CA2454095A1 - Method for protecting a software using a so-called conditional jump principle against its unauthorised use - Google Patents

Abstract

The invention relates to a method for protecting, from a unit, a vulnerable software against its unauthorized use, said vulnerable software operating on a data processing system. The method consists in creating protected software: - by choosing in the source of the vulnerable software, at least one conditional connection, - by producing the source of the protected software from the source of the vulnerable software, by modifying the source of the vulnerable software so that a second execution part executed in a unit performs at least the functionality of at least one selected conditional connection and makes available to the data processing system information allowing the execution to continue at the chosen place .

Description

METHOD FOR PROTECTING SOFTWARE USING A SAID PRINCIPLE
OF "CONDITIONAL CONNECTION" AGAINST ITS USE NOT
AUTHORIZED
The present invention relates to the technical field of treatment systems of data in the general sense and it targets, more specifically, the means for protect, against its unauthorized use, software running on said systems data processing.
The object of the invention relates, more particularly, to the means for protecting a software against unauthorized use, from a unit of treatment and storage, such a unit being commonly embodied by a card chip or by a hardware key on USB port.
In the technical area above, the main drawback concerns (unauthorized use of software by users who have not paid Rights of license. This illegal use of software causes harm manifesto for software publishers, software distributors and / or anyone integrating such software in products. To avoid such illegal copies, he been proposed in (state of the art, various solutions for protecting software.
Thus, it is known a protection solution consisting in implementing a protective material system, such as a physical element called a key protection or "dongle" in Anglo-Saxon terminology. Such a protection key should guarantee (software execution only in the presence of the key. However, it must to be found that such a solution is ineffective because it presents a disadvantage to be easily bypassable. A malicious person or pirate can, with (help specialized tools, such as disassemblers, remove instructions of protection key check. It then becomes possible to carry out copies illegal corresponding to modified versions of software no longer any protection. In addition, this solution cannot be generalized to all software since it is difficult to connect more than two keys protection on a same system.
The object of the invention is precisely to remedy the drawbacks stated above above by proposing a method to protect software against its use no authorized, from an ad hoc processing and storage unit, in the extent the presence of such a unit is necessary for the software is fully functional.
To achieve such an objective, the object of the invention relates to a method for protect, from at least one blank unit comprising at least means of processing and storage means, software vulnerable to its unauthorized use, said vulnerable software running on a system of data processing. The method according to the invention consists in a protection phase ~ to create protected software - by choosing in the source of the vulnerable software, at least one conditional connection, - by choosing at least a portion of the source of the vulnerable software containing at least one selected conditional branch, - by producing the source of the protected software from the source of the vulnerable software, by modifying at least a selected portion of the vulnerable software source to get at least a portion modified from the source of the protected software, this modification being such that during (execution of the protected software ~ a first part of execution is executed in the system of data processing and a second part of execution is executed in a unit, obtained from (blank unit after loading information, and the second execution part performs at least the functionality at least one conditional branch chosen and puts at the data processing system layout, information allowing the first party to execute its execution at the chosen location, - and by producing ~ a first object part of the protected software, from the source of the protected software, this first object part being such that during (execution of protected software, the first part appears

2 which is executed in the processing system of data and at least a portion of which takes into account that minus a selected conditional branching is executed in Single, ~ and a second object part of the protected software, this second object part being such that, after loading in (blank unit and during (execution of the protected software, appears the second part by means of which each connection selected conditional is executed, ~ and to load the second object part into the blank unit, in order to obtain (unit, and in a phase of use during which the software is executed protected:
~ in the presence of the unit and each time that a portion of the first part of execution requires it, to execute the functionality of a connection conditional in unity, so this portion is executed properly and therefore the protected software is completely functional, ~ and in the absence of the unit and despite the request for a portion of the first part of execution to execute the functionality of a branch conditional in the unit, not being able to respond correctly to this request, so that at least this portion is not executed properly and therefore the protected software is not fully functional.
According to an alternative embodiment, the method according to the invention consists, in the protection phase, to modify the protected software - by choosing, in the source of the protected software at least a series of selected conditional branches, - by modifying at least a selected portion of the software source protected, this modification being such that during (execution of the protected software, the overall functionality of at least one chosen series of conditional branches is executed by means of the second

3 WO 03/01237

4 PCT / FR02 / 02342 execution part, in (unit, - and by producing the first part object of the protected software, this first part object being such that during (execution of the protected software, the functionality of at least one selected series of connections conditional is executed in (unit, and the second part, subject of the protected software, this second part object being such that, after loading into the unit and when (execution of the protected software, appears the second part by which the overall functionality of the minus a selected set of conditional branches is executed.
According to a preferred embodiment, the method according to the invention consists in the protection phase ~ to modify the protected software - by choosing in the source of the protected software at least one algorithmic processing which during execution of the protected software, uses at least one operand, and allows determine, at least in part, the result of a connection conditional chosen, and at least one portion containing at least one treatment chosen algorithmic, - by modifying at least a selected portion of the software source protected, this modification being such that ~ at least the functionality of at least one algorithmic processing chosen is executed by means of the second execution part, at least one chosen algorithmic processing is broken down by so that during the execution of the protected software appear on the means of the second part of execution, several stages separate, namely 0 the provision of at least one operand for (unit, 0 the realization in (unity, of the functionality of the treatment algorithmic on at least this operand, 0 and possibly the provision of at least one result, per (unit for the data processing system, D for at least one chosen algorithmic processing, commands steps are defined so that when running the protected software, each step command is executed by the first part of execution and triggers in (unit, execution by means of the second part of execution, of a step, and a sequencing of the step commands is chosen from (all the orders allowing the execution of the protected software, - and by producing the first part object of the protected software, this first part object being such that during (execution of the protected software, the step commands are executed according to (scheduling selected, and the second part, subject of the protected software, this second part object being such that, after loading in (unit and during (execution of the protected software, appears the second part by means of which the steps are carried out triggered by the first part of execution, and in the use phase ~ in the presence of the unit and each time a step command is contained in a portion of the first part of execution (requires, to execute (corresponding step in (unit, so this portion is executed properly and therefore the protected software is completely functional, ~ and in the absence of (unit, despite the request for a portion of the first execution part to trigger the execution of a step in (unit, not to not be able to respond correctly to this request, so that at least this portion is not executed correctly and that, therefore, the protected software is not fully functional.
s According to a preferred embodiment, the method according to the invention consists in the protection phase ~ to modify the protected software:
- by choosing at least one variable used in at least one chosen algorithmic processing, which during (software execution protected, partially defines the state of the protected software, - by modifying at least a selected portion of the software source protected, this modification being such that during (execution of the protected software, at least one variable chosen or at least one copy chosen variable resides in (unit, - and by producing the first part object of the protected software, this first part object being such that during (execution of protected software, at minus a portion of the first part of execution also takes into account account that at least one variable or at least one copy of variable resides in (unit, and the second part, subject of the protected software, this second part object being such that, after loading in (unit and during (execution of the protected software, appears the second part 'of execution by means of which at least one variable chosen, or at least one copy of the chosen variable also resides in funlte, and in the use phase ~ in the presence of (unit each time a portion of the first part of execution (requires, to use a variable or a copy of a variable residing in (unit, so this portion is executed correctly and that, therefore, the protected software is fully functional, ~ and in (absence of (unit, despite the request for a portion of the first execution part of using a variable or a copy of resident variable in (unit, not being able to respond correctly to this request, so that at least this portion is not performed correctly and that, by Consequently, the protected software is not fully functional.

