CA2454094A1 - Method for protecting a software using a so-called renaming principle against its unauthorised use - Google Patents

Abstract

The invention concerns a method for protecting, from a unit, a vulnerable software against unauthorised use, said vulnerable software operating on a data processing system. The inventive method consists in defining: a set of dependent functions whereof the dependent functions are executable in a unit; a set of triggering commands, said triggering commands capable of being executed in the data processing system and of triggering execution of the dependent functions in a unit; for each triggering command, an instruction; a method for renaming the instructions; and reinstating means for implementation in a unit during a use phase, and enabling to recover the dependent function to be executed, from the renamed instruction.

Description

METHOD FOR PROTECTING SOFTWARE USING A SAID PRINCIPLE
OF "RENAME" AGAINST ITS UNAUTHORIZED USE
The present invention relates to the technical field of treatment systems of data in the general sense and it targets, more specifically, the means for protect, against its unauthorized use, software running on said systems data processing.
The object of (invention relates, more particularly, to the means for protecting a software against unauthorized use, from a unit of treatment and storage, such a unit being commonly embodied by a card chip or by a hardware key on USB port.
In the technical area above, the main drawback concerns (unauthorized use of software by users who have not paid Rights license. This illegal use of software causes harm manifesto for software publishers, software distributors and / or anyone integrating such software in products. To avoid such illegal copies, he been proposed in (state of the art, various solutions for protecting software.
Thus, it is known a protection solution consisting in implementing a protective material system, such as a physical element called a key protection or "dongle" in Anglo-Saxon terminology. Such a protection key should guarantee the execution of the software only in the presence of the key. However, he must to be found that such a solution is ineffective because it has (disadvantage to be easily bypassable. A malicious person or pirate can, with (help specialized tools, such as disassemblers, remove instructions of protection key check. It then becomes possible to carry out copies illegal corresponding to modified versions of software no longer any protection. In addition, this solution cannot be generalized to all software since it is difficult to connect more than two keys protection on a same system.
The object of (invention aims precisely to remedy the drawbacks stated above above by proposing a method to protect software against its use no authorized, from an ad hoc processing and storage unit, in the

2 extent that the presence of such a unit is necessary for the software is fully functional.
To achieve such an objective, the object of the invention relates to a method for protect, from at least one blank unit comprising at least means of processing and storage means, software vulnerable to its unauthorized use, said vulnerable software running on a system of data processing. The method according to the invention consists -i in a protection phase ~ to be defined - a set of dependent functions including dependent functions are likely to be performed in a unit, - a set of triggering commands for this set of dependent functions, these triggering commands being likely to be executed in the data processing system and trigger (execution in a unit, dependent functions, - for each triggering command, a set point corresponding to the less in part to the information transmitted from the data processing to a unit, in order to trigger the execution of the corresponding dependent function in a unit, this setpoint in the form of at least one argument of the command triggering, - a method of renaming the instructions allowing renaming of the instructions in order to obtain triggering orders with instructions renamed, - and recovery means intended to be implemented in a unit during a phase of use, and allowing to find the dependent function to be executed, from the renamed setpoint, ~ to build operating resources to transform the unit virgin into a unit capable of implementing the means of recovery, ~ to create protected software

3 - by choosing, at least one algorithmic processing which, during (execution of vulnerable software, uses at least one operand and allows to obtain at least one result, by choosing at least a portion of the source of the vulnerable software containing at least one chosen algorithmic processing, - by producing the source of the protected software from the source of the vulnerable software, by modifying at least a selected portion of the vulnerable software source to get at least a portion modified from the source of the protected software, this modification being such than ~ during (execution of the protected software a first part execution is executed in the data processing system and a second execution part is executed in a unit, obtained from the blank unit after loading information, ~ the second part of execution performs at least the functionality at least one chosen algorithmic processing, ~ at least one chosen algorithmic processing is broken down by so that during (execution of the protected software, this processing algorithmic is executed, by means of the second part execution, using dependent functions, ~ for at least one chosen algorithmic processing, commands triggers with renowned instructions are integrated in the source of the protected software, so that when (execution of the protected software, each command triggers at setpoint rename is executed by the first execution party and triggers in (unity, recovery, by means of reestablishment, instruction and execution, by means of the second part of execution, of the dependent function correspondingly, ~ and a sequencing of triggering orders with instructions renames is chosen from (all the schedules allowing (execution of protected software, WO 03/01260

4 PCT / FR02 / 02340 - and by producing ~ a first object part of the protected software, from the source of the protected software, this first object part being such that during the execution of the protected software, appears a first part which is executed in the processing system of data and at least a portion of which takes into account that the trigger commands with renowned instructions are executed according to (scheduling chosen, ~ and a second object part of the protected software, containing the operating means, this second object part being such that, after loading in the blank unit and during (execution of the protected software, appears the second part of execution by means from which the instructions are restored and the functions dependent are executed, ~ and to load the second object part into the blank unit, in order to obtain (unit, - ~ and in a use phase during which the software protected:
~ in the presence of the unit and each time a command triggers at renowned instruction, contained in a portion of the first part of execution requires it, to restore in unity the identity of the function corresponding dependent and execute it, so that portion is executed correctly and therefore the protected software is fully functional, ~ and in the absence of (unit, despite the request for a portion of the first execution part of triggering (execution of a dependent function in the unit, not being able to respond correctly to this request, so that at least this portion is not performed correctly and that, by Consequently, the protected software is not fully functional.
According to an alternative embodiment, the method according to the invention consists ~ in the protection phase ~ to define for at least one dependent function, a family of functions algorithmically equivalent dependent, but triggered by triggering commands whose renamed instructions are different, ~ and modify the protected software - by choosing at least one source from the protected software

5 triggering command with renamed setpoint, - and by modifying at least a selected portion of the software source protected by replacing at least the renowned setpoint of a trigger command with renamed setpoint chosen, by another renamed setpoint, triggering a function dependent on the same family.
According to an alternative embodiment, the method according to the invention consists in the protection phase ~ to be defined - as a method of renaming instructions, a method of encryption to encrypt the instructions, - and as means of recovery, means implementing a decryption method to decrypt the instructions renamed and thus re-establish the identity of the functions dependent on run in (unit.
According to a preferred embodiment, the method according to the invention consists in the protection phase ~ to modify the protected software:
- by choosing at least one variable used in at least one chosen algorithmic processing, which during (software execution protected, partially defines the state of the protected software, - by modifying at least a selected portion of the software source protected, this modification being such that during (execution of the protected software, at least one variable chosen or at least one copy chosen variable resides in (unit, - and by producing ~ the first part object of the protected software, this first part

6 object being such that during (execution of protected software, at minus a portion of the first part of execution also takes into account account that at least one variable or at least one copy of variable resides in (unit, ~ and the second part, object of the protected software, this second part object being such that, after loading in (unit and during (execution of the protected software, appears the second part of execution by means of which at least one variable chosen, or at least one copy of the chosen variable also resides in (unit, and in the use phase ~ in the presence of (unit each time a portion of the first part of execution requires it, to use a variable or a copy of a variable residing in (unit, so this portion is executed correctly and that, therefore, the protected software is fully functional, ~ and in (absence of (unit, despite the request for a portion of the first execution part of using a variable or a copy of resident variable in the unit, not being able to respond correctly to this request, so that at least this portion is not performed correctly and that, by Consequently, the protected software is not fully functional.
According to another preferred embodiment, the method according to the invention is in the protection phase ~ to be defined - a set of elementary functions, subset of all dependent functions, - and a set of elementary commands for this set of functions elementary, this set of elementary commands being a sub-all of the triggering commands, ~ to build the operating resources allowing (unit, to also execute the elementary functions of said game, (execution of these functions elementary being triggered by execution in the processing system

7 data, elementary commands whose setpoint has been renamed, ~ and modify the protected software:
- by modifying at least a selected portion of the software source protected, this modification being such that the decomposition of at least an algorithmic processing chosen as dependent functions does not use that elementary functions, - by producing ~ the first part object of the protected software, this first part object being such that during (execution of protected software, at minus a portion of the first part of execution also performs elementary orders according to (scheduling chosen, ~ and the second object part of the protected software also containing the operating means, this second object part being such that, after loading in the unit and during (software execution protected, appears the second part of execution by means of which also perform the basic functions triggered by the first part of execution, and in the use phase in the presence of (unit and each time an elementary command contained in a portion of the first part of execution (requires, to execute the corresponding elementary function in (unit, so that this portion is executed correctly and therefore the software protected is fully functional, ~ and in (absence of (unit, despite the request for a portion of the first execution part, to trigger the execution of an elementary function in (unit, not being able to respond correctly to this request, from so that at least this portion is not executed correctly and that, by Consequently, the protected software is not fully functional.
According to another preferred embodiment, the method according to the invention is ~ in the protection phase to define

8 - at least one software execution characteristic, capable of being at least partially monitored in (unit, - at least one criterion to respect for at least one characteristic software execution, - detection means to be implemented in (unit and allowing detect that at least one software execution characteristic does not does not meet at least one associated criterion, - and means of coercion to be implemented in (unity and to inform the data processing system and / or modify the execution of a software, when at least one criterion is not met, ~ to build the operating resources allowing (unit, to also put using the detection means and the coercion means, and modify the protected software - by choosing at least one software execution characteristic to monitor, among the performance characteristics likely to be monitored, - by choosing at least one criterion to respect for at least one selected software execution characteristic, - by choosing in the source of the protected software, functions elementary for which at least one performance characteristic of software chosen, is to be monitored, - by modifying at least a selected portion of the software source protected, this modification being such that during (execution of the protected software, at least one selected execution characteristic is monitored by the second part of execution, and non-compliance of a criterion leads to information from the processing system data and / or a modification of the execution of the protected software, - and by producing the second object part of the protected software containing the operating means also using the means of detection and means of coercion, this second object part being

9 such that, after loading into the unit and during (execution of the protected software, at least one software execution characteristic is monitored and non-compliance with a criterion leads to information of the data processing system and / or a modification of the execution of the protected software, and in the use phase ~ in the presence of (unit - as long as all the criteria corresponding to all the characteristics monitored execution of all modified portions of the software protected are respected, to allow nominal operation of these portions of the protected software and therefore allow the nominal operation of protected software, - and if at least one of the criteria corresponding to a characteristic supervised execution of a portion of the protected software is not complied with, to inform the data processing system and / or to modify the operation of the protected software portion, so that the operation of the protected software is modified.
According to an alternative embodiment, the method according to the invention consists - ~ in the protection phase ~ to be defined - as a feature of software execution likely to be monitored, a variable measuring the use of a functionality software, - as a criterion to be respected, at least one threshold associated with each measurement variable, - and updating means making it possible to update at least one measurement variable, ~ to build the operating resources allowing the unit to also put implement the updating means, ~ and modify the protected software - by choosing as a software execution characteristic to monitor, at least one measurement variable of (use of a software functionality, - by choosing at least one feature of the protected software whose use S can be monitored using a measurement variable, at least one measurement variable used to quantify (use of said functionality, at least one threshold associated with a chosen measurement variable corresponding to a limit of use of said functionality,

10 ~ and at least one method for updating a measurement variable chosen according to (use of said functionality, - and by modifying at least a selected portion of the software source protected, this modification being such that, when (execution of the protected software, the measurement variable is updated using the second part of execution, depending on (use of said functionality and at least one threshold violation is taken into account, and in the use phase, in the presence of (unit, and in the event that it East detected at least one threshold crossing corresponding to at least one limit of use, to inform the data processing system and / or to edit the protected portion of the software, so that the operation of protected software is changed.
According to an alternative embodiment, the method according to the invention consists in the protection phase ~ to be defined - for at least one measurement variable, several associated thresholds, - and different means of coercion corresponding to each of these thresholds, ~ and modify the protected software - by choosing in the source of the protected software, at least one chosen measurement variable to which several must be associated thresholds corresponding to different limits of use of the feature

11 - by choosing at least two thresholds associated with the measurement variable selected, - and by modifying at least a selected portion of the software source protected, this modification being such that, when (execution of the protected software, the overruns of the various thresholds are taken into account account, by means of the second part of execution, so different, and in the use phase ~ in the presence of (unit - in the event that a first threshold is exceeded, at order the protected software to stop using the functionality correspondingly, - and in the event that a second threshold is exceeded, at render the corresponding functionality and / or at least one inoperative portion of the protected software.
According to an alternative embodiment, the method according to the invention consists in the protection phase ~ to define reloading means allowing to credit at least one additional use for at least one software feature monitored by a measurement variable, ~ to build the operating resources also allowing (unit to put using the reloading means, ~ and modify the protected software - by choosing in the source of the protected software, at least one chosen measurement variable to limit (use of a functionality to which at least one additional use must can be credited, - and by modifying at least one selected portion, this modification being such as in a so-called recharging phase, at least one use additional of at least one functionality corresponding to a selected measurement variable can be credited,

12 and in the recharging phase ~ to update at least one selected measurement variable and / or at least one associated threshold, so as to allow at least one use additional functionality.
According to an alternative embodiment, the method according to the invention consists in the protection phase ~ to be defined as a software performance feature that may be monitored, a software usage profile, - and as a criterion to be respected, at least one performance trait of software, ~ and modify the protected software - by choosing as a software execution characteristic to monitor at least one software usage profile, - by choosing at least one performance trait than at least one profile of use chosen must respect, - and by modifying at least a selected portion of the software source protected, this modification being such that, during the execution of the protected software, the second part of execution respects all the features of execution chosen, - ~ and in the use phase in the presence of (unit, and in the event that it East detected that at least one performance trait is not respected, to inform the data processing system and / or to modify the functioning of the portion of the protected software, so that the operation of the software protected is changed.
According to an alternative embodiment, the method according to the invention consists - ~ in the protection phase ~ to be defined - a set of instructions whose instructions are likely to be executed in (unit, - a set of instruction commands for this set of instructions, these

13 instruction commands being capable of being executed in the data processing and trigger system in (unit (execution of instructions, - as a usage profile, (sequence of instructions, - as an execution feature, a desired sequence for (execution of instructions, - as detection means, means making it possible to detect that (sequence of instructions does not correspond to that desired, - and as means of coercion, means making it possible to inform the data processing system and / or modify the operation of the portion of protected software when (sequence of instructions does not correspond to that desired, ~ to build the operating resources also allowing the unit to execute the instructions in the instruction set, the execution of these instructions being triggered by the execution in the data processing system of instruction commands, ~ and modify the protected software - by modifying at least a selected portion of the software source protected ~ by transforming elementary functions into instructions, ~ by specifying (sequence that must respect at least some of the instructions when executed in (unit, ~ and by transforming elementary commands into commands instructions corresponding to the instructions used, - ~ and in the use phase, in the presence of (unit, in the event that it is detected that (sequence of instructions executed in (unit does not correspond to that desired, to inform the data processing system and / or to modify the operation of the protected software portion, so that the operation of protected software is changed.
According to an alternative embodiment, the method according to the invention consists ~ in the protection phase ~ to be defined

