In accordance with an embodiment of the present invention, a client device is protected against the execution of unauthorized software. The client includes a code authentication process that verifies the integrity of executable code, by generating and comparing a first hash value of the executable code with a known hash value of the original code. Furthermore, during boot-up, the client initializes a CPU exception vector table with one or more vector table entries. One or more, or all, of the vector table entries direct the CPU to execute the code authentication process prior to executing an event handler when an exception event occurs. Consequently, the code authentication process is virtually guaranteed to execute, thereby protecting against the execution of unauthorized code.
|
1. A method for providing security on a client device, the method being performed by one or more processors and comprising:
initializing an exception vector table, the exception vector table including comprising one or more vector table entries that each references a corresponding event handling routine that is used to process a corresponding exception event, wherein at least one vector table entry of the one or more vector table entries causes a code authentication process to be executed before a the corresponding event handling routine is executed;
in response to detecting an the corresponding exception event associated with the at least one vector table entry of the one or more vector table entries, executing the code authentication process to authenticate a portion of executable code stored in a memory resource, the code authentication process determining whether the portion of the executable code is authorized or unauthorized; and
in response to the code authentication process determining that the portion of the executable code is authorized, executing an the corresponding event handling routine corresponding to the at least one vector table entry of the one or more vector table entries.
17. A non-transitory computer readable medium storing instructions that, when executed by one or more processors, causes cause the one or more processors to perform steps comprising:
initializing an exception vector table, the exception vector table including comprising one or more vector table entries that each references a corresponding event handling routine that is used to process a corresponding exception event, wherein at least one vector table entry of the one or more vector table entries causes a code authentication process to be executed before a the corresponding event handling routine is executed;
in response to detecting an the corresponding exception event associated with the at least one vector table entry of the one or more vector table entries, executing the code authentication process to authenticate a portion of executable code stored in a memory resource, the code authentication process determining whether the portion of the executable code is authorized or unauthorized; and
in response to the code authentication process determining that the portion of the executable code is authorized, executing an the corresponding event handling routine corresponding to the at least one vector table entry of the one or more vector table entries.
9. A client device comprising:
one or more memory resources; and
one or more processing resources coupled to the one or more memory resources, the one or more processing resources configured to:
initialize an exception vector table, the exception vector table including comprising one or more vector table entries that each references a corresponding event handling routine that is used to process a corresponding exception event, wherein at least one vector table entry of the one or more vector table entries causes a code authentication process to be executed before a the corresponding event handling routine is executed;
in response to detecting an the corresponding exception event associated with the at least one vector table entry of the one or more vector table entries, execute the code authentication process to authenticate a portion of executable code stored in the one or more memory resources, the code authentication process determining whether the portion of the executable code is authorized or unauthorized; and
in response to the code authentication process determining that the portion of the executable code is authorized, execute an the corresponding event handling routine corresponding to the at least one vector table entry of the one or more vector table entries.
2. The method of
in response to the code authentication process determining that the portion of the executable code is unauthorized, preventing the execution of the corresponding event handling routine corresponding to the at least one vector table entry of the one or more vector table entries.
3. The method of
in response to the code authentication process determining that the portion of the executable code is not authorized unauthorized, transmitting information about the determined unauthorized portion of the executable code determined to be unauthorized to a server over a network.
4. The method of
maintaining status information indicating:
which portions of the executable code have been authenticated by the code authentication process, the portions of the executable code comprising the portion of the executable code; and
when the portions of the executable code have been authenticated by the code authentication process.
5. The method of
the code authentication process is executed to authenticate the portion of the executable code based, at least in part, on the maintained status information maintained.
6. The method of
during a power-on procedure,:
(i) executing a system integrity authenticator to authenticate boot-loader code stored in a non-volatile memory resource, by determining that the boot-loader code is authorized; and
(ii) in response to the system integrity authenticator determining that the boot-loader code is authorized, loading a portion of the an operating system into the memory resource by executing the boot-loader code.
7. The method of
the exception vector table is initialized in response to executing the boot-loader code.
