US6546487B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for protecting use of dynamically linked executable modules
Assignee: Sun Microsystems Inc
•
Filing: 1999-10-19
•
Granted: 2003-04-08
•
Expires: 2019-10-19
Abstract
Abstract A computer system has a program module verifier and at least first and second program modules. Each program module includes a digital signature and an executable procedure. The first program module furthermore includes a procedure call to the second procedure module, a procedure call to the program module verifier that is logically positioned in the first program module so as to be executed prior to execution of the procedure call to the second program module, and instructions preventing execution of the procedure call to the second program module when the procedure call to the program module verifier results in a verification denial being returned by the program module verifier. The second program module includes an executable procedure to be performed in response to the procedure call by the first program module to the second program module, a procedure call to the program module verifier that is logically positioned in the second program module so as to be executed prior to completion of execution of the second program module's executable procedure, and instructions preventing completion of execution of that executable procedure when the program module verifier returns a verification denial with respect to the first program module. The program module verifier responds to procedure calls by verifying the authenticity of any specified program module and by returning a verification confirmation or denial. When the program module verifier fails to verify the authenticity of a program module, the calling program module throws an exception and aborts its execution.
Inventors
- 👤 Charles E. McManis
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-05 20:53
CPC Classifications
G; G06; G06F; G06F9/00; G06F9/06; G06F9/46; G06F21/00; G06F21/10; G06F21/12; G06F21/121; G06F21/125; G06F2211/00; G06F2211/007
Claims Analysis
Total Claims: 24
Claim 1
Independent Claim
278 words
A computer data signal residing on a medium, the computer data signal carrying program module data for receipt and storage in a computer system having a program module verifier configured to respond to procedure calls to the program module verifier by verifying authenticity of any specified program module and by returning a verification confirmation or denial in response to each such procedure call; the program module data carried by the computer data signal comprising: a first program module; and a second program module; the first program module including: a procedure call to the second program module; a procedure call to the program module verifier for verifying the second program module's authenticity, wherein the procedure call to the program module verifier is logically positioned in the first program module so as to be executed prior to execution of the procedure call to the second program module; and instructions preventing execution of the procedure call to the second program module when the procedure call to the program module verifier results in a verification denial being returned by the program module verifier; the second program module including: an executable procedure to be performed in response to the procedure call to the second program module; a procedure call to the program module verifier for verifying the first program module's authenticity, wherein the procedure call to the program module verifier is logically positioned in the second program module so as to be executed prior to completion of execution of the executable procedure; and instructions preventing completion of execution of the executable procedure when the procedure call to the program module verifier results in a verification denial being returned by the program module verifier.
Claim 2
Dependent Claim
278 words
A computer data signal residing on a medium, the computer data signal carrying program module data for receipt and storage in a computer system having a program module verifier configured to respond to procedure calls to the program module verifier by verifying authenticity of any specified program module and by returning a verification confirmation or denial in response to each such procedure call; the program module data carried by the computer data signal comprising: a first program module; and a second program module; the first program module including: a procedure call to the second program module; a procedure call to the program module verifier for verifying the second program module's authenticity, wherein the procedure call to the program module verifier is logically positioned in the first program module so as to be executed prior to execution of the procedure call to the second program module; and instructions preventing execution of the procedure call to the second program module when the procedure call to the program module verifier results in a verification denial being returned by the program module verifier; the second program module including: an executable procedure to be performed in response to the procedure call to the second program module; a procedure call to the program module verifier for verifying the first program module's authenticity, wherein the procedure call to the program module verifier is logically positioned in the second program module so as to be executed prior to completion of execution of the executable procedure; and instructions preventing completion of execution of the executable procedure when the procedure call to the program module verifier results in a verification denial being returned by the program module verifier.
Claim 3
Dependent Claim
98 words
The computer data signal of claim 1 , wherein the program verifier module includes instructions for issuing an authenticity verification for any specified program module only when inspection of the specified program module indicates that the specified program module is identical to a corresponding program module known to be authentic, and for otherwise issuing an authenticity verification denial; and the instructions preventing execution of the procedure call include instructions for aborting execution of the first program module when the procedure call to the program module verifier results in a verification denial being returned by the program module verifier.