14 - as a set of instructions, a set of instructions of which at least some instructions work on registers and use at least an operand to render a result, - for at least part of the instructions working on registers ~ a part of the functionality of (instruction, ~ and a part defining the desired sequence for (execution instructions and having corresponding bit fields at:
0 an identification field of (instruction, 0 and for each operand of (instruction a flag field, and a planned identification field of the operand, - for each register belonging to the operating resources and used by the instruction set, a generated identification field in which is automatically memorized (identification of the last instruction having returned its result in this register, - as detection means, means allowing, during the execution of an instruction, for each operand, when the field flag (requires, to control the equality between the identification field generated corresponding to the register used by this operand, and the field expected identification of the origin of this operand, - and as means of coercion, means making it possible to modify the result of the instructions, if at least one of the ties controlled is false.
According to another preferred embodiment, the method according to the invention is - ~ in the protection phase ~ to modify the protected software - by choosing in the source of the protected software, at least one conditional branching performed in at least one treatment chosen algorithmic, - by modifying at least a selected portion of the software source protected, this modification being such that during the execution of the protected software, the functionality of at least one connection conditional chosen, is executed, by means of the second part 5 of execution, in (unit, - and by producing ~ the first part object of the protected software, this first part object being such that during (execution of the protected software, the functionality of at least one conditional branch chosen is 10 executed in (unit, ~ and the second part, object of the protected software, this second part object being such that, after loading into the unit and when the execution of the protected software, appears the second part by means of which the functionality of at least one

15 conditional branch chosen is executed, and in the use phase in the presence of unity and whenever a portion of the first part of execution (requires, to execute the functionality of at least one conditional branch in (unit, so this portion is executed correctly and therefore the protected software is fully functional, ~ and in (absence of (unit and despite the request for a portion of the first execution part to execute the functionality of a branch conditional in (unit, not being able to respond correctly to this request, so that at least this portion is not executed properly and therefore the protected software is not fully functional.
According to an alternative embodiment, the method according to the invention consists, in the protection phase, to modify the protected software - by choosing, in the source of the protected software at least a series of selected conditional branches, - by modifying at least a selected portion of the software source

16 protected, this modification being such that during the execution of the protected software, the overall functionality of at least one chosen series of conditional branches is executed by means of the second execution part, in (unit, - and by producing ~ the first part object of the protected software, this first part object being such that during (execution of the protected software, the functionality of at least one selected series of connections conditional is executed in (unit, ~ and the second part, object of the protected software, this second part object being such that, after loading into the unit and when (execution of the protected software, appears the second part by which the overall functionality of the minus a selected set of conditional branches is executed.
The method according to (the invention thus makes it possible to protect (use of a software by the implementation of a processing and storage unit which presents the peculiarity of containing a part of the running software. he it follows that any version derived from the software attempting to operate without the unit of treatment and memorization requires recreating the part of the software contained in the unit of processing and storage during (execution, under penalty that this version derived from the software is not fully functional.
Various other characteristics will emerge from the description given below in reference to the accompanying drawings which show, by way of non-limiting examples, of the embodiments and implementation of the object of (invention.
Figs. 10 and 11 are functional block diagrams illustrating the various representations of software that is respectively unprotected and protected by the process in accordance with (invention.
Figs. 20 to 22 illustrate, by way of examples, various embodiments a device for implementing the method in accordance with (invention.
Figs. 30 and 31 are functional block diagrams explaining the principle general of the process according to (invention.

17 Figs. 40 to 43 are diagrams illustrating the protection method according to (invention implementing the principle of protection by variable.
Figs. 60 to 64 are diagrams illustrating the protection method according to (invention implementing the principle of protection by functions elementary.
Figs. 70 to 74 are diagrams illustrating the protection method according to (invention implementing the principle of protection by detection and coercion.
Figs. 80 to 85 are diagrams illustrating the protection process according to (invention implementing the principle of protection by renaming.
Figs. 90 to 92 are diagrams illustrating the protection method according to (invention implementing the principle of protection by connection conditional.
Fig. 100 is a diagram illustrating the different phases of implementation of (object of the invention.
Fig. 110 illustrates an embodiment of a system allowing the setting in work of the construction stage of the protection phase in accordance with (invention.
Fig. 120 illustrates an exemplary embodiment of a pre-personalization used in the protection method according to the invention.
Fig. 130 illustrates an embodiment of a system allowing the setting in work from the tool-making stage of the protection phase in accordance with the invention.
Fig. 140 illustrates an embodiment of a system allowing the setting in protection process according to (invention.
Fig. 150 illustrates an exemplary embodiment of a personalization unit used in the protection method according to (invention.
In the following description, the following definitions will be used ~ A data processing system 3 is a system capable of executing a program.
~ A processing and storage unit is a unit capable - accept data provided by a processing system data 3, - to restore data to the data processing system 3, - to store data at least in part secretly and to keep at least some of these even when (unit is

18 off, - and to perform algorithmic processing on data, part or all of this processing is secret.
~ A unit 6 is a processing and storage unit putting in implements the method according to (invention.
~ A blank unit 60 is a unit which does not implement the method according to (invention, but who can receive information transforming it into a unit 6.
~ A pre-personalized unit 66 is a blank unit 60 having received a part of the information allowing it, after receiving information to be transformed into a unit 6.
~ Loading information into a blank 60 unit or a pre-custom 66 corresponds to a transfer of information in (unit blank 60 or (pre-personalized unit 66, and to storage of said information transferred. Optionally, the transfer may include a information format change.
~ A variable, a data or a function contained in the system of data processing 3 will be indicated by a capital letter, while a variable, data or function contained in (unit 6 will be indicated by a lowercase.
~ "Protected software" is software that has been protected by at least one protection principle implemented by the process according to (invention.
~ "Vulnerable software" is software that has not been protected by any protection principle implemented by the process according to (invention.
~ In case the differentiation between a vulnerable software and a software protected does not matter, the term "software" is used.
~ A software comes in various representations depending on (instant considered in its life cycle - a source representation, - an object representation, - a distribution,

19 - or a dynamic representation.
~ A source representation of software is understood as a representation which after transformation, gives an object representation.
A source representation can be presented at different levels, from abstract conceptual level at a level executable directly by a data processing system or a processing unit and storage.
~ An object representation of software corresponds to a level of representation which after transfer to a distribution then loading in a data processing system or a processing unit and memorization, can be executed. This could be, for example, a code binary, interpreted code, etc.
~ A distribution is a physical or virtual medium containing the object representation, this distribution must be made available to the user to allow him to use the software.
~ A dynamic representation corresponds to (execution of the software from of its distribution.
~ A portion of software corresponds to any part of software and can, for example, correspond to one or more instructions consecutive or not, and / or one or more consecutive functional blocks or not, and / or one or more functions, and / or one or more sub programs, and / or one or more modules. A portion of software can also match all of this software.
Figs. 10 and 11 illustrate the various representations respectively of a vulnerable software 2v in the general sense, and protected software 2p according to the process in accordance with (invention.
Fig. 10 illustrates various representations of vulnerable 2v software appearing during its life cycle. Vulnerable 2v software can so appear under fades of the following representations ~ a 2vs source representation, ~ a 2vo object representation, ~ 2vd distribution. This distribution can occur commonly in the form of a physical distribution medium such as a CDROM or in the form of files distributed across a network (GSM, Internet, ...), ~ or a dynamic representation 2ve corresponding to (execution of the 5 vulnerable software 2v on a data processing system 3 of all known types, which conventionally comprises at least one processor 4.
Fig. 11 illustrates various representations of 2p protected software appearing during its life cycle. Protected 2p software can appear under Tune 10 of the following performances ~ a 2ps source representation comprising a first source part for the data processing system 3 and a second source part intended for (unit 6, part of these source parts commonly being be contained in common files, 15 ~ a 2in object representation comprising a first part 2pos object intended for the data processing system 3 and a second object part 2 for (unit 6, ~ a 2pd distribution comprising - a first part of 2pds distribution containing the first part

20 object 2pos, this first part of distribution 2pds being intended for data processing system 3 and which may arise commonly in the form of a physical distribution medium such than a CDROM, or in the form of files distributed through a network (GSM, Internet, ...), - and a second 2pdu distribution part in the form ~ at least one pre-personalized unit 66 on which part of the second part object 2pou has been loaded and for which (user must complete the personalization by loading additional information, in order to obtain a unit 6, these additional information being obtained, for example, by upload or download over a network,

21 or at least one unit 6 on which the second object part 2pou has been charged, ~ or a dynamic 2pe representation corresponding to (execution of protected software 2p. This dynamic 2pe representation includes a first part of execution 2pes which is executed in the system of data processing 3 and a second execution part 2 little which is performed in unit 6.
If the differentiation between the different representations of the software protected 2p does not matter, the expressions first part of the software protected and second part of the protected software are used.
The implementation of the method according to (invention in accordance with the dynamic representation of fig. 11, uses a 1p device comprising a data processing system 3 connected by a link 5 to a unit 6. The system of data processing 3 is of all types and comprises, so classic, at least a processor 4. The data processing system 3 can be a computer where do part, for example, of various machines, devices, stationary products or mobile, or vehicles in the general sense. Connection 5 can be carried out anyway possible such that for example by a serial line, a USB bus, a radio link, a optical link, a network link or a direct electrical connection on a circuit of the system of data processing 3, etc. It should be noted that (unit 6 can possibly be located physically at (inside the same integrated circuit as processor 4 of system of data processing 3. In this case, (unit 6 can be considered as a co-processor versus processor 4 of the data processing system 3 and the link 5 is internal to the integrated circuit.
Figs. 20 to 22 show by way of illustration and without implied limitation, various embodiments of the device 1p allowing the implementation of the method of protection according to (invention.
In (exemplary embodiment illustrated in FIG. 20, the device for protection 1p comprises, as data processing system 3, a computer and, in so unit 6, a smart card 7 and its interface 8 commonly called a reader of menu. Computer 3 is connected to (unit 6 by a link 5. When (execution of a protected software 2p, the first part of 2pes execution which is executed in

22 (computer 3 and the second execution part 2 which is executed in the card to chip 7 and its interface 8, must both be functional in order to that the 2p protected software is fully functional.
In (exemplary embodiment illustrated in FIG. 21, the device for protection 1p equips a product 9 in the general sense, comprising various organs 10 adapted to the where the functions assumed by such a product 9. The 1p protection device includes, on the one hand, a data processing system 3 embedded in the product 9 and, on the other hand, a unit 6 associated with the product 9. So that the product 9 is entirely functional, protected 2p software must be fully functional. So, during (execution of 2p protected software, the first part of 2pes execution which is executed in data processing system 3 and the second part execution 2 few that are performed in (unit 6, both must be functional. This 2p protected software therefore indirectly protects against unauthorized use, product 9 or any of its functionality. Through example the product 9 can be an installation, a system, a machine, a toy, a apparatus appliances, telephone, etc.
In (exemplary embodiment illustrated in FIG. 22, the device for protection 1p includes multiple computers, as well as part of a network of communication. The data processing system 3 is a first computer connected by a link 5 network type, to a unit 6 consisting of a second computer. For the setting work of (invention, the second computer 6 is used as a server of licenses for protected software 2p. When (running protected software 2p, the first part of execution 2pes which is executed in the first computer 3 and the second part of execution 2peu which is executed in the second computer both must be functional so that 2p protected software is fully functional.
Fig. 30 makes it possible to explain more precisely, the method of protection in accordance with the invention. It should be noted that vulnerable software 2v is considered as being executed completely in a data processing system 3. By against, in the case of the implementation of a protected software 2p, the system of data processing 3 includes transfer means 12 connected by the link 5, to transfer means 13 forming part of (unit 6 making it possible to make

23 communicate with each other, the first part of 2pes execution and the second part 2peu execution of protected software 2p.
It must be considered that the transfer means 12, 13 are of a nature software and / or material and are capable of ensuring and possibly optimizing the data communication between the data processing system 3 and (unit 6.
These transfer means 12, 13 are adapted to allow a software protected 2p which is preferably independent of the type of link 5 used. These transfer means 12, 13 are not part of (object of (invention and do not are not described more precisely because they are well known to those skilled in the art. The first part of the 2p protected software includes commands. When (execution of protected software 2p, (execution of these commands by the first party execution 2pes allows communication between the first 2pes execution part and the second part of execution 2peu. In the following description, these orders are represented by IN, OUT or TRIG.
As illustrated in fig. 31, to allow the implementation of the second part of execution 2peu of the protected software 2p, (unit 6 comprises means of protection 14. The protection means 14 include storage means 15 and of the means of treatment 16.
For the sake of simplification in the following description, it is chosen to consider, when (running 2p protected software, the presence of (unit 6 or (absence of unit 6. In reality, unit 6 presenting means of protection 14 unsuitable for (execution of the second part of execution 2peu of the software protected 2p is also considered absent, whenever (software execution protected 2p is not correct. In other words ~ a unit 6 physically present and comprising means for protection 14 adapted to (execution of the second execution part 2 little protected software 2p, is always considered as present, ~ a unit 6 physically present but comprising means for protection 14 unsuitable, that is to say not allowing the implementation correct of the second part of execution 2peu of the protected software 2p is considered to be present, when functioning properly, and as absent when it is not functioning properly,

24 ~ and a unit 6 physically absent is still considered to be absent.
In the case where (unit 6 is constituted by a smart card 7 and its interface the transfer means 13 are broken down into two parts, one of which is sure (interface 8 and the other of which is on the smart card 7. In this example of realization, (absence of the smart card 7 is considered equivalent to (absence of (unit 6. In other words, in (absence of the smart card 7 and / or its interface 8, the protection means 14 are not accessible and do not allow therefore not (execution of the second execution part 2 bit of the protected software, of so the 2p protected software is not fully functional.
In accordance with the invention, the protection method aims to implement a protection principle, said by "renaming" of which a description is made in relation of fig. 80 to 85.
For the implementation of the principle of protection by renaming, it is defined ~ a set of dependent functions, whose dependent functions are likely to be executed, by means of the second part of execution 2 little, in (unit 6, and possibly to transfer data between the data processing system 3 and (unit 6, this set of functions dependent that can be finite or infinite, ~ a set of triggering commands for these dependent functions, these triggering commands being capable of being executed in the data processing system 3 and trigger in (unit 6, the execution of corresponding dependent functions, ~ for each triggering command, a set point corresponding to less in part to (information transmitted by the first executing party 2pes, at the second part of execution 2peu, in order to trigger (execution of the corresponding dependent function, this setpoint is presented under the form of at least one argument of the triggering command, ~ a method of renaming the instructions intended to be implemented when modifying the vulnerable software, such a method allowing to rename the instructions in order to obtain triggering commands at renowned instructions to conceal the identity of functions corresponding dependents, ~ and recovery means 20 intended to be implemented in (unit 6 during the use phase and allowing to find the setpoint initial, from the renamed setpoint, in order to find the function 5 dependent to execute.
For the implementation of the principle of protection by renaming, it is also builds operating resources to transform a virgin unit 60 in a unit 6 using at least the recovery means 20.
For the implementation of the principle of protection by renaming, it is also 10 chosen, in the source of the vulnerable software 2vs ~ at least one algorithmic processing using at least one operand and rendering at least one result, ~ and at least a portion of the source of the vulnerable software 2vs, containing at minus an algorithmic treatment chosen.
15 The source of the vulnerable 2vs software is then modified, so as to get the source of 2ps protected software. This modification is such that in particular ~ when running 2p protected software, at least a portion of the first part of execution 2pes, which is executed in the system of data processing 3, takes into account that the functionality of at least 20 a chosen algorithmic processing is executed in unit 6, ~ during (execution of the protected software Zp, the second part of execution 2peu, which is executed in unit 6, performs at least the functionality at least one chosen algorithmic processing, each algorithmic processing chosen is broken down so that during

