] }
[0089] At the time of the call, the function cnrm will analyze the contents of the stack. If it finds the editor codes in the stack then it will know that this is a passing by value, otherwise this is a passing by reference.
[0090] It should be noted that this mechanism requires that the software interfaces be customized based on editor, that each editor-based interface be capable of recognizing the editor codes in the stack, and that each editor possess different codes, this being provided for and implemented by the manufacturer of the keys.
[0091] In this way the programmer need no longer concern himself with the mode of parameter passing, and can choose the mode which he desires when he desires. When using semicompiled programs implementing parameter passing by value only, it will have a mode of operation and a principal of writing which is identical to that for a program compiled with parameter passing by reference.
[0092] The call to the function cnrm is made uniform and the calls can be made in the same way, irrespective of the language.
[0093] In an advantageous embodiment the execution context is set up once only, during the first implementation of the function linking the software and the device (input login).
[0094] This thereby affords the maximum performance in respect of the other calls to the function cnrm.
[0095] Advantageously the process additionally comprises the implementation of a method of protection in which a few sensitive functions of the software to be protected are chosen, the entry point of these functions is masked by an indirect call, and the structure which contains the entry point of said functions is encrypted.
[0096] Thus, it is certain that the key has indeed been read, otherwise decryption is not carried out, the entry points of the functions not being found.
[0097] Stated otherwise, if a normal user having a license does not put in his key, he will obtain the “key absent” message.
[0098] If a pirate tries to replace the key or to delete the test for the presence of the key, decryption is not carried out, and in this case the entry points of the functions are not found.
[0099] The encryption is advantageously carried out by an external program after compilation and link editing. It can for example use a so-called TAG1 string which must be unique in order to find the area to be encrypted and the length of said area. More generally, the encryption tool will be adapted by the programmer as a function of his specific requirements.
[0100] The invention also relates to a system implementing the process described above.
[0101] It likewise relates to a system for controlling the use of software developed under a specified platform, comprising a device provided with an electronic circuit with read/write retentive memory, connectable to the terminals of a parallel port between a computer and a peripheral apparatus, devised so as to process and/or return signals to the computer in response to signals transmitted from the latter, characterized in that
[0102] the system comprises means for writing to and reading from the circuit of the device by calling upon a function built into an object file (.OBJ) or a Dynamic Library file (.DLL) previously inserted into said software, said function having the following form:
[0103] result=cnmr(var1, var2, . . . var8)
[0104] in which var1 to var8 correspond to particular values depending on what it is desired to execute with the device and to at least one specific value corresponding to a specified user,
[0105] said function being devised so as automatically to detect the type of specified platform, and calculate the software execution context as a function of said platform.
[0106] Advantageously the system moreover comprises means for automatically recognizing the type of passing of parameters by reference or by value implemented within the software.
[0107] The invention will be better understood on reading the description of embodiments given below by way of non-limiting example, by making reference in particular to various tables.
[0108] The description refers also to the drawings which accompany it, in which:
[0109] FIG. 1 is a schematic, perspective view of a microcomputer equipped with a device according to the invention plugged into the parallel port for connection with the printer.
[0110] FIG. 2 is a general block diagram of an electronic device belonging to the system according to the invention.
[0111] FIGS. 3 and 4 show a flowchart giving the operating steps of the control system and process according to the embodiment of the invention more particularly described here.
[0112] FIG. 5 shows a flowchart of an encryption process used in an embodiment of the invention.
[0113] FIG. 1 shows a microcomputer 1 comprising a box 2 and a screen 3.
[0114] The box is provided with a parallel-port socket 4 for connection via a cable 5 with a peripheral apparatus which in this instance is a printer 6.
[0115] The microcomputer 1 which is programmed with protected software is fitted, on its parallel port, with a device 7 corresponding to said protected software, in the form of a double connector, which can be plugged into the parallel port of the computer at one end and into another device box or the cable of the printer 5 at the other end.
[0116] More precisely, with reference to FIG. 2, the device according to the embodiment of the invention more particularly described here 7 comprises a box 8 fitted with two sockets 9 and 10 for plugging into a parallel port which are known per se and are of standard type with 25 pins at the microcomputer end and of a corresponding female type at the printer end.
[0117] The device 7 according to the invention comprises connected to the male plug 9 linked to the microcomputer 2 a circuit 11, itself connected on the one hand to the female socket 10 and on the other hand to the handler circuit 12.
[0118] The device 7 is for example of the type described in the document 2,740,236 incorporated herein by reference, and which will therefore not be detailed further.
[0119] Within the framework of the embodiments of the invention which are more particularly described here, envisaged below is the case of the (16- and 32-bit) Windows™ platforms.
[0120] Passing by value and by reference having already been described hereinabove, the setting up of the execution context according to the Windows™ platform will now be specified by referring in particular to FIGS. 3 and 4.
[0121] In what follows, the libraries and programs used therefore make particular reference to those of the American company Microsoft. They may be consulted further in guides such as and for example the “API Bible” or “Windows 95, Win32 programming of APIs—The expert's secrets” published by Simon & Schuster Macmillan.
[0122] Thus, APIs such as getVersion, or DLLs such as GetProcAddress32W, will be implementable without supplementary explanation.
[0123] An embodiment of the algorithm for context calculation and management according to the embodiment of the invention more particularly be described here will now be detailed, the memory area during login containing the context information.
[0124] Let us recall that during login of the key, cnrm will automatically carry out recognition of the platform and set up the appropriate execution context. This context is advantageously calculated once only.
[0125] To do this, after switching on the computer (step 16) and loading the protected software while setting up the key (step 18), cnrm will identify (step 20) whether the environment is 16 or 32 bits) To do this, the memory area allocated during Login contains the context information.