According to another preferred embodiment, the method according to the invention is in the protection phase;
~ to be defined - a set of elementary functions whose elementary functions are likely to be executed in (unit, - and a set of elementary commands for this set of functions elementary, these elementary commands being likely to be executed in the data processing system and trigger (execution in (unit, elementary functions, ~ to build operating resources allowing (unit, to execute the elementary functions of said game, execution of these elementary functions being triggered by (execution in the data processing system, basic commands, ~ and modify the protected software:
- by choosing in the source of the protected software, at least one step which during (execution of the protected software, realizes the functionality of a algorithmic processing, - by modifying at least a selected portion of the software source protected, this modification being such that at least one chosen step is broken down so that when (execution of the protected software, this step is executed by means of the second part of execution, using functions elementary ~ for at least one chosen step, elementary commands are integrated into the source of the protected software, so that during (execution of the protected software, each command elementary is executed by the first part of execution and triggers in (unit, execution by means of the second part of execution, of an elementary function, and a scheduling of elementary commands is chosen among all the orders allowing (execution of the protected software, - and by producing the first part object of the protected software, this first part object being such that during the execution of the protected software, the elementary commands are executed according to the scheduling selected, and the second object part of the protected software also containing the operating means, this second object part being such that, after loading in the unit and during (software execution protected, appears the second part of execution by means of which are executed the elementary functions triggered by the first part of execution, and in the use phase ~ in the presence of the unit and each time an elementary command contained in a portion of the first part of execution (requires, to execute the corresponding elementary function in (unit, so that this portion is executed correctly and therefore the software protected is fully functional, ~ and in (absence of the unit, despite the request for a portion of the first execution part, to trigger the execution of an elementary function in (unit, not being able to respond correctly to this request, from so that at least this portion is not executed correctly and that, by Consequently, the protected software is not fully functional.
According to another preferred embodiment, the method according to the invention is in the protection phase ~ to be defined - at least one software execution characteristic, capable of being at least partially monitored in (unit, - at least one criterion to respect for at least one characteristic software execution, - detection means to be implemented in (unit and allowing s detect that at least one software execution characteristic does not does not meet at least one associated criterion, - and means of coercion to be implemented in (unity and to inform the data processing system and / or modify (software execution, when at least one criterion is not met, ~ to build the operating resources allowing the unit, to also put using the detection means and the coercion means, ~ and modify the protected software - by choosing at least one software execution characteristic to monitor, among the performance characteristics likely to be monitored, - by choosing at least one criterion to respect for at least one selected software execution characteristic, - by choosing in the source of the protected software, functions elementary for which at least one performance characteristic of software chosen, is to be monitored, - by modifying at least a selected portion of the software source protected, this modification being such that during (execution of the protected software, at least one selected execution characteristic is monitored by the second part of execution, and non-compliance of a criterion leads to information from the processing system data and / or a modification of the execution of the protected software, - and by producing the second object part of the protected software containing the operating means also using the means of detection and means of coercion, this second object part being such that, after loading into the unit and during (execution of the protected software, at least one software execution characteristic is monitored and non-compliance with a criterion leads to information of the data processing system and / or a modification of the execution of the protected software, and in the use phase ~ in the presence of (unit - as long as all the criteria corresponding to all the characteristics monitored execution of all modified portions of the software protected are respected, to allow nominal operation of these portions of the protected software and therefore allow the nominal operation of protected software, - and if at least one of the criteria corresponding to a characteristic supervised execution of a portion of the protected software is not complied with, to inform the data processing system and / or to modify the operation of the protected software portion, so that the operation of the protected software is modified.
According to an alternative embodiment, the method according to the invention consists in the protection phase ~ to be defined - as a feature of software execution likely to be monitored, a variable measuring the use of a functionality software, - as a criterion to be respected, at least one threshold associated with each measurement variable, - and updating means making it possible to update at least one measurement variable, ~ to build the operating resources allowing the unit to also put implement the updating means, ~ and modify the protected software - by choosing as a software execution characteristic to monitor, at least one measurement variable of (use of a software functionality, - by choosing at least one feature of the protected software whose use is likely to be monitored by a measurement variable, at least one measurement variable used to quantify (use 1o of said functionality, at least one threshold associated with a chosen measurement variable corresponding to a limit of use of said functionality, and at least one method for updating a measurement variable chosen according to (use of said functionality, - and by modifying at least a selected portion of the software source protected, this modification being such that, when (execution of the protected software, the measurement variable is updated using the second part of execution, depending on (use of said functionality and at least one threshold violation is taken into account, and in the use phase, in the presence of the unit, and in the event that it East detected at least one threshold crossing corresponding to at least one limit of use, to inform the data processing system and / or to edit the protected portion of the software, so that the operation of protected software is changed.
According to an alternative embodiment, the method according to the invention consists -i in the protection phase ~ to be defined - for at least one measurement variable, several associated thresholds, - and different means of coercion corresponding to each of these thresholds, ~ and modify the protected software - by choosing in the source of the protected software, at least one chosen measurement variable to which several must be associated thresholds corresponding to different limits of use of the feature - by choosing at least two thresholds associated with the measurement variable selected, - and by modifying at least a selected portion of the software source protected, this modification being such that, when (execution of the protected software, the overruns of the various thresholds are taken into account account, by means of the second publication of execution, so different, and in the use phase ~ in the presence of unity - in the event that a first threshold is exceeded, at order the protected software to stop using the functionality correspondingly, and in the event that a second threshold is exceeded, at render the corresponding functionality and / or at least one inoperative portion of the protected software.
According to an alternative embodiment, the method according to the invention consists in the protection phase ~ to define reloading means allowing to credit at least one additional use for at least one software feature monitored by a measurement variable, ~ to build the operating resources also allowing (unit to put using the reloading means, ~ and modify the protected software - by choosing in the source of the protected software, at least one chosen measurement variable to limit (use of a functionality to which at least one additional use must can be credited, - and by modifying at least one selected portion, this modification being such as in a so-called recharging phase, at least one use additional of at least one functionality corresponding to a selected measurement variable can be credited, and in the recharging phase ~ to update at least one selected measurement variable and / or at least one associated threshold, so as to allow at least one use additional functionality.
According to an alternative embodiment, the method according to the invention consists -i in the protection phase ~ to be defined as a software performance feature that may be monitored, a software usage profile, - and as a criterion to be respected, at least one performance trait of software, ~ and modify the protected software - by choosing as a software execution characteristic to monitor at least one software usage profile, - by choosing at least one performance trait than at least one profile of use chosen must respect, - and by modifying at least a selected portion of the software source protected, this modification being such that, when (execution of the protected software, the second part of execution respects all the features of execution chosen, ~ and in the use phase in the presence of (unit, and in the event that it East detected that at least one performance trait is not respected, to inform the data processing system and / or to modify the functioning of the portion of the protected software, so that the operation of the software protected is changed.
According to an alternative embodiment, the method according to the invention consists in the protection phase ~ to be defined - a set of instructions whose instructions are likely to be executed in (unit, - a set of instruction commands for this set of instructions, these instruction commands being capable of being executed in the data processing and trigger system in (unit (execution of instructions, - as a usage profile, (sequence of instructions, - as an execution feature, a desired sequence for (execution of instructions, as detection means, means for detecting that (sequence of instructions does not correspond to that desired, and as means of coercion, means of informing the data processing system and / or modify the operation of the portion of protected software when the sequence of instructions does not correspond to that desired, ~ to build the operating resources also allowing the unit to execute the instructions in the instruction set, the execution of these instructions being triggered by the execution in the data processing system of instruction commands, ~ and modify the protected software - by modifying at least a selected portion of the software source protected by transforming basic functions into instructions, D by specifying the sequence that must be respected at least some of the instructions when executed in (unit, D and by transforming elementary commands into commands instructions corresponding to the instructions used, and in the use phase, in the presence of the unit, if it is detected that (sequence of instructions executed in the unit does not correspond to that desired, to inform the data processing system and / or to modify the operation of the protected software portion, so that the operation of protected software is changed.
According to an alternative embodiment, the method according to the invention consists ~ in the protection phase ~ to be defined as an instruction set, an instruction set of which at least some instructions work on registers and use at least an operand to render a result, - for at least part of the instructions working on registers a part defining the functionality of (instruction, and a part defining (desired sequence for (execution instructions and having corresponding bit fields at:
0 an instruction identification field, 0 and for each operand of the instruction * a flag field, * and a planned identification field of (operand, - for each register belonging to the operating resources and used by the instruction set, a generated identification field in which is automatically memorized the identification of the last instruction having returned its result in this register, - as detection means, means allowing, during the execution of an instruction, for each operand, when the field flag requires it, to control the equality between the field of identification generated corresponding to the register used by this operand, and the field expected identification of the origin of this operand, - and as means of coercion, means making it possible to modify the result of the instructions, if at least one of the ties controlled is false.
According to another preferred embodiment, the method according to the invention is in the protection phase ~ to be defined - as a triggering command, a basic command or an instruction command, - as a dependent function, an elementary function or a instruction, - as an instruction, at least one argument for an order triggering, corresponding at least in part to the information transmitted by the data processing system to (unit, in order to trigger the execution of the corresponding dependent function, - a method of renaming the instructions allowing renaming of the 1s instructions in order to obtain triggering orders with instructions renamed, - and recovery means intended to be implemented in (unit during the use phase, and allowing to find the dependent function to be executed, from the renamed setpoint, ~ to build operating resources allowing the unit to also put implement the means of recovery, ~ and modify the protected software - by choosing commands from the source of the protected software triggering, - by modifying at least a selected portion of the software source protected by renaming the instructions of the triggering commands chosen, in order to conceal (identity of dependent functions corresponding, - and by producing: ' the first part object of the protected software, this first part object being such that during the execution of the protected software, the trigger commands with renowned instructions are executed, and the second part, object of the protected software containing the means operating also implementing the means of recovery, this second object part being such that, after loading in the unit and during (execution of the protected software, (identity of dependent functions whose execution is triggered by the first part of execution is restored to means of the second part of execution, and the functions dependent are executed by means of the second part execution, -i and in the use phase ~ in the presence of (unit and each time a command triggers at renowned instruction, contained in a portion of the first part of execution (requires, to restore in (unity, the identity of the function corresponding dependent and execute it, so that portion is executed correctly and therefore the protected software is fully functional, ~ and in (absence of the unit, despite the request for a portion of the first execution part, to trigger (execution of a dependent function in (unit, not being able to respond correctly to this request, from so that at least this portion is not executed correctly and that, by Consequently, the protected software is not fully functional.
According to an alternative embodiment, the method according to the invention consists in the protection phase ~ to define for at least one dependent function, a family of functions algorithmically equivalent dependent, but triggered by triggering commands whose renamed instructions are different, ~ and modify the protected software - by choosing at least one source from the protected software triggering command with renamed setpoint, - and by modifying at least a selected portion of the software source protected by replacing at least the renowned setpoint of a trigger command with renamed setpoint chosen, by another renamed setpoint, triggering a function dependent on the same family.
According to an alternative embodiment, the method according to the invention consists in the protection phase, to be defined, for at least one dependent function, a family of algorithmically equivalent dependent functions - by concatenating a noise field to (information defining the part of the dependent function to be executed in (unit, - or by using the identification field of (instruction and the fields expected identification of the operands.
According to an alternative embodiment, the method according to the invention consists in the protection phase ~ to be defined - as a method of renaming instructions, a method of encryption to encrypt the instructions, - and as means of recovery, means implementing a decryption method to decrypt the instructions renamed and thus re-establish the identity of the functions dependent on run in unity.
The method according to the invention thus makes it possible to protect the use of a software by the implementation of a processing and storage unit which presents the peculiarity of containing a part of the running software. he it follows that any version derived from the software attempting to operate without the unit of treatment and memorization requires recreating the part of the software contained in the unit of processing and storage during (execution, under penalty that this version derived from the software is not fully functional.
Various other characteristics will emerge from the description given below in reference to the accompanying drawings which show, by way of non-limiting examples, of the embodiments and implementation of (object of (invention.
Figs. 10 and 11 are functional block diagrams illustrating the various representations of software that is respectively unprotected and protected by the process in accordance with (invention.
Figs. 20 to 22 illustrate, by way of examples, various embodiments a device for implementing the method according to the invention.
Figs. 30 and 31 are functional block diagrams explaining the principle general of the process according to (invention.
Figs. 40 to 43 are diagrams illustrating the protection method according to (invention implementing the principle of protection by variable.
Figs. 50 to 54 are diagrams illustrating the protection method according to (invention implementing the principle of protection by dissociation time.
Figs. 60 to 64 are diagrams illustrating the protection method according to the invention implementing the principle of protection by functions elementary.
Figs. 70 to 74 are diagrams illustrating the protection method according to (invention implementing the principle of protection by detection and coercion.
Figs. 80 to 85 are diagrams illustrating the protection process according to (invention implementing the principle of protection by renaming.
1s Figs. 90 to 92 are diagrams illustrating the protection method according to the invention implementing the principle of protection by connection conditional.
Fig. 100 is a diagram illustrating the different phases of implementation of the subject of the invention.
Fig. 110 illustrates an embodiment of a system allowing the setting in work of the construction stage of the protection phase in accordance with (invention.
Fig. 120 illustrates an exemplary embodiment of a pre-personalization used in the protection method according to (invention.
Fig. 130 illustrates an exemplary embodiment of a system allowing the setting in work from the tool-making stage of the protection phase in accordance with (invention.
Fig. 140 illustrates an embodiment of a system allowing the setting in protection process according to (invention.
Fig. 150 illustrates an exemplary embodiment of a personalization unit used in the protection method according to the invention.
In the following description, the following definitions will be used ~ A data processing system 3 is a system capable of executing a program.
~ A processing and storage unit is a unit capable - accept data provided by a processing system data 3, - to restore data to the data processing system 3, - to store data at least in part secretly and to keep at least some of these even when (unit is off, - and to perform algorithmic processing on data, part or all of this processing is secret.
~ A unit 6 is a processing and storage unit putting in implements the method according to (invention.
~ A blank unit 60 is a unit which does not implement the method according to (invention, but who can receive information transforming it into a unit 6.
~ A pre-personalized unit 66 is a blank unit 60 having received a part of the information allowing it, after receiving information to be transformed into a unit 6.
~ Loading information into a blank 60 unit or a pre-custom 66 corresponds to a transfer of information in the unit blank 60 or (pre-personalized unit 66, and to storage of said information transferred. Optionally, the transfer may include a information format change.
~ A variable, a data or a function contained in the system of data processing 3 will be indicated by a capital letter, while a variable, data or function contained in (unit 6 will be indicated by a lowercase.
~ "Protected software" is software that has been protected by at least one protection principle implemented by the process according to (invention.
~ "Vulnerable software" is software that has not been protected by any protection principle implemented by the process according to (invention.
~ In case the differentiation between a vulnerable software and a software protected does not matter, the term "software" is used.
~ A software comes in various representations depending on the time considered in its life cycle - a source representation, - an object representation, - a distribution, - or a dynamic representation.
~ A source representation of software is understood as a representation which after transformation, gives an object representation.
A source representation can be presented at different levels, from abstract conceptual level at a level executable directly by a data processing system or a processing unit and storage.

~ An object representation of software corresponds to a level of representation which after transfer to a distribution then loading in a data processing system or a processing unit and memorization, can be executed. This could be, for example, a code binary, interpreted code, etc.
~ A distribution is a physical or virtual medium containing the object representation, this distribution must be made available to the user to allow him to use the software.
~ A dynamic representation corresponds to the execution of the software from of its distribution.
~ A portion of software corresponds to any part of software and can, for example, correspond to one or more instructions consecutive or not, and / or one or more consecutive functional blocks or not, and / or one or more functions, and / or one or more sub programs, and / or one or more modules. A portion of software can also match all of this software.
Figs. 10 and 11 illustrate the various representations respectively of a vulnerable software 2v in the general sense, and protected software 2p according to the process in accordance with (invention.
Fig. 10 illustrates various representations of vulnerable 2v software appearing during its life cycle. Vulnerable 2v software can so appear under fades of the following representations ~ a 2vs source representation, ~ an obj and 2vo representation, ~ 2vd distribution. This distribution can occur commonly in the form of a physical distribution medium such as a CDROM or in the form of files distributed across a network (GSM, Internet, ...), ~ or a dynamic representation 2ve corresponding to (execution of the vulnerable software 2v on a data processing system 3 of all known types, which conventionally comprises at least one processor 4.

Fig. 11 illustrates various representations of 2p protected software appearing during its life cycle. Protected 2p software can appear under one of the following representations ~ a 2ps source representation comprising a first source part intended for the data processing system 3 and a second source part intended for (unit 6, part of these source parts commonly being be contained in common files, ~ a 2in object representation comprising a first Zpos object part intended for the data processing system 3 and a second object part 2 for unit 6, ~ a 2pd distribution comprising a first part of 2pds distribution containing the first part 2pos object, this first 2pds distribution part being intended for data processing system 3 and which may arise commonly in the form of a physical distribution medium such than a CDROM, or in the form of files distributed through a network (GSM, Internet, ...), - and a second 2pdu distribution part in the form at least one pre-personalized unit 66 on which part of the second Zpou object part has been loaded and for which (user must complete the personalization by loading additional information, in order to obtain a unit 6, these additional information being obtained, for example, by upload or download over a network, ~ or at least one unit 6 on which the second object part 2pou has been charged, ~ or a dynamic 2pe representation corresponding to the execution of the protected software 2p. This dynamic 2pe representation includes a first part of execution 2pes which is executed in the system of data processing 3 and a second execution part 2 little which is executed in (unit 6.