25 of the execution of the protected software 2p, each algorithmic processing chosen is executed, by means of the second execution part 2peu, in using dependent functions. Preferably, each treatment algorithm chosen is decomposed into dependent functions fd "(with n varying from 1 to N), i.e.
- possibly one or more dependent functions allowing the provision of one or more operands for unit 6,

26 - dependent functions, some of which use the operand (s) and which in combination execute the functionality of the processing chosen algorithm, using this or these operands, - and possibly one or more dependent functions allowing the made available by (unit 6, for the treatment system of data 3 of the result of the chosen algorithmic processing, ~ during (execution of 2p protected software, the second part of execution 2peu performs fd dependent functions ", ~ when (running 2p protected software, dependent functions are triggered by triggering commands with renowned instructions, ~ and a sequencing of triggering commands is chosen from all the schedules allowing the execution of the protected software 2p.
The first part of 2pes execution of the protected 2p software, executed in the data processing system 3, executes triggering commands at renamed instructions transferring to (unit 6 renamed instructions, and triggering in (unit 6 recovery by means of recovery 20, instructions, then (execution by means of the second part of execution 2peu, of each of the previously defined dependent functions fd ".
In other words, the principle of protection by renaming consists in rename the instructions of the triggering commands, so as to obtain trigger commands with renowned instructions whose execution in the system data processing 3, triggers in (unit 6, (execution of functions dependent that would have been triggered by the triggering commands at instructions not renamed, without however that (examination of the protected 2p software does not allows to determine (identity of the dependent functions executed.
Fig. 80 illustrates an example of execution of vulnerable 2v software. In this example, it appears during (execution of vulnerable software 2v in the system data processing 3, at a given time, the calculation of Z E- F (X, Y) corresponding to the assignment to a variable Z of the result of a treatment algorithm represented by a function F and using the operands X and Y.