8. The method of
the system integrity authenticator also authenticates at least one of:
code corresponding the exception vector table; or
code corresponding to the code authentication process.
10. The method client device of
the one or more processors processing resources are further configured to, in response to the code authentication process determining that the portion of the executable code is unauthorized, prevent the execution of the corresponding event handling routine corresponding to the at least one vector table entry of the one or more vector table entries.
11. The method client device of
the one or more processors processing resources are further configured to, in response to the code authentication process determining that the portion of the executable code is not authorized unauthorized, transmit information about the determined unauthorized portion of the executable code determined to be unauthorized to a server over a network.
12. The method client device of
the one or more processors processing resources are further configured to maintain status information indicating:
which portions of the executable code have been authenticated by the code authentication process, the portions of the executable code comprising the portion of the executable code; and
when the portions of the executable code have been authenticated by the code authentication process.
13. The method client device of
the one or more processors processing resources execute the code authentication process based, at least in part, on the maintained status information maintained.
14. The method client device of
the one or more processors processing resources are further configured to, during a power-on procedure,:
(i) execute a system integrity authenticator to authenticate boot-loader code stored in a non-volatile memory resource, by determining that the boot-loader code is authorized; and
(ii) in response to the system integrity authenticator determining that the boot-loader code is authorized, load a portion of the an operating system into the one or more memory resources by executing the boot-loader code.
15. The method client device of
the one or more processing resources initialize the exception vector table in response to executing the boot-loader code.
16. The method client device of
the system integrity authenticator also authenticates at least one of:
code corresponding the exception vector table; or
code corresponding to the code authentication process.
18. The non-transitory computer readable medium of
in response to the code authentication process determining that the portion of the executable code is not authorized, unauthorized:
(i) prevent the execution of the corresponding event handling routine corresponding to the at least one vector table entry, of the one or more vector table entries; and
(ii) transmit information about the determined unauthorized portion of the executable code determined to be unauthorized to a server over a network.
19. The non-transitory computer readable medium of
maintain status information indicating:
which portions of the executable code have been authenticated by the code authentication process, the portions of the executable code comprising the portion of the executable code; and
when the portions of the executable code have been authenticated by the code authentication process.
20. The non-transitory computer readable medium of
execute the code authentication process based, at least in part, on the maintained status information maintained.
|
This Application The present application is a reissue application of U.S. Pat. No. 8,677,142 issued Mar. 18, 2014 from U.S. patent application Ser. No. 13/538,430 filed Jun. 29, 2012, which is a Continuation of U.S. patent application Ser. No. 11/413,392, filed Apr. 27, 2006, now U.S. Pat. No. 8,239,686; the aforementioned priority application applications being hereby incorporated by reference in its their entirety for all purposes.
The present invention relates generally to protecting the integrity of a trusted client, and in particular, to a method and system for protecting against the execution of unauthorized software on a trusted client.
The Internet has shown great promise as a means for delivering digital content (e.g., video and audio content, such as television shows, movies and songs). One of the advantages of network-based digital content delivery systems is the ability to deliver digital content to users on an on-demand basis (e.g., video on demand, or VOD). However, content providers have been slow to make content available via the Internet, in large part because of security concerns. Specifically, content providers fear that, once their digital content is available on the Internet, hackers will circumvent any security mechanisms used to protect their digital content and then freely distribute the content. Consequently, system developers are continuously looking for ways to secure digital content and improve the systems by which digital content is delivered over computer networks.
One of the ways that system developers attempt to secure digital content is to develop trusted clients that cannot be modified by hackers. For example, many digital content delivery systems utilize trusted clients to access, or play, digital content. One of the ways that hackers attempt to circumvent digital content security measures is to modify the trusted client device that is used to access, or play, the digital content. In particular, hackers may attempt to modify existing software, or introduce new software, on the trusted client. Accordingly, hackers may use the modified or new software processes to analyze and/or probe the trusted client in an effort to discover encryption keys, or otherwise circumvent security measures. Consequently, it is desirable to prevent the modification, or introduction of new, executable code on a client.