[0126] 32-bit operation will now be detailed.
[0127] If the environment is 32 bits
[0128] During login (test 22):
[0129] Search for platform by the API getVersion (step 24)
[0130] Storage in memory of the fact of being under NT or not (step 26)
[0131] Depending on the platform (test 28), the internal routines of cnrm are called in order to talk to the key (step 30), or the cnrm driver is called for WINDOWS NT (step 32).
[0132] During the other calls (step 34):
[0133] Depending on the platform (test 28), the internal routines of cnrm are called in order to talk to the key (step 30), or the cnrm driver is called for WINDOWS NT (step 32).
[0134] If the environment is 16 bits
[0135] During login (test 36):
[0136] Platform search by the API getVersion (step 38)
[0137] If the version is <=3.10 (test 40) then we are definitely not under WINDOWS NT and hence 16-bit operation can continue normally (step 48), that is to say call the internal routines of the cnrm function (see step 69 below)
[0138] If the version is >3.10 then we are under a 16- or 32-bit version
[0139] The version will then be retrieved by going into 32-bit mode (step 42)
[0140] Loading of the dynamic library KRNL386.DLL (16 bits) (step 44)
[0141] If loading fails (step 46), we are certainly on a 16-bit platform (step 48)
[0142] If loading does not fail
[0143] the following functions will be loaded dynamically (step 50)
[0144] GetProcAddress32W
[0145] LoadLibraryEX32W
[0146] CallProc32W
[0147] FreeLibrary32W
[0148] If one of these functions does not exist (loading failure) (test 52) we are definitely on a 16-bit platform only (48).
[0149] Otherwise, we are on a 32-bit platform, the DLL KERNEL32.DLL will be loaded dynamically (step 54) by virtue of the previously loaded LoadLibrary32W.
[0150] The getVersion (32 bits) function of the KERNEL32.DLL module will be loaded dynamically (step 56) by virtue of the previously loaded getProcAddress32W.
[0151] getVersion (32 bits) is called (step 58) by way of callProc32W loaded previously, and hence the version number of the 32-BIT platform being run is obtained.
[0152] This version number allows us to ascertain whether we are on NT or not.
[0153] Storage in memory of the fact of being under NT or not (step 62)
[0154] Depending on the platform (test 66), the internal routines of cnrm are called (step 69) so as to talk with the key, or the cnrm driver is called (step 68) for WINDOWS NT as follows:
[0155] The following functions will be loaded dynamically (step 70) (they are definitely there in KRNL386.DLL since they have already been loaded during Login):
[0156] GetProcAddress32W
[0157] LoadLibraryEX32W
[0158] CallProc32W
[0159] FreeLibrary32W
[0160] GetVDMPointer32W (a function making it possible to convert addresses from the 16-bit world to the 32-bit world)
[0161] The following functions from KERNEL32.DLL will then be loaded (step 72) (by way of LoadLibraryEX32W and GetProcAddress32W):
[0162] CreateFileW
[0163] DeviceIoControl
[0164] CloseHandle
[0165] so that the NT driver can be called directly (step 74) in 32-bit mode.
[0166] During the other calls (test 36, step 76)
[0167] Depending on the platform (test 78), the internal routines of cnrm are called (step 80) so as to talk with the key (step 69), or the CNRM driver is called (step 82) for WINDOWS NT as follows:
[0168] The following functions will be loaded dynamically (step 70) (they are definitely there in KRNL386.DLL since they have already been loaded):
[0169] GetProcAddress32W
[0170] LoadLibraryEX32W
[0171] CallProc32W
[0172] FreeLibrary32W
[0173] GetVDMPointer32W (a function making it possible to convert addresses from the 16-bit world to the 32-bit world).
[0174] The following functions from KERNEL32-DLL will then be loaded dynamically (step 72) (by way of Load LibraryEX32W and GetprocAddress32W):
[0175] CreateFileW
[0176] DeviceIoControl
[0177] CloseHandle
[0178] in order to call directly (step 74) the NT driver in 32 bit mode.
[0179] All the 16-bit pointers are then converted into 32-bit pointers by GetVDMPointer32 (step 84), as during Login, this not having been described hitherto.
[0180] The driver is called (step 86) by calling the functions CreateFileW, DeviceIoControl and CloseHandle by way of the function CallProc32W.
[0181] The function cnrm will now be described more precisely.
[0182] Cnrm makes it possible to carry out numerous actions with regard to the key. All these actions (also referred to as functions in what follows) can be accessed via a unique function called “cnrm” of the general form:
[0183] integer cnrm (reference var1, reference var2, reference var3, reference var4, reference var5, reference var6, reference var7, reference var8)
[0184] When using the C language we will have for example:
[0185] Declaration in C: Int cnrm (int *var1, int *var2, int *var3, int *var4, int *var5, int *var6, int *var7, int *var8);
[0186] When using Pascal, we have: Declaration in Pascal: Function cnrm(var var1, var2, var3, var4, var5, var6, var7, var8: integer): integer;
[0187] It will be noted depending on the languages, that it may be necessary to qualify these prototypes more precisely, for example WINAPI will be used under Windows.
[0188] These elements are within the scope of the person skilled in the art.
[0189] The actions are moreover grouped together into various categories depending on the embodiment given below by way of example:
[0190] The pure local actions
[0191] Function 00: Test presence of key in the local machine
[0192] Function 01: Initialization of the key password if it is not initialized
[0193] The Login and Logout actions:
[0194] Function 02: Login on a particular key or on the first one found
[0195] Function 03: Logout on a key for which a login has been performed
[0196] All the other actions may only be executed if a Login has been successful and up to the corresponding Logout.