If the differentiation between the different representations of the software protected 2p does not matter, the expressions first part of the software protected and second part of the protected software are used.
The implementation of the method according to (invention in accordance with the dynamic representation of fig. 11, uses a 1p device comprising a data processing system 3 connected by a link 5 to a unit 6. The system of data processing 3 is of all types and comprises, so classic, at least a processor 4. The data processing system 3 can be a computer where do part, for example, of various machines, devices, stationary products or mobile, or vehicles in the general sense. Connection 5 can be carried out anyway possible such that for example by a serial line, a USB bus, a radio link, urie optical link, a network link or a direct electrical connection on a circuit of the system of data processing 3, etc. It should be noted that (unit 6 can possibly be located physically inside the same integrated circuit as processor 4 of system of data processing 3. In this case, (unit 6 can be considered as a co-processor versus processor 4 of the data processing system 3 and the link 5 is internal to the integrated circuit.
Figs. 20 to 22 show by way of illustration and without implied limitation, various embodiments of the device 1p allowing the implementation of the method of protection according to (invention.
In (exemplary embodiment illustrated in FIG. 20, the device for protection 1p comprises, as data processing system 3, a computer and, in so unit 6, a smart card 7 and its interface 8 commonly called a reader of menu. Computer 3 is linked to (unit 6 by a link 5. When (execution of a protected software 2p, the first part of 2pes execution which is executed in the computer 3 and the second execution part 2 which is executed in the card to chip 7 and its interface 8, must both be functional in order to that the 2p protected software is fully functional.
In (exemplary embodiment illustrated in FIG. 21, the device for protection 1p equips a product 9 in the general sense, comprising various organs 10 adapted to the where the functions assumed by such a product 9. The 1p protection device includes, on the one hand, a data processing system 3 embedded in the product 9 and, on the other hand, a unit 6 associated with the product 9. So that the product 9 is entirely functional, protected 2p software must be fully functional. So, during running 2p protected software, the first part of 2pes running which East executed in data processing system 3 and the second part execution 2 little which is performed in unit 6, both must be functional. This 2p protected software therefore indirectly protects against unauthorized use, product 9 or any of its functionality. Through example the product 9 can be an installation, a system, a machine, a toy, a apparatus appliances, telephone, etc.
In (exemplary embodiment illustrated in FIG. 22, the device for protection 1p includes multiple computers, as well as part of a network of communication. The data processing system 3 is a first computer connected by a link 5 network type, to a unit 6 consisting of a second computer. For the setting work of (invention, the second computer 6 is used as a server of licenses for protected software 2p. When running protected software 2p, the first part of execution 2pes which is executed in the first computer 3 and the second part of execution 2peu which is executed in the second computer both must be functional so that 2p protected software is fully functional.
Fig. 30 makes it possible to explain more precisely, the method of protection in accordance with the invention. It should be noted that vulnerable software 2v is considered as being executed completely in a data processing system 3. By against, in the case of the implementation of a protected software 2p, the system of data processing 3 includes transfer means 12 connected by the link 5, to transfer means 13 forming part of (unit 6 making it possible to make communicate with each other, the first part of 2pes execution and the second part 2peu execution of protected software 2p.
It must be considered that the means of transfer 12,13 are of a nature software and / or material and are capable of ensuring and possibly optimizing the data communication between the data processing system 3 and unit 6.
These transfer means 12, 13 are adapted to allow a software protected 2p which is preferably independent of the type of link 5 used. These transfer means 12, 13 are not part of (object of (invention and do not are not described more precisely because they are well known to those skilled in the art. The first part of the 2p protected software includes commands. When (execution of protected software 2p, the execution of these commands by the first party execution 2pes allows communication between the first 2pes execution part and the second part of execution 2peu. In the following description, these orders are represented by IN, OUT or TRIG.
As illustrated in fig. 31, to allow the implementation of the second part of execution 2peu of the protected software 2p, (unit 6 comprises means of protection 14. The protection means 14 include storage means 15 and of the means of treatment 16.
For the sake of simplification in the following description, it is chosen to consider, when (running 2p protected software, the presence of (unit 6 or (absence of (unit 6. In reality, a unit 6 presenting means of protection 14 unsuitable for (execution of the second part of execution 2peu of the software protected 2p is also considered absent, whenever (software execution protected 2p is not correct. In other words ~ a unit 6 physically present and comprising means for protection 14 adapted to (execution of the second execution part 2 little protected software 2p, is always considered as present, ~ a unit 6 physically present but comprising means for protection 14 unsuitable, that is to say not allowing the implementation correct of the second part of execution Zpeu of the protected software 2p is considered to be present, when functioning properly, and as absent when it is not functioning properly, ' ~ and a unit 6 physically absent is still considered to be absent.
In the case where (unit 6 is constituted by a smart card 7 and its interface the transfer means 13 are broken down into two parts, one of which is sure (interface 8 and of which felt is on the smart card 7. In this example of realization, (absence of the smart card 7 is considered equivalent to (absence of (unit 6. In other words, in (absence of the smart card 7 and / or 2s its interface 8, the protection means 14 are not accessible and do not allow therefore not the execution of the second execution part 2 bit of the software protected from so the 2p protected software is not fully functional.
In accordance with the invention, the protection process aims to implement a protection principle known as "conditional connection" whose description East carried out in relation to fig. 90 to 92.
For the implementation of the principle of protection by conditional connection, it is chosen from the source of the vulnerable 2vs software, at least one connection conditional BC. It is also chosen at least a portion of the source of the software vulnerable 2vs containing at least one BC conditional branch chosen.
At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the protected 2ps software. This change is such that in particular when running protected software 2p at least a portion of the first 2pes execution part, which is executed in the data processing system 3, takes into account that the functionality of at least one conditional branch chosen BC is performed in unit 6, ~ and the second part of execution 2peu, which is executed in (unit 6, performs at least the functionality of at least one conditional branch BC chooses and makes available to the data processing system 3, information allowing the first part of execution 2pes, to continue its execution at (chosen location.
The first part of 2pes execution of the protected 2p software, executed in the data processing system 3, performs branching commands conditional, triggering in (unit 6, (execution by means of the second part of execution 2peu, of conditional branchings deported be whose functionality is equivalent to the functionality of the selected BC conditional branches.
Fig. 90 illustrates an example of execution of vulnerable 2v software. In this example, it appears, during (execution of vulnerable software 2v in the data processing system 3 at a given time, a connection conditional BC telling vulnerable software 2v where to continue unfolding, at know (one of the three possible places Bl, Ba or B3. It must be understood that the conditional branch BC takes the decision to continue (execution of the software at place Bl, Ba or B3.
Fig. 91 illustrates an exemplary implementation of (invention for which the conditional branch chosen to be deported to (unit 6, corresponds to conditional branch BC. In this example, when running in the system data processing 3 of the first part 2pes execution of the software protected 2p and in the presence of unit 6, it appears ~ at time t1, the execution of the conditional branch command CBCI triggering in unit 6, execution by means of the second part of execution 2peu, of conditional branching deported bc algorithmically equivalent to the conditional branching BC, this conditional branching command CBCI being represented by TRIG (bc) ~ and at time t2, the transfer from unit 6 to the processing system of data 3, of (information allowing the first part of execution 2pes, to continue its execution at (chosen place, namely (place Bl, B2 or B3.
Note that when performing a portion of the first part 2pes execution of protected 2p software, connection commands conditional executed in the data processing system 3 trigger (execution of the corresponding remote conditional connections in (unit 6.
Thus, it appears that in the presence of (unit 6, this portion is executed correctly and therefore the 2p protected software is fully functional.
Fig. 92 illustrates an attempt to execute the protected 2p software, then than (unit 6 is absent. In this example, during (execution in the data processing 3 of the first part 2pes execution of the software protected Zp ~ at (time t1, (execution of the conditional branching command CBCi, cannot trigger (execution of remote conditional connection bc, taking into account (absence of (unit 6, ~ and at (time t2, the transfer of information allowing the first part 2pes execution to continue at (chosen location fails given (absence of (unit 6.
It therefore appears that in the absence of (unit 6, at least one request from a portion of the first 2pes execution part to trigger the execution of a conditional branch deported in (unit 6, cannot be satisfied correctly, so that at least this portion is not executed correctly and that, therefore, 2p protected software is not completely functional.
In the foregoing description in relation to FIGS. 90 to 92, the object of the invention aims to deport in unit 6, a conditional connection. Of course, a preferred embodiment of (invention may consist of deporting in (unit 6, a series conditional branches whose overall functionality is equivalent to (set of functionalities of conditional connections which have been deported.
The execution of the overall functionality of this series of connections conditional deportees results in the provision, for the processing system of data 3, information allowing the first part of 2pes execution of the software protected 2p to continue its execution at (chosen location.
According to another advantageous characteristic of the invention, the method of protection aims to implement a principle of protection, said by "dissociation temporal ", a description of which is given in relation to FIGS. 50 to 54.
For the implementation of the principle of protection by temporal dissociation, he at least one treatment is chosen in the source of the vulnerable 2vs software algorithmic using at least one operand and rendering at least one result.
It is also choose at least a portion of the source of the vulnerable 2vs software containing at minus an algorithmic treatment chosen.
At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software. This change is such that in particular ~ when running 2p protected software, at least a portion of the first part of execution 2pes, which is executed in the system of data processing 3, takes into account that the functionality of at least a chosen algorithmic processing is executed in unit 6, ~ when running 2p protected software, the second part of execution 2s 2peu, which is executed in unit 6, performs at least the functionality at least one chosen algorithmic processing, ~ when running 2p protected software, each algorithmic processing chosen is broken down into several distinct stages, namely - step 1: the provision of the operand (s) for (unit 6, - step 2: the realization in (unit 6) of the functionality of the treatment algorithmic chosen using this or these operands, - and step 3: possibly, provision by (unit 6 for the data processing system 3, of the processing result chosen algorithmic, ~ step commands are defined to trigger the execution of steps, ~ and a sequencing of step orders is chosen from the set orders allowing the execution of the protected software 2p.
The first part of 2pes execution of the protected 2p software, which is executed in the data processing system 3, executes the step commands, triggering in (unit 6, (execution by means of the second part execution 2 little, from each of the previously defined steps.
Fig. 50 illustrates an example of execution of a vulnerable 2v software. In this example, it appears, during the execution of the vulnerable software 2v, in the data processing system 3, at a given instant, the calculation of Z ~ - F (X, Y) corresponding to the assignment to a variable Z, of the result of a processing algorithm represented by a function F and using operands X and Y.
Fig. 51 illustrates an exemplary implementation of (invention for which the algorithmic processing chosen in fig. 50 is deported to (unit 6. In this example, during (execution in the data processing system 3 of the first part of 2pes execution of the protected 2p software and in the presence of (unit 6, it appears ~ at (instant t1, (step l, namely the execution of a step command CEl triggering the transfer of X and Y data from the processing system of data 3 to memory areas respectively x and y located in the storage means 15 of (unit 6, this step command CEl being represented by OUT (x, X), OUT (y, ~, ~ at time t2, (step 2, namely (execution of a step command CE2, triggering in (unit 6, (execution by means of the second part of execution 2peu, of the function f, this function f being algorithmically equivalent to function F and this step command CE2 being represented by TRIG (f). More specifically, (execution of the command CEZ step leads to (execution of the function f which uses the content of storage areas x and y and returns its result in an area of storage z of unit 6, ~ and at (instant t3, step 3, namely (execution of a step command CE3 triggering the transfer of the result of the function f, contained in the area of storage z of (unit 6 to the data processing system 3 so to assign it to variable Z, this step command CE3 being represented by IN (z).
In the example illustrated, steps 1 to 3 are carried out successively. he is at note that two improvements can be made ~ The first improvement concerns the case where several treatments algorithms are deported to (unit 6 and at least the result of a algorithmic processing is used by another algorithmic processing.
In this case, certain transfer steps may be possibly deleted.
~ The second improvement aims to opt for a relevant scheduling stage commands from among (all the schedules allowing (execution of the protected software 2p. In this respect, it is preferable to choose a scheduling of step commands which temporally dissociates (execution of the steps, by inserting, between them, portions of code executed in the data processing system 3 and comprising or not step commands for determining other data. The Fig. 52 and 53 illustrate the principle of such an embodiment.
Fig. 52 shows an example of execution of vulnerable 2v software. In this example, it appears, during the execution of the vulnerable software 2v, in the data processing system 3, the execution of two processing algorithmic leading to the determination of Z and Z ', such as Z E- F (X, Y) and Z' E-F '(X', Y ').
Fig. 53 illustrates an example of implementation of the method according to the invention for which the two algorithmic treatments chosen in fig. 52 are deported in (unit 6. According to such an example, when running in the system treatment data 3, of the first 2pes execution part of the protected software 2p, and in presence of unit 6, it appears, as explained above, the execution of step commands CEI, CE2, CE3 corresponding to the determination of Z and step commands CE'1, CE'2, CE'3 corresponding to the determination of Z '.
As illustrated, the step commands CE1 to CE3 are not executed consecutively insofar as step commands CE'1 to CE'3, as well than other portions of code are interspersed. In the example, it is thus realized (following scheduling: CEI, portion of intercalated code, CE2, portion of code intercalated, CE'1, portion of intercalated code, CE'2, portion of intercalated code, CE'3, portion of intercalated code, CE3.
It should be noted that, when running the 2p protected software, in the presence of unit 6, each time a step command contained in a portion of the first part of 2pes execution of protected software 2p requires it, step corresponding is executed in (unit 6. Thus, it appears, that in the presence of (unit 6, this portion is executed correctly and that, therefore, the software protected 2p is fully functional.
Fig. 54 illustrates an example of an attempt to run protected software 2p while (unit 6 is absent. In this example, when (execution in the system data processing 3 of the first part 2pes execution of the software protected 2p ~ at (time t1, (execution of the step command OUT (x, X), OUT (y, Y) does cannot trigger the transfer of X and Y data to the areas of respective storage x and y taking into account (absence of unit 6, ~ at (time t2, (execution of the TRIG step command (f) cannot trigger (execution of function f, taking into account (absence of (unit ~ and at (time t3, (execution of the step command IN (z) cannot trigger the transfer of the result of the function f, taking into account (absence of (unit 6.
It therefore appears that in the absence of (unit 6, at least one request from a portion of the first part of execution 2pes to trigger (execution of a step in (unit 6, cannot be satisfied correctly, so that at least this portion is not executed correctly and therefore the software protected 2p is not fully functional.
According to another advantageous characteristic of the invention, the method of protection aims to implement a protection principle known as "variable" of which a description is made in relation to FIGS. 40 to 43.
For the implementation of the principle of protection by variable, it is chosen in the source of the vulnerable software 2vs at least one variable which during (execution of vulnerable software 2v, partially defines (state of it. By state of a software it must be understood all the information, at a given time, necessary at complete execution of this software, so that (absence of such a variable selected harms (complete execution of this software. At least one is also chosen portion of source of the vulnerable Zvs software containing at least one chosen variable.
At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the protected 2ps software. This change is such that when (running 2p protected software, at least a portion of the first part of execution 2pes which is executed in the system of Treatment of data 3, takes into account that at least one chosen variable or at least one copy chosen variable resides in unit 6.
Fig. 40 illustrates an example of execution of a vulnerable software 2v. In this example, it appears during (execution of vulnerable software 2v in the system data processing 3 ~ at (instant t1, (assignment of the data X to the variable Vl, represented by VlE- X, ~ at (instant t2, the assignment of the value of the variable Vi to the variable Y, represented by Y ~ Vl, ~ and at time t3, the assignment of the value of the variable Vl to the variable Z, represented by Z E- Vl.
Fig. 41 illustrates an example of a first form of implementation of (invention for which the variable resides in (unit 6. In this example, during (execution in the data processing system 3 of the first part 2pes execution of protected software 2p, and in the presence of unit 6, it appears ~ at time t1, (execution of a transfer command triggering the transfer of data X from the data processing system 3 to the variable v1 located in the storage means 15 of (unit 6, this transfer command being represented by OUT (vl, X) and corresponding in the end to (assignment of the data X to the variable v1, ~ at (instant t2, (execution of a transfer command triggering the transfer of the value of variable v1 residing in (unit 6 to the system of data processing 3 in order to assign it to the variable Y, this transfer command being represented by IN (vl) and corresponding to the (wrong with (assignment of the value of variable v1 to variable Y, ~ and at (instant t3, (execution of a transfer command triggering the transfer of the value of variable v1 residing in (unit 6 to the system of data processing 3 in order to assign it to variable Z, this transfer command being represented by IN (vl) and corresponding to the final to (assignment of the value of variable v1 to variable Z.
It should be noted that when (running 2p protected software, at least one variable resides in (unit 6. So when a portion of the first part 2pes execution of protected software 2p (requires, and in the presence of unit 6, the value of this variable residing in (unit 6 is transferred to the Treatment of data 3 to be used by the first 2pes execution part of the software protected 2p, so that this portion is executed correctly and that by Consequently, the 2p protected software is fully functional.
Fig. 42 illustrates an example of a second form of implementation of (invention for which a copy of the variable resides in (unit 6. In this example, when running in the data processing system 3 of the first part of 2pes execution of the protected 2p software, and in the presence of (unit 6, it appears ~ at (time t1, the assignment of the data X to the variable Vl located in the data processing system 3, as well as the execution of an order of transfer triggering the transfer of data X from the system of data processing 3 to variable v1 located in the means of storage 15 of (unit 6, this transfer command being represented by OUT (v1, X), ~ at (instant t2, the assignment of the value of the variable Vl to the variable Y, ~ and at time t3, (execution of a transfer command triggering the transfer of the value of variable v1 residing in (unit 6 to the system data 3 in order to assign it to variable Z, this transfer command being represented by IN (vl).
It should be noted that when running 2p protected software, at least one copy of a variable resides in unit 6. So when a portion of the first part 2pes execution of protected software 2p (requires, and in the presence of (unit 6, the value of this copy of variable residing in (unit 6 is transferred to the system of data processing 3 to be used by the first execution party 2pes du 2p protected software, so this portion is executed correctly and by Consequently, the 2p protected software is fully functional.
Fig. 43 illustrates an example of an attempted execution of the protected software 2p while (unit 6 is absent. In this example, when (execution in the system data processing 3 of the first part 2pes execution of the software protected 2p ~ at (time t1, (execution of the transfer command OUT (vl, X) cannot not trigger the transfer of data X to variable v1, taking into account of (absence of unit 6, ~ at (instant t2, (execution of the transfer command IN (vl) cannot trigger the transfer of the value of the variable v1 to the system of data processing 3, taking into account (absence of unit 6, ~ and at (time t3, the execution of the transfer command IN (vl) cannot trigger the transfer of the value of the variable v1 to the system of data processing 3, taking into account the absence of unit 6.
It therefore appears that in the absence of (unit 6, at least one request from a portion of the first part of 2pes execution to use a variable or a copy of variable residing in (unit 6, cannot be satisfied correctly, from kind that at least this portion is not performed correctly and that, by therefore, the 2p protected software is not fully functional.
It should be noted that the data transfers between the processing system data 3 and unit 6 illustrated in the above examples do not use only simple assignments but those skilled in the art will be able to combine them with other operations to lead to complex operations such as for example OUT (vl, 2 * X + 3) or Z E- (5 * v1 + v2).
According to another advantageous characteristic of the invention, the method of protection aims to implement a principle of protection, said by "functions elementary ", a description of which is given in relation to fig. 60 to 64.
For the implementation of the principle of protection by elementary functions, he is defined ~ a set of elementary functions whose elementary functions are likely to be executed, by means of the second part of execution 2 little, in unit 6, and possibly to transfer data between the data processing system 3 and (unit 6, ~ and a set of elementary commands for this set of elementary functions, these elementary commands being capable of being executed in the data processing system 3 and trigger execution in the unit 6, corresponding elementary functions.
For the implementation of the principle of protection by elementary functions, he is also built operating resources to transform a unit virgin 60 into a unit 6 capable of performing basic functions, (execution of these elementary functions being triggered by (execution in the system of processing of data 3, of elementary commands.
For the implementation of the principle of protection by elementary functions, he is also chosen, in the source of the vulnerable 2vs software, at least one treatment algorithmic using at least one operand and rendering at least one result.
It is also choose at least a portion of the source of the vulnerable 2vs software containing at minus an algorithmic treatment chosen.
At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software. This change is such that in particular ~ when running 2p protected software, at least a portion of the first part of execution 2pes, which is executed in the system of data processing 3, takes into account that the functionality of at least a chosen algorithmic processing is executed in unit 6, ~ when running 2p protected software, the second part of execution 2 little, which is executed in (unit 6, performs at least the functionality at least one chosen algorithmic processing, ~ each algorithmic processing chosen is broken down so that the execution of the protected 2p software, each algorithmic processing chosen is executed, by means of the second execution part 2peu, in using basic functions. Preferably, each treatment chosen algorithmic is broken down into elementary functions fe "(with n varying from 1 to N), i.e.
- possibly one or more elementary functions allowing the provision of one or more operands for unit 6, - elementary functions, some of which use the operand (s) and which in combination execute the functionality of the processing chosen algorithm, using this or these operands, - and possibly one or more elementary functions allowing the provision by (unit 6, for the treatment system of data 3 of the result of the chosen algorithmic processing, ~ and a scheduling of elementary commands is chosen from all the schedules allowing the execution of the protected software 2p.