A method and system for protecting against the execution of unauthorized software are disclosed. According to one embodiment of the invention, a client device is protected against the execution of unauthorized software. The client includes a code authentication process that verifies the integrity of executable code, by generating and comparing a hash value of the executable code with a known hash value of the authentic executable code. Furthermore, during boot-up, the client initializes a CPU exception vector table with one or more vector table entries. One or more, or all, of the vector table entries direct the CPU to execute the code authentication process prior to executing an event handler when an exception event occurs. Consequently, the code authentication process is virtually guaranteed to execute, thereby protecting against the execution of unauthorized code.
Other objects, advantages and features of the present invention will become apparent upon examining the following detailed description of an embodiment thereof, taken in conjunction with the attached drawings.
The invention will be readily understood by reviewing the following detailed description in conjunction with the accompanying drawings, in which like references indicate similar elements and in which:
A method and system for protecting against the execution of unauthorized software on a trusted client are disclosed. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be evident to one skilled in the art, however, that the present invention may be practiced without these specific details. The description and representation herein are the means used by those experienced or skilled in the art to effectively convey the substance of their work to others skilled in the art. In some instances, to avoid unnecessarily obscuring aspects of the present invention, well-known operations and components have not been described in detail.
Reference herein to “one embodiment” or “an embodiment” means that a particular feature, structure, operation, or other characteristic described in connection with the embodiment may be included in at least one implementation of the invention. However, the appearance of the phrase “in one embodiment” or the phrase “in an embodiment” in various places in the specification does not necessarily refer to the same embodiment.
In one embodiment of the invention, one or more of the individual components shown in
The disk storage device 44 stores executable code 54 and a hash table for the executable code 66. In one embodiment of the invention, the executable code includes, but is not limited to the operating system 56, system applications 58, and an executable code authentication process 60. The operating system 56 may be a customized version of any conventional operating system, such as Linux or Microsoft Windows®. The system applications 58 will generally be customized applications that enable the primary functions of the client device 30, to include the play back of digital content received over the network interface 42. The executable code authentication process 60 is a set of instructions, or a process, that authenticates segments of executable code when executed by the CPU 32. As described in greater detail below, when the system powers on, segments of the executable code are read into memory to be executed by the CPU 32.
It will be appreciated by those skilled in the art that, depending on the state of the client, the executable code 54 may be a set of instructions stored on disk storage 44, or alternatively, a process stored in memory and being executed by the CPU. Furthermore, although the disk storage 44 is shown in
The non-volatile memory 38 includes boot-loader code 62, and a digital signature 64 for the boot-loader code 64. The boot-loader code 62 includes boot-up instructions that are executed during a power-on procedure, which enables the client to load the operating system and enter into an operating state. As described in greater detail below, the boot-loader digital signature 64 is a mechanism used for authenticating the boot-loader code 62. Accordingly, the authentication mechanism is intended to identify non-conforming or unauthorized code before it is executed, thereby preventing hackers from modifying existing code, and/or introducing new code into the client.
In one embodiment of the invention, during production of the client 30, the executable code 54 that is to be written to the disk storage device 44 is loaded on to a production server. On the production server, the executable code 54 is analyzed, and a hash generator algorithm is utilized to generate a table 66 of hash values corresponding to segments of the executable code. Accordingly, each hash value in the hash table 66 represents a digest of a segment of executable code. Similarly, one or more hash values are generated for the boot-loader code 62. In one embodiment of the invention, the hash value for the boot-loader code is encrypted with an encryption key to generate a digital signature 64. For example, the encryption key utilized to encrypt the hash value for the boot-loader code may be shared in common with the security processor 40. Accordingly, the security processor 40, utilizing the encryption/decryption key 72, can decrypt the digital signature to access the originally generated hash for the boot-loader code 62.