[0197] The actions for latching registers of the key:
[0198] Function 04: Writing of the protection register (defined for the write-protected registers)
[0199] Function 05: Reading of the protection register (reading of the number of protected registers)
[0200] The actions of reading from and writing to registers of the key
[0201] Function 06: Writing of a Far Buffer to the key
[0202] Function 07: Reading of the contents of the key from the Far Buffer
[0203] Function 08: Writing of a near Buffer to the key
[0204] Function 09: Reading of the contents of the key from a near Buffer
[0205] Function 10: Writing of two integers to two consecutive registers
[0206] Function 11: Reading of two integers from two consecutive registers
[0207] Function 12: Writing of an integer to a register
[0208] Function 13: Reading of an integer from a register
[0209] Function 14: Writing of a byte to a register
[0210] Function 15: Reading of a byte from an 8-bit register
[0211] Function 16: Writing of a bit to a register
[0212] Function 17: Reading of a bit from a register
[0213] Function 18: Writing a value from register X to register Y
[0214] Function 19: Incrementation (+) or decrementation (−)
[0215] Function 20: Right (+) or left (−) rotation
[0216] Function 21: Right (+) or left (−) shift
[0217] Function 22: Writing of a date
[0218] Function 23: Reading of a date
[0219] The actions for managing the encryption key and encryption/decryption
[0220] Function 25: Writing of a far encryption key
[0221] Function 26: Reading of a far encryption key
[0222] Function 27: Writing of a near encryption key
[0223] Function 28: Reading of a near encryption key
[0224] Function 29: Far text encryption according to encryption key
[0225] Function 30: Far text decryption according to encryption key
[0226] Function 31: Near text encryption according to encryption key
[0227] Function 32: Near text decryption according to encryption key
[0228] The actions for reading and writing system information from and to the key
[0229] Function 24: Reading the date of manufacture
[0230] Function 34: Writing final user code
[0231] Function 35: Reading the final user code
[0232] Function 36: Writing the SSII code
[0233] Function 37: Reading the SSII code
[0234] Function 38: Reserving the registers for an SSII
[0235] Function 39: Reading the number of registers for an SSII
[0236] Function 40: Writing the multiprotection code
[0237] Function 41: Reading the multiprotection code
[0238] Function 42: Reading the national distributor code
[0239] Function 43: Reading the cheksum
[0240] Function 44: Reading the serial number
[0241] The actions specific to the keys on a network
[0242] Function 46: Network: Writing the maximum number of users
[0243] Function 47: Network: Reading the number of network users
[0244] The actions specific to the clock keys
[0245] Function 50: Initializing the date and the time in the clock.
[0246] Function 51: Reading the date and the key time with clock
[0247] Function 52: Key with clock with alarm write
[0248] Function 53: Key with clock with alarm read
[0249] Function 54: Key with clock with status read
[0250] Function 55: Key with RAM/CLOCK Clock Write
[0251] Function 56: Key with RAM/CLOCK Clock Read
[0252] The actions specific to the microprocessor keys
[0253] Function 48: EEPROM save to microprocessor
[0254] Function 49: EEPROM initialization from the microprocessor
[0255] The functions 33 and 45 are reserved in the example more particularly described here.
[0256] The function cnrm returns an integer (16 or 32 bits depending on whether the environment is 16 or 32 bits).
[0257] It always receives 8 parameters var1 to var8 passed by reference (pointers) whose value must be initialized before the call, and whose value after the call depends on the action requested.
[0258] Before the call, the contents of the variables var1 to var8 follow a convention which is always the same.
[0259] After the call, the contents of the variables depend on the action requested and always follow a specified model. The value returned makes it possible to ascertain whether the action has succeeded or not, and in the event of success var1 takes a value called True (the value of true is specific to each editor just like the editor codes).
[0260] For certain actions (Function 0, Function 1 and Function 2 only), a value called CfgFun which defines a particular position of the key can, by addition, be combined with the contents of var1.
[0261] We thus have a general format and contents for the variables of the following type:
[0262] Before the call:
[0263] cfgLog=cnrm (reference var1, {number of action parameter (function) [+cfgFun]}
[0264] reference var2, {Code customer 0=code0)
[0265] reference var3, {code customer 1=code1)
[0266] reference var4, {password (key0) or var4 received from the “LOGIN” action)
[0267] reference var5, {parameter specific to the action desired}
[0268] reference var6, {parameter specific to the action desired}
[0269] reference var7, {parameter specific to the action desired}
[0270] reference var8, {parameter specific to the action desired})
[0271] For the functions 0, 1 and 2, var4 must contain the password key0 when calling cnrm.
[0272] For all the other functions, var4 must contain the value received in var4 during login (Function 2).
[0273] After the call:
[0274] For the functions 0 and 1:
[0275] cfgLog: always 0
[0276] var1: True if the action has succeeded
[0277] Some other value in the event of failure
[0278] For all the other functions: cfgLog can be equal to 0. In this case var1 is equal to 0 and var8 contains an error code
[0279] cfgLog can be different from 0. In this case var1 contains a value which may be
[0280] 0: There is an error code in var8 True: The action has succeeded Some other value: Key not found
[0281] In all cases:
[0282] var2: A value specific to the action requested (cfgKey for functions 0, 1 and 2)
[0283] var3: A value specific to the action requested (cfgFun for functions 0, 1 and 2)
[0284] var4: A unique value which can no longer be modified hereafter (Identical to cfgLog)
[0285] var5: A value specific to the action requested
[0286] var6: A value specific to the action requested
[0287] var7: A value specific to the action requested
[0288] var8: Address of the parallel port on which the key has been found or error code
[0289] The function cfgKey is defined more precisely below, with values taken as an entirely non-limiting example.