27 Figs. 81 and 82 illustrate an example of implementation of (invention.
Fig. 81 illustrates the partial implementation of the (invention. In this example, during (execution in the data processing system 3 of the first part 2pes execution of protected software 2p and in the presence of (unit 6, it appears ~ at times t1, t2, (execution of triggering commands CDI, CD2 triggering in (unit 6, (execution by means of the second part of execution 2peu, corresponding dependent functions fdl, fd2 which ensure the transfer of X, Y data from the processing system data 3 to memory areas respectively x, y located in the storage means 15 of (unit 6, these triggering commands CDI, CD2 being represented respectively by OUT (x, X), OUT (y, Y), ~ at times t3 to tN_l, (execution of triggering commands CD3 to CDN_l, triggering in (unit 6, (execution by means of the second execution part 2peu, dependent functions fd3 to fdN_1 corresponding, these triggering commands CD3 to CDN_1 being represented, respectively, by TRIG (fd3) to TRIG (fdN_1). The continuation of dependent functions fd3 to fdN_1 executed in combination is algorithmically equivalent to function F. More precisely, (execution of these triggering commands leads to (execution in (unit 6, dependent functions fd3 to fdN_1 which use the content storage areas x, y and render the result in an area of memorization z of (unit 6, ~ and at (instant tN, (execution of a triggering CDN triggering command in unit 6, (execution by means of the second execution part 2peu, of the fdN dependent function ensuring the transfer of the treatment result algorithm contained in the storage area z of (unit 6 towards the data processing system 3, in order to assign it to variable Z, this command being represented by IN (z).
In this example, to fully implement (invention, it is chosen as a setpoint, the first argument of the trigger commands OUT and (argument of the triggering commands TRIG and IN. The instructions thus chosen 2 ~
are renamed by the renaming method. In this way, the instructions for triggering commands CDl to CDN, namely x, y, fd3, fdN_l, z are renamed so as to obtain respectively R (x), R (y), R (fd3) ..., R (fdN_1), R (z).
Fig. 82 illustrates the full implementation of the (invention. In this example, during (execution in the data processing system 3, from the first part 2pes execution of protected software 2p, and in the presence of (unit 6, it appears at times t1, t2, (execution of triggering commands with instructions renamed CDCRI, CDCR2, transferring to (unit 6, the instructions renamed R (x), R (y) as well as the data X, Y triggering in (unit 6 recovery by means of recovery means 20, renamed instructions to restore the instructions, namely (identity of storage areas x, y, then (execution by means of the second part of execution 2peu, corresponding dependent functions fdl, fd2 which ensure the transfer of X, Y data from the processing system data 3 to the storage areas respectively x, y located in the memorization means 15 of (unit 6, these triggering commands with renamed instructions CDCRI, CDCR2 being represented respectively by OUT (R (x), X), OUT (R (y), Y), ~ at times t3 to tN_l, (execution of triggering commands with instructions renamed CDCR3 to CDCRN_i, transferring to (unit 6, the instructions renamed R (fd3) to R (fdN_1), triggering in (unit 6 recovery by means of the recovery means 20, instructions, namely fd3 to fdN_l, then (execution by means of the second part of execution 2peu, of dependent functions fd3 to fdN_i, these commands triggering at renamed instructions CDCR3 to CDCRN_1 being represented respectively by TRIG (R (fd3)) to TRIG (R (fdN_1)), and at (instant tN, the execution of the command triggering at setpoint renamed CDCRN transferring to (unit 6, the renamed setpoint R (z) triggering in (unit 6 recovery by means of re-establishment 20, of the set point namely (identity of the storage z, then (execution by means of the second execution part Zpeu, of the dependent function fdN ensuring the transfer of the result of algorithmic processing contained in the storage area z of the unit 6 to the data processing system 3, in order to assign it to the variable Z, this command triggers with a renamed setpoint CDCRN being represented by IN (R (z)).
In (example illustrated, the triggering commands with renamed instructions 1 to N are executed successively. It should be noted that two improvements can to be made ~ The first improvement concerns the case where several treatments algorithms are deported to unit 6 and at least the result of a algorithmic processing is used by another algorithmic processing.
In this case, certain triggering commands with renowned instructions used for transfer, can be optionally deleted.
~ The second improvement aims to opt for a relevant scheduling Triggering commands with renowned instructions among all orders allowing (execution of the protected software 2p. To this regard, it is best to choose an order scheduling triggering with renowned instructions which temporally dissociates (execution of dependent functions, by inserting, between them, portions of code executed in the data processing system 3 and with or without triggering commands with renowned instructions used for the determination of other data. Figs. 83 and 84 illustrate the principle of such an achievement.
Fig. 83 shows an example of running vulnerable 2v software. In this example, it appears, during (execution of vulnerable software 2v, in the data processing system 3, the execution of two processing algorithmic leading to the determination of Z and Z ', such that Z f- F (X, Y) and Z' ~ F ' (X ', Y ').
Fig. 84 illustrates an example of implementation of the method according to (invention for which the two algorithmic treatments chosen in fig. 83 are deported in (unit 6. According to such an example, during (execution in the treatment 3 of the first 2pes execution part of the protected software 2p and in presence of unit 6, it appears, as explained above, (execution of trigger commands with renamed instructions CDCRI to corresponding CDCRN
to the determination of Z and (execution of triggering commands with instructions renamed CDCR'1 to CDCR'M corresponding to the determination of Z '. As 5 illustrated, the triggering commands with renamed setpoints CDCRI to CDCRN do not are not executed consecutively, as long as the commands triggers with renowned instructions CDCR'1 to CDCR'M as well as others portions of code are interspersed. In the example, it is thus carried out (following scheduling: CDCRI, portion of intercalated code, CDCR'1, CDCR2, 10 portion of interleaved code, CDCR'2, CDCR'3, portion of interleaved code, CDCR'4, CDCR3, CDCR4, ..., CDCRN, CDCR'M.
It should be noted that, during (execution of a portion of the first part 2pes execution of the protected 2p software, the commands triggering at instructions names executed in data processing system 3, trigger in 15 (unit 6 restoring the identity of dependent functions corresponding then the execution of these. Thus, it appears that in the presence of (unit 6, this portion is executed correctly and therefore the protected software 2p is fully functional.
Fig. 85 illustrates an example of attempted protected software execution 2p 20 while (unit 6 is absent. In this example, when (execution in the system data processing 3 of the first part 2pes execution of the software protected 2p, at all times, (execution of a triggering command with setpoint rename cannot trigger the setpoint restoration nor the execution of the corresponding dependent function, due to (absence of (unit 6. The value 25 to be assigned to variable Z cannot therefore be determined correctly.
It therefore appears that in the absence of (unit 6, at least one request from a portion of the first 2pes execution part of the protected 2p software, to trigger re-establishment of a setpoint and (execution of a dependent function in (unit 6 cannot be satisfied properly, so at least this portion is not 30 executed correctly and therefore the 2p protected software is not not fully functional.
Thanks to this principle of protection by renaming, (examination in the software protected 2p from triggered commands with renowned instructions does not allow determine (identity of dependent functions to be performed in (unit 6.
It should be noted that the renaming of the instructions is carried out during the modification of vulnerable software 2v into protected software 2p.
According to a variant of the principle of protection by renaming, it is defined for at least one dependent function, a family of dependent functions algorithmically equivalent but triggered by commands triggering with different renowned instructions. According to this variant, for at least one treatment algorithmic using dependent functions, this algorithmic processing East broken down into dependent functions which for at least fade out of them is replaced by a function dependent on the same family instead of keeping multiple occurrences of the same dependent function. To this end, orders triggers with renamed instructions are modified to take into account the replacement of dependent functions with dependent functions of the same family. In other words, two dependent functions of the same family have of the different instructions and therefore triggering commands at instructions different renames and, it is not possible, to (examination of the protected software 2p, from detect that the dependent functions called are algorithmically equivalent.
According to a first preferred embodiment of the variant of the principle of protection by renaming, it is defined for at least one dependent function, one family of algorithmically equivalent dependent functions, by concatenating a field of noise at (information defining the functional part of the function dependent on run in (unit 6.
According to a second preferred embodiment of the variant of the principle of protection by renaming, it is defined for at least one dependent function, one family of algorithmically equivalent dependent functions using fields Identification.
According to a preferred embodiment of the principle of protection by renaming, it is defined as a method of renaming instructions a method encryption to encrypt the instructions to transform them into instructions renamed. It is recalled that the renaming of the instructions is carried out in the phase protection P. For this preferred variant, the recovery means 20 are means implementing a decryption method making it possible to decipher the famous instructions and thus restore (identity of functions dependent to be executed in (unit 6. These means of recovery are put in works in (unit 6 and can be software or hardware in nature.
means 20 are requested in the use phase U each time once a trigger command with renamed setpoint is executed in the data processing 3 in order to trigger in (unit 6, (execution a dependent function.
According to another advantageous characteristic of the invention, the method of protection aims to implement a protection principle known as "variable" of which a description is made in relation to FIGS. 40 to 43.
For the implementation of the principle of protection by variable, it is chosen in the source of the vulnerable software 2vs at least one variable which during (execution of vulnerable software 2v, partially defines (state of it. By state of a software it must be understood (all the information, at a given time, necessary at (complete execution of this software, so that (absence of such a variable selected harms (complete execution of this software. At least one is also chosen portion of source of vulnerable 2vs software containing at least one chosen variable.
At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the protected 2ps software. This change is such that when (running 2p protected software, at least a portion of the first part of execution 2pes which is executed in the system of Treatment of data 3, takes into account that at least one chosen variable or at least one copy chosen variable resides in (unit 6.
Fig. 40 illustrates an example of execution of a vulnerable software 2v. In this example it appears during the execution of the vulnerable 2v software in the system data processing 3 ~ at (instant t1, (assignment of the data X to the variable Vl, represented by Vl ~ X, ~ at (time t ~, the assignment of the value of the variable Vl to the variable Y, represented by Y E- Vl, ~ and at (time t3, the assignment of the value of the variable V1 to the variable Z
represented by Z ~ Vl.
Fig. 41 illustrates an example of a first form of implementation of the invention for which the variable resides in (unit 6. In this example, during (execution in the data processing system 3 of the first part 2pes execution of protected software 2p, and in the presence of (unit 6, it appears ~ at (instant t1, (execution of a transfer command triggering the transfer of data X from the data processing system 3 to the variable v1 located in the storage means 15 of (unit 6, this transfer command being represented by OUT (vl, X) and corresponding in the end to the assignment of the data X to the variable vi, ~ at (instant ta, the execution of a transfer command triggering the transfer of the value of variable v1 residing in (unit 6 to the system of data processing 3 in order to assign it to the variable Y, this transfer command being represented by IN (vl) and corresponding to the final to the assignment of the value of variable v1 to variable Y, ~ and at (instant t3, (execution of a transfer command triggering the transfer of the value of the variable y residing in unit 6 to the system of data processing 3 in order to assign it to variable Z, this transfer command being represented by IN (vl) and corresponding to the final to (assignment of the value of variable v1 to variable Z.
It should be noted that when running 2p protected software, at least one variable resides in (unit 6. So when a portion of the first part 2pes execution of protected software 2p (requires, and in the presence of (unit 6, the value of this variable residing in (unit 6 is transferred to the Treatment of data 3 to be used by the first 2pes execution part of the software protected 2p, so that this portion is executed correctly and that by Consequently, the 2p protected software is fully functional.
Fig. 42 illustrates an example of a second form of implementation of (invention for which a copy of the variable resides in (unit 6. In this example, during (execution in the data processing system 3 of the first part of 2pes execution of the protected 2p software, and in the presence of (unit 6, it appears ~ at (instant t1, (assignment of the data X to the variable Vl located in the data processing system 3, as well as (execution of an order of transfer triggering the transfer of data X from the system of data processing 3 to variable v1 located in the means of storage 15 of (unit 6, this transfer command being represented by OUT (vl, 'X), ~ at (instant t2, the assignment of the value of the variable Vl to the variable Y, ~ and at (instant t3, (execution of a transfer command triggering the transfer of the value of variable v1 residing in (unit 6 to the system data 3 in order to assign it to variable Z, this transfer command being represented by IN (vl).
It should be noted that when running 2p protected software, at least one copy of a variable resides in (unit 6. So when a portion of the first part 2pes execution of protected software 2p (requires, and in the presence of (unit 6, the value of this copy of variable residing in (unit 6 is transferred to the system of data processing 3 to be used by the first execution party 2pes du 2p protected software, so this portion is executed correctly and by Consequently, the 2p protected software is fully functional.
Fig. 43 illustrates an example of an attempted execution of the protected software 2p while (unit 6 is absent. In this example, when running in the system data processing 3 of the first part 2pes execution of the software protected 2p ~ at (time t1, (execution of the transfer command OUT (vl, X) cannot not trigger the transfer of data X to variable v1, taking into account the absence of (unit 6, ~ at (instant t2, (execution of the transfer command IN (vl) cannot trigger the transfer of the value of the variable v1 to the system of data processing 3, taking into account (absence of (unit 6, ~ and at (instant t3, (execution of the transfer command IN (vl) cannot trigger the transfer of the value of the variable v1 to the system of data processing 3, taking into account (absence of (unit 6.
It therefore appears that in the absence of (unit 6, at least one request from a portion of the first part of 2pes execution to use a variable or a copy of 5 variable residing in (unit 6, cannot be satisfied correctly, so that at least this portion is not performed correctly and that, by therefore, the 2p protected software is not fully functional.
It should be noted that the data transfers between the processing system data 3 and unit 6 illustrated in the above examples do not use only 10 simple assignments, but one skilled in the art will combine them with other operations to lead to complex operations such as for example OUT (vl, 2 * X + 3) or Z ~ (5 * v1 + v2).
According to another advantageous characteristic of the invention, the method of protection aims to implement a principle of protection, said by "functions 15 elementary ", a description of which is given in relation to FIGS. 60 to 64.
For the implementation of the principle of protection by elementary functions, he is defined ~ a set of elementary functions whose elementary functions are likely to be executed, by means of the second part of execution 20 2 little, in (unit 6, and possibly to transfer data between the data processing system 3 and (unit 6, ~ and a set of elementary commands for this set of elementary functions, these elementary commands being capable of being executed in the data processing system 3 and trigger (execution in (unit 25 6, corresponding elementary functions.
For the implementation of the principle of protection by elementary functions, he is also built operating resources to transform a unit virgin 60 into a unit 6 capable of performing basic functions, (execution of these elementary functions being triggered by (execution in the system of 30 processing of data 3, of elementary commands.
For the implementation of the principle of protection by elementary functions, he is also chosen, in the source of the vulnerable 2vs software, at least one treatment algorithmic using at least one operand and rendering at least one result.
It is also choose at least a portion of the source of the vulnerable 2vs software containing at minus an algorithmic treatment chosen.
At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software. This change is such that in particular ~ when (running 2p protected software, at least a portion of the first part of execution 2pes, which is executed in the system of data processing 3, takes into account that the functionality of at least a chosen algorithmic processing is executed in unit 6, ~ during (execution of 2p protected software, the second part of execution 2 little, which is executed in (unit 6, performs at least the functionality at least one chosen algorithmic processing, each algorithmic processing chosen is broken down so that during the execution of the protected 2p software, each algorithmic processing chosen is executed, by means of the second execution part 2peu, in using basic functions. Preferably, each treatment chosen algorithmic is broken down into elementary functions fe "(with n varying from 1 to N), i.e.
- possibly one or more elementary functions allowing the provision of one or more operands for (unit 6, - elementary functions, some of which use the operand (s) and which in combination execute the functionality of the processing chosen algorithm, using this or these operands, - and possibly one or more elementary functions allowing the provision by (unit 6, for the treatment system of data 3 of the result of the chosen algorithmic processing, ~ and a scheduling of elementary commands is chosen from all the schedules allowing the execution of the protected software 2p.
The first part of 2pes execution of the protected 2p software, which is executed in the data processing system 3, executes elementary commands CFE "(with n varying from 1 to 1 ~, triggering in (unit 6, (execution by means of the second part of execution 2peu, of each of the elementary functions fe "
previously defined.
Fig. 60 illustrates an example of execution of vulnerable 2v software. In this example, it appears, during (execution of vulnerable software 2v in the data processing system 3, at a given instant, the calculation of Z E- F (X, Y) corresponding to the assignment to a variable Z of the result of a treatment algorithm represented by a function F and using operands X and Y.
Fig. 61 illustrates an example of implementation of (invention for which the algorithmic processing chosen in fig. 60 is deported to (unit 6. In this example, during (execution in the data processing system 3 of the first part of 2pes execution of the protected 2p software and in the presence of unit 6 it appears ~ at times t1, t2, (execution of elementary commands CFEI, CFEz triggering in (unit 6, execution by means of the second part of execution 2peu, corresponding elementary functions fel, fe2 which ensure the transfer of X, Y data from the processing system data 3 to memory areas respectively x, y located in the storage means 15 of the unit 6, these elementary commands CFEI, CFE2 being represented respectively by OUT (x, X), OUT (y, Y), ~ at times t3 to tN_l, (execution of elementary commands CFE3 to CFEN_l, triggering in (unit 6, execution by means of the second part of execution 2peu, elementary functions fe3 to feN_1 corresponding, these elementary commands CFE3 to CFEN_1 being represented, respectively, by TRIG (fe3) to TRIG (feN_i). The continuation of elementary functions fe3 to feN_1 executed in combination is algorithmically equivalent to function F. More precisely, (execution of these elementary commands leads to (execution in (unit 6, elementary functions fe3 to feN_1 which use the content of storage areas x, y and render the result in an area of memorization z of (unit 6, ~ and at (instant tN, (execution of an elementary CFEN command triggering in (unit 6, (execution by means of the second execution part 2peu, of the elementary function feN ensuring the transfer of the result of the treatment algorithmic, contained in the storage area z of (unit 6 towards the data processing system 3, in order to assign it to variable Z, this CFEN elementary command being represented by IN (z).
In (illustrated example, elementary commands 1 to N are executed successively. It should be noted that two improvements can be made ~ The first improvement concerns the case where several treatments algorithms are deported to (unit 6 and at least the result of a algorithmic processing is used by another algorithmic processing.
In this case, some elementary commands used for the transfer, can be optionally deleted.
1 S ~ The second improvement aims to opt for a relevant scheduling elementary commands among (all the schedules allowing (execution of protected software 2p. In this regard, it is preferable to choose a scheduling of elementary commands which dissociates temporally (execution of elementary functions, by intercalating, between these portions of code executed in the processing system data 3 and with or without elementary commands used for the determination of other data. Figs. 62 and 63 illustrate the principle of a such an achievement.
Fig. 62 shows an example of execution of vulnerable 2v software. In this example, it appears during (execution of vulnerable software 2v, in the data processing system 3, the execution of two treatments algorithmic leading to the determination of Z and Z ', such as Z f- F (X, Y) and Z' ~ F '(X', Y ').
Fig. 63 illustrates an example of implementation of the method according to (invention for which the two algorithmic treatments chosen in fig. 62 are deported in (unit 6. According to such an example, during (execution in the treatment 3 of the first 2pes execution part of the protected software 2p and in presence of (unit 6, it appears, as explained above, (execution of elementary commands CFE1 to CFEN corresponding to the determination of Z and the execution of elementary commands CFE'1 to CFE ~ M corresponding to the determination of Z '. As illustrated, the elementary commands CFEI to CFEN do not are not executed consecutively, as long as the commands elementary CFE'1 to CFE'M, as well as other code portions are interspersed. In The example it is thus carried out (following scheduling: CFEI, portion of code intercalated, CFE'1, CFE2, portion of code intercalated, CFE'2, CFE'3, portion of code intercalated, CFE'4, CFE3, CFE4, ..., CFEN, CFE'M.
It should be noted that, during (execution of the protected 2p software, in the presence of unit 6, each time an elementary command contained in a portion of the first part of 2pes execution of the protected software 2p requires it, the function corresponding elementary is executed in (unit 6. So it appears, that presence of (unit 6, this portion is executed correctly and that, by therefore, protected 2p software is fully functional.
Fig. 64 illustrates an example of an attempt to run protected software 2p while (unit 6 is absent. In this example, when (execution in the system data processing 3, from the first part 2pes execution of the software protected 2p, at all times, (execution of an elementary command cannot trigger (execution of the corresponding elementary function, due to the absence of (unit 6. The value to be assigned to the variable Z cannot therefore to be determined correctly.
It therefore appears that in the absence of (unit 6, at least one request from a portion of the first 2pes execution part of the protected 2p software, to trigger (execution of an elementary function in (unit 6 cannot be satisfied correctly, so that at least this portion is not executed correctly and that, therefore, 2p protected software is not completely functional.
According to another advantageous characteristic of the invention, the method of protection aims to implement a principle of protection, said by "detection and coercion ", a description of which is given in relation to figs. 70 to 74.
For the implementation of the principle of protection by detection and coercion, he is defined ~ at least one characteristic of software execution likely to be at least partially monitored in unit 6, ~ at least one criterion to respect for at least one characteristic software execution, ~ detection means 17 to be implemented in (unit 6 and allowing 5 to detect that at least one software execution characteristic does not does not meet at least one associated criterion, ~ and coercion means 18 to be implemented in (unit 6 and to inform the data processing system 3 and / or modify (software execution, when at least one criterion is not 10 respected.
For the implementation of the principle of protection by detection and coercion, he is also built operating resources to transform a unit blank 60 in a unit 6 using at least the detection means 17 and means of coercion 18.
15 Fig. 70 illustrates the means necessary for the implementation of this principle of protection by detection and coercion. Unit 6 includes the means of detection 17 and the coercion means 18 belonging to the processing means 16. The means of coercion 18 are informed of the non-compliance with a criterion by the means of detection 17.
20 More precisely, the detection means 17 use information from the transfer means 13 and / or the means of storage 15 and / or processing means 16, in order to monitor one or more several software execution features. To each characteristic software execution is set at least one criterion to be met.
25 In the case where it is detected that at least one performance characteristic of software does not meet at least one criterion, the detection means 17 in inform the coercion means 18. These coercion means 18 are suitable for modify, as appropriate, (state of (unit 6.
For the implementation of the principle of protection by detection and coercion, he 30 is also chosen ~ at least one software execution characteristic to monitor, among the performance characteristics likely to be monitored, ~ at least one criterion to respect for at least one characteristic selected software execution, ~ in the source of the vulnerable 2vs software, at least one processing algorithmic for which at least one performance characteristic of software is to watch, ~ and in the source of the vulnerable software 2vs, at least a portion containing at least one algorithmic processing chosen.
At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software. This change is such that in particular when (running 2p protected software ~ at least a portion of the first 2pes execution part, which is executed in data processing system 3, takes into account that at least one selected software execution characteristic is at monitor, at least in part in (unit 6, ~ and the second part of execution 2peu, which is executed in unit 6, at least partially monitors a software performance feature chosen.
When running 2p protected software, protected by this principle of protection by detection and coercion, in the presence of (unit 6 ~ as long as all the criteria corresponding to all the characteristics monitored execution of all modified portions of protected software 2p are respected, these modified portions of the protected software 2p operate nominally and therefore 2p protected software operates nominally, ~ and if at least one of the criteria corresponding to a characteristic supervised execution of a portion of 2p protected software is not respected, the data processing system 3 is informed thereof and / or the operation of the protected software portion 2p is modified, so that the operation of the protected software 2p is modified.
Of course, in the absence of (unit 6, at least one request for a portion of the first part 2pes execution of protected software 2p to use (unit 6 can not not be satisfied properly so that at least this portion does not not run correctly and therefore the 2p protected software is not completely functional.
For the implementation of the principle of protection by detection and coercion, two types of software runtime features are used preferentially.
The first type of software execution characteristic corresponds to a measurement variable of (software execution and the second type corresponds to a software usage profile. These two types of characteristics can to be used independently or in combination.
For the implementation of the principle of protection by detection and coercion using, as an execution characteristic, a measurement variable of execution of software it is defined ~ in the storage means 15, the possibility of storing at least a measurement variable used to quantify (use of at least one software functionality, ~ in the detection means 17, the possibility of monitoring at least one threshold associated with each measurement variable, ~ and updating means allowing each variable to be updated of measurement according to (use of the functionality for which it is associated.
It is also built operating resources using, in addition of the detection means 17 and coercion means 18, the means discount.
It is also chosen, in the source of the vulnerable software 2vs ~ at least one feature of the vulnerable 2v software whose use is likely to be monitored using a measurement variable, ~ at least one measurement variable used to quantify (use of said feature ~ at least one threshold associated with the measurement variable corresponding to a limit of use of said functionality, ~ and at least one method for updating the measurement variable in function of (use of said functionality.

The source of the vulnerable 2vs software is then modified, so as to get the source of the 2ps protected software, this modification being such that, when (execution of the protected software 2p, the second part of execution 2peu ~ updates the measurement variable according to (use of said feature ~ and takes into account at least one threshold crossing.
In other words, when running 2p protected software, the variable of measurement is updated according to (use of said functionality, and when the threshold is exceeded, the detection means 17 inform the means of coercion 18 who make a suitable decision to inform the system of data processing 3 and / or modify the processing carried out by the means of treatment 16 allowing the operation of the portion of the software protected 2p, so that the operation of the protected 2p software is changed.
For the implementation of a first preferred alternative embodiment of the protection principle by detection and coercion using, as feature, a measurement variable it is defined ~ for at least one measurement variable, several associated thresholds, ~ and different coercion means corresponding to each of these thresholds.
It is also chosen, in the source of the vulnerable software 2vs ~ at least one measurement variable used to quantify (use of at least a functionality of the software and which must be associated with several thresholds corresponding to different limits of use of said feature ~ and at least two thresholds associated with the measurement variable.
The source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software, this modification being such that, when (execution protected software 2p, the second part of execution 2peu ~ updates the measurement variable according to (use of said feature ~ and takes into account, in a different way, the overruns of the various thresholds.