During production of the client, the boot-loader code 62 and the digital signature 64, are programmed into the non-volatile memory 38. In addition, the hash table is stored in a file on the hard disk. Consequently, after production when the client is in use, the system integrity authenticator 68 can authenticate the boot-loader code 62 during a power-on, or boot-up, procedure. Similarly, after boot-up, the executable code authentication process 60 can authenticate the executable code 54 by generating a hash value with the same hash generating algorithm used on the production server. The generated hash value is then compared with the pre-calculated hash value in the hash table 66. If the hash values match, it can be presumed that the segment of executable code is authentic and original.
The security processor 40, which includes the system integrity authenticator 48, also includes an encryption/decryption engine 70 and at least one encryption/decryption key 72. Accordingly, the security processor 40 may provide the client 30 with a wide variety of security functions or services. In one embodiment of the invention, the security processor 40 provides processing power for encryption/decryption tasks that are computationally intensive. For example, encrypted digital content received via the network interface 42 may be decrypted by the encryption/decryption engine 50, in real time, before being provided to the display subsystem (not shown) for display to a user. Accordingly, in various embodiments of the invention, the security processor 40 may have any number of secret keys in addition to the encryption/decryption key 72, and each key may serve a different purpose.
During the boot-up procedure, the operating system 56, or a portion thereof, is loaded into the memory 36 in accordance with the boot-loader instructions 62. In addition, an exception vector table 74 is generated and loaded into the memory 36, along with system applications 58, or a portion of, the executable code authentication process 60 and the hash table 66. Before loading the operating system and the application code, the boot loader also verifies that those files are authentic by checking their signatures.
In one embodiment of the invention, the exception vector table 74 causes the CPU to switch contexts, and execute the executable code authentication process 60, when an exception event occurs. As described in connection with
In one embodiment of the invention, the code authentication process 60 generates a hash value for a segment of executable code in memory, and then compares the hash value with a pre-calculated hash value from the hash table for that particular segment of executable code. Assuming the hash values match, it is assumed that the executable code is authentic. However, if the hash values do not match, it is presumed that the executable code is not authentic. In one embodiment of the invention, when unauthentic code is discovered, the code authentication process may cause the client to halt executing all together. Additionally, or alternatively, the code authentication process 60 may report the discovery of unauthentic code to a server.
In one embodiment of the invention, the code authentication process may maintain status information indicating which segments of code have been authenticated, as well as information relating to the time at which segments were authenticated. Accordingly, the code authentication process 60 may control how frequently it operates by determining whether executable code in memory 36 needs to be authenticated based on the status information it maintains. For example, if all of the executable code in memory 36 has recently been authenticated, the code authentication process 60 may not operate, thereby passing control to the exception handling routine associated with the exception event that initially triggered the execution of the code authentication process 60. Or, if the code authentication process has consumed too much CPU recently, it may decide not to check and just pass control onto the event handler.
In one embodiment of the invention, in addition to authenticating the boot-loader code at boot-up time, the system integrity authenticator 68 of the security processor 40 systematically authenticates the exception vector table, code authentication process 60 and the hash table 66. For example, the system integrity authenticator 68 may generate a hash value based on the hash table, and compare that hash value to a previously generated hash value. The previously generated hash value for the hash table may be a special hash value that is stored in the non-volatile memory, or in the security processor. In this manner, the system integrity authenticator can verify the authenticity of the hash table that is used to authenticate the executable code. Similarly, the system integrity authenticator may authenticate the code for the code authentication process 60, or the exception vector table 74.
Although the hash table 66 is shown in
During the boot-up procedure, boot loader transfers control to the kernel of the operating system, and the operating system boot-up proceeds. At operation 88, the client initializes a CPU vector table with one or more vector table entries, which cause the CPU to execute a code authentication process when an exception event occurs, prior to executing the operating system's exception handling routine associated with the exception event. Accordingly, at operation 90, when an exception event occurs, the CPU interrupts the current process to lookup the event handling routine associated with the exception event. At operation 92, the code authentication process is executed to authenticate a segment of executable code in memory. If the executable code is not authentic, the client halts execution at operation 94. However, if the executable code is authentic, then the event handling routine for the exception event is executed at operation 96, after which the normal activities of the operating system including execution of the application code resume in block 98.