[0290] CfgKey is a value on 16 bits which makes it possible to ascertain the position of the key in the case of the use of several keys. The bits then form groups with the following meanings:
[0291] bits 0 to 3: Number of editor registers in the key
[0292] 000: No key
[0293] 001: 32 registers
[0294] 010: 96 registers
[0295] 011: 224 registers
[0296] 100: 480 registers
[0297] 101: 992 registers
[0298] 110: 2016 registers
[0299] 111: 4064 registers
[0300] bit 4: 0 the key is a multiprotection key (Pathway Functions 40 and 41)
[0301] 1 the key is a multiprotection key
[0302] bit 5: 0 the key contains no protection register (see Functions 4 and 5)
[0303] 1 the key contains a protection register
[0304] bit 6: 0 the key is not a clock key
[0305] 1 the key is a clock key
[0306] bit 7: output indicator of the data (Ack or PE)
[0307] bits 8 and 9: address of the parallel port or server number
[0308] For a local-mode key the values are:
[0309] 00: no key
[0310] 01: 03bch
[0311] 10: 0378h
[0312] 11: 0278h
[0313] For a network-mode key
[0314] 00: server number 0
[0315] 01: server number 1
[0316] 10: server number 2
[0317] 11: server number 3
[0318] bits 10 to 12: Number of the key for stacked keys
[0319] 000: no key
[0320] 001: key number 1
[0321] 010: key number 2
[0322] 011: key number 3
[0323] 100: key number 4
[0324] 101: key number 5
[0325] 110: key number 6
[0326] 111: key number 7
[0327] bits 13 to 14: location of the key
[0328] 00: no key
[0329] 01: key on the local station
[0330] 10: key on a Novell server
[0331] 11: key on a Netbios compatible server
[0332] bit 15: Reserved
[0333] The function of cfgFun is described below:
[0334] CfgFun is a value on 16 bits which makes it possible to ascertain the position of the key, or to request a login on a particular key. The meaning of the bits is as follows:
[0335] bits 0 to 7: reserved
[0336] bit 7: output indicator for the data (Ack or PE)
[0337] bits 8 and 9: address of the parallel port or server number
[0338] For a local-mode key the values are:
[0339] 00: no key
[0340] 01: 03bch
[0341] 10: 0378h
[0342] 11: 0278h
[0343] For a network-mode key
[0344] 00: server number 0
[0345] 01: server number 1
[0346] 10: server number 2
[0347] 11: server number 3
[0348] bits 10 to 12: Number of the key for stacked keys
[0349] 000: no key
[0350] 001: key number 1
[0351] 010: key number 2
[0352] 011: key number 3
[0353] 100: key number 4
[0354] 101: key number 5
[0355] 110: key number 6
[0356] 111: key number 7
[0357] bits 13 to 14: location of the key
[0358] 00: no key
[0359] 01: key on the local station
[0360] 10: key on a Novell server
[0361] 11: key on a Netbios compatible server
[0362] bit 15: Reserved
[0363] CfgFun can be used to Login on a particular key. To do this, the bits must be set as a function of the search. A search may be made by specifying each group of bits independently.
[0364] The location of the key (bits 13 and 14) is then selected by specifying the type of server sought or whether it is a local-mode key which is sought.
[0365] Next, the number of the server or the parallel port is selected via bits 8 and 9.
[0366] Finally, the number of the key is selected via bits 10 to 12.
[0367] For example, to login only on key number 3 of server 2 of Novell type, the value of cfgFun will be: 0 10 011 10 0000 0000, i.e. 04E00h.
[0368] During the login CfgFun+2 must be placed in var1 so that the login takes place only on the desired key.
[0369] If cfgFun is not used during the login, cnrm searches for the first valid key for which the number of connections is not exhausted, over the whole of the network in the order:
[0370] Local
[0371] Novell server 0 to server 3
[0372] Netbios server 0 to server 3
[0373] The order of searching on the servers might not be complied with so as to increase the efficiency of the search, however cnrm always commences with a local-mode search.
[0374] The first three facilities of the cnrm function will now be described below, by way of example.
Function 00: Test for the Presence of the Local-mode
[0375] key
[0376] Public: No
[0377] System: No
[0378] Read: No
[0379] Write: No
[0380] Write once: No
[0381] Password: Yes, if already initialized
[0382] SSII access: Function 64
[0383] Protection: No
[0384] The function 0 makes it possible to ascertain whether a key of the developer is present. All the keys have a code allocated by the key manufacturer to each developer. They will be recognized irrespective of the contents of the various registers.
| Contents of the variables |
Before Call: Initialization of the Variables
[0385] The values between [ ] are optional.
[0386] Var1: 0 [+cfgFun]−Function number. Add cfgFun for a local key so that the test is faster.
[0387] Var2: Code0—High-order bits of the editor code supplied by the key vendor
[0388] Var3: Code1—Low-order bits of the editor code supplied by the key vendor
[0389] Var4: 0 or password - if the password is not initialized, then 0 must be used, otherwise the password must be used.
[0390] Var5: 0
[0391] Var6: 1 or 2 or 3 or 4 or True: with the value True a request is made to return the date in var7. 1 makes it possible to request a duration of execution value in microseconds, 2 makes it possible to obtain the duration in milliseconds, 3 makes it possible to obtain the duration in clock ticks (55 ms), and 4 makes it possible to obtain a duration in seconds. For any other value the function returns a time in microseconds in Var6 and the version of the software in Var7.