The first part of 2pes execution of the protected 2p software, which is executed in the data processing system 3, executes elementary commands CFE "(with n varying from 1 to N), triggering in unit 6, (execution at means the second part of execution 2peu, of each of the elementary functions fe "
previously defined.
Fig. 60 illustrates an example of execution of vulnerable 2v software. In this example, it appears, during (execution of vulnerable software 2v in the data processing system 3, at a given instant, the calculation of Z E- F (X, Y) corresponding to the assignment to a variable Z of the result of a treatment algorithm represented by a function F and using operands X and Y.
Fig. 61 illustrates an example of implementation of (invention for which the algorithmic processing chosen in fig. 60 is deported to (unit 6. In this example, during (execution in the data processing system 3 of the first part of 2pes execution of the protected 2p software and in the presence of (unit 6, it appears ~ at times t1, t2, (execution of elementary commands CFEI, CFE2 triggering in (unit 6, execution by means of the second part of execution 2peu, corresponding elementary functions fel, fe2 which ensure the transfer of X, Y data from the processing system data 3 to memory areas respectively x, y located in the storage means 15 of (unit 6, these elementary commands CFEI, CFEZ being represented respectively by OUT (x, X), OUT (y, Y), ~ at times t3 to tN_l, (execution of elementary commands CFE3 to CFEN_l, triggering in unit 6, (execution by means of the second part of execution 2peu, elementary functions fe3 to feN_i corresponding, these elementary commands CFE3 to CFEN_1 being represented, respectively, by TRIG (fe3) to TRIG (feN_1). The continuation of elementary functions fe3 to feN_1 executed in combination is algorithmically equivalent to function F. More precisely, (execution of these elementary commands leads to (execution in unit 6, elementary functions (e3 to feN_1 which use the content of the storage areas x, y and render the result in an area of storage z of unit 6, ~ and at (instant tN, the execution of an elementary CFEN command triggering in unit 6, (execution by means of the second execution part 2peu, of the elementary function feN ensuring the transfer of the result of the treatment algorithmic, contained in the storage area z of (unit 6 towards the data processing system 3, in order to assign it to variable Z, this CFEN elementary command being represented by IN (z).
In (illustrated example, elementary commands 1 to N are executed successively. It should be noted that two improvements can be made ~ The first improvement concerns the case where several treatments algorithms are deported to (unit 6 and at least the result of a algorithmic processing is used by another algorithmic processing.
In this case, some elementary commands used for the transfer, can be optionally deleted.
~ The second improvement aims to opt for a relevant scheduling elementary commands among (all the schedules allowing (execution of protected software 2p. In this regard, it is preferable to choose a scheduling of elementary commands which dissociates temporally (execution of elementary functions, by intercalating, between these portions of code executed in the processing system data 3 and with or without elementary commands used for the determination of other data. Figs. 62 and 63 illustrate the principle of a such an achievement.
Fig. 62 shows an example of execution of vulnerable 2v software. In this example, it appears during (execution of vulnerable software 2v, in the data processing system 3, the execution of two treatments algorithmic leading to the determination of Z and Z ', such as Z ~ F (X, Y) and Z' ~ -F '(X', Y ').
Fig. 63 illustrates an example of implementation of the method according to (invention for which the two algorithmic treatments chosen in fig. 62 are deported in (unit 6. According to such an example, during (execution in the treatment 3 of the first 2pes execution part of the protected software 2p and in presence of (unit 6, it appears, as explained above, (execution of elementary commands CFEi to CFEN corresponding to the determination of Z and (execution of elementary commands CFE'1 to CFE ~ M corresponding to the determination of Z '. As illustrated, the elementary commands CFEI to CFEN do not are not executed consecutively, as long as the commands elementary CFE'1 to CFE'M, as well as other code portions are interspersed. In The example it is thus carried out (following scheduling: CFEI, portion of code intercalated, CFE'1, CFE2, portion of code intercalated, CFE'2, CFE'3, portion of code intercalated, CFE'4, CFE3, CFE4, ..., CFEN, CFE'M.
It should be noted that, during (execution of the protected 2p software, in the presence of unit 6, each time an elementary command contained in a portion of the first part of 2pes execution of the protected software 2p requires it, the function corresponding elementary is executed in (unit 6. So it appears, that presence of (unit 6, this portion is executed correctly and that, by therefore, protected 2p software is fully functional.
Fig. 64 illustrates an example of an attempt to run protected software 2p while (unit 6 is absent. In this example, when (execution in the system data processing 3, from the first part 2pes execution of the software protected 2p, at all times, (execution of an elementary command cannot trigger (execution of the corresponding elementary function, due to (absence of (unit 6. The value to be assigned to the variable Z cannot therefore to be determined correctly.
It therefore appears that in the absence of (unit 6, at least one request from a portion of the first 2pes execution part of the protected 2p software, to trigger (execution of an elementary function in (unit 6 cannot be satisfied correctly, so that at least this portion is not executed correctly and that, therefore, 2p protected software is not completely functional.
According to another advantageous characteristic of the invention, the method of protection aims to implement a principle of protection, said by "detection and coercion ", a description of which is given in relation to figs. 70 to 74.
For the implementation of the principle of protection by detection and coercion, he is defined ~ at least one characteristic of software execution likely to be at least partially monitored in unit 6, ~ at least one criterion to respect for at least one characteristic software execution, ~ Detection means 17 to be implemented in unit 6 and allowing detect that at least one software execution characteristic does not does not meet at least one associated criterion, ~ and coercion means 18 to be implemented in (unit 6 and to inform the data processing system 3 and / or modify (software execution, when at least one criterion is not respected.
For the implementation of the principle of protection by detection and coercion, he is also built operating resources to transform a unit blank 60 in a unit 6 using at least the detection means 17 and means of coercion 18.
Fig. 70 illustrates the means necessary for the implementation of this principle of protection by detection and coercion. Unit 6 includes the means of detection 17 and the coercion means 18 belonging to the processing means 16. The means of coercion 18 are informed of the non-compliance with a criterion by the means of detection 17.
More precisely, the detection means 17 use information from the transfer means 13 and / or the means of storage 15 and / or processing means 16, in order to monitor one or more several software execution features. To each characteristic software execution is set at least one criterion to be met.
In the case where it is detected that at least one performance characteristic of software does not meet at least one criterion, the detection means 17 in inform the coercion means 18. These coercion means 18 are suitable for modify, as appropriate, (state of (unit 6.
For the implementation of the principle of protection by detection and coercion, he is also chosen ~ at least one software execution characteristic to monitor, among the performance characteristics likely to be monitored, ~ at least one criterion to respect for at least one characteristic selected software execution, ~ in the source of the vulnerable 2vs software, at least one processing algorithmic for which at least one performance characteristic of software is to be monitored, ~ and in the source of the vulnerable software 2vs, at least a portion containing at least one algorithmic processing chosen.
At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software. This change is such that in particular when (running 2p protected software ~ at least a portion of the first 2pes execution part, which is executed in data processing system 3, takes into account that at least one selected software execution characteristic is at monitor, at least in part in unit 6, ~ and the second part of execution 2peu, which is executed in unit 6, at least partially monitors a software performance feature chosen.
When (running 2p protected software, protected by this principle of protection by detection and coercion, in the presence of (unit 6 ~ as long as all the criteria corresponding to all the characteristics monitored execution of all modified portions of protected software 2p are respected, these modified portions of the protected software Zp operate nominally and therefore 2p protected software operates nominally, ~ and if at least one of the criteria corresponding to a characteristic supervised execution of a portion of 2p protected software is not respected, the data processing system 3 is informed thereof and / or the operation of the protected software portion 2p is modified, so that the operation of the protected software 2p is modified.
Of course, in the absence of (unit 6, at least one request for a portion of the first part of 2pes execution of protected software 2p to use (unit 6 can not not be satisfied properly so that at least this portion does not not run correctly and therefore the 2p protected software is not completely functional.
For the implementation of the principle of protection by detection and coercion, two types of software runtime features are used preferentially.
The first type of software execution characteristic corresponds to a measurement variable of (software execution and the second type corresponds to a software usage profile. These two types of characteristics can to be used independently or in combination.
For the implementation of the principle of protection by detection and coercion using, as an execution characteristic, a measurement variable of execution of software it is defined ~ in the storage means 15, the possibility of storing at least a measurement variable used to quantify (use of at least one software functionality, ~ in the detection means 17, the possibility of monitoring at least one threshold associated with each measurement variable, ~ and updating means allowing each variable to be updated of measurement according to (use of the functionality for which it is associated.
It is also built operating resources using, in addition of the detection means 17 and coercion means 18, the means discount.
It is also chosen, in the source of the vulnerable software 2vs ~ at least one feature of the vulnerable 2v software whose use is likely to be monitored using a measurement variable, ~ at least one measurement variable used to quantify (use of said feature ~ at least one threshold associated with the measurement variable corresponding to a limit of use of said functionality, ~ and at least one method for updating the measurement variable in function of (use of said functionality.
The source of the vulnerable 2vs software is then modified, so as to get the source of the 2ps protected software, this modification being such that, when the execution of the protected software 2p, the second part of execution 2peu ~ updates the measurement variable according to (use of said feature ~ and takes into account at least one threshold crossing.
In other words, when running 2p protected software, the variable of measurement is updated according to the use of said functionality, and when the threshold is exceeded, the detection means 17 inform the means of coercion 18 who make a suitable decision to inform the system of data processing 3 and / or modify the processing carried out by the means of treatment 16 allowing the operation of the portion of the software protected 2p, so that the operation of the protected 2p software is changed.
For the implementation of a first preferred embodiment of the protection principle by detection and coercion using, as feature, a measurement variable it is defined ~ for at least one measurement variable, several associated thresholds, ~ and different coercion means corresponding to each of these thresholds.
It is also chosen, in the source of the vulnerable software 2vs ~ at least one measurement variable used to quantify (use of at least a functionality of the software and which must be associated with several thresholds corresponding to different limits of use of said feature ~ and at least two thresholds associated with the measurement variable.
The source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software, this modification being such that, when (execution protected software 2p, the second part of execution 2peu ~ updates the measurement variable according to (use of said feature ~ and takes into account, in a different way, the overruns of the various thresholds.
In other words, conventionally, when running the software protected 2p, when the first threshold is exceeded, (unit 6 informs the system of Treatment of data 3 directing the protected software 2p to no longer use this functionality. Yes