In other words, conventionally, when running the software protected 2p, when the first threshold is exceeded, (unit 6 informs the system of Treatment of data 3 directing the protected software 2p to no longer use this functionality. Yes 2p protected software continues to use this feature, the second threshold may to be surpassed. If the second threshold is exceeded, the means of coercion 18 may render the selected functionality inoperative and / or render the software protected 2p.
For the implementation of a second preferred embodiment of the protection principle by detection and coercion using, as feature, a measurement variable, reloading means are defined making it possible to credit at least one additional use for at least one functionality of software monitored by a measurement variable.
It is also built operating resources using, in addition of the detection means 17, coercion means 18 and means discount, means of recharging.
It is also chosen, in the source of the vulnerable 2vs software, at least one measurement variable used to limit the use of at least one functionality of software and to which at least one additional use must be able to be credited.
The source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software, this modification being such that, in a so-called phase reload, at least one additional use of at least one functionality corresponding to a selected measurement variable can be credited.
In the reloading phase, at least the update is carried out a chosen measurement variable and / or at least one associated threshold, so as to allow at least one additional use of the functionality corresponding. In other words, it is possible, in the phase of reloading, credit additional uses of at least one feature of the software protected 2p.
For the implementation of the principle of protection by detection and coercion using, as a feature, a software usage profile, it is defined as that criterion to respect for this usage profile, at least one trait execution of software.
It is also chosen, in the source of the vulnerable software 2vs ~ at least one use profile to monitor, ~ and at least one performance feature that at least one chosen use profile 5 must comply.
The source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software, this modification being such that, when (execution protected software 2p, the second part of execution 2peu respects all features of execution chosen. In other words, (unit 6 itself monitors the how 10 the second part of execution 2peu is executed and can inform the system of data processing 3 and / or modify the operation of the protected software 2p in the case where at least one performance line is not respected.
When (running 2p protected software, protected by this principle, in presence from unit 6 15 ~ as long as all the execution features of all the modified portions of the 2p protected software is respected, these modified portions of the software protected 2p operate nominally and therefore the software protected 2p operates nominally, ~ and if at least one feature of a portion of 2p protected software is 20 not respected, the data processing system 3 is informed and / or the operation of the protected software portion 2p is modified, so that the operation of the protected software 2p is modified.
It is possible to envisage the surveillance of different performance traits, such as through example monitoring the presence of instructions with a marker where the 25 monitoring of (sequence of execution for at least part of the instructions.
For the implementation of the principle of protection by detection and coercion using as a performance line to be respected, monitoring of (concatenation of execution for at least part of the instructions, it is defined ~ a set of instructions whose instructions are likely to be executed 30 in unit 6, ~ a set of instruction commands for this set of instructions, these instruction commands are likely to be executed in the data processing system 3. The execution of each of these instruction commands in the data processing system 3 triggers in (unit 6, (execution of (corresponding instruction, ~ Detection means 17 making it possible to detect that (sequence of instructions does not match that desired, ~ and coercion means 18 to inform the system of data processing 3 and / or modify (software execution when (sequence of instructions does not correspond to that desired.
Operating resources are also built, allowing (unit 6, to run also the instructions in the instruction set, the execution of these instructions being triggered by execution in the data processing system 3 of instruction commands.
It is also chosen, in the source of the vulnerable software 2vs, at least one algorithmic processing to be deported to (unit 6 and for which (sequence of at least part of the instructions is to be monitored.
The source of the vulnerable 2vs software is then modified so as to obtain the source of the 2ps protected software, this modification is such that, when (execution of protected software 2p ~ the second part of execution 2peu executes at least the functionality of the chosen algorithmic processing, ~ the chosen algorithmic processing is broken down into instructions, ~ timing that at least some of the instructions must follow when executed in unit 6 is specified, ~ and the first part of 2pes execution of the protected software 2p executes instruction commands that trigger (execution of instructions in (unit 6.
When (running 2p protected software, protected by this principle, in presence from (unit 6 ~ as long as (sequence of instructions for all modified portions of protected software 2p corresponds to that desired, these modified portions of the 2p protected software operate nominally and therefore the 2p protected software works nominally, ~ and if the instructions for a portion of 2p protected software executed in (unit 6 does not correspond to the desired one, the data processing 3 is informed and / or the functioning of the portion of the protected software 2p is modified, so that the operation 2p protected software is changed.
Fig. 71 illustrates an example of implementation of the principle of protection by detection and coercion using, as an execution trait to respect the oversight the execution sequence of at least part of the instructions, in the case (desired sequence is respected.
The first part of 2pes execution of the protected 2p software, executed in the data processing system 3, executes instructions commands CI;
triggering, in (unit 6 the execution of instructions i; belonging to the game instructions. In the instruction set, at least some of the instructions each have a part defining the functionality of (instruction and a part allowing to verify (desired sequence for (execution of instructions. In this example, the CI instruction commands; are represented by TRIG (i;) and (desired sequence for (execution of instructions is i ", i" + i and i "+ z. Executing in (unit 6, of (instruction i" gives the result a and (execution of the instruction i "+ i gives the result b. The instruction i" +2 uses as operand, the results a and b of instructions i "and i" + i and its execution gives the result c.
Given that this sequence of instructions executed in (unit 6 corresponds to that desired, resulting in normal or nominal operation of protected software 2p.
Fig. 72 illustrates an example of implementation of the principle of protection by detection and coercion using, as an execution trait to be respected, the oversight of (sequence of execution of at least part of the instructions, in the case (desired sequence is not respected.
According to this example, (desired sequence for (execution of instructions is always i ", i" + i and 1n + 2. However, (sequence of execution of instructions is modified by replacing (instruction i "by (instruction i '", so than (sequence actually executed is i '", i" + i and 1 "+ 2 ~ The execution of (instruction i '"gives the result a, that is to say the same result as the execution of (instruction i ".
However, at the latest when (execution of (instruction i "+ i, the means of detection 17 detect that (instruction i '"does not correspond to (instruction desired to generate the result used as operand of (instruction i "+ z.
means of detection 17 inform the means of coercion 18 which modify in result, the operation of (instruction i "+ z, so that (execution of instruction i ~ + a gives the result c 'which can be different from c. Of course, if (execution of (instruction i '"gives a result a' different from the result a of (instruction i ", it is clear that the result of (instruction i "+ a can also be different from c.
Insofar as the sequence of execution of the instructions executed in unit 6 does not correspond to the desired one, so it can be obtained a change the operation of protected software 2p.
Figs. 73 and 74 illustrate a preferred embodiment of the principle of protection by detection and coercion using, as an execution trait to respect, the monitoring of (sequence of execution of at least part of the instructions.
According to this preferred variant, a set of instructions is defined, the less some instructions work on registers and use at least one operand in view to render a result.
As illustrated in ~ g. 73, it is defined for at least some of the instructions working on registers, a PF part defining the functionality of (instruction and a PE part defining (desired sequence for (execution of instructions. The PF part corresponds to the known operation code of (Man of wax.
The PE part defining the desired sequence, includes bit fields corresponding to ~ an identification field of (CII instruction, and for each operand k of (instruction, with k varying from 1 to K, and K
number of operands of (instruction - a CDk flag field, indicating whether to check the from (operand k, - and a field of identification identified CIPk of the operand, indicating (identity expected from (instruction that generated the content of (operand k.
As illustrated in fig. 74, the instruction set includes V registers belonging to the processing means 16, each register being named R ~, with v varying from 1 to V. For each register R ~, two fields are defined, namely ~ a functional field CF ~, known to (skilled in the art and making it possible to store the result of (execution of instructions, ~ and a CIG generated identification field ~ for storing (identity of (instruction that generated the content of the functional field CF, .. This CIG ~ generated identification field is updated automatically with the contents of the identification field of (instruction CII having generated the functional field CF ~. This identification field generated CIG ~ is not accessible, nor modifiable by any instruction and only used for detection means 17.
During (execution of an instruction, the detection means 17 carry out for each operand k the following operations ~ the CDk flag field is read, ~ if the CDk flag field (requires, the expected identification field CIPk and the identification field generated CIG ~ corresponding to the register used by (operand k are read both, ~ the equality of the two fields CIP ~ and CIG ~ is checked, ~ and if the equality is false, the detection means 17 consider that (sequence of execution of instructions is not respected.
The coercion means 18 make it possible to modify the result of the instructions when the detection means 17 have informed them of a sequence instructions not respected. A preferential realization consists in modifying the part functional PF of (instruction in progress or the functional part PF
instructions later.
According to another advantageous characteristic of the invention, the method of protection aims to implement a protection principle known as "connection conditional ", the description of which is given in relation to figs. 90 to 92.
For the implementation of the principle of protection by conditional connection, it is chosen from the source of the vulnerable 2vs software, at least one connection conditional BC. It is also chosen at least a portion of the source of the software vulnerable 2vs containing at least one BC conditional branch chosen.
At least a selected portion of the source of the vulnerable 2vs software is then 5 modified, so as to obtain the source of the 2ps protected software. This change is such that in particular when (running 2p protected software ~ at least a portion of the first 2pes execution part, which is executed in the data processing system 3, takes into account that the functionality of at least one conditional branch chosen BC is 10 executed in unit 6, ~ and the second part of execution 2peu, which is executed in (unit 6, performs at least the functionality of at least one conditional branch BC chooses and makes available to the data processing system 3, information allowing the first part of execution 2pes, to 15 continue its execution at the chosen location.
The first part of 2pes execution of the protected 2p software, executed in the data processing system 3, performs branching commands conditional, triggering in unit 6, execution by means of the second part of execution 2peu, of conditional branchings deported bc whose functionality 20 is equivalent to the functionality of conditional branches BC
choose.
Fig. 90 illustrates an example of execution of vulnerable 2v software. In this example, it appears, during (execution of vulnerable software 2v in the data processing system 3 at a given time, a connection conditional BC indicating to vulnerable software 2v (place where to continue its progress, at 25 namely (one of the three possible locations Bl, BZ or B3. It must be understood that the conditional branch BC takes the decision to continue the execution of the software at (location Bl, B2 or B3.
Fig. 91 illustrates an exemplary implementation of (invention for which the conditional branch chosen to be deported to (unit 6, corresponds to 30 conditional connection BC. In this example, when (running in the system data processing 3 of the first part 2pes execution of the software protected 2p and in the presence of (unit 6, it appears ~ at (time t1, (execution of the conditional branching command CBCl triggering in (unit 6, (execution by means of the second part of execution 2peu, of conditional branching deported bc algorithmically equivalent to the conditional branching BC, this conditional branching command CBCI being represented by TRIG (bc) ~ and at (instant tz, the transfer from unit 6 to the processing system data 3, of (information allowing the first part of execution 2pes, to continue its execution at the chosen location, namely the Bi location, Bz or B3.
It should be noted that during (execution of a portion of the first part 2pes execution of protected 2p software, connection commands conditional executed in the data processing system 3 trigger the execution of the corresponding remote conditional connections in (unit 6.
Thus, it appears that in the presence of (unit 6, this portion is executed correctly and therefore the 2p protected software is fully functional.
Fig. 92 illustrates an attempt to execute the protected software Zp, then than (unit 6 is absent. In this example, during (execution in the data processing 3 of the first part 2pes execution of the software protected 2p ~ at time t1, the execution of the conditional branch command CBC1, cannot trigger (execution of remote conditional connection bc, taking into account (absence of (unit 6, ~ and at (instant tz, the transfer of (information allowing the first part 2pes execution to continue at the chosen location fails given (absence of (unit 6.
It therefore appears that in the absence of (unit 6, at least one request from a portion of the first part of 2pes execution to trigger (execution of a conditional remote connection in unit 6, cannot be satisfied correctly, so that at least this portion is not executed correctly and that, therefore, 2p protected software is not completely functional.