[0392] Var7: 0—Reserved
[0393] Var8: 0—Reserved
After call: Contents of the Variables if the Key is present
[0394] Var1: True if the key is present, otherwise random value.
[0395] Var2: cfgKey—This value gives information about the location and the type of key.
[0396] Var3: cfgFun—This value gives information about the location and the type of key.
[0397] Var4: Always 0
[0398] Var5: Duration of execution of the call to the function. This time depends on the unit specified in var4, and constitutes only an approximate value. It is possible to obtain the exact values as follows:
[0399] If the time is expressed in microseconds, divide this value by 1.193180
[0400] If the time is expressed in milliseconds, divide this value by 1.193180
[0401] If the time is expressed in clock ticks, divide the value by 18.20648193 to obtain the time in seconds.
[0402] The time in seconds is that of the internal clock.
[0403] However, it should be noted here that in 32-bit protected mode (32-bit WINDOWS, 32-bit DOS EXTENDERS), the time is not returned.
[0404] Var6: Time of start of execution of the function.
[0405] The time is expressed in the unit specified by Var4
[0406] Here again, in 32-bit protected mode (32-bit WINDOWS, 32-bit DOS EXTENDERS), the time is not returned
[0407] Var7: Version of the software or date compacted. If before the call var6 contained True, then Var7 contains the date in the compacted format:
[0408] bits 15141387654321012109
[0409] Value Year+1980 Month Day
[0410] In the other cases var7 contains the version of the software to two decimal places. Example: 100 corresponds to version 1.00
[0411] Var8: Address of the parallel port on which the key is situated.
Function 01: Initialization of the Password (local only)
[0412] Public: No
[0413] System: Yes
[0414] Read: No
[0415] Write: No
[0416] Write once: Yes
[0417] Password: Yes, to initialize it
[0418] SSII access: Function 65
[0419] Protection:No
[0420] On the first order from a developer, the key manufacturer allocates, for example, two codes Code 0 and Code 1. A third code is available for an initialization by the developer. However, for better management of the developer's keys, the manufacturer may also initialize it. In the mode described here the password will be written once only and it may neither be read nor modified. If the developer tries to reinitialize it, Var1 will contain a value different from True during the call. In this instance it is then recommended that the same password always be used after initialization. If the password is present, it will be obligatory in order to access all the functions.
| Contents of the variables |
Before call: Initialization of the Variables
[0421] The values between [ ] are optional.
[0422] Var1: 01 [+cfgFun]−Function number. Add cfgFun to select a particular local key.
[0423] Var2: Code0−High-order bits of the editor code supplied by the manufacturer
[0424] Var3: Code1−Low-order bits of the editor code supplied by the manufacturer
[0425] Var4: key 0=password to be initialized always different from 0.
[0426] Var5: 0
[0427] Var6: 0—Reserved
[0428] Var7: 0—Reserved
[0429] Var8: 0—Reserved
After call: Contents of the Variables if the Key is Present and Key0 not Initialized
[0430] Var1: True if the key is present, and was able to be initialized.
[0431] Var2: cfgKey—This value gives information about the location and the type of key.
[0432] Var3: cfgFun—This value gives information about the location and the type of key.
[0433] Var4: 0
[0434] Var5: Reserved
[0435] Var6: Reserved
[0436] Var7: Contains the value of the password written to the key provided that this is the first initialization of the latter. If the key is absent or already initialized, an unspecified value will be displayed.
[0437] Var8: Address of the parallel port on which the key is situated.
Function 02: Key Login
[0438] Public: No
[0439] System: Yes
[0440] Read: Yes
[0441] Write: No
[0442] Write once: No
[0443] Password: Yes
[0444] SSII access: Function 66
[0445] Protection: Yes
[0446] This function allows an application to attach itself to a key, the objective being to guarantee that the latter is linked with the correct key when there are several. Login also makes it possible to set up the channel with the key server in the network environment.
[0447] Usually, an application which uses login is designed to operate in all possible cases:
[0448] one or more local-mode keys
[0449] one or more network-mode keys
[0450] one key for several application packages
[0451] several applications on identical keys (same editor)
[0452] It is obligatory to go via login in order to be able to execute the functions of index higher than 2.
[0453] It is possible either to carry out a general login (var6=var7 var8=0 on calling), or a login on a register (var6=True, Var7=register number and var7=value which the register must contain). The number of connection to the key server will always be counted by the machine, hence a machine can make as many logins as it desires, while using up just a single connection.
[0454] In what follows, the general login is regarded as a login on register number −1, for any value: it is therefore also a register login.
| Contents of the variables |
Before call: Initialization of the Variables
[0455] The values between [ ] are optional.
[0456] Var1: 02 [+cfgFun]—Function number. Add cfgFun to select a particular key.
[0457] Var2: Code0—High-order bits of the editor code supplied by ACTIKEY
[0458] Var3: Code1—Low-order bits of the editor code supplied by ACTIKEY
[0459] Var4: key 0 password
[0460] Var5: 0
[0461] Var6: 0 or True for a login on a register
[0462] Var7: Value of the register (application code) if Var6=True
[0463] Var8: Address of the register if Var6=True
After call: Contents of the Variables if the Key is Present and Login has Occurred Correctly
[0464] Var1: True if the key is present, otherwise random value. A value of 0 indicates a login error for which the error code is in var8. This error code corresponds to that returned by the last server encountered.
[0465] 0: Memory allocation error
[0466] 1: Failure to initialize the network APIs : No network driver
[0467] 2: Failure to connect with the network
[0468] APIs: Network operating error
[0469] 3: No key server has been found
[0470] 4: Error in dialog with the key server
[0471] 5: Access refused since the user has not logged on
[0472] 6: Access refused since the maximum number of connection has been reached
[0473] 10: IPX not installed
[0474] 11: Impossible to open a socket
[0475] 254: Key absent
[0476] 255: Unexpected error
[0477] Var2: cfgKey—This value gives information about the location and the type of key.