5 'the protected software 2p continues to use this functionality, the second threshold may to be surpassed. If the second threshold is exceeded, the means of coercion 18 may render the selected functionality inoperative and / or render the software protected 2p.
For the implementation of a second preferred embodiment of the protection principle by detection and coercion using, as feature, a measurement variable, reloading means are defined making it possible to credit at least one additional use for at least one functionality of software monitored by a measurement variable.
It is also built operating resources using, in addition of the detection means 17, coercion means 18 and means discount, means of recharging.
It is also chosen, in the source of the vulnerable 2vs software, at least one measurement variable used to limit (use of at least one functionality of software and to which at least one additional use must be able to be credited.
The source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software, this modification being such that, in a so-called phase reload, at least one additional use of at least one functionality corresponding to a selected measurement variable can be credited.
In the reloading phase, at least the update is carried out a chosen measurement variable and / or at least one associated threshold, so as to allow at least one additional use of the functionality corresponding. In other words, it is possible, in the phase of reloading, credit additional uses of at least one feature of the software protected 2p.
For the implementation of the principle of protection by detection and coercion using, as a feature, a software usage profile, it is defined as that criterion to respect for this usage profile, at least one trait execution of software.
It is also chosen, in the source of the vulnerable software 2vs ~ at least one use profile to monitor, ~ and at least one performance feature that at least one chosen use profile must respect.
The source of the vulnerable 2vs software is then modified, so as to obtain the source of the 2ps protected software, this modification being such that, when (execution protected software 2p, the second part of execution 2peu respects all features of execution chosen. In other words, (unit 6 itself monitors the how the second part of execution 2peu is executed and can inform the system of data processing 3 and / or modify the operation of the protected software 2p in the case where at least one performance line is not respected.
When (running 2p protected software, protected by this principle, in presence from unit 6 ~ as long as all the performance features of all the modified portions of the 2p protected software is respected, these modified portions of the software protected 2p operate nominally and therefore the software protected 2p operates nominally, ~ and if at least one feature of a portion of 2p protected software is not respected, the data processing system 3 is informed and / or the operation of the protected software portion 2p is modified, so that the operation of the protected software 2p is modified.
It is possible to envisage the surveillance of different performance traits, such as through example monitoring the presence of instructions with a marker where the monitoring of (sequence of execution for at least part of the instructions.
For the implementation of the principle of protection by detection and coercion using as a performance line to be respected, monitoring of (concatenation of execution for at least part of the instructions, it is defined ~ a set of instructions whose instructions are likely to be executed in (unit 6, ~ a set of instruction commands for this set of instructions, these instruction commands are likely to be executed in the data processing system 3. The execution of each of these instruction commands in the data processing system 3 triggers in unit 6, the execution of the corresponding instruction, ~ Detection means 17 making it possible to detect that the sequence of instructions does not match that desired, ~ and coercion means 18 to inform the system of 3 data processing and / or modify the execution of software when the sequence of instructions does not correspond to that desired.
Operating resources are also built, allowing (unit 6, to run also the instructions in the instruction set, the execution of these instructions being triggered by execution in the data processing system 3 of instruction commands.
It is also chosen, in the source of the vulnerable software 2vs, at least one algorithmic processing to be deported to unit 6 and for which (sequence of at least part of the instructions is to be monitored.
The source of the vulnerable 2vs software is then modified so as to obtain the source of the 2ps protected software, this modification is such that, when (execution of protected software 2p ~ the second part of execution 2peu executes at least the functionality of the chosen algorithmic processing, ~ the chosen algorithmic processing is broken down into instructions, ~ (sequence that must respect at least some of the instructions when executed in (unit 6 is specified, ~ and the first part of 2pes execution of the protected software 2p executes instruction commands that trigger (execution of instructions in (unit 6.
When (running 2p protected software, protected by this principle, in presence from (unit 6 ~ as long as (sequence of instructions for all modified portions of protected software 2p corresponds to that desired, these modified portions of the Zp protected software operate nominally and therefore the 2p protected software works nominally, ~ and if (sequence of instructions for a portion of 2p protected software executed in (unit 6 does not correspond to the desired one, the data processing 3 is informed and / or the functioning of the portion of the protected software Zp is modified, so that the operation 2p protected software is changed.
Fig. 71 illustrates an example of implementation of the principle of protection by detection and coercion using, as an execution trait to respect the oversight of (sequence of execution of at least part of the instructions, in the case (desired sequence is respected.
The first part of 2pes execution of the protected 2p software, executed in the data processing system 3, executes instructions commands CI;
triggering, in (unit 6 (execution of instructions i; belonging to the game instructions. In the instruction set, at least some of the instructions each have a part defining the functionality of (instruction and a part allowing to verify (desired sequence for (execution of instructions. In this example, the CI instruction commands; are represented by TRIG (i;) and (desired sequence for (execution of instructions is i ", i" +1 and i "+ 2. Execution in (unit 6, of (instruction i" gives the result a and (execution of (instruction i "+1 gives the result b. Instruction i" +2 uses as operand, the results a and b of instructions i "and i" +1 and its execution gives the result c.
Given that this sequence of instructions executed in (unit 6 corresponds to that desired, resulting in normal or nominal operation of protected software 2p.
Fig. 72 illustrates an example of implementation of the principle of protection by detection and coercion using, as an execution trait to be respected, the oversight of (sequence of execution of at least part of the instructions, in the case (desired sequence is not respected.
According to this example, (desired sequence for (execution of instructions is always i ", i" +1 and 1n + 2. However, (sequence of execution of instructions is modified by replacing instruction i "with (instruction i '", so than the sequence actually executed is i'n, i "+ i and i" +2. The execution of (instruction i '"gives the result a, that is to say the same result as the execution of the instruction in.
However, at the latest when the instruction i "+2 is executed, the means of detection 17 detect that the instruction i '"does not correspond to the instruction desired to generate the result used as the operand of the instruction i "+ a.
means of detection 17 inform the means of coercion 18 which modify in result, the operation of the instruction i "+2, so that the execution of instruction i "+2 gives the result c 'which can be different from e. Of course, if (execution of instruction i '"gives a result a' different from the final result i ", it is clear that the result of the instruction i "+ i can also be different from c.
Insofar as (sequence of execution of the instructions executed in (unit 6 does not correspond to the desired one, so it can be obtained a change the operation of protected software 2p.
The fg. 73 and 74 illustrate a preferred embodiment of the principle of protection by detection and coercion using, as an execution trait to respect, the monitoring of the execution sequence of at least part of the instructions.
According to this preferred variant, a set of instructions is defined, the less some instructions work on registers and use at least one operand in view to render a result.
As illustrated in fig. 73, it is defined for at least some of the instructions working on registers, a PF part defining the functionality of (instruction and a PE part defining (desired sequence for (execution of instructions. The PF part corresponds to the known operation code of (Man of art.
The PE part defining the desired sequence, includes bit fields corresponding to ~ an identification field of (CII instruction, ~ and for each operand k of (instruction, with k varying from 1 to K, and K
number of operands of (instruction - a CDk flag field, indicating whether to check the from (operand k, - and a field of identification identified CIPk of the operand, indicating (identity expected from the instruction that generated the content of (operand k.
As illustrated in fig. 74, the instruction set includes V registers belonging to the processing means 16, each register being named R ~, with v varying from 1 to V. For each register R ~, two fields are defined, namely ~ a functional field CF ,,, known to those skilled in the art and making it possible to store the result of (execution of instructions, ~ and a CIG generated identification field. allowing to memorize the identity of (instruction having generated the content of the functional field CF ,,. This identification field generated CIG ~ is updated automatically with the contents of the identification field of (instruction CII having generated the functional field CF ~. This identification field generated CIG ~ is not accessible, nor modifiable by any instruction and only used for detection means 17.
During the execution of an instruction, the detection means 17 carry out for each operand k the following operations ~ the CD flag field ~ is read, ~ if the CDk flag field requires it, the expected identification field CIPk and the identification field generated CIG ~ corresponding to the register used by (operand k are read both, ~ the equality of the two fields CIPk and CIG ,, is checked, ~ and if the equality is false, the detection means 17 consider that (sequence of execution of instructions is not respected.
The coercion means 18 make it possible to modify the result of the instructions when the detection means 17 have informed them of a sequence instructions not respected. A preferential realization consists in modifying the part functional PF of (instruction in progress or the functional part PF
instructions later.
According to another advantageous characteristic of the invention, the method of protection aims to implement a principle of protection, said by "renaming"
a description of which is given in relation to FIGS. 80 to 85.