In the foregoing description in relation to FIGS. 90 to 92, the object of (invention aims to deport in (unit 6, a conditional branch. Of course, a preferred embodiment of (invention may consist of deporting in (unit 6, a series conditional branches whose overall functionality is equivalent to (set of functionalities of conditional connections which have been deported.
The execution of the overall functionality of this series of connections conditional deportees results in the provision, for the processing system of data 3, information allowing the first part of 2pes execution of the software protected 2p to continue its execution at the chosen location.
In the foregoing description in relation to FIGS. 40 to 92, five principles protection of software have been explained in general independently of each other. The protection process in accordance with (invention, is implemented using the principle of protection by renaming, possibly associated with one or more other protection principles. In the case where the principle of protection by renaming is supplemented by the implementation at minus another principle of protection, the principle of protection by renaming East advantageously supplemented by the principle of protection by variable and / or the principle of protection by elementary functions and / or the principle of protection by conditional connection.
And when the principle of protection by elementary functions is also put in work, it can in turn be supplemented by the principle of protection through detection and coercion and / or the protection principle by connection conditional.
And when the principle of protection by detection and coercion is also put in work, it can in turn be supplemented by the principle of protection through conditional connection.
According to the preferred embodiment, the principle of protection by renaming is supplemented by the principle of protection by variable and by the principle protection by elementary functions, supplemented by the principle of protection by detection and coercion, supplemented by the principle of protection by connection conditional.
If a protection principle is applied, in addition to the principle of protection by renaming, its description made previously must include, to take account of its combined implementation, the modifications following the concept of vulnerable software must be understood as software vulnerable to the protection principle being described.
Thus, in the case where a protection principle has already been applied to vulnerable software, the expression "vulnerable software" should be interpreted by the reader as (expression "software protected by the principle (s) protection already applied ”;
~ the concept of protected software must be understood as protected software vis-with regard to the protection principle being described. So in the case where a protection principle has already been applied, (expression "software protected "should be interpreted by the reader as (expression" new protected software version ”;
~ and the choice or choices made) for the implementation of the principle of protection being described must (wind) take into account the choice (s) carried out) for the implementation of the protection principle (s) already applied (s).
The following description provides a better understanding of the implementation of the protection method according to the invention. This protection process according to (invention involves, as appears more precisely in ~ g.100 ~ first, a protection phase P during which software vulnerable 2v is changed to 2p protected software, ~ then, a use phase U during which the protected software 2p is implemented. In this phase of use U
- in the presence of (unit 6 and each time that a portion of the first 2pes execution part executed in the processing system data 3 (impose, an imposed functionality is executed in (unit 6, so that this portion is executed correctly and that, therefore, 2p protected software is fully functional, - in the absence of (unit 6 and despite the request for a portion of the first part of execution 2pes to execute a functionality in (unit 6, this request cannot be honored correctly, so that at least this portion is not executed correctly and that by therefore, 2p protected software is not fully functional, ~ and possibly a recharging phase R during which is credited with at least one additional use of a feature protected by the implementation of the second preferred variant of realization of the principle of protection by detection and coercion using as a characteristic, a measurement variable.
The protection phase P can be broken down into two sub-phases of protection Pl and P2. The first, called upstream protection sub-phase P1, is setting works independently of the vulnerable 2v software to be protected. The second, called P2 downstream protection sub-phase is dependent on the vulnerable software 2v to protect.
It should be noted that the upstream protection sub-phases P1 and downstream protection P2 can to be advantageously carried out by two different people or two teams different. For example, the upstream protection sub-phase P1 can be produced by a person or a company ensuring the development of protection of software, while the P2 downstream protection sub-phase can be implemented by one person or company developing software to be protected.
Of course, it is clear that the upstream and downstream protection sub-phases P1 and PZ
can also be done by the same person or team.
The upstream protection sub-phase P1 involves several stages S11, ..., Yes, for each of which different tasks or works are to be carried out.
The first stage of this upstream protection sub-phase P1 is called "stage of definitions Sll ". At this stage of definitions Sl ~ he is chosen - the type of unit 6. By way of illustration, it can be chosen as unit 6, a smart card reader 8 and the smart card 7 associated with the reader, - And the transfer means 12, 13 intended to be used respectively in the data processing system 3 and in (unit 6, during the use phase U and capable of ensuring the data transfer between the data processing system 3 and (unit 6, ~ it is defined - a set of dependent functions including dependent functions are likely to be performed in a unit 6, - a set of triggering commands for this set of 5 dependent functions, these triggering commands being likely to be executed in the data processing system 3 and trigger (execution in a unit 6, functions dependent, - for each triggering command, a set point corresponding to the 10 at least in part to the information transmitted from the data processing 3 to a unit 6, in order to trigger the execution of the corresponding dependent function in a unit 6, this instruction being in the form of at least one argument of the triggering command, 15 - a method of renaming the instructions allowing renaming of the instructions in order to obtain triggering orders with instructions renamed, - and recovery means 20 intended to be implemented in a unit 6 during a use phase U, and allowing 20 find the dependent function to be executed, from the setpoint fame, ~ and in the case where the protection method according to (invention implements a variant of the principle of protection by renaming, it is also defined for at least one dependent function, a family of functions 25 algorithmically equivalent dependent, but triggered by triggering commands whose renamed instructions are different, and in the case where the protection method according to (the invention implements a preferred variant of the renaming protection principle it is also defined 30 - as a method of renaming instructions, a method of encryption to encrypt the instructions, - And as recovery means 20, means putting in uses a decryption method to decipher the instructions renamed and thus restore (identity of functions dependent on run in (unit 6.
~ and in the case where the protection method according to (invention implements the protection principle by elementary functions, it is also defined - a set of elementary functions, subset of all dependent functions, - and a set of elementary commands for this set of functions elementary, this set of elementary commands being a sub all of the triggering commands, ~ and in the case where the protection method according to the invention implements the protection by detection and coercion principle, it is also defined - at least one software execution characteristic, capable of being at least partially monitored in unit 6, - at least one criterion to respect for at least one characteristic software execution, - detection means 17 to be implemented in (unit 6 and making it possible to detect that at least one performance characteristic of software does not meet at least one associated criterion, - and coercion means 18 to be implemented in (unit 6 and to inform the data processing system 3 and / or modify (software execution, when at least one criterion is not met, ~ and in the case where the protection method according to (invention implements the protection principle by detection and coercion using as characteristic a measurement variable of software execution it's also defined - as a feature of software execution likely to be monitored, a variable measuring the use of a functionality software, - as a criterion to be respected, at least one threshold associated with each measurement variable, - and updating means making it possible to update at least one measurement variable, ~ and in the case where the protection method according to (invention implements a first preferred alternative embodiment of the principle of protection by detection and coercion using a variable of measurement of (software execution, it is also defined - for at least one measurement variable, several associated thresholds, - and different means of coercion corresponding to each of these thresholds, ~ and in the case where the protection method according to (invention implements a second preferred alternative embodiment of the principle of protection by detection and coercion using a variable of measurement of (software execution, it is also defined means of reload to credit at least one use additional for at least one software functionality monitored by a measurement variable, ~ and in the case where the protection method according to (invention implements the protection principle by detection and coercion using as characteristic of a software usage profile, it is also defined - as a feature of software execution likely to be monitored, a software usage profile, - and as a criterion to be respected, at least one performance trait of software, ~ and in the case where the protection method according to the invention implements the protection by detection and coercion principle using as a trait of execution to be observed, monitoring of (sequence of execution, it is also defined - a set of instructions whose instructions are likely to be executed in (unit 6, - a set of instruction commands for this set of instructions, these instruction commands being capable of being executed in the data processing system 3 and trigger in (unit 6 (execution of instructions, - as a usage profile, (sequence of instructions, - as an execution feature, a desired sequence for (execution of instructions, - as detection means 17, means making it possible to detect that (sequence of instructions does not correspond to that desired, - And as means of coercion 18, means allowing to inform the data processing system 3 and / or to modify the operation of the portion of protected software 2p when (sequence of instructions does not correspond to that desired, ~ and in the case where the protection method according to (invention implements a preferred embodiment of the principle of protection by detection and coercion using as an execution trait to be respected, surveillance of (sequence of execution, it is also defined - as a set of instructions, a set of instructions of which at least some instructions work on registers and use at least an operand to render a result, - for at least part of the instructions working on registers ~ a PF part which smooths out the functionality of (instruction, ~ and a part defining (desired sequence for (execution instructions and having corresponding bit fields at 0 an identification field of (CII instruction, 0 and for each operand of (instruction * a CDk flag field, * and a CIP identification field, ~ of (operand, - for each register belonging to the operating resources and used by the instruction set, a CIG ~ generated identification field in which is automatically memorized (identification of the last instruction having returned its result in this register, - As detection means 17, means allowing, during the execution of an instruction, for each operand, when the field CDk flag requires it, to control (equality between the field generated identification CIG ~ corresponding to the register used by this operand, and the expected identification field CIPk of the origin of this operand, - And as means of coercion 18, means making it possible to modify the result of the instructions, if at least one of the ties controlled is false.
During the upstream protection sub-phase, the definition stage Sll is followed by a stage called "construction stage S12". At such a stage 512, are build them transfer means 12, 13 and the operating means corresponding to definitions from the definition stage Sll.
During this construction stage 512, it is therefore proceeded ~ the construction of the transfer means 12, 13 allowing, during the U use phase, data transfer between the processing system data 3 and (unit 6, ~ the construction of operating resources allowing (unit 6, during of the use phase U to implement the means of recovery, ~ and when the principle of protection by elementary functions is also placed implemented, the construction of operating resources also allowing (unit 6, during the use phase U of executing the functions, elements of the set of elementary functions, ~ and when the principle of protection by detection and coercion is also placed at work, at construction - operating means allowing (unit 6, during the phase of use U to also use the detection means 17 and the coercion means 18, - and possibly operating resources allowing (unit 6, at during the use phase U to also implement the means update, - and possibly operating resources allowing (unit 6, at 5 during the recharging phase to also implement the reloading means, - and possibly operating resources also allowing (unit 6, during the use phase U to execute the instructions of the game of instruction.
10 The construction of the operating resources is carried out in a classic, by (intermediary of a program development unit taking into account the definitions at the definition stage Sll. Such a unit is described in the continuation of the description in fig. 110.
During the upstream protection sub-phase Pl, the construction stage S12 can 15 to be followed by a stage called "pre-personalization stage S13". During this stage of pre-personalization S13 at least part of the transfer means 13 and / or the operating resources are loaded into at least one blank unit 60 in view obtain at least one pre-personalized unit 66. It should be noted that part of operating resources, once transferred to a pre-personalized unit 66, is 20 more directly accessible from (outside of this pre-personalized unit 66. The transfer of operating resources to a blank unit 60 can be carried out through (intermediary of a suitable pre-personalization unit, which is described in the continuation of the description in fig. 120. In the case of a pre-custom 66, consisting of a smart card 7 and its reader 8, the pre-personalization born 25 relates to the chip card 7.
During the upstream protection sub-phase P1, it can be implemented, after the definition stage S11 and, possibly after construction stage 512, a stadium called "tool making stage S14". During this stage of preparation of tools S14 tools are made to assist in the generation of software protected 30 or automate software protection. Such tools allow ~ help choose or choose automatically in vulnerable software 2v to protect - the algorithmic processing (s) likely to be broken down in dependent remote functions in (unit 6 and for which the instructions for triggering commands can be renamed, - the portion (s) liable to be modified, - and when the principle of protection by variable is also implemented work, the variable or variables likely to be deported to (unit 6, - and when the principle of protection by elementary functions is also implemented, the algorithmic processing (s) likely to be broken down into elementary functions that can be deported in (unit 6, - and when the principle of protection by detection and coercion is also implemented, the performance characteristic (s) to be monitored and, possibly, the algorithmic processing (s) likely to be broken down into remote instructions in (unit 6, - and when the principle of protection by conditional connection is also implemented, the conditional branch (es) whose functionality may be transferred to (unit 6, ~ and, possibly, to help generate protected software or automate software protection.
These different tools can be produced independently or in combination and each tool can take various forms, such as preprocessor, assembler, compiler, etc.
The upstream protection sub-phase P1 is followed by a sub-phase of P2 downstream protection dependent on the vulnerable 2v software to be protected. This sub-phase P2 downstream protection also involves several stages. The first Stadium corresponding to the implementation of the principle of protection by renaming is called "creation stage S21". At this stage of creation 521, it is used the choices intervened at the definition stage Sll. A (help with these choices and possibly tools built at the stage of making Sia tools, the software is created protected 2p ~ by choosing, at least one algorithmic treatment which, during (execution vulnerable 2v software, uses at least one operand and provides at least one result, ~ by choosing at least a portion of the source of the vulnerable 2vs software containing at least one chosen algorithmic processing, ~ by producing the source of the 2ps protected software from the source of the software vulnerable 2vs, by modifying at least a selected portion of the source of the vulnerable 2vs software to get at least a modified portion of the source of the 2ps protected software, this modification being such that - during the execution of the protected software 2p a first part 2pes execution is executed in the data processing system 3 and a second execution part 2 little is executed in a unit 6, obtained from (blank unit 60 after loading information, - the second part of execution 2peu executes at least the functionality at least one chosen algorithmic processing, - at least one chosen algorithmic processing is broken down so that during (execution of 2p protected software, this processing algorithmic is executed, by means of the second part of execution 2 little, using dependent functions, - for at least one chosen algorithmic processing, commands triggers with renowned instructions are integrated in the source of the 2ps protected software, so that when (running the software protected 2p, each triggered command with renamed setpoint is executed by the first 2pes execution part and triggers in (unit 6, recovery, by means of recovery 20, instructions and execution, by means of the second part of execution 2peu, of the corresponding dependent function, - and a sequencing of triggering orders with instructions renames is chosen from (all the schedules allowing (execution of 2p protected software, ~ and by producing - a first part 2pos object of the protected software 2p, from the source of the 2ps protected software, this first part 2pos object being such that when (running 2p protected software, a first part of execution 2pes which is executed in the system of data processing 3 and at least a portion of which takes into account that the triggered commands with renowned instructions are executed according to (scheduling chosen, - and a second object 2pou part of the protected 2p software, containing the operating means, this second object part 2pou being such that, after loading in (blank unit 60 and during (execution of the protected software 2p, appears the second part of execution 2peu at means by which the instructions are restored and the functions dependent are executed.
For the implementation of a variant of the principle of protection by renaming, protected 2p software is modified ~ by choosing at least one protected source of 2ps software triggering command with renamed setpoint, ~ and by modifying at least a selected portion of the source of the protected software 2ps by replacing at least the renamed setpoint of an order triggering at a renamed setpoint chosen, by another setpoint fame, triggering a function dependent on the same family.
During the downstream protection sub-phase PZ, and when at least one other principle protection is applied in addition to the principle of protection by renaming, it East implemented a "modification stage S22". During this stage of modification 522 he the definitions used at the Sll definition stage are used. Has helped of these definitions and possibly tools built at the manufacturing stage of tools 514, the 2p protected software is modified to allow the implementation of the principles of protection according to (one of the arrangements defined above.
When the variable protection principle is implemented, the software protected 2p is modified ~ by choosing at least one variable used in at least one treatment chosen algorithm, which when (running 2p protected software, defines partially (state of protected software 2p, ~ by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that during (execution of the protected software 2p, at least one chosen variable or at least one copy of chosen variable resides in (unit 6, ~ and by producing - the first part 2pos object of the protected software 2p, this first object part 2pos being such that during (execution of the protected software 2p, at least a portion of the first part of 2pes execution takes also take into account that at least one variable or at least one copy of variable resides in (unit 6, - and the second object part 2pou of the protected software 2p, this second object part 2pou being such that, after loading in unit 6 and during from (running protected software 2p, appears the second part of execution 2 little by means of which at least one variable chosen, or at least one copy of the chosen variable also resides in (unit 6.
When the principle of protection by elementary functions is implemented artwork, protected 2p software is modified ~ by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that the decomposition of at least one algorithmic processing chosen as dependent functions uses only elementary functions, ~ by producing - the first part 2pos object of the protected software 2p, this first object part 2pos being such that during (execution of the protected software 2p, at least a portion of the first 2pes execution part also execute elementary commands according to provisioning selected, - and the second object part 2pou of the protected software 2p also containing the operating means, this second object part 2pou being such that after loading in (unit 6 and when (running the software protected 2p, appears the second part of execution 2peu by means of which are also executed the triggered elementary functions by the first part of execution 2pes.