[0478] Var3: cfgFun—This value gives information about the location and the type of key.
[0479] Var4: cfgLog: login handle to be used in all subsequent calls
[0480] Var5: Number of connections still available if the network is connected
[0481] Var6: Number of connections already installed if the network is connected
[0482] Var7: Maximum number of connections permitted
[0483] Var8: var8: Address of the parallel port on which the key is situated.
How to Provide Protection with the Function 02
[0484] This function allows and guarantees the unique association between an application and a key, even within the framework of networks (for network keys). As a general rule, a register is defined per application, with internally an application code which will be the version number of the application. The software then performs a login which will find the key which corresponds to the application and to its version, doing so in single-station or network mode, irrespective of the number of keys present. Thus, the same key can be programmed to operate on several application packages. In network mode it is possible to protect up to 1024 users with a single key, by installing it on the server for NOVELL or on a station for NOVELL or NETBIOS.
[0485] Var1: Its value must always be equal to True. If you have some other value, either the key is absent or login has failed
[0486] Var2: Do not use to provide protection.
[0487] Var3: Do not use to provide protection
[0488] Var4: cfgLog: login handle. This value of var4 must be retained for calls to the other functions of index higher than 2. Each login returns a different cfgLog, and as many logouts must be made as logins in order to release the connection of the keys in network mode. If var4 contains a 0 after the call, then the login has failed and no subsequent function can succeed.
[0489] Var5: Number of users available for the connection
[0490] Var6: Number of users connected at the moment of the call
[0491] Var7: Maximum number of users permitted
[0492] Var8: Address of the parallel port. The constructors implement the parallel ports at the addresses 0378h, 0278h and 3BCh. If you obtain a different value it is certain to be because a replacement routine has been installed, in which case it would be better to exit the program. It is also possible that the machine may not possess a non-compatible parallel port. In the latter case the key is not usable.
[0493] See function 47 to ascertain the number of logins on a register per machine, and number of logins on a register for the whole of the network.
[0494] The other functions 03, 04, etc. are defined so as to obtain the results sought.
[0495] They are programmed in a manner known per se to the person skilled in the art, in a similar manner to the three functions specified above.
[0496] In advantageous embodiments and in order to cater for a larger number of cases in point, the function cnrm is additionally supplemented with other functions.
[0497] Let us recall that in all the declarations below, and for a Windows platform (16 or 32 bits) it is necessary to qualify the functions of WINAPI.
[0498] The following modes are thus provided for:
a—Function cnrm with passing of parameters by value
[0499] Model integer cnrm(value var1, value var2, value var3, value var4, value var5, value var6, value var7, value var8)
[0500] Declaration in C int cnrm(int var1, int var2, int var3, int var4, int var5, int var6, int var7, int var8);
[0501] Declaration in Pascal Function cnrm(var1, var2, var3, var4, var5, var6, var7, var8: integer): integer;
[0502] It should be observed that the name of the function is the same as in the case of passing by reference. The only difference stems from the fact that in the first case references are transmitted to the function, whereas in the second case values are transmitted to the function.
[0503] The definition of the arguments is similar to that already described.
[0504] On the other hand, to obtain the contents of the variables after the call, the function cnrmvar described below will be used.
[0505] Additionally, it is entirely possible to mix the types of call in the same program, for example login can be carried out by value, and the reading of a register can be carried out by reference.
b—Function Cnrmvar
[0506] Cnrmvar is a function which makes it possible to retrieve the post-call parameters of cnrm for the latest call if login has been successful.
[0507] It is mainly used together with the calling of cnrm by value, but can also be called in the case of calls by reference: in this case this makes it possible to store in memory the state of the values returned until the next call to cnrm.
[0508] Model integer cnrmvar(int cfgLog, int numVar)
[0509] Declaration in C int cnrmvar(int cfgLog, int numVar);
[0510] Declaration in Pascal Function cnrmvar(cfgLog, numVar: integer): integer;
[0511] cfgLog: Value returned during login numVar: 1 to 8: request to return var1 to var8 respectively
[0512] 9: request to return the error code of the latest call to cnrm
[0513] 10 to 13: request to return the error code received from the NOVELL type key servers for server number 0 to 3 respectively
[0514] 20 to 23: request to return the error code received from the NETBIOS type key servers for server number 0 to 3
[0515] For all the other values of numVar, cnrmvar returns cfgLog
[0516] An example of the mode of operation is given below:
EXAMPLE
[0517] // login is assumed to be correct
[0518] cfgLog=cnrm(13, 12127, 2221, 1654, cfgLog, 0, 0, 0); // reading register 0 passing by value
[0519] if (cnrmvar(cfgLog, 1)==True) {// test if var1 =True<==>action successful
[0520] v=cnrmvar(cfgLog, 7); // v contains the value of register 0
[0521] }
c—Function Cnrmcb: Definition of a Return Call
[0522] The return call (or callBack) is a function which will be called by cnrm during calls following the fetch by cnrmcb.
[0523] The interest in it lies in the possibility of ascertaining which operation cnrm is performing, of halting execution of cnrm prematurely, but also of improving protection by making it possible indirectly to call important functions of the protected application software during the execution of cnrm. This function considerably increases the protection of programs which use cnrm in the form of a dynamic library(DLL), if it defines a callBack of an application-critical function, such as for example the initialization of sensitive data, one of the components of which is stored in the key.
[0524] Callback will only be done for actions of index>2, and only if login is successful.