For the implementation of the principle of protection by renaming, it is defined ~ a set of dependent functions, whose dependent functions are likely to be executed, by means of the second part of execution 2 little, in (unit 6, and possibly to transfer data between the data processing system 3 and (unit 6, this set of functions dependent that can be finite or infinite, ~ a set of triggering commands for these dependent functions, these triggering commands being capable of being executed in the data processing system 3 and trigger in (unit 6, the execution of corresponding dependent functions, ~ for each triggering command, a set point corresponding to less in part to (information transmitted by the first executing party 2pes, at the second part of execution 2peu, in order to trigger (execution of the corresponding dependent function, this setpoint is presented under the form of at least one argument of the triggering command, ~ a method of renaming the instructions intended to be implemented when modifying the vulnerable software, such a method allowing to rename the instructions in order to obtain triggering commands at renowned instructions to conceal the identity of functions corresponding dependents, ~ and recovery means 20 intended to be implemented in (unit 6 during the use phase and allowing to find the setpoint initial, from the renamed setpoint, in order to find the function dependent to execute.
For the implementation of the principle of protection by renaming, it is also builds operating resources to transform a virgin unit 60 in a unit 6 using at least the recovery means 20.
For the implementation of the principle of protection by renaming, it is also chosen, in the source of the vulnerable software 2vs ~ at least one algorithmic processing using at least one operand and rendering at least one result, n ~ and at least a portion of the source of the vulnerable software 2vs, containing at minus an algorithmic treatment chosen.
The source of the vulnerable 2vs software is then modified, so as to obtain the source of Zps protected software. This modification is such that in particular ~ when (running 2p protected software, at least a portion of the first part of execution 2pes, which is executed in the system of data processing 3, takes into account that the functionality of at least a chosen algorithmic processing is executed in unit 6, ~ during the execution of the protected software Zp, the second part of execution 2peu, which is executed in unit 6, performs at least the functionality at least one chosen algorithmic processing, ~ each algorithmic processing chosen is broken down so that the execution of the protected 2p software, each algorithmic processing chosen is executed, by means of the second execution part 2peu, in using dependent functions. Preferably, each treatment algorithm chosen is decomposed into dependent functions fd "(with n varying from 1 to N), i.e.
- possibly one or more dependent functions allowing the provision of one or more operands for (unit 6, - dependent functions, some of which use the operand (s) and which in combination execute the functionality of the processing chosen algorithm, using this or these operands, - and possibly one or more dependent functions allowing the made available by unit 6, for the treatment system of data 3 of the result of the chosen algorithmic processing, ~ during (execution of 2p protected software, the second part of execution 2peu performs fd dependent functions ", ~ when running 2p protected software, the dependent functions are triggered by triggering commands with renowned instructions, ~ and a sequencing of triggering commands is chosen from all the schedules allowing the execution of the protected software s1 2p.
The first part of 2pes execution of the protected 2p software, executed in the data processing system 3, executes triggering commands at renamed instructions transferring to (unit 6 renamed instructions, and triggering in (unit 6 recovery by means of recovery 20, instructions, then (execution by means of the second part of execution 2peu, of each of the previously defined dependent functions fd ".
In other words, the principle of protection by renaming consists in rename the instructions of the triggering commands, so as to obtain trigger commands with renowned instructions including (execution in the system data processing 3, triggers in (unit 6, (execution of functions dependent that would have been triggered by the triggering commands at instructions not renamed, without however that (examination of the protected 2p software does not allows to determine (identity of the dependent functions executed.
Fig. 80 illustrates an example of execution of vulnerable 2v software. In this example, it appears during (execution of vulnerable software 2v in the system data processing 3, at a given time, the calculation of Z E-- F (X, Y) corresponding to the assignment to a variable Z of the result of a treatment algorithm represented by a function F and using the operands X and Y.
Figs. 81 and 82 illustrate an example of implementation of (invention.
Fig. 81 illustrates the partial implementation of the (invention. In this example, during (execution in the data processing system 3 of the first part 2pes execution of protected software 2p and in the presence of (unit 6, it appears ~ at times t1, t2, (execution of triggering commands CDI, CDZ
triggering in (unit 6, (execution by means of the second part of execution 2peu, dependent functions fdl, fda corresponding which ensure the transfer of X, Y data from the processing system data 3 to memory areas respectively x, y located in the storage means 15 of the unit 6, these triggering commands CDI, CDZ being represented respectively by OUT (x, X), OUT (y, Y), ~ at times t3 to tN_l, the execution of the triggering commands CD3 to s2 CDN_l, triggering in (unit 6, execution by means of the second execution part 2peu, dependent functions fd3 to fdN_1 corresponding, these triggering commands CD3 to CDN_I being represented, respectively, by TRIG (fd3) to TRIG (fdN_1). The continuation of dependent functions fd3 to fdN_1 executed in combination is algorithmically equivalent to function F. More precisely, (execution of these triggering commands leads to (execution in unit 6, dependent functions fd3 to fdN_1 which use the content storage areas x, y and render the result in an area of memorization z of (unit 6, ~ and at (instant tN, (execution of a triggering CDN triggering command in (unit 6, (execution by means of the second execution part 2peu, of the fdN dependent function ensuring the transfer of the treatment result algorithm contained in the storage area z of (unit 6 towards the data processing system 3, in order to assign it to variable Z, this command being represented by IN (z).
In this example, to fully implement (invention, it is chosen as a setpoint, the first argument to the OITT trigger commands and (argument of the triggering commands TRIG and IN. The instructions thus chosen are renamed by the renaming method. In this way, the instructions for triggering commands CDl to CDN, namely x, y, fd3, fdN_l, z are renamed so as to obtain respectively R (x), R (y), R (fd3) ..., R (fdN_1), R (z).
Fig. 82 illustrates the full implementation of the (invention. In this example, during (execution in the data processing system 3, from the first part 2pes execution of protected software 2p, and in the presence of funitë 6, it appears ~ at times t1, t2, (execution of triggering commands with instructions renamed CDCRI, CDCR2, transferring to (unit 6, the instructions renamed R (x), R (y) as well as the data X, Y triggering in (unit

6 recovery by means of recovery means 20, renamed instructions to restore the instructions, namely (identity of storage areas x, y, then (execution by means of the second part of execution 2peu, dependent functions fdl, fda corresponding which ensure the transfer of X, Y data from the processing system data 3 to the storage areas respectively x, y located in the storage means 15 of the unit 6, these triggering commands with renamed instructions CDCRI, CDCR2 being represented respectively by OUT (R (x), X), OUT (R (y), Y), ~ at times t3 to tN_l, (execution of triggering commands with instructions renamed CDCR3 to CDCRN_l, transferring to (unit 6, the instructions renamed R (fd3) to R (fdN_1), triggering in (unit 6 recovery by means of the recovery means 20, instructions, namely fd3 to fdN_l, then (execution by means of the second part of execution 2peu, of dependent functions fd3 to fdN_l, these commands triggering at renamed instructions CDCR3 to CDCRN_1 being represented respectively by TRIG (R (fd3)) to TRIG (R (fdN_1)), ~ and at (instant tN, (execution of the triggering command at setpoint renamed CDCRN transferring to (unit 6, the renamed setpoint R (z) triggering in (unit 6) recovery by means of re-establishment 20, of the set point namely (identity of the storage z, then (execution by means of the second execution part 2peu, of the dependent function fdN ~ ensuring the transfer of the result of algorithmic processing contained in the storage area z of (unit 6 to the data processing system 3, in order to assign it to the variable Z, this command triggers with a renamed setpoint CDCRN being represented by IN (R (z)).
In (example illustrated, the triggering commands with renamed instructions 1 to N are executed successively. It should be noted that two improvements can to be made ~ The first improvement concerns the case where several treatments algorithms are deported in funitë 6 and at least the result of a algorithmic processing is used by another algorithmic processing.
In this case, certain triggering commands with renowned instructions used for transfer, can be optionally deleted.

