Digital computer system for executing encrypted programs

Claim 2

A digital computer system for executing at least one program comprising a set of instructions, at least one of said sets including at least one encrypted instruction, said system comprising: A. main memory means for storing the instructions of said set, B. cache memory including means for storing selected instructions in said set, said selected instructions being

Claim 3

selected non-decrypted instructions, that is, instructions, either in plaintext form or in encrypted form, which have not been decrypted; or 2. selected decrypted instructions corresponding to said encrypted instructions in said set, C. decryption means selectively operable when enabled for receiving an encrypted instruction from said memory means, for decrypting said received instruction to generate a corresponding decrypted instruction, and for transferring said decrypted instruction to said cache memory for storage therein, D. central processing means including i. means selectively operable in an execute mode for searching for an instruction in said cache memory, and when said instruction is not resident in said cache memory, for transferring said instructions from said memory means to said decryption means and for enabling said decryption means, and when said decrypted instruction is resident in said cache memory for transferring said instruction from said cache memory to said central processing means and for executing said instruction, and when said corresponding encrypted instruction is resident in said cache memory, for removing said instruction from said cache memory, and for then transferring said instruction from said main memory means to said decryption means and for enabling said decryption means ii. means selectively operable in a fetch mode for searching for an instruction in said cache memory, and when said instruction is resident in said cache memory and said instruction is a decrypted instruction, for transferring said corresponding encrypted instruction from said main memory means to said cache memory and to said central processing means, when said instruction is resident in said cache memory and said instruction is a non-decrypted instruction, for transferring said instruction from said cache memory to said central processing means, and when said instruction is not resident in said cache memory, for transferring said instruction from said main memory means to said cache memory and to said central processing means.

Claim 4

selected non-decrypted instructions, that is, instructions, either in plaintext form or in encrypted form, which have not been decrypted; or 2. selected decrypted instructions corresponding to said encrypted instructions in said set, C. decryption means selectively operable when enabled for receiving an encrypted instruction from said memory means, for decrypting said received instruction to generate a corresponding decrypted instruction, and for transferring said decrypted instruction to said cache memory for storage therein, D. central processing means including i. means selectively operable in an execute mode for searching for an instruction in said cache memory, and when said instruction is not resident in said cache memory, for transferring said instructions from said memory means to said decryption means and for enabling said decryption means, and when said decrypted instruction is resident in said cache memory for transferring said instruction from said cache memory to said central processing means and for executing said instruction, and when said corresponding encrypted instruction is resident in said cache memory, for removing said instruction from said cache memory, and for then transferring said instruction from said main memory means to said decryption means and for enabling said decryption means ii. means selectively operable in a fetch mode for searching for an instruction in said cache memory, and when said instruction is resident in said cache memory and said instruction is a decrypted instruction, for transferring said corresponding encrypted instruction from said main memory means to said cache memory and to said central processing means, when said instruction is resident in said cache memory and said instruction is a non-decrypted instruction, for transferring said instruction from said cache memory to said central processing means, and when said instruction is not resident in said cache memory, for transferring said instruction from said main memory means to said cache memory and to said central processing means.

Claim 5

A system according to claim 1 wherein said cache memory includes means for storing a tag associated with each instruction stored therein, said tag being characterized by a first value for a stored instruction when said stored instruction was transferred thereto from said decryption means and by a second value for a stored instruction when said stored instruction was transferred thereto from said main memory means, and wherein said central processing means includes means for determining whether an instruction identified during a cache search is a decrypted instruction or a non-decrypted instruction from the tag stored in said cache memory is association with said instruction, said non-decrypted instruction being an instruction, either in plaintext form or in encrypted form, which has not been decrypted.

Claim 6

A system according to claim 1 wherein said decryption means includes means for storing one or more decryption keys, each of said decryption keys being associated with at least one of said programs and providing information necessary for use by said decryption means in decrypting an encrypted instruction in said programs, and wherein said central processing means includes means operable during the execution of one of said programs for controlling said decryption means to use the stored decryption key associated with said one program to generate said decrypted instructions when said decryption means is enabled during said execution.

Claim 7

A system according to claim 3 wherein said decryption key storage means includes a write-only memory portion for storing a decrypted version of at least one said decryption key which decrypted version can be invoked only internally to said decryption means.

Claim 8

A system according to claim 1 or 2 or 3 or 4 wherein said encrypted instructions are encrypted using an encryption key uniquely associated with said system, said decryption keys being substantially not derivable from said encryption key.

Claim 10

A system according to claim 6 wherein said encrypted instructions are encrypted using an encryption key uniquely associated with said system, said decryption keys being substantially not derivable from said encryption key.