[0525] We have:
[0526] Model integer cnrmcb(int cfgLog, reference cb, integer unsigned long Object)
[0527] Declaration in C int cnrmcb(int cfgLog, callBack *cb, unsigned long Object);
[0528] Declaration in Pascal
[0529] Function cnrmcb(cfgLog: Integer; cb: _callBack; Object: longInt): integer; far; external;
[0530] cfgLog: value received during login
[0531] cb: address of the return function
[0532] Object: a value which will always be transmitted to the function called back
[0533] cnrmcb always returns cfgLog, hence if cfgLog is invalid it is the value 0
[0534] The general form of the function called back is moreover as follows:
[0535] Model int callBack(unsigned long Object, int E, int SE, int cfgLog);
[0536] Declaration in C typedef int _callBack(unsigned long Object, int E, int SE, int cfgLog);
[0537] Declaration in Pascal
[0538] type _callBack=Function(Object: longint; E: integer; SE: integer; cfgLog: integer): integer;
[0539] If callBack returns the value 0 then execution of cnrm is halted in the current state, otherwise the execution of cnrm continues.
[0540] “Object” is an unsigned integer which is left available: in general a pointer this for a C++ object is placed thereon. Object has been given during the fetch of the callBack
[0541] E is the value of the internal state of cnrm at the time of the call to callback
[0542] E=0=START: begin cnrm
[0543] E=1=LOCAL: before calling cnrm in local mode (local test)
[0544] E=2=NOVELL before calling cnrm on NOVELL
[0545] E=3=NETBIOS: before calling cnrm on NETBIOS
[0546] E=255=END: before exiting cnrm
[0547] The order of the calls is guaranteed only for E=0 and E=255. The other states may be given several times in any order.
[0548] SE gives sub-state information which depends on E.
[0549] if E=0 or E=255, SE always equals 0
[0550] if E=1, SE can take values from 1 to 99
[0551] if E=2, SE can take values from 1 to 99
[0552] if E=3, SE can take values from 1 to 99
[0553] CfgLog makes it possible to retrieve the state of the variables passed as parameter during the call to cnrm for all the values of E<255, or the values after the call for all the values of E>=255.
[0554] The callBack function must not call cnrm except if E=255, but it can call cnrmcb to fetch a new function back which will be called for the next state, or call cnrmccb to cancel the callBack. If the callBack function calls cnrm for E<>255, nothing will happen.
[0555] On the other hand if E=255, cnrm is called normally, but without calling the function back. Therefore, no precaution needs to be taken in the callBacks to avoid recursion since it cannot occur.
d—Function Cnrmccb: Cancelling a Callback
[0556] Callback is a function which will be called by cnrm during calls following the fetch by cnrmcb. It is possible to delete this callback at any time, even within a callBack function, with the help of cnrmccb
[0557] Model integer cnrmccb(int cfgLog)
[0558] Declaration in C int cnrmccb(int cfgLog);
[0559] Declaration in Pascal Function cnrmccb(cfgLog: Integer): integer; far; external,
[0560] cfgLog: value received during login
[0561] cnrmccb always returns cfgLog, hence if cfgLog is not valid it is 0
e—Function Cnrmseg: Returns the Segment of a Variable (16-bit Environment only)
[0562] The function cnrmseg returns the segment of a far type variable. It is generally used with languages which do not allow the segments and offset to be retrieved (example: VISUAL BASIC).
[0563] Model int cnrmseg(void far *s); // with s the variable whose segment is to be extracted
[0564] Declaration in C int cnrmseg(char far *s);
[0565] Declaration in Pascal Function cnrmseg(p: pointer): integer; far; external;
f—Function Cnrmoff: Returns the Offset of a Variable (16-bit Environment Only)
[0566] The function cnrmoff returns the segment of a far type variable. It is generally used with languages which do not allow the segments and offset to be retrieved (example: VISUAL BASIC).
[0567] Model int cnrmoff(void far *s); // with s the variable whose segment is to be extracted
[0568] Declaration in C int cnrmoff(char far *s);
[0569] Declaration in Pascal Function cnrmoff(p: pointer): integer; far; external;
[0570] Whether it be in the form of a static library (.LIB or .OBJ). or in the form of dynamic libraries, the functions described above are all accessible, (however, cnrmseg and cnrmoff are only meaningful for the 16-bit environments).
[0571] Two examples of protections will now be described according to the embodiments of the invention more particularly described here.
[0572] These examples are given by way of indication, the objective of the protections given here being to be reliable by guaranteeing a dependence of the application on the contents of the key, and a genuine execution of the software interfaces is for access to the key.
[0573] This type of protection is especially recommended when using DLL.
[0574] In the modes described more particularly below, an external encryption tool to be applied to the final executable programme is moreover called upon.
[0575] This tool is the same for both applications and is given by way of non-limiting example.
[0576] In all cases, the developer will have to adapt it as a function of his particular case.
[0577] The two examples enlist an application for calculating the diameter of a circle, its circumference, the volume of a cylinder based on the circle and the weight of said cylinder. The result is displayed each time.
[0578] The first example is in the C language, the source provided here being in the 16-bit environment.
[0579] Here, the principle of protection is to choose a few sensitive functions of the software to be protected, to mask the entry point of these functions by an indirect call, and to encrypt the structure which contains the entry point of said functions.
[0580] Thus, the key is guaranteed to be properly read otherwise decryption will not be performed, and in this case the entry points of the functions are not valid.
[0581] If a normal user who has a licence does not put in his key, he will obtain the “key absent” message.
[0582] If a pirate tries to replace the key or to delete the test for the presence of the key, decryption is not carried out and in this case the entry points of the functions are not valid.