~ The second improvement aims to opt for a relevant scheduling Triggering commands with renowned instructions among (together orders allowing (execution of the protected software 2p. To this regard, it is best to choose an order scheduling triggering with renowned instructions which temporally dissociates the execution of dependent functions, by inserting, between them, portions of code executed in the data processing system 3 and with or without triggering commands with renowned instructions used for the determination of other data. Figs. 83 and 84 illustrate the principle of such an achievement.
Fig. 83 shows an example of running vulnerable 2v software. In this example, it appears, during the execution of the vulnerable software 2v, in the data processing system 3, the execution of two processing algorithmic leading to the determination of Z and Z ', such as Z E- F (X, Y) and Z' ~ -F '(X', Y ').
Fig. 84 illustrates an example of implementation of the method according to (invention for which the two algorithmic treatments chosen in fig. 83 are deported in unit 6. According to such an example, during (execution in the system of treatment 3 of the first 2pes execution part of the protected software 2p and in presence of (unit 6, it appears, as explained above, (execution of trigger commands with renamed instructions CDCRI to corresponding CDCRN
to the determination of Z and (execution of triggering commands with instructions renamed CDCR'1 to CDCR'M corresponding to the determination of Z '. As illustrated, the triggering commands with renamed instructions CDCRI to CDCRN do not are not executed consecutively, as long as the commands triggers with renowned instructions CDCR'1 to CDCR'M as well as others portions of code are interspersed. In the example, it is thus carried out following provisioning: CDCRI, portion of intercalated code, CDCR'1, CDCRa, portion of interleaved code, CDCR'2, CDCR'3, portion of interleaved code, CDCR'4, CDCR3, CDCR4, ..., CDCRN, CDCR'M.
It should be noted that, during (execution of a portion of the first part 2pes execution of the protected 2p software, the commands triggering at instructions ss names executed in data processing system 3, trigger in (unit 6 restoring the identity of dependent functions corresponding then (execution of these. Thus, it appears that in the presence of (unit 6, this portion is executed correctly and therefore the protected software 2p is fully functional.
Fig. 85 illustrates an example of attempted protected software execution 2p while (unit 6 is absent. In this example, when (execution in the system data processing 3 of the first part 2pes execution of the software protected 2p, at all times, the execution of a triggered command to setpoint rename cannot trigger the restoration of the setpoint nor (execution of the corresponding dependent function, due to (absence of (unit 6. The value to assign to variable Z cannot therefore be determined correctly.
It therefore appears that in the absence of (unit 6, at least one request from a portion of the first 2pes execution part of the protected 2p software, to trigger re-establishment of a setpoint and (execution of a dependent function in (unit 6 cannot be satisfied correctly, so that at least this portion is not executed correctly and therefore the 2p protected software is not fully functional.
Thanks to this principle of protection by renaming, (examination in the software protected 2p from triggered commands with renowned instructions does not allow determine the identity of dependent functions to be performed in (unit 6.
It should be noted that the renaming of the instructions is carried out during the modification of vulnerable software 2v into protected software 2p.
According to a variant of the principle of protection by renaming, it is defined for at least one dependent function, a family of dependent functions algorithmically equivalent but triggered by commands triggering with different renowned instructions. According to this variant, for at least one treatment algorithmic using dependent functions, this algorithmic processing East broken down into dependent functions which for at least fade out of them is replaced by a function dependent on the same family instead of keeping multiple occurrences of the same dependent function. To this end, orders triggers with renamed instructions are modified to take into account the replacement of dependent functions with dependent functions of the same family. In other words, two dependent functions of the same family have of the different instructions and therefore triggering commands at instructions different renames and, it is not possible, to (examination of the protected software 2p, from detect that the dependent functions called are algorithmically equivalent.
According to a first preferred embodiment of the variant of the principle of protection by renaming, it is defined for at least one dependent function, one family of algorithmically equivalent dependent functions, by concatenating a field of noise at (information defining the functional part of the function dependent on run in (unit 6.
According to a second preferred embodiment of the variant of the principle of protection by renaming, it is defined for at least one dependent function, one family of algorithmically equivalent dependent functions using fields Identification.
According to a preferred embodiment of the principle of protection by renaming, it is defined as a method of renaming instructions a method encryption to encrypt the instructions to transform them into instructions renamed. It is recalled that the renaming of the instructions is carried out in the phase protection P. For this preferred variant, the recovery means 20 are means implementing a decryption method making it possible to decipher the famous instructions and thus restore (identity of functions dependent to be executed in unit 6. These means of recovery are put in works in (unit 6 and can be software or hardware in nature.
means 20 are requested in the use phase U each time once a trigger command with renamed setpoint is executed in the data processing 3 for the purpose of triggering in (unit 6, the execution a dependent function.
In the foregoing description in relation to FIGS. 40 to 92, six principles protection of software have been explained in general independently of each other. The protection process in accordance with (invention, is implemented using the connection protection principle conditional, possibly associated with one or more other protection principles. In the case s7 where the principle of protection by conditional branching is supplemented by the setting using at least one other protection principle, the principle of protection by conditional branching is advantageously supplemented by the principle of protection by temporal dissociation.
And when the principle of protection by temporal dissociation is also put in covers, this can in turn be supplemented by the protection principle through variable and / or the principle of protection by elementary functions.
And when the principle of protection by elementary functions is also put in work, it can in turn be supplemented by the principle of protection through detection and coercion and / or the principle of protection by renaming.
And when the principle of protection by detection and coercion is also put in covers, this can in turn be supplemented by the protection principle through renaming.
According to the preferred embodiment, the principle of protection by conditional connection is supplemented by the principle of protection by dissociation temporal, supplemented by the principle of protection by variable and by the principle of protection by elementary functions, supplemented by the protection principle through detection and coercion, supplemented by the principle of protection by renaming.
If a protection principle is applied, in addition to the protection principle by conditional connection, description made previously must include, to account for its combined implementation, the following changes ~ the notion of vulnerable software must be understood as software vulnerable to the protection principle being described.
Thus, in the case where a protection principle has already been applied to vulnerable software, (expression "vulnerable software" must be interpreted by the reader as the expression "software protected by the principle (s) protection already applied ”;
the concept of protected software must be understood as protected software vis with regard to the protection principle being described. So in the case where a protection principle has already been applied, (expression "software protected "should be interpreted by the reader as (expression" new ss protected software version ”;
~ and the choice or choices made) for the implementation of the principle of protection being described must (wind) take into account the choice (s) carried out) for the implementation of the protection principle (s) already applied (s).
The following description provides a better understanding of the implementation of the protection method according to the invention. This protection process according to (invention involves, as appears more precisely in fig. 100 ~ first, a protection phase P during which software vulnerable 2v is changed to Zp protected software, ~ then, a use phase U during which the protected software 2p is implemented. In this phase of use U
- in the presence of (fi unit and each time that a portion of the first 2pes execution part executed in the processing system data 3 (impose, an imposed functionality is executed in (unit 6, so that this portion is executed correctly and that, therefore, 2p protected software is fully functional, - in the absence of unit 6 and despite the request for a portion of the first part of execution 2pes to execute a functionality in unit 6, this request cannot be honored correctly, so that at least this portion is not executed correctly and that by therefore, 2p protected software is not fully functional, ~ and possibly a recharging phase R during which is credited with at least one additional use of a feature protected by the implementation of the second preferred variant of realization of the principle of protection by detection and coercion using as a characteristic, a measurement variable.
The protection phase P can be broken down into two sub-phases of protection Pl and P2. The first, called upstream protection sub-phase P1, is setting works independently of the vulnerable 2v software to be protected. The second, called PZ downstream protection sub-phase is dependent on vulnerable software 2v to protect.