The content delivery systems illustrated in
Thus, a method and system for protecting against the execution of unauthorized software on a client device have been described. Although the present invention has been described with reference to specific exemplary embodiments, it will be evident that various modifications and changes may be made to these embodiments without departing from the broader spirit and scope of the invention. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense.
Ganesan, Prasanna, Goodman, Andrew M., Hodzic, Edin
Patent | Priority | Assignee | Title |
11681809, | Apr 19 2018 | Canon Kabushiki Kaisha | Information processing apparatus, control method, and storage medium |
Patent | Priority | Assignee | Title |
4288659, | May 21 1979 | Atalla Technovations | Method and means for securing the distribution of encoding keys |
4578530, | Jun 24 1981 | VISA U S A , INC A DE CORP | End-to-end encryption system and method of operation |
5410343, | Sep 27 1991 | Verizon Patent and Licensing Inc | Video-on-demand services using public switched telephone network |
5509120, | Nov 30 1993 | LENOVO SINGAPORE PTE LTD | Method and system for detecting computer viruses during power on self test |
5748732, | Feb 08 1995 | ARRIS ENTERPRISES LLC | Pay TV method and device which comprise master and slave decoders |
5949881, | Dec 04 1995 | Intel Corporation | Apparatus and method for cryptographic companion imprinting |
6115816, | Dec 18 1996 | Intel Corporation | Optimized security functionality in an electronic system |
6154633, | Oct 22 1997 | ARRIS ENTERPRISES LLC | Method and apparatus for upgrading features and functions of a set top box in the field |
6263504, | Nov 27 1995 | Sony Corporation | Data delivery system, data receiving apparatus, and storage medium for video programs |
6289455, | Sep 02 1999 | Crypotography Research, Inc.; Cryptography Research, Inc | Method and apparatus for preventing piracy of digital content |
6408386, | Jun 07 1995 | Intel Corporation | Method and apparatus for providing event handling functionality in a computer system |
6424714, | Dec 04 1995 | Scientific-Atlanta, LLC | Method and apparatus for providing conditional access in connection-oriented interactive networks with a multiplicity of service providers |
6625729, | Mar 31 2000 | CONVERSANT INTELLECTUAL PROPERTY MANAGEMENT INC | Computer system having security features for authenticating different components |
6687683, | Oct 16 1998 | Sovereign Peak Ventures, LLC | Production protection system dealing with contents that are digital production |
6715085, | Apr 18 2002 | Daedalus Blue LLC | Initializing, maintaining, updating and recovering secure operation within an integrated system employing a data access control function |
6804357, | Apr 28 2000 | Nokia Technologies Oy | Method and system for providing secure subscriber content data |
6804719, | Aug 24 2000 | Microsoft Technology Licensing, LLC | Method and system for relocating files that are partially stored in remote storage |
6961858, | Jun 16 2000 | MIH Technology Holdings BV | Method and system to secure content for distribution via a network |
6993132, | Dec 03 2002 | MATSUSHITA ELECTRIC INDUSTRIAL CO , LTD | System and method for reducing fraud in a digital cable network |
7003672, | Sep 25 2001 | HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | Authentication and verification for use of software |
7027460, | Dec 21 2001 | TAHOE RESEARCH, LTD | Method and system for customized television viewing using a peer-to-peer network |
7069332, | Feb 24 2000 | Hitachi, LTD | Video server for video distribution system |
7134138, | Feb 15 2001 | EMC IP HOLDING COMPANY LLC | Methods and apparatus for providing security for a data storage system |