[0583] Encryption is carried out by an external program after compilation and link editing. It uses the string TAG1 which must be unique to find the area to be encrypted and the length of said area.
[0584] The sole objective of the string TAG1 is the identification of a data section seen by the external program, the latter being unable to read the sources of the program to be protected.
[0585] An example of the mode of operation of this encryption program is specified with reference to FIG. 5.
[0586] More precisely the program R1 includes a first step 90 in which the executable file to be protected is opened, followed by a test 91 on the end of the file.
[0587] If the file has not terminated, the routine is halted (step 97).
[0588] If the end of the file is observed, a step 92 for reading the next character is undertaken, followed by a test 93 for comparing the character read with a reference character R, which is the character of the start of the so-called TAG1 string.
[0589] If this is not the correct character, the next character is then read (return to step 92), otherwise the next n characters are read (step 94), for example six characters.
[0590] A test step 95 is then performed to verify whether this is the so-called TAG1 string.
[0591] If this is not the case, we return to step 92, if it is the case, step 96 for encrypting the data structure is then initiated just after the TAG1 string.
[0592] Once encryption has been performed, the relevant routine is halted (step 97).
| #include <windows.h> |
| #include <stdio.h> |
| #include <stdlib> |
| #include “ACTIKEY.H” |
[0593] The second example is that of an application with a very high level of protection in Visual Basic.
[0594] This application calls upon a DLL and does not allow the use of techniques which are possible with C.
| Begin VB.Form Form1 |
[0595] As goes without saying and as moreover follows from the foregoing, the present invention is not limited to the embodiments more particularly described, but on the contrary embraces all variants thereof and especially those in which other methods of encryption are used.
Claims
What is claimed is:
1. A process for authorizing and controlling the use of a software developed under a specified platform, associated with a device provided with an electronic circuit with read/write memory, the device being connected to terminals of a parallel port between a computer and a peripheral apparatus, wherein signals are processed in the device and/or are returned from the device to the computer in response to signals transmitted from the computer, said process comprising the steps of:
writing to or reading from the circuit of the device by calling upon a function built into an object file or a Dynamic Library File previously inserted into the software, said function having the following form:
result=cnrm (var1, var2. . . varn) with n>3 in which var1 to varn correspond to particular values depending on what the software is desired to execute with the device and to at least one specific value corresponding to a specified user,
detecting automatically the type of specified platform, with said function, and
calculating software execution context as a function of the platform.
2. The process according to claim 1, wherein during implementation of a linking function between the software and the device, said process further comprises the steps of:
identifying the key and/or position of the key by way of a specific value given or not given by the software, p1 storing the specific value in memory, and
using the specific value later as a constant when operating the software.
3. The process according to claim 1, wherein the function cnrm is devised so as to recall the software at least once while operating, so as to verify that it is indeed the original cnrm which has been called.
4. The process according to claim 1, wherein the specified platform is devised so as to allow automatic recognition of the type of passing of parameters by reference to or by value implemented within the software.
5. The process according to claim 4, wherein the execution context is set up once only, during a first implementation of a function linking the software and the device.
6. The process according to claim 1, wherein n is equal to 8.
7. The process according to claim 1, further comprising a method of protection in which at least one sensitive function of the software to be protected is chosen, the entry point of said sensitive function being masked by an indirect call, and the structure which contains the entry point of said sensitive function being encrypted.
8. The process according to claim 1, further comprising a method of protection in which at least one control function or one significant constant is chosen, and said control function or said constant is encrypted.
9. The process according to claim 7, wherein the encryption is carried out by an external program after compilation and link editing.
10. A system for interactive authorization and control of the use of items of software developed under a specified platform and comprising at least one device provided with an electronic circuit with read/write memory, the device being connected to terminals of a parallel port between a computer and a peripheral apparatus, wherein signals are processed in the device or are returned from the device to the computer in response to signals transmitted from the computer, said system comprising:
means for writing to or reading from the electronic circuit of the device by calling upon a function built into an object file or a Dynamic Library File previously inserted into the software, said function having the following form:
result=cnrm (var1, var2. . . varn) with n>3 in which var1 to varn correspond to particular values depending on what the software is desired to execute with the device and to at least one specific value corresponding to a specified user,
means for automatically detecting the type of specified platform using said function, and
means for calculating software execution context as a function of the platform.
11. The process according to claim 8, wherein the encryption is carried out by an external program after compilation and link editing.
12. A process for controlling and authorizing the use of a software developed under a specified platform, associated with a device provided with an electronic circuit with read/write memory, connected to terminals of a parallel port between a computer and a peripheral apparatus, said process comprising the steps of:
performing a log-in of the device comprising allocating a memory stack in the read/write memory for storing return data from the computer including elements of the specified platform;
writing or reading from the circuit of the device by calling upon a function built into an object file or a Dynamic Library file previously inserted into the software, said function having the following form:
result=cnrm (var1, var2, . . . varn) with n>3, in which var1 to varn correspond to particular values depending on what the software is desired to execute with the device and to at least two specific values corresponding to a specified user and to an editor of the software;
providing the editor value to the stack, software interfaces being customized based on the editor value;
analyzing content of the stack in order to avoid passing by reference, to pass by value which authorizes a programmer, while installing the device, to choose a mode of operation irrespective of language of the software or state of compilation of the software;
detecting automatically the type of specified platform; and
calculating software execution context as a function of the platform.
13. The process according to claim 2, wherein the specified platform is devised so as to allow automatic recognition of the type of passing of parameters by reference to or by value implemented within the software.
14. The process according to claim 13, wherein the execution context is set up once only, during a first implementation of the linking function.