When the principle of protection by detection and coercion is implemented artwork, protected 2p software is modified ~ by choosing at least one software execution characteristic to monitor, among the performance characteristics likely to be 5 monitored, ~ by choosing at least one criterion to respect for at least one selected software execution characteristic, ~ by choosing in the source of the protected 2ps software, functions elementary for which at least one performance characteristic of 10 software selected, should be monitored, ~ by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that during (execution of the protected software 2p, at least one selected performance characteristic is monitored at means of the second part of execution 2peu, and the non respect of a criterion 15 results in information from the data processing system 3 and / or a modification of the execution of the protected software 2p, ~ and by producing the second object part 2pou of the protected software 2p containing the operating means also implementing the means of detection 17 and the coercion means 18, this second object part 2pou 20 being such that, after loading into unit 6 and during (execution of the 2p protected software, at least one software execution characteristic is monitored and non-compliance with a criterion results in information to the data processing system 3 and / or a modification of the execution protected software 2p.
25 For the implementation of the principle of protection by detection and coercion using as characteristic a measurement variable of (execution of software, the protected 2p software is changed by choosing as a software execution feature to monitor, at least one variable measuring the use of a 30 software functionality, ~ by choosing - at least one feature of the 2p protected software whose use is likely to be monitored using a measurement variable, - at least one measurement variable used to quantify (use of said functionality, - at least one threshold associated with a chosen measurement variable corresponding to a limit on the use of this functionality, - and at least one method for updating a measurement variable chosen according to (use of said functionality, ~ and by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that, during the execution of the software protected 2p, the measurement variable is updated using the second 2-bit execution part, depending on (use of said functionality and at least one threshold crossing is taken into account.
For the implementation of a first preferred alternative embodiment of the protection principle by detection and coercion using, as feature, a measurement variable, the protected 2p software is modified ~ by choosing in the source of the protected 2ps software, at least one variable of selected measurement with which several thresholds must be associated corresponding to different limits on the use of the functionality, ~ by choosing at least two thresholds associated with the measurement variable selected, ~ and by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that, during (execution of the software protected 2p, the overruns of the various thresholds are taken into account, at means of the second part of execution 2peu, differently.
For the implementation of a second preferred embodiment of the protection principle by detection and coercion using as characteristic, a measurement variable, 2p protected software is modified ~ by choosing in the source of the protected 2ps software, at least one variable of measurement chosen to limit (use of a functionality to which must be credited for at least one additional use, ~ and by modifying at least one selected portion, this modification being such that in a so-called recharging phase, at least one use additional of at least one functionality corresponding to a variable selected measurement can be credited.
For the implementation of the principle of protection by detection and coercion using as a feature, a software usage profile, the protected software 2p is changed ~ by choosing as software execution feature to monitor at least one software usage profile, ~ by choosing at least one line of execution than at least one profile of use chosen must respect, ~ and by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that, during (execution of the software protected 2p, the second part of execution 2peu respects all the features of execution chosen.
For the implementation of the principle of protection by detection and coercion using as a performance line to be respected, monitoring of the web execution, 2p protected software is modified by modifying at least a selected portion of the source of the protected software 2 ps:
- by transforming elementary functions into instructions, - by specifying (sequence that at least some must respect instructions when executed in (unit 6, - and by transforming elementary orders into orders instructions corresponding to the instructions used.
When the principle of protection by conditional connection is implemented protected 2p software is modified ~ by choosing in the source of the protected 2ps software, at least one conditional branching performed in at least one treatment chosen algorithmic, ~ by modifying at least a selected portion of the source of the protected software 6 ~
2ps, this modification being such that during (execution of the protected software 2p, the functionality of at least one conditional branch chosen, is executed, by means of the second execution part 2 little, in (unit 6, ~ and by producing - the first part 2pos object of the protected software 2p, this first object part 2pos being such that during (execution of the protected software 2p, the functionality of at least one conditional branch chosen is executed in (unit 6, - and the second object part 2pou of the protected software 2p, this second object part 2pou being such that, after loading in unit 6 and during (execution of the protected software 2p, appears the second part 2-bit execution by means of which the functionality of at least one conditional branch chosen is executed.
For the implementation of a preferred embodiment of the protection principle through conditional connection, 2p protected software is modified ~ by choosing, in the source of the 2ps protected software at least a series of selected conditional branches, ~ by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that during (execution of the protected software 2p, the overall functionality of at least one selected series of connections conditional is executed by means of the second execution part 2peu, in (unit 6, ~ and by producing - the first part 2pos object of the protected software 2p, this first object part 2pos being such that during (execution of the protected software 2p, the functionality of at least one selected series of connections conditional is executed in (unit 6, - and the second object part 2pou of the protected software 2p, this second object part 2pou being such that, after loading in unit 6 and during (execution of the protected software 2p, appears the second part 2-bit execution by means of which the overall functionality of least a selected series of conditional branches is executed.
Of course, the protection principles according to (invention can be applied directly when developing new software without require the prior production of intermediate protected software. In this way, the stages creation S21 and modification S22 can be carried out simultaneously of so as to directly obtain the protected software 2p.
During the downstream protection sub-phase P2, it is implemented after the stage of creation S21 of the protected software 2p, and possibly after the stage of change 522, a stage called "personalization stage S23". During this stage of personalization 523, the second object part 2pou containing the means operating system is loaded into at least one blank unit 60, with a view to obtaining at minus one unit 6, or part of the second part object 2pou containing possibly the operating means is loaded into at least one unit pre-custom 66, in order to obtain at least one unit 6. The loading of these personalization information makes it possible to operationalize at least one unit 6. It should be noted that part of this information, once transferred to a unit 6, is not directly accessible from (outside of this unit 6. The transfer of personalization information in a blank unit 60 or a pre-custom 66 can be achieved by (through a personalization adapted which is described in the following description in FIG. 150. In the case of a unit 6, consisting of a smart card 7 and its reader 8, the customization does concerns only the smart card 7.
For the implementation of the protection phase P, different means techniques are described more precisely in relation to FIGS. 110, 120, 130, 140 and 150.
Fig. 110 illustrates an exemplary embodiment of a system 25 making it possible to implement the S12 construction stage taking into account the definitions intervened at the definition stage Sll and during which the means 12, 13 and possibly the operating resources intended for (unit 6.
Such a system 25 includes a program or station development unit of work conventionally presented in the form of a computer comprising a central unit, a screen, keyboard-mouse peripherals, and comprising, in particular, the following programs: file editors, assemblers, pre-processors, compilers, interpreters, debuggers and linkers.
Fig. 120 illustrates an exemplary embodiment of a pre-unit personalization 30 making it possible to at least partially load the means of transfer 5 13 and / or the operating means in at least one blank unit 60 in view to obtain at least one pre-personalized unit 66. This pre-personalized unit personalization 30 includes a read and write means 31 allowing befor-electrically customize a blank unit 60 so as to obtain a pre-personalized unit 66 in which the transfer means 13 and / or 10 operations were loaded. The pre-personalization unit 30 can also include physical personalization means 32 of the blank unit 60 up for example, in the form of a printer. In the case where (unit 6 is consisting of a smart card 7 and its reader 8, the pre-personalization concerned usually only the smart card 7.
15 Fig. 130 illustrates an embodiment of a system 35 allowing make the tools to help generate protected software or automate software protection. Such a system 35 includes a unit of development of program or workstation presenting itself conventionally under the shape of a computer comprising a central unit, a screen, peripheral devices 20 of the keyboard-mouse type, and comprising, in particular, the following programs:
publishers files, assemblers, pre-processors, compilers, interpreters, debuggers and link publishers.
Fig. 140 illustrates an exemplary embodiment of a system 40 making it possible to directly create 2p protected software or modify vulnerable software 2v in 25 to obtain protected software 2p. Such a system 40 includes a unit of development of program or workstation presenting itself conventionally under the shape of a computer comprising a central unit, a screen, peripheral devices of the keyboard-mouse type, and comprising, in particular, the following programs:
publishers files, assemblers, pre-processors, compilers, interpreters, debuggers and 30 linkers, as well as tools to help generate software protected or automate software protection.
The ~ g. 150 illustrates an exemplary embodiment of a personalization unit allowing to load the second object part 2pou in at least one unit virgin 60 in order to obtain at least one unit 6 or part of the second object part 2pou in at least one pre-personalized unit 66 in order to obtain at least one unit 6. ' This personalization unit 45 includes a means of reading and writing for electrically personalizing at least one blank unit 60 or at least one pre-personalized unit 66, so as to obtain at least one unit 6.
At the end of this personalization, a unit 6 includes the information required when running protected software 2p. Personalization unit 45 can also include physical personalization means 47 for at least one unit 6 can be for example, in the form of a printer. In the case or a unit 6 is constituted by a smart card 7 and its reader 8, the personalization generally only concerns the smart card 7.
The protection method of the invention can be implemented with the following improvements ~ Several treatment units can be used together and of storage in which the second part object 2pou is distributed protected 2p software so that their joint use allows to run protected 2p software, the absence of at least one of these processing and memorization preventing (use of protected software 2p.
~ Similarly, after the S13 pre-personalization stage and during the customization 523, the part of the second part object 2 can be necessary to transform the pre-personalized unit 66 into a unit 6 can be contained in a processing and storage unit used by the personalization unit 45 in order to limit access to this part of the second part object 2pou. Of course, this part of the second part 2pou object can be distributed in several processing units and memorization so that this part of the second object part 2pou only accessible during (joint use of these processing and memorization.

Claims (34)

CLAIMS: 1 - Process for protecting, from at least one blank unit (60) comprising at least storage means (15) and processing means (16), a vulnerable software (2v) against its unauthorized use, said software vulnerable (2v) operating on a data processing system (3), characterized in what he consists of:
.fwdarw. in a protection phase (P):
.cndot. to define:
- a set of dependent functions whose dependent functions are likely to be executed in a unit (6), - a set of triggering commands for this set of dependent functions, these triggering commands being capable of being executed in the data processing system (3) and to trigger the execution in a unit (6), of the functions dependent, - for each triggering command, an instruction corresponding to the least in part to the information transmitted from the system of data processing (3) to a unit (6), in order to trigger the execution of the corresponding dependent function in a unit (6), this instruction being in the form of at least one argument the triggering command, - a method for renaming setpoints allowing you to rename the setpoints in order to obtain triggering commands with setpoints fame, - And recovery means (20) intended to be implemented in ~
a unit (6) during a use phase (U), and making it possible to find the dependent function to be executed, from the setpoint fame, .cndot. to construct the means of exploitation making it possible to transform the unit virgin (60) into a unit (6) capable of implementing the means of recovery (20), .cndot. to create protected software (2p):
- by choosing at least one algorithmic processing which, when execution of the vulnerable software (2v), uses at least one operand and allows to obtain at least one result, - by choosing at least a portion of the source of the vulnerable software (2vs) containing at least one chosen algorithmic processing, - by producing the source of the protected software (2ps) from the source of the vulnerable software (2vs), by modifying at least a selected portion of the source of the vulnerable software (2vs) to obtain at least a portion modified from the source of the protected software (2ps), this modification being such as:
~ when running protected software (2p) a first part execution (2pes) is executed in the processing system of data (3) and a second execution part (2peu) is executed in a unit (6), obtained from the blank unit (60) after loading information, ~ the second execution part (2peu) executes at least the functionality of at least one chosen algorithmic processing, ~ at least one chosen algorithmic processing is broken down into way that when running the protected software (2p), this algorithmic processing is performed, by means of the second execution part (2 bit), using dependent functions, ~ for at least one chosen algorithmic processing, commands triggers with renamed setpoints are integrated into the source of the protected software (2ps), so that when (execution of protected software (2p), each command renamed setpoint is executed by the first execution part (2pes) and triggers in (unit (6), the restoration, by means of the restoration means (20), of the instruction and execution, by means of the second execution part (2peu), of the corresponding dependent function, ~ and scheduling triggering commands with instructions renames is chosen from among the set of schedules allowing the execution of the protected software (2p), - and producing:
~ a first object part (2pos) of the protected software (2p), from of the source of the protected software (2ps), this first object part (2pos) being such that during the execution of the protected software (2p), appears a first execution part (2pes) which is executed in the data processing system (3) and of which at least one portion takes into account that the commands triggering renamed instructions are executed according to the schedule selected, ~ and a second object part (2pou) of the protected software (2p), containing the operating means, this second object part (2pou) being such that, after loading into the blank unit (60) and when running the protected software (2p), appears the second execution part (2peu) by means of which the instructions are restored and the dependent functions are executed, .cndot. and loading the second object part (2po) into the blank unit (60), in sight to obtain the unit (6), .fwdarw. and in a use phase (U) during which is executed The software protected (2p):
.cndot. in the presence of the unit (6) and each time a command triggering with renamed instruction, contained in a portion of the first part of execution (2pes) imposes it, to restore in the unit (6), the identity of the corresponding dependent function and executing it, so that this portion is executed correctly and therefore the software protected (2p) is fully functional, .cndot. and in the absence of unit (6), despite the request for a portion of the first part of execution (2pes) to trigger the execution of a function dependent in unity (6), not being able to respond correctly to this request, so at least that portion is not executed correctly and therefore the protected software (2p) is not completely functional. 2- Process according to claim 1, characterized in that it consists .fwdarw. in the protection phase (P):
.cndot. to be defined for at least one dependent function, a family of functions algorithmically equivalent dependent, but triggered by triggering commands whose renamed setpoints are different, .cndot. and modify the protected software (2p):
- by choosing in the source of the protected software (2ps) at least one renamed setpoint triggering command, - and by modifying at least a selected portion of the software source protected (2ps) by replacing at least the renamed setpoint with a triggering command with renamed setpoint chosen, by another renamed setpoint, triggering a function dependent on the same family. 3 - Process according to claim 1 or 2, characterized in that it consists:
.fwdarw. in the protection phase (P):
.cndot. to define:
- as a method of renaming setpoints, a method of encryption to encrypt the instructions, - and as recovery means (20), means putting in place implements a decryption method to decrypt the instructions renamed and thus restore the identity of the dependent functions to run in unit (6). 4 - Method according to one of claims 1 to 3, characterized in that it consists of:
.fwdarw. in the protection phase (P):
.cndot. to modify the protected software (2p):
- by choosing at least one variable used in at least one chosen algorithmic processing, which when running the software protected (2p), partially defines the state of protected software (2p), - by modifying at least a selected portion of the software source protected (2ps), this modification being such that during the execution of the protected software (2p), at least one selected variable or at least one copy of chosen variable resides in unit (6), - and producing:
~ the first object part (2pos) of the protected software (2p), this first object part (2pos) being such that during the execution of the copyrighted software (2p), at least a portion of the first part execution (2pes) also takes into account that at least one variable or at least one copy of variable resides in unit (6), ~ and the second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading into the unit (6) and when running the protected software (2p), appears the second part of execution (2peu) by means of which at at least one chosen variable, or at least one copy of variable chosen also resides in unit (6), .fwdarw. and in the use phase (U):
.cndot. in the presence of the unit (6) each time a portion of the first part execution (2pes) requires it, to use a variable or a copy of a variable residing in unit (6), so that portion is performed correctly and that, therefore, the protected software (2p) is fully functional, .cndot. and in the absence of unit (6), despite the request for a portion of the first part of execution (2pes) to use a variable or a copy of variable residing in the unit (6), in not being able to respond correctly to this request, so that at least this portion is not executed correctly and therefore the protected software (2p) is not completely functional. 5 - Method according to one of claims 1 to 3, characterized in that it consists of:
.fwdarw. in the protection phase (P):
.cndot. to define:
- a set of elementary functions, a sub-set of the set of dependent functions, - and a set of elementary commands for this set of functions elementary commands, this set of elementary commands being a sub-set of the set of triggering commands, .cndot. to build the means of exploitation allowing the unit (6), to execute also the elementary functions of said game, the execution of these functions elements being triggered by the execution in the processing system data (3), elementary commands whose instruction has been fame, .cndot. and modify the protected software (2p):
- by modifying at least a selected portion of the software source protected (2ps), this modification being such that the decomposition of at least one chosen algorithmic treatment in dependent functions uses only elementary functions, - by producing:
~ the first object part (2pos) of the protected software (2p), this first object part (2pos) being such that during the execution of the copyrighted software (2p), at least a portion of the first part of execution (2pes) also executes the elementary commands according to the chosen order, ~ and the second object part (2pou) of the protected software (2p) also containing the means of exploitation, this second part object (2pou) being such that, after loading into the unit (6) and when running the protected software (2p), appears the second execution part (2peu) by means of which are also executed the elementary functions triggered by the first execution part (2pes), ~ and in the use phase (U):
.cndot. in the presence of the unit (6) and each time a command elementary contained in a portion of the first execution part (2pes) imposes it, to execute the corresponding elementary function in the unit (6), so that this portion is performed correctly and therefore the protected software (2p) is fully functional, .cndot. and in the absence of the unit (6) despite the request for a portion of the first part of execution (2pes), to trigger the execution of a function elementary in unity (6), not being able to respond correctly to this request, so at least that portion is not executed correctly and therefore the protected software (2p) is not completely functional. 6 - Process according to claim 5, characterized in that it consists:
.fwdarw. in the protection phase (P):
.cndot. to define:
- at least one software execution characteristic, capable of being monitored at least in part in the unit (6), - at least one criterion to be met for at least one characteristic software execution, - detection means (17) to be implemented in the unit (6) and making it possible to detect that at least one execution characteristic of software does not meet at least one associated criterion, - and coercion means (18) to be implemented in the unit (6) and making it possible to inform the data processing system (3) and/or to modify the execution of software, when at least one criterion is not respected, .cndot. to build the means of exploitation allowing the unit (6), to put also implement the means of detection (17) and the means of coercion (18), .cndot. and modify the protected software (2p):
- by choosing at least one software execution characteristic to monitor, among the execution characteristics likely to be monitored, - by choosing at least one criterion to be respected for at least one selected software performance feature, - by choosing in the source of the protected software (2ps), functions elements for which at least one execution characteristic chosen software, is to be monitored, - by modifying at least a selected portion of the software source protected (2ps), this modification being such that during the execution of the protected software (2p), at least one execution characteristic chosen is monitored by means of the second execution part (2peu), and the non-compliance with a criterion leads to an information of the system of data processing (3) and/or to a modification of the execution of the protected software (2p), - and by producing the second object part (2pou) of the protected software (2p) containing the means of exploitation also implementing the detection means (17) and coercion means (18), this second object part (2pou) being such that, after loading into the unit (6) and during (execution of the protected software (2p), at least one software performance characteristic is monitored and non-compliance of a criterion leads to information from the processing system of data (3) and/or modification of the execution of the protected software (2p), .fwdarw. and in the use phase (U):
.cndot. in the presence of the unit (6):
- as long as all the criteria correspond to all the characteristics execution of all modified portions of the software protected (2p) are complied with, to allow nominal operation of these portions of the protected software (2p) and consequently to allow the nominal operation of the protected software (2p), - and if at least one of the criteria corresponding to a characteristic supervised execution of a portion of the protected software (2p) is not respected, to inform the data processing system (3) and/or to modify the operation of the portion of the protected software (2p), of so that the operation of the protected software (2p) is modified. 7 - Process according to claim 6, for limiting the use of software protected (2p), characterized in that it consists of:
.fwdarw. in the protection phase (P):