It should be noted that the upstream protection phases P1 and downstream protection Pa can to be advantageously carried out by two different people or two teams different. For example, the upstream protection sub-phase P1 can be produced by a person or a company ensuring the development of protection of software, while the PZ downstream protection sub-phase can be implemented by one person or company developing software to be protected.
Of course, it is clear that the upstream and downstream protection sub-phases P1 and can also be done by the same person or team.
The upstream protection sub-phase P1 involves several stages S11, ..., Sl, for each of which different tasks or works are to be carried out.
The first stage of this upstream protection sub-phase Pi is called "stage of definitions S11 ". At this stage of definitions Sll ~ he is chosen - the type of (unit 6. By way of illustration, it can be chosen as unit 1 S 6, a smart card reader 8 and the smart card 7 associated with the reader, - And the transfer means 12, 13 intended to be used respectively in the data processing system 3 and in (unit 6, during the use phase U and capable of ensuring the data transfer between the data processing system 3 and (unit 6, ~ and in the case where the protection method according to (invention implements the protection principle by elementary functions, it is also defined - a set of elementary functions whose elementary functions are likely to be performed in (unit 6, - and a set of elementary commands for this set of functions elementary, these elementary commands being likely to be executed in the data processing system 3 and trigger (execution in (unit 6, elementary functions, ~ and in the case where the protection method according to the invention implements the protection by detection and coercion principle, it is also defined - at least one software execution characteristic, capable of being at least partially monitored in unit 6, - at least one criterion to respect for at least one characteristic software execution, - detection means 17 to be implemented in (unit 6 and making it possible to detect that at least one performance characteristic of software does not meet at least one associated criterion, - and coercion means 18 to be implemented in (unit 6 and to inform the data processing system 3 and / or modify (software execution, when at least one criterion is not met, ~ and in the case where the protection method according to (invention implements the protection principle by detection and coercion using as characteristic a measurement variable of software execution it's also defined - as a feature of software execution likely to be monitored, a variable measuring the use of a functionality software, - as a criterion to be respected, at least one threshold associated with each measurement variable, - and updating means making it possible to update at least one measurement variable, ~ and in the case where the protection method according to (invention implements a first preferred alternative embodiment of the principle of protection by detection and coercion using a variable of measurement of (software execution, it is also defined - for at least one measurement variable, several associated thresholds, - and different means of coercion corresponding to each of these thresholds, ~ and in the case where the protection method according to (invention implements a second preferred alternative embodiment of the principle of protection by detection and coercion using a variable of measurement of (software execution, it is also defined means of reload to credit at least one use additional for at least one software functionality monitored by a measurement variable, ~ and in the case where the protection method according to the invention implements the protection principle by detection and coercion using as characteristic of a software usage profile, it is also defined - as a feature of software execution likely to be monitored, a software usage profile, - and as a criterion to be respected, at least one performance trait of software, ~ and in the case where the protection method according to (invention implements the protection by detection and coercion principle using as a trait of execution to be observed, monitoring of (sequence of execution, it is also defined - a set of instructions whose instructions are likely to be performed in unit 6, - a set of instruction commands for this set of instructions, these instruction commands being capable of being executed in the data processing system 3 and trigger in (unit 6 the execution of instructions, - as a usage profile, (sequence of instructions, - as an execution feature, a desired sequence for (execution of instructions, - as detection means 17, means making it possible to detect that (sequence of instructions does not correspond to that desired, - And as means of coercion 18, means allowing to inform the data processing system 3 and / or to modify the operation of the portion of protected software 2p when (sequence of instructions does not correspond to that desired, ~ and in the case where the protection method according to (invention implements a preferred embodiment of the principle of protection by detection and coercion using as an execution trait to be respected, surveillance of the execution sequence, it is also defined - as a set of instructions, a set of instructions of which at least some instructions work on registers and use at least an operand to render a result, - for at least part of the instructions working on registers a PF part defining the functionality of the instruction, and a part defining the desired sequence for (execution instructions and having corresponding bit fields at:
0 an identification field of (CII instruction, 0 and for each operand of (instruction * a CDk flag field, * and a CIPk planned identification field of (operand, - for each register belonging to the operating resources and used by the instruction set, a CIG ~ generated identification field in which is automatically memorized (identification of the last instruction having returned its result in this register, - As detection means 17, means allowing, during the execution of an instruction, for each operand, when the field CDk flag (requires, to control the equality between the field generated identification CIG ~ corresponding to the register used by this operand, and the expected identification field CIPk of (origin of this operand, - And as means of coercion 18, means making it possible to modify the result of the instructions, if at least one of the ties checked is false, ~ and in the case where the protection method according to (invention implements the protection principle by renaming, it is also defined - as a triggering command, a basic command or an instruction command, - as a dependent function, an elementary function or a instruction, - as an instruction, at least one argument for an order triggering, corresponding at least in part to (information transmitted by the data processing system 3 to (unit 6, in order to trigger the execution of the corresponding dependent function, - a method of renaming the instructions allowing renaming of the instructions in order to obtain triggering orders with instructions renamed, - and recovery means 20 intended to be implemented in (unit 6 during the use phase U, and allowing to find the dependent function to be executed, from the renamed setpoint, ~ and in the case where the protection method according to the invention implements a variant of the principle of protection by renaming, it is also defined for at least one dependent function, a family of functions algorithmically equivalent dependent, but triggered by triggering commands whose renamed instructions are different, ~ and in the case where the protection method according to the invention implements any of the preferred embodiments of the variant of the principle of protection by renaming, it is also defined for at least one function dependent, a family of algorithmically dependent functions equivalent - by concatenating a noise field to (information defining the part of the dependent function to be executed in (unit 6, - or by using the identification field of (CII instruction and the expected CIPk identification fields of the operands, ~ and in the case where the protection method according to the invention implements a preferred variant of the renaming protection principle it is also 3 0 defined - as a method of renaming instructions, a method of encryption to encrypt the instructions, - And as recovery means 20, means putting in uses a decryption method to decipher the instructions renamed and thus restore (identity of functions dependent on execute in (unit 6.
During the upstream protection sub-phase, the definition stage Sll is followed by a stage called "construction stage S12". At such a stage 512, are build them transfer means 12, 13 and possibly the operating means corresponding to the definitions of definition stage Sll.
During this Slz construction stage, it is therefore carried out:
~ the construction of the transfer means 12, 13 allowing, during the U use phase, data transfer between the processing system data 3 and (unit 6, ~ and when the principle of protection by elementary functions is also placed implementation, the construction of operating resources allowing (unit 6, during the use phase U of performing the elementary functions the set of elementary functions, ~ and when the principle of protection by detection and coercion is also placed at work, at construction - operating means allowing (unit 6, during the phase of use U to also use the detection means 17 and the coercion means 18, - and possibly operating resources allowing (unit 6, at during the use phase U to also implement the means update, - and possibly operating resources allowing (unit 6, at during the recharging phase to also implement the reloading means, - and possibly operating resources also allowing (unit 6, during the use phase U to execute the instructions of the game instruction, ~ and when the principle of protection by renaming is also implemented, the construction of operating resources allowing (unit 6, during of the use phase U to also implement the means of recovery.
The construction of the operating resources is carried out in a conventional manner, through (intermediary of a program development unit taking into account the definitions at the definition stage Sll. Such a unit is described in the continuation of the description in fig. 110.
During the upstream protection sub-phase Pl, the construction stage S12 can be followed by a stage called "S13 pre-personalization stage". During this stage of pre-personalization S13 at least part of the transfer means 13 and / or the operating resources are loaded into at least one blank unit 60 in view obtain at least one pre-personalized unit 66. It should be noted that part of operating resources, once transferred to a pre-personalized unit 66, is more directly accessible from (outside of this pre-personalized unit 66.
The transfer of operating resources to a blank unit 60 can be carried out through through a suitable pre-personalization unit, which is described in the continuation of the description in fig. 120. In the case of a pre-custom 66, consisting of a smart card 7 and its reader 8, the pre-personalization born concerns only the smart card 7.
During the upstream protection sub-phase P1, it can be implemented, after the definition stage Sll and, possibly after the construction stage Sl ~, a stadium called "tool making stage S14". During this stage of preparation of tools S14 tools are made to assist in the generation of software protected or automate software protection. Such tools allow ~ help choose or choose automatically in vulnerable software 2v to protect - the conditional branch (es) whose functionality is likely to be deported to (unit 6, - the portion (s) liable to be modified, - and when the principle of protection by temporal dissociation is also implemented, the algorithmic processing (s) likely to be broken down into deportable stages in (unit 6, - and when the principle of protection by variable is also implemented work, the variable or variables likely to be deported to (unit 6, - and when the principle of protection by elementary functions is also implemented, the algorithmic processing (s) likely to be broken down into elementary functions that can be deported in (unit 6, - and when the principle of protection by detection and coercion is also implemented, the performance characteristic (s) to be monitored and, possibly, the algorithmic processing (s) likely to be broken down into remote instructions in (unit 6, - and when the principle of protection by renaming is also implemented work, the algorithmic treatment (s) likely to be broken down into deported dependent functions in (unit 6 and for which the instructions of the triggering commands can be renamed, ~ and, possibly, to help generate protected software or automate software protection. ' These different tools can be produced independently or in combination and each tool can take various forms, such as preprocessor, assembler, compiler, etc.
The upstream protection sub-phase P1 is followed by a sub-phase of P2 downstream protection dependent on the vulnerable 2v software to be protected. This sub-phase P2 downstream protection also involves several stages. The first Stadium corresponding to the implementation of the protection principle by connection conditional is called "creation stage S21". At this stage of creation 521 he is used the choices made at the definition stage Sll. A (using these choices and possibly of tools built at the tool making stage 514, it is created the protected software 2p ~ by choosing in the source of the vulnerable software 2vs, at least one conditional connection, ~ by choosing at least a portion of the source of the vulnerable 2vs software containing at least one selected conditional branch, ~ by producing the source of the 2ps protected software from the source of the software vulnerable 2vs, by modifying at least a selected portion of the source of the vulnerable 2vs software to get at least a modified portion of the source of the protected 2ps software, this modification being such as during running 2p protected software - a first part of execution 2pes is executed in the system of data processing 3 and a second part of execution 2peu is executed in a unit 6, obtained from (blank unit 60 after loading information, - and the second part of execution 2peu executes at least the functionality of at least one conditional branch chosen and the layout of the data processing system 3, information allowing the first part of Zpes execution to continue its execution at the chosen location, ~ and by producing - a first part 2pos object of the protected software 2p, from the source of the 2ps protected software, this first part 2pos object being such as when running the 2p protected software, a first part of execution 2pes which is executed in the system of data processing 3 and at least a portion of which takes into account at least one conditional branch chosen is executed in unit 6, - and a second object part 2pou of the protected software 2p, this second object part 2pou being such that, after loading in the blank unit 60 and when (running 2p protected software, the second appears 2-inch execution part by means of which each connection selected conditional is executed.
Of course, the principle of protection by conditional connection according to the invention can be applied directly when developing a new software without requiring prior implementation of vulnerable 2v software.
Of this way it is obtained directly 2p protected software.
For the implementation of a preferred embodiment of the protection principle through conditional connection, 2p protected software is modified ~ by choosing, in the source of the 2ps protected software at least a series of selected conditional branches, ~ by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that during (execution of the software protected.
2p, the overall functionality of at least one selected series of connections conditional is executed by means of the second execution part 2peu, in (unit 6, ~ and by producing - the first part 2pos object of the protected software 2p, this first object part 2pos being such that during (execution of the protected software 2p, the functionality of at least one selected series of connections conditional is executed in (unit 6, - and the second object part 2pou of the protected software 2p, this second object part 2pou being such that, after loading in unit 6 and during (execution of the protected software 2p, appears the second part 2-bit execution by means of which the overall functionality of least a selected series of conditional branches is executed.
During the downstream protection sub-phase P ~, and when at least one other principle protection is applied in addition to the connection protection principle conditional, a "modification stage S ~ 2" is implemented. During this stage of modification 522, it is used the definitions intervened at the stage of definitions Sl ~
A (using these definitions and possibly tools built at the stage of confection tools 514, the protected 2p software is modified to allow the implementation work of protection principles according to (one of the arrangements defined above.
When the principle of protection by temporal dissociation is implemented artwork, protected 2p software is modified by choosing in the source of the protected software 2ps - at least one algorithmic processing which during (execution of the 2p protected software, uses at least one operand, and allows determine, at least in part, the result of a connection conditional chosen, S - and at least one portion containing at least one treatment chosen algorithmic, ~ by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that - at least the functionality of at least one algorithmic processing chosen is executed by means of the second execution part 2peu, - at least one chosen algorithmic processing is broken down so that during (execution of the protected software 2p appear by means of the second part of execution 2peu, several distinct stages, to know ~ the provision of at least one operand for (unit 6, the realization in (unit 6) of the functionality of the treatment algorithmic on at least this operand, and possibly, the provision of at least one result, by (unit 6 for the data processing system 3, - for at least one chosen algorithmic processing, commands steps are defined so that when (running the software protected 2p, each step command is executed by the first 2pes execution part and triggers in (unit 6, execution at means of the second part of execution 2 little, of a step, - and a sequencing of the orders of stages is chosen from (set of schedules allowing (software execution protected 2p, ~ and by producing - the first part 2pos object of the protected software 2p, this first object part 2pos being such that during (execution of the protected software 2p, the stage commands are executed according to (scheduling C1101s1, - and the second object part Zpou of the protected software 2p, this second object part 2pou being such that, after loading in unit 6 and during of the execution of the protected software 2p, appears the second part 2-minute execution by means of which the steps are carried out triggered by the first part of execution 2pes.
When the variable protection principle is implemented, the software protected 2p is modified ~ by choosing at least one variable used in at least one treatment chosen algorithm, which when (running 2p protected software, defines partially (state of protected software 2p, ~ by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that during (execution of the protected software 2p, at least one chosen variable or at least one copy of chosen variable resides in unit 6, ~ and by producing - the first part 2pos object of the protected software Zp, this first object part 2pos being such that during the execution of the protected software 2p, at least a portion of the first part of 2pes execution takes also take into account that at least one variable or at least one copy of variable resides in unit 6, - and the second object part 2pou of the protected software 2p, this second object part 2pou being such that, after loading in unit 6 and during of the execution of the protected software 2p, appears the second part of execution 2 little by means of which at least one variable chosen, or at least one copy of the chosen variable also resides in unit 6.
When the principle of protection by elementary functions is implemented artwork, protected 2p software is modified ~ by choosing at least one step in the source of the 2ps protected software which when running 2p protected software, realizes the functionality of a algorithmic processing, ~ by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that - at least one chosen step is broken down so that during (execution of the protected software 2p, this step is executed by means of the second part of execution 2peu, using functions elementary - for at least one chosen stage, elementary commands are integrated into the source of the 2ps protected software, so that when (execution of protected 2p software, each elementary command is executed by the first 2pes execution part and triggers in (unit 6, execution by means of the second execution part 2peu, of an elementary function, - and a scheduling of elementary orders is chosen from all the schedules allowing (software execution protected 2p, ~ and by producing - the first part 2pos object of the protected software 2p, this first Zpos object part being such that during (execution of protected software 2p, elementary commands are executed according to chosen provisioning, - and the second object part 2pou of the protected software 2p also containing the operating means, this second object part 2pou being such that after loading in unit 6 and when (running the software protected Zp, appears the second part of execution Zpeu by means of which are executed the elementary functions triggered by the first part of execution 2pes.
When the principle of protection by detection and coercion is implemented artwork, protected 2p software is modified ~ by choosing at least one software execution characteristic â
monitor, among the performance characteristics likely to be monitored, ~ by choosing at least one criterion to respect for at least one selected software execution characteristic, ~ by choosing in the source of the protected 2ps software, functions elementary for which at least one performance characteristic of software chosen, is to be monitored, ~ by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that during (execution of the protected software 2p, at least one selected performance characteristic is monitored at means of the second part of execution 2peu, and the non respect of a criterion results in information from the data processing system 3 and / or a modification of the execution of the protected software 2p, ~ and by producing the second object part 2pou of the protected software 2p containing the operating means also implementing the means of detection 17 and the coercion means 18, this second object part 2pou being such that, after loading in unit 6 and during (execution of the 2p protected software, at least one software execution characteristic is monitored and non-compliance with a criterion results in information to the data processing system 3 and / or a modification of the execution protected software 2p.
For the implementation of the principle of protection by detection and coercion using as characteristic a measurement variable of (execution of software, the protected 2p software is changed ~ by choosing as software execution feature to monitor, at least one measurement variable of (use of a software functionality, ~ by choosing - at least one feature of the 2p protected software whose use is likely to be monitored using a measurement variable, - at least one measurement variable used to quantify (use of said functionality, - at least one threshold associated with a chosen measurement variable corresponding to a limit of use of said functionality, - and at least one method for updating a measurement variable chosen according to the use of said functionality, ~ and by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that, during the execution of the software protected 2p, the measurement variable is updated using the second 2-bit execution part, depending on (use of said functionality and at least one threshold crossing is taken into account.
For the implementation of a first preferred alternative embodiment of the protection principle by detection and coercion using, as feature, a measurement variable, the protected 2p software is modified ~ by choosing in the source of the protected 2ps software, at least one variable of selected measurement with which several thresholds must be associated corresponding to different limits on the use of the functionality, ~ by choosing at least two thresholds associated with the measurement variable selected, ~ and by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that, during (execution of the software protected 2p, the overruns of the various thresholds are taken into account, at means of the second part of execution 2peu, differently.
For the implementation of a second preferred embodiment of the protection principle by detection and coercion using as characteristic, a measurement variable, 2p protected software is modified ~ by choosing in the source of the protected 2ps software, at least one variable of measurement chosen to limit (use of a functionality to which must be credited for at least one additional use, ~ and by modifying at least one selected portion, this modification being such that in a so-called recharging phase, at least one use additional of at least one functionality corresponding to a variable selected measurement can be credited.
For the implementation of the principle of protection by detection and coercion using as a feature, a software usage profile, the protected software 2p is changed ~ by choosing as software execution feature to monitor at least one software usage profile, ~ by choosing at least one line of execution than at least one profile of use chosen must respect, ~ and by modifying at least a selected portion of the source of the protected software Zps, this modification being such that, during the execution of the software protected 2p, the second part of execution 2peu respects all the features of execution chosen.
For the implementation of the principle of protection by detection and coercion using as a performance line to be respected, monitoring of (concatenation execution, 2p protected software is modified ~ by modifying at least a selected portion of the source of the protected software 2 ps:
- by transforming elementary functions into instructions, - by specifying the sequence that at least some must respect instructions when executed in (unit 6, - and by transforming elementary orders into orders instructions corresponding to the instructions used.
When the renaming protection principle is implemented, the software 2p is changed ~ by choosing commands from the source of the protected 2ps software, triggering, ~ by modifying at least a selected portion of the source of the 2ps protected software by renaming the instructions for the selected trigger commands, in order to to conceal (identity of the corresponding dependent functions, ~ and by producing - the first part 2pos object of the protected software 2p, this first object part 2pos being such that during the execution of the protected software 2p, the triggering commands with renowned instructions are executed - and the second object part 2pou of the protected 2p software containing the operating means also using the means of recovery 20, this second object part 2pou being such that, after loading in unit 6 and during (execution of protected software 2p, (identity of dependent functions whose execution is triggered by the first part of execution 2pes is restored by means of the second part of execution 2peu, and the dependent functions are executed by means of the second execution part 2peu.
For the implementation of a variant of the principle of protection by renaming, protected 2p software is modified ~ by choosing at least one protected source of 2ps software triggering command with renamed setpoint, ~ and by modifying at least a selected portion of the source of the protected software 2ps by replacing at least the renamed setpoint of an order triggering at a renamed setpoint chosen, by another setpoint fame, triggering a function dependent on the same family.
Of course, the protection principles according to (invention can be applied directly when developing new software without require the prior production of intermediate protected software. In this way, the stages creation S21 and modification S22 can be carried out simultaneously of so as to directly obtain the protected software 2p.
During the downstream protection sub-phase P2, it is implemented after the stage of creation S21 of the protected software 2p, and possibly after the stage of change 522, a stage called "personalization stage S23". During this stage of personalization 523, the second part object 2pou possibly containing the operating means is loaded into at least one blank unit 60, with a view to obtain at least one unit 6, or part of the second object part 2pou possibly containing the operating resources is loaded into at least a pre-personalized unit 66, in order to obtain at least one unit 6. The loading of this personalization information makes it possible to make operational at least a unit 6. It should be noted that some of this information, once transferred in unit 6, is not directly accessible from (outside this unit 6. The transfer personalization information in a blank unit 60 or a pre unit custom 66 can be achieved through a personalization adapted which is described in the following description in FIG. 150. In the case of a unit 6, consisting of a smart card 7 and its reader 8, the customization does concerns only the smart card 7.
For the implementation of the protection phase P, different means techniques are described more precisely in relation to FIGS. 110, 120, 130, 140 and 150.
Fig. 110 illustrates an exemplary embodiment of a system 25 making it possible to implement the S12 construction stage taking into account the definitions intervened at the definition stage Sll and during which the means 12, 13 and possibly the operating resources intended for (unit 6.
Such a system 25 includes a program or station development unit of work conventionally presented in the form of a computer comprising a central unit, a screen, keyboard-mouse peripherals