7168065, | Mar 09 1999 | GEMALTO SA | Method for monitoring program flow to verify execution of proper instructions by a processor |
7228432, | Sep 11 2003 | Meta Platforms, Inc | Method and apparatus for providing security for a computer system |
7240345, | Feb 16 2001 | Sony Corporation | Data processing apparatus and associated method |
7380276, | May 20 2004 | Intel Corporation | Processor extensions and software verification to support type-safe language environments running with untrusted code |
7440574, | Jun 11 2003 | Hewlett-Packard Development Company, L.P. | Content encryption using programmable hardware |
7475254, | Jun 19 2003 | DROPBOX, INC | Method for authenticating software using protected master key |
7496756, | Sep 11 2001 | Sony Corporation | Content usage-right management system and management method |
7631356, | Apr 08 2005 | Microsoft Technology Licensing, LLC | System and method for foreign code detection |
7900060, | Feb 17 2006 | NBCUniversal Media LLC | Method and system for securing a disk key |
20020114465, | |||
20020154892, | |||
20020184489, | |||
20030084298, | |||
20030120923, | |||
20030208765, | |||
20040025186, | |||
20040039911, | |||
20040088558, | |||
20040093507, | |||
20040148634, | |||
20050015814, | |||
20050094724, | |||
20050108414, | |||
20050114659, | |||
20050117747, | |||
20050135705, | |||
20050160308, | |||
20050177853, | |||
20050210525, | |||
20050262546, | |||
20060008256, | |||
20060031537, | |||
20060078307, | |||
20060129795, | |||
20060136597, | |||
20060143476, | |||
20060174004, | |||
20060190615, | |||
20060200413, | |||
20070016832, | |||
20070101399, | |||
20070157281, | |||
20070245392, | |||
20080091840, | |||
20080148323, | |||
20080267406, | |||
20090006583, | |||
20090019131, | |||
20090300673, | |||
20100005496, | |||
20100023976, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Apr 25 2006 | HODZIC, EDIN | VVOND, INC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046093 | 0779 | |
Apr 26 2006 | GOODMAN, ANDREW M | VVOND, INC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046093 | 0779 | |
Apr 26 2006 | GANESAN, PRASANNA | VVOND, INC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046093 | 0779 | |
Sep 29 2006 | VVOND, INC | MARQUEE, INC | CHANGE OF NAME SEE DOCUMENT FOR DETAILS | 046368 | 0457 | |
Apr 24 2007 | MARQUEE, INC | VUDU, INC | CHANGE OF NAME SEE DOCUMENT FOR DETAILS | 046364 | 0378 | |
Mar 16 2016 | VUDU, Inc. | (assignment on the face of the patent) | ||||
Jun 13 2020 | VUDU, INC | VUDU, LLC | CHANGE OF NAME SEE DOCUMENT FOR DETAILS | 053585 | 0162 | |
Aug 20 2020 | VUDU, LLC | NBCUniversal Media LLC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 053609 | 0302 | |
Aug 20 2020 | VUDU, LLC | NBCUniversal Media LLC | CORRECTIVE ASSIGNMENT TO CORRECT THE COVERSHEET TO EXCLUDE APP NO 11368308, WHICH WAS INADVERTENTLY ADDED AT THE TIME OF RECORDING THE ASSIGNMENT PREVIOUSLY RECORDED AT REEL: 053609 FRAME: 0302 ASSIGNOR S HEREBY CONFIRMS THE ASSIGNMENT | 058756 | 0244 |
Date | Maintenance Fee Events |
Sep 20 2021 | M1552: Payment of Maintenance Fee, 8th Year, Large Entity. |
Date | Maintenance Schedule |
Apr 23 2022 | 4 years fee payment window open |
Oct 23 2022 | 6 months grace period start (w surcharge) |
Apr 23 2023 | patent expiry (for year 4) |
Apr 23 2025 | 2 years to revive unintentionally abandoned end. (for year 4) |
Apr 23 2026 | 8 years fee payment window open |
Oct 23 2026 | 6 months grace period start (w surcharge) |
Apr 23 2027 | patent expiry (for year 8) |
Apr 23 2029 | 2 years to revive unintentionally abandoned end. (for year 8) |
Apr 23 2030 | 12 years fee payment window open |
Oct 23 2030 | 6 months grace period start (w surcharge) |
Apr 23 2031 | patent expiry (for year 12) |
Apr 23 2033 | 2 years to revive unintentionally abandoned end. (for year 12) |