.cndot. to define:
- as a software runtime feature capable of being monitored, a variable measuring the use of a feature of software, - as a criterion to be respected, at least one threshold associated with each measurement variable, - and updating means making it possible to update at least one measurement variable, .cndot. to build the means of exploitation allowing the unit (6) to put also implements the means of updating, .cndot. and modify the protected software (2p):
- by choosing as the software runtime characteristic to monitor at least one measurement variable of the use of a software functionality, - by choosing:
~ at least one feature of the protected software (2p) of which usage is likely to be monitored through a variable measurement, ~ at least one measurement variable used to quantify the use of said functionality, ~ at least one threshold associated with a chosen measurement variable corresponding to a limit of use of said functionality, ~ and at least one method for updating a measurement variable chosen according to the use of said functionality, - and by modifying at least a selected portion of the software source protected (2ps), this modification being such that, when executing the protected software (2p), the measurement variable is updated by means of the second execution part (2peu), depending on the use of said functionality and at least one threshold overrun is taken into account account, .fwdarw. and in the use phase (U), in the presence of (unit (6), and in case he is detected at least one threshold overrun corresponding to at least one limit of use, to inform the data processing system (3) and/or to modify the operation of the portion of the protected software (2p), so that the operation of protected software (2p) is changed. 8 - Process according to claim 7, characterized in that it consists:
.fwdarw. in the protection phase (P):
.cndot. to define:
- for at least one measurement variable, several associated thresholds, - and different means of coercion corresponding to each of these thresholds, .cndot. and modify the protected software (2p):
- by choosing in the source of the protected software (2ps), at least one chosen measurement variable to which must be associated several thresholds corresponding to different limits of use of the feature, - by choosing at least two thresholds associated with the measurement variable chosen, - and by modifying at least a selected portion of the software source protected (2ps), this modification being such that, when executing the protected software (2p), the overruns of the various thresholds are taken into account, by means of the second execution part (2peu), in such a way different, .fwdarw. and in the use phase (U):
.cndot. in the presence of (unit (6):
- in the event that it is detected that a first threshold has been exceeded, instruct the protected software (2p) to no longer use the functionality corresponding, - and in the event that it is detected that a second threshold has been exceeded, at render inoperative the corresponding functionality and/or at least one portion of protected software (2p). 9 - Process according to claim 7 or 8, characterized in that it consists of:
.fwdarw.in protection phase (P) .cndot.à define means of reloading making it possible to credit at least a additional use for at least one software feature monitored by a measurement variable, .cndot.to build the means of exploitation also allowing (unit (6) to implement the means of recharging, .cndot.et to modify the protected software (2p):
- by choosing in the source of the protected software (2ps), at least one chosen measurement variable making it possible to limit (use of a functionality to which at least one additional use must to be able to be credited, - and modifying at least one selected portion, this modification being such as in a so-called recharging phase, at least one use additional of at least one functionality corresponding to a chosen measurement variable can be credited, .fwdarw.and in the reload phase:
.cndot.to update at least one selected measurement variable and/or at least a associated threshold, so as to allow at least one use additional functionality. 10 - Process according to claim 6, characterized in that it consists:
.fwdarw.in protection phase (P):
.cndot.to set:
- as a software runtime feature capable of being monitored, a software usage profile, - and as a criterion to be respected, at least one execution feature of software, .cndot.et to modify the protected software (2p) - by choosing as the software runtime characteristic to monitor at least one software usage profile, - by choosing at least one execution trait and at least one profile of use chosen must respect, - and by modifying at least a selected portion of the software source protected (2ps), this modification being such that, during (execution of the protected software (2p), the second execution part (2peu) respects all chosen execution traits, .fwdarw.et in the use phase (U) in the presence of (unit (6), and in the case where he is detected that at least one execution trait is not respected, to inform the data processing system (3) and/or to modify the operation of the portion of the protected software (2p), so that the operation of the software protected (2p) is changed. 11- Process according to claim 10, characterized in that it consists of:
in the protection phase (P):
.cndot.to be defined - a set of instructions whose instructions are likely to be executed in (unit (6), - a command set of instructions for this set of instructions, these instruction commands being capable of being executed in the data processing system (3) and trigger in funity.(6) the execution of instructions, - as a user profile, the sequence of instructions, - as an execution trait, a desired sequence for the execution of instructions, - as detection means (17), means making it possible to detect that (sequence of instructions does not correspond to that wish, - and as means of coercion (18), means allowing to inform the data processing system (3) and/or to modify the operation of the portion of protected software (2p) when the sequence of instructions does not correspond to that desired, .cndot.to build the means of exploitation also allowing the unit (6) to execute the instructions of the instruction set, the execution of these instructions being triggered by execution in the processing system data (3), instruction commands, and to modify the protected software (2p) - by modifying at least a selected portion of the software source protected (2ps) by transforming elementary functions into instructions, by specifying the sequence that must be respected at least some of the instructions when executing them in (unit(6), and by transforming the elementary commands into commands instructions corresponding to the instructions used, .fwdarw.et in the use phase (U), in the presence of the unit (6), in the case where he is detected that the sequence of instructions executed in the unit (6) does not does not correspond to the desired one, to inform the processing system of this data (3) and/or to modify the operation of the portion of the software protected (2p), so that the operation of the protected software (2p) is modified. 12 - Process according to claim 11, characterized in that it consists .fwdarw.in protection phase (P):
~ to be defined:
- as an instruction set, an instruction set of which at least some instructions work on registers and use at least an operand to return a result, - for at least part of the instructions working on registers a part (PF) defining the functionality of the instruction, and a part defining the sequence desired for the execution instructions and having corresponding bit fields at:
<> an instruction identification field (CII), <> and for each operand of the instruction a flag control (CDk), and a predicted identification field (CIPk) of the operand, - for each register belonging to the means of exploitation and used by the instruction set, a generated identification field (CIGv) in which the identification of the last instruction having returned its result in this register, - as detection means (17), means allowing, when the execution of an instruction, for each operand, when the field flag (CDk) imposes it, to control the equality between the field generated identification (CIGv) corresponding to the register used by this operand, and the intended identification field (CIPk) of the origin of this operand, - and as means of coercion (18), means making it possible to modify the result of the instructions, if at least one of the equalities controlled is false. 13 - Process according to claims 1 to 12, characterized in that it consists of:
.fwdarw.in protection phase (P):
.cndot.to modify protected software (2p):
- by choosing in the source of the protected software (2ps), at least one conditional branch performed in at least one process chosen algorithm, - by modifying at least a selected portion of the software source protected (2ps), this modification being such that during the execution of the protected software (2p), the functionality of at least one branch chosen conditional, is executed, by means of the second part of execution (2 few), in the unit (6), - and producing:
the first object part (2pos) of the protected software (2p), this first object part (2pos) being such that during the execution of the protected software (2p), the functionality of at least one branch chosen conditional is executed in unit (6), and the second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading into the unit (6) and when running the protected software (2p), appears the second part of execution (2peu) by means of which the functionality of at least one chosen conditional branch is executed, .fwdarw.and in the use phase (U):
.cndot.in the presence of the unit (6) and whenever a portion of the first execution part (2pes) requires it, to execute the functionality of at least a conditional branch in unit (6), so that this portion is executed correctly and that, therefore, the protected software (2p) is fully functional, .cndot.et in (absence of unit (6) and despite the request for a portion of the first execution part (2pes) to execute the functionality of a conditional branch in unit (6), not being able to answer correctly to this request, so that at least this portion is not executed correctly and therefore the protected software (2p) is not not fully functional. 14 - Process according to claim 13, characterized in that it consists, in the protection phase (P), to modify the protected software (2p) - by choosing, in the source of the protected software (2ps) at least one series of chosen conditional branches, - by modifying at least a selected portion of the software source protected (2ps), this modification being such that during the execution of the protected software (2p), the overall functionality of at least one series choice of conditional branches is executed by means of the second part of execution (2peu), in unit (6), - and producing the first object part (2pos) of the protected software (2p), this first object part (2pos) being such that during the execution of the protected software (2p), the functionality of at least one serial choice of conditional branches is executed in the unit (6), and the second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading into the unit (6) and when running the protected software (2p), appears the second part of execution (2peu) by means of which the overall functionality of at least one selected series of conditional branches is executed. 15 - Method according to one of claims 1 to 14, characterized in that it consists in decomposing the protection phase (P) into a sub-phase of protection upstream (P1), independent of the software to be protected and a sub-phase of protection downstream (P2), dependent on the software to be protected. 16 - Process according to claim 15, characterized in that it consists, when of the upstream protection sub-phase (P1), to involve a stage of definitions (S11) in which all definitions are made. 17- Process according to claim 16, characterized in that it consists, after the definition stage (S11), involving a construction stage (S12) in which the means of exploitation are constructed. 18 - Process according to claim 17, characterized in that it consists, after the construction stage (S12), to involve a stage of pre-personalization (S13), consisting in loading into a blank unit (60), at least part of the means operating to obtain a pre-customized unit (66). 19 - Process according to claim 16 or 17, characterized in that it consists, during the upstream protection sub-phase (P1), involving a stage of tool making (S14) in which tools are made for to help to generate protected software or automate software protection. 20 - Process according to claims 15 and 18, characterized in that it consists of break down the downstream protection sub-phase (P2), into .cndot.a creation stage (S21) in which the protected software is created (2p), to from the vulnerable software (2v), .cndot.optionally, a modification stage (S22) in which is modified the protected software (2p), .cndot. and a personalization stage (S23) in which:
- the second object part (2pou) of the protected software (2p) containing the operating means is loaded into at least one blank unit (60) in order to obtain at least one unit (6), - or part of the second object part (2pou) of the protected software (2p) possibly containing the operating means is loaded into at least one pre-customized unit (66) to obtain at least one unit (6). 21 - Process according to claims 19 and 20, characterized in that it consists, during the creation stage (S21) and possibly during the modification stage (S22), to use at least one of the help tools for the generation of protected software Where software protection automation. 22 - System for implementing the method according to claim 17, characterized in that it comprises a program development unit, serving, during the construction stage (S12), to carry out the construction of the means intended for the unit (6), taking into account the definitions occurred at definition stage (S11). 23 - System for implementing the method according to claim 18, characterized in that it comprises a pre-personalization unit (30) allowing to loading at least part of the operating means into at least one unit blank (60), in order to obtain at least one pre-personalized unit (66). 24 - System for implementing the method according to claim 19, characterized in that it comprises a program development unit, serving to be performed in the tool making stage (S14), tool making help with generation of protected software or automation of the protection of software. 25 - System for implementing the method according to claim 20 or 21, characterized in that it comprises a development unit of programs used to create or modify protected software (2p). 26 - System for implementing the method according to claim 20, characterized in that it comprises a personalization unit (45) allowing of load:

.cndot. the second object part (2pou) in at least one blank unit (60), in seen to obtain at least one unit (6), .cndot. or part of the second object part (2pou) in at least one pre-unit personalized (66), in order to obtain at least one unit (6). 27 - Pre-personalized unit (66), characterized in that it is obtained by the system according to claim 23. 28 - Unit (6) for executing protected software (2p) and preventing his unauthorized use, characterized in that it contains the second object part (2po) of the protected software (2p) loaded using a storage unit customization (45) according to claim 26. 29 - Set of units (6), characterized in that the second object part (2inch) protected software (2p), loaded using a personalization unit (45) according to claim 26, is distributed over several units of treatment and storage in such a way that their joint use makes it possible to execute the software protected (2p). 30 - Distribution assembly (2pd) of protected software (2p), characterized in this that it includes:
.cndot. a first distribution part (2pds) containing the first part object (2pos) and intended to operate in a data processing system data (3), .cndot. and a second distribution part (2pdu) appearing as form:
- a blank unit (60), - or a pre-customized unit (66) according to claim 27, capable, after loading personalization information, of transform into a unit (6), - or a unit (6) according to claim 28. 31 - Distribution set (2pd) of protected software (2p) according to the claim 30, characterized in that the first distribution part (2pds) se present in the form of a physical distribution means, CDROM for example, or in the form of files distributed through a network. 32 - Distribution set (2pd) of protected software (2p) according to the claim 30, characterized in that the second dispensing part (2pdu), se in the form of blank units (60), pre-customized units (66) or of units (6), comprises at least one chip card (7). 33 - Processing and storage unit characterized in that it contains the part of the second part object (2pou) needed to transform a unit pre-customized (66) according to claim 27 into a unit (6) according to the claim 28. 34 - Set of processing and storage units characterized in that the processing and storage units used jointly, contain the part of the second part object (2pou) needed to transform a unit pre-customized (66) according to claim 27 into a unit (6) according to the claim 28.