Claim 4
Dependent Claim
121 words
The computer data signal of claim 1 , the first program module including a first digital signature and a first executable procedure; the second program module including a second digital signature and a second executable procedure; the program verifier module including instructions for responding to a procedure call requesting verification of the second program module by decoding the second digital signature in the second program module with a corresponding decoding key, generating a message digest of at least a portion the second program module in accordance with a predefined message digest function, returning a verification confirmation when the decoded digital signature matches the message digest, and returning a verification denial when the decoded digital signature does not match the message digest.
Claim 5
Dependent Claim
181 words
A computer data signal residing on a medium, the computer data signal carrying program module data for receipt and storage in a computer system having a program module verifier configured to verify authenticity of any specified program module and to return to a requesting program module a verification signal, comprising a verification confirmation or verification denial, respectively confirming or denying authenticity of the specified program module; the program module data carried by the computer data signal comprising: a first program module; and a second program module; the first program module including: first instructions for receiving from the program module verifier the verification signal with respect to the second program module, and second instructions for preventing execution of third instructions in the first program module when the received verification signal comprises a verification denial; and the second program module including: fourth instructions for receiving from the program module verifier the verification signal with respect to the first program module, and fifth instructions for preventing execution of sixth instructions in the second program module when the received verification signal comprises a verification denial.
Claim 6
Dependent Claim
181 words
A computer data signal residing on a medium, the computer data signal carrying program module data for receipt and storage in a computer system having a program module verifier configured to verify authenticity of any specified program module and to return to a requesting program module a verification signal, comprising a verification confirmation or verification denial, respectively confirming or denying authenticity of the specified program module; the program module data carried by the computer data signal comprising: a first program module; and a second program module; the first program module including: first instructions for receiving from the program module verifier the verification signal with respect to the second program module, and second instructions for preventing execution of third instructions in the first program module when the received verification signal comprises a verification denial; and the second program module including: fourth instructions for receiving from the program module verifier the verification signal with respect to the first program module, and fifth instructions for preventing execution of sixth instructions in the second program module when the received verification signal comprises a verification denial.
Claim 7
Dependent Claim
95 words
The computer data signal of claim 4 , wherein the program verifier module includes instructions for issuing a verification signal comprising a verification confirmation with respect to any specified program module only when inspection of the specified program module indicates that the specified program module is identical to a corresponding program module known to be authentic, and for otherwise issuing a verification signal comprising a verification denial; and the second instructions of the first program module prevent execution of a procedure call to the second procedure when the received verification signal comprises a verification denial.
Claim 8
Dependent Claim
92 words
The computer data signal of claim 4 , wherein the program verifier module includes instructions for issuing a verification signal comprising a verification confirmation with respect to any specified program module only when inspection of the specified program module indicates that the specified program module is identical to a corresponding program module known to be authentic, and for otherwise issuing a verification signal comprising a verification denial; and the second instructions of the first program module abort execution of the first program module when the received verification signal comprises a verification denial.
Claim 9
Dependent Claim
131 words
The computer data signal of claim 4 , wherein the first program module includes a first digital signature and a first executable procedure; the second program module includes a second digital signature and a second executable procedure; the program verifier module includes instructions for responding to a procedure call requesting verification of the second program module by decoding the second digital signature in the second program module with a corresponding decoding key, generating a message digest of at least a portion of the second program module in accordance with a predefined message digest function, returning a verification signal comprising a verification confirmation when the decoded digital signature matches the message digest, and returning a verification signal comprising a verification denial when the decoded digital signature does not match the message digest.
Claim 10
Dependent Claim
180 words
A computer data signal residing on a medium, the computer data signal carrying program module data for receipt and storage in a computer system, the program module data carried by the computer data signal comprising: a program module verifier configured to verify authenticity of any specified program module and to return to a requesting program module a verification signal, comprising a verification confirmation or verification denial, respectively confirming or denying authenticity of the specified program module; a first program module; and a second program module; the first program module including: first instructions for receiving from the program module verifier the verification signal with respect to the second program module, and second instructions for preventing execution of third instructions in the first program module when the received verification signal comprises a verification denial; and the second program module including: fourth instructions for receiving from the program module verifier the verification signal with respect to the first program module, and fifth instructions for preventing execution of sixth instructions in the second program module when the received verification signal comprises a verification denial.
Claim 11
Dependent Claim
180 words
A computer data signal residing on a medium, the computer data signal carrying program module data for receipt and storage in a computer system, the program module data carried by the computer data signal comprising: a program module verifier configured to verify authenticity of any specified program module and to return to a requesting program module a verification signal, comprising a verification confirmation or verification denial, respectively confirming or denying authenticity of the specified program module; a first program module; and a second program module; the first program module including: first instructions for receiving from the program module verifier the verification signal with respect to the second program module, and second instructions for preventing execution of third instructions in the first program module when the received verification signal comprises a verification denial; and the second program module including: fourth instructions for receiving from the program module verifier the verification signal with respect to the first program module, and fifth instructions for preventing execution of sixth instructions in the second program module when the received verification signal comprises a verification denial.
Claim 12
Dependent Claim
95 words
The computer data signal of claim 8 , wherein the program verifier module includes instructions for issuing a verification signal comprising a verification confirmation with respect to any specified program module only when inspection of the specified program module indicates that the specified program module is identical to a corresponding program module known to be authentic, and for otherwise issuing a verification signal comprising a verification denial; and the second instructions of the first program module prevent execution of a procedure call to the second procedure when the received verification signal comprises a verification denial.
Claim 13
Dependent Claim
92 words
The computer data signal of claim 8 , wherein the program verifier module includes instructions for issuing a verification signal comprising a verification confirmation with respect to any specified program module only when inspection of the specified program module indicates that the specified program module is identical to a corresponding program module known to be authentic, and for otherwise issuing a verification signal comprising a verification denial; and the second instructions of the first program module abort execution of the first program module when the received verification signal comprises a verification denial.
Claim 14
Dependent Claim
131 words
The computer data signal of claim 8 , wherein the first program module includes a first digital signature and a first executable procedure; the second program module includes a second digital signature and a second executable procedure; the program verifier module includes instructions for responding to a procedure call requesting verification of the second program module by decoding the second digital signature in the second program module with a corresponding decoding key, generating a message digest of at least a portion of the second program module in accordance with a predefined message digest function, returning a verification signal comprising a verification confirmation when the decoded digital signature matches the message digest, and returning a verification signal comprising a verification denial when the decoded digital signature does not match the message digest.
Claim 15
Dependent Claim
167 words
A computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism comprising: a program module verifier configured to verify authenticity of any specified program module and to return to a requesting program module a verification signal, comprising a verification confirmation or verification denial, respectively confirming or denying authenticity of the specified program module; a first program module; and a second program module; the first program module including: first instructions for receiving from the program module verifier the verification signal with respect to the second program module, and second instructions for preventing execution of third instructions in the first program module when the received verification signal comprises a verification denial; and the second program module including: fourth instructions for receiving from the program module verifier the verification signal with respect to the first program module, and fifth instructions for preventing execution of sixth instructions in the second program module when the received verification signal comprises a verification denial.
Claim 16
Dependent Claim
167 words
A computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism comprising: a program module verifier configured to verify authenticity of any specified program module and to return to a requesting program module a verification signal, comprising a verification confirmation or verification denial, respectively confirming or denying authenticity of the specified program module; a first program module; and a second program module; the first program module including: first instructions for receiving from the program module verifier the verification signal with respect to the second program module, and second instructions for preventing execution of third instructions in the first program module when the received verification signal comprises a verification denial; and the second program module including: fourth instructions for receiving from the program module verifier the verification signal with respect to the first program module, and fifth instructions for preventing execution of sixth instructions in the second program module when the received verification signal comprises a verification denial.
Claim 17
Dependent Claim
95 words
The computer program product of claim 12 , wherein the program verifier module includes instructions for issuing a verification signal comprising a verification confirmation with respect to any specified program module only when inspection of the specified program module indicates that the specified program module is identical to a corresponding program module known to be authentic, and for otherwise issuing a verification signal comprising a verification denial; and the second instructions of the first program module prevent execution of a procedure call to the second procedure when the received verification signal comprises a verification denial.
Claim 18
Dependent Claim
92 words
The computer program product of claim 12 , wherein the program verifier module includes instructions for issuing a verification signal comprising a verification confirmation with respect to any specified program module only when inspection of the specified program module indicates that the specified program module is identical to a corresponding program module known to be authentic, and for otherwise issuing a verification signal comprising a verification denial; and the second instructions of the first program module abort execution of the first program module when the received verification signal comprises a verification denial.
Claim 19
Dependent Claim
131 words
The computer program product of claim 12 , wherein the first program module includes a first digital signature and a first executable procedure; the second program module includes a second digital signature and a second executable procedure; the program verifier module includes instructions for responding to a procedure call requesting verification of the second program module by decoding the second digital signature in the second program module with a corresponding decoding key, generating a message digest of at least a portion of the second program module in accordance with a predefined message digest function, returning a verification signal comprising a verification confirmation when the decoded digital signature matches the message digest, and returning a verification signal comprising a verification denial when the decoded digital signature does not match the message digest.
Claim 20
Dependent Claim
180 words
A computer program product for use in conjunction with a computer system having a program module verifier configured to verify authenticity of any specified program module and to return to a requesting program module a verification signal, comprising a verification confirmation or verification denial, respectively confirming or denying authenticity of the specified program module; the computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism comprising: a first program module; and a second program module; the first program module including: first instructions for receiving from the program module verifier the verification signal with respect to the second program module, and second instructions for preventing execution of third instructions in the first program module when the received verification signal comprises a verification denial; and the second program module including: fourth instructions for receiving from the program module verifier the verification signal with respect to the first program module, and fifth instructions for preventing execution of sixth instructions in the second program module when the received verification signal comprises a verification denial.
Claim 21
Dependent Claim
180 words
A computer program product for use in conjunction with a computer system having a program module verifier configured to verify authenticity of any specified program module and to return to a requesting program module a verification signal, comprising a verification confirmation or verification denial, respectively confirming or denying authenticity of the specified program module; the computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism comprising: a first program module; and a second program module; the first program module including: first instructions for receiving from the program module verifier the verification signal with respect to the second program module, and second instructions for preventing execution of third instructions in the first program module when the received verification signal comprises a verification denial; and the second program module including: fourth instructions for receiving from the program module verifier the verification signal with respect to the first program module, and fifth instructions for preventing execution of sixth instructions in the second program module when the received verification signal comprises a verification denial.
Claim 22
Dependent Claim
95 words
The computer program product of claim 16 , wherein the program verifier module includes instructions for issuing a verification signal comprising a verification confirmation with respect to any specified program module only when inspection of the specified program module indicates that the specified program module is identical to a corresponding program module known to be authentic, and for otherwise issuing a verification signal comprising a verification denial; and the second instructions of the first program module prevent execution of a procedure call to the second procedure when the received verification signal comprises a verification denial.
Claim 23
Dependent Claim
92 words
The computer program product of claim 16 , wherein the program verifier module includes instructions for issuing a verification signal comprising a verification confirmation with respect to any specified program module only when inspection of the specified program module indicates that the specified program module is identical to a corresponding program module known to be authentic, and for otherwise issuing a verification signal comprising a verification denial; and the second instructions of the first program module abort execution of the first program module when the received verification signal comprises a verification denial.
Claim 24
Dependent Claim
131 words
The computer program product of claim 16 , wherein the first program module includes a first digital signature and a first executable procedure; the second program module includes a second digital signature and a second executable procedure; the program verifier module includes instructions for responding to a procedure call requesting verification of the second program module by decoding the second digital signature in the second program module with a corresponding decoding key, generating a message digest of at least a portion of the second program module in accordance with a predefined message digest function, returning a verification signal comprising a verification confirmation when the decoded digital signature matches the message digest, and returning a verification signal comprising a verification denial when the decoded digital signature does not match the message digest.
References Cited (Backward Citations)
US5224160A
Cited
US5339403A
Cited
US5421006A
Cited
US5349642A
Cited
US5343527A
Cited
US5748739A
Cited
US5742759A
Cited
US5757914A
Cited
US5970145A
Cited
US5737523A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2006-04-07 | 2006-10-07 | 2007-04-08 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2010-04-07 | 2010-10-07 | 2011-04-08 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2014-04-07 | 2014-10-07 | 2015-04-08 | $7700.00 | Window Closed / Lapsed |