System and method for protecting digital goods using random and automatic code obfuscation

Claim 3

A method as recited in claim 1 , wherein the randomly applying comprises pseudo randomly applying the various forms of protection according to pseudo random techniques.

Claim 4

A method as recited in claim 1 , wherein the applying comprises randomly selecting the forms of protection from a set of available forms of protection.

Claim 5

A method as recited in claim 1 , wherein the applying comprises applying the various forms of protection to randomly selected portions of the original digital good.

Claim 6

A method as recited in claim 1 , wherein the various forms of protection are selected from a group of protection tools comprising code integrity verification, acyclic code integrity verification, cyclic code integrity verification, secret key scattering, obfuscated function execution, encryption/decryption, probabilistic checking, Boolean check obfuscation, in-lining, reseeding pseudo random number generators with time varying inputs, anti-disassembly methods, varying execution paths between runs, anti-debugging methods, and time/space separation between tamper detection and response.

Claim 7

A method as recited in claim 1 , wherein the applying comprises applying a form of protection in which a checksum can be computed on a set of bytes of the digital good without actually reading the bytes.

Claim 8

A computer-readable medium comprising computer-readable instructions that, when executed by a processor, direct a computer system to perform the method as recited in claim 1 .

Claim 11

A method as recited in claim 8 , wherein at least two of the segments overlap one another.

Claim 12

A method as recited in claim 8 , wherein the selecting comprises randomly selecting the segments.

Claim 13

A method as recited in claim 8 , wherein the transforming comprises transforming the selected segments according to randomly chosen protection techniques.

Claim 14

A method as recited in claim 8 , further comprising receiving quantitative parameters indicative of how much the protected digital good should be altered.

Claim 15

A method as recited in claim 12 , wherein the transforming is performed to satisfy the quantitative parameters.

Claim 16

A method as recited in claim 8 , wherein the protection techniques are selected from a group of protection tools comprising code integrity verification, acyclic code integrity verification, cyclic code integrity verification, secret key scattering, obfuscated function execution, encryption/decryption, probabilistic checking, Boolean check obfuscation, in-lining, reseeding pseudo random number generators with time varying inputs, anti-disassembly methods, varying execution paths between runs, anti-debugging methods, and time/space separation between tamper detection and response.

Claim 17

A method as recited in claim 8 , wherein the transforming comprises applying a protection technique in which a checksum can be computed on a set of bytes of the digital good without actually reading the bytes.

Claim 18

A computer-readable medium comprising computer-readable instructions that, when executed by a processor, direct a computer system to perform the method as recited in claim 8 .

Claim 21

A method as recited in claim 17 , wherein the establishing comprises enabling a user to enter the parameters.

Claim 22

A method as recited in claim 17 , wherein the augmenting comprises applying a protection technique selected from a group of protection techniques comprising code integrity verification, acyclic code integrity verification, cyclic code integrity verification, secret key scattering, obfuscated function execution, encryption/decryption, probabilistic checking, Boolean check obfuscation, in-lining, reseeding pseudo random number generators with time varying inputs, anti-disassembly methods, varying execution paths between runs, anti-debugging methods, and time/space separation between tamper detection and response.

Claim 23

A method as recited in claim 17 , wherein the augmenting comprises applying a protection technique in which a checksum can be computed on a set of bytes of the digital good without actually reading the bytes.

Claim 24

A computer-readable medium comprising computer-readable instructions that, when executed by a processor, direct a computer system to perform the method as recited in claim 17 .

Claim 25

A production system, comprising: a memory to store an original digital good; a production server equipped with a set of multiple protection tools that may be used to augment the original digital good for protection purposes, the production server being configured to: parse the original digital good and apply protection tools selected from the set of protection tools only to selected portions of the original digital good in a random manner to produce a protected digital good having a composite of the protected selected portions; generate a plurality of checkpoints, each of the checkpoints being associated with and positioned outside of one of the protected selected portions and causing a system receiving the protected digital good, upon encountering each of the checkpoints, to invoke a function call to validate the protected selected portions associated with each of the checkpoints have not been tampered with based on the protection tools used to produce the protected selected portions; and insert the plurality of checkpoints within the protected digital good, the positions of each of the plurality of checkpoints being one of variably offset and randomly offset outside of the protected selected portions with which each of the checkpoints is associated.

Claim 26

A production system, comprising: a memory to store an original digital good; a production server equipped with a set of multiple protection tools that may be used to augment the original digital good for protection purposes, the production server being configured to: parse the original digital good and apply protection tools selected from the set of protection tools only to selected portions of the original digital good in a random manner to produce a protected digital good having a composite of the protected selected portions; generate a plurality of checkpoints, each of the checkpoints being associated with and positioned outside of one of the protected selected portions and causing a system receiving the protected digital good, upon encountering each of the checkpoints, to invoke a function call to validate the protected selected portions associated with each of the checkpoints have not been tampered with based on the protection tools used to produce the protected selected portions; and insert the plurality of checkpoints within the protected digital good, the positions of each of the plurality of checkpoints being one of variably offset and randomly offset outside of the protected selected portions with which each of the checkpoints is associated.

Claim 27

A production system as recited in claim 22 , wherein the protection tools are selected from a group of protection tools comprising code integrity verification, acyclic code integrity verification, cyclic code integrity verification, secret key scattering, obfuscated function execution, encryption/decryption, probabilistic checking, Boolean check obfuscation, in-lining, reseeding pseudo random number generators with time varying inputs, anti-disassembly methods, varying execution paths between runs, anti-debugging methods, and time/space separation between tamper detection and response.

Claim 28

A production system as recited in claim 22 , wherein the production server applies a protection tool that enables a checksum to be computed on a set of bytes of the digital good without actually reading the bytes.

Claim 29

A production system as recited in claim 22 , wherein the production server has a pseudo random generator to introduce randomness into the application of the protection tools to various portions of the original digital good.

Claim 30

An obfuscation system, comprising: a parser to parse a digital good into a plurality of segments; a set of protection tools that may be applied to the segments of the digital good to augment the segments with protection qualities; a target segment selector to select at least one segment from the plurality of segments; a tool selector to select at least one protection tool from the set of protection tools and apply the selected protection tool to the selected segment so that a protection tool of the set of protection tools is applied only to a selected segment of the plurality of segments to generate a plurality of protected selected segments; and a checkpoint generator to create checkpoints for at least a portion of the protected selected segments, the checkpoints being assigned positions outside of the protected selected segments at variable positions relative to each of the protected selected segments, the checkpoints being operable to cause a system receiving the plurality of protected selected segments, upon encountering the checkpoints, to invoke a function call to validate authenticity of the protected selected segments based on the protection tool applied to generate the plurality of protected selected segments.

Claim 31

An obfuscation system, comprising: a parser to parse a digital good into a plurality of segments; a set of protection tools that may be applied to the segments of the digital good to augment the segments with protection qualities; a target segment selector to select at least one segment from the plurality of segments; a tool selector to select at least one protection tool from the set of protection tools and apply the selected protection tool to the selected segment so that a protection tool of the set of protection tools is applied only to a selected segment of the plurality of segments to generate a plurality of protected selected segments; and a checkpoint generator to create checkpoints for at least a portion of the protected selected segments, the checkpoints being assigned positions outside of the protected selected segments at variable positions relative to each of the protected selected segments, the checkpoints being operable to cause a system receiving the plurality of protected selected segments, upon encountering the checkpoints, to invoke a function call to validate authenticity of the protected selected segments based on the protection tool applied to generate the plurality of protected selected segments.

Claim 32

An obfuscation system as recited in claim 26 , wherein the protection tools are selected from a group of protection tools comprising code integrity verification, acyclic code integrity verification, cyclic code integrity verification, secret key scattering, obfuscated function execution, encryption/decryption, probabilistic checking, Boolean check obfuscation, in-lining, reseeding pseudo random number generators with time varying inputs, anti-disassembly methods, varying execution paths between runs, anti-debugging methods, and time/space separation between tamper detection and response.

Claim 33

An obfuscation system as recited in claim 26 , wherein the target segment selector comprises a pseudo random generator to enable random selection of the segment.

Claim 34

An obfuscation system as recited in claim 26 , wherein the tool selector comprises a pseudo random generator to enable random selection of the protection tool.

Claim 35

An obfuscation system as recited in claim 26 , further comprising a quantitative unit to specify a quantity of protection qualities to be added to the digital good.

Claim 36

A client-server system, comprising: a production server to randomly apply various forms of protection only to selected portions of a digital good to produce a protected digital good, the protected digital good including a plurality of one of variably and randomly placed checkpoints configured to cause a system encountering the checkpoints to authenticate that the selected portions of the protected digital good have not been tampered with; and a client to store and execute the protected digital good, the client being configured to, upon encountering each of the checkpoints, to invoke a function call to evaluate the selected portions of the protected digital good to determine whether the protected digital good has been tampered with based on at least one form of protection applied to the selected portions to produce the protected digital good.

Claim 37

A client-server system, comprising: a production server to randomly apply various forms of protection only to selected portions of a digital good to produce a protected digital good, the protected digital good including a plurality of one of variably and randomly placed checkpoints configured to cause a system encountering the checkpoints to authenticate that the selected portions of the protected digital good have not been tampered with; and a client to store and execute the protected digital good, the client being configured to, upon encountering each of the checkpoints, to invoke a function call to evaluate the selected portions of the protected digital good to determine whether the protected digital good has been tampered with based on at least one form of protection applied to the selected portions to produce the protected digital good.

Claim 38

One or more computer-readable media having computer-executable instructions that, when executed, direct a computing device to: parse a digital good into a plurality of segments; apply multiple different protection tools to only a selected portion of the segments in a random manner to produce a protected digital good having a composite of variously protected portions; and insert a plurality of checkpoints into the protected digital good at positions one of variably and randomly offset from the variously protected portions, such that upon encountering each of the plurality of checkpoints, a receiving computing system executing the protected digital good will invoke a function call to authenticate that variously protected portions have not been tampered with based on the at least one of the multiple different protection tools used to produce the variously protected portions.

Claim 39

One or more computer-readable media having computer-executable instructions that, when executed, direct a computing device to: parse a digital good into a plurality of segments; apply multiple different protection tools to only a selected portion of the segments in a random manner to produce a protected digital good having a composite of variously protected portions; and insert a plurality of checkpoints into the protected digital good at positions one of variably and randomly offset from the variously protected portions, such that upon encountering each of the plurality of checkpoints, a receiving computing system executing the protected digital good will invoke a function call to authenticate that variously protected portions have not been tampered with based on the at least one of the multiple different protection tools used to produce the variously protected portions.

Claim 40

One or more computer-readable media as recited in claim 32 , further comprising computer-executable instructions to randomly select the protection tools from a set of available protection tools.

Claim 41

One or more computer-readable media as recited in claim 32 , further comprising computer-executable instructions to apply the protection tools to randomly selected portions of the original digital good.

Claim 42

One or more computer-readable media as recited in claim 32 , wherein the protection tools are selected from a group of protection tools comprising code integrity verification, acyclic code integrity verification, cyclic code integrity verification, secret key scattering, obfuscated function execution, encryption/decryption, probabilistic checking, Boolean check obfuscation, in-lining, reseeding pseudo random number generators with time varying inputs, anti-disassembly methods, varying execution paths between runs, anti-debugging methods, and time/space separation between tamper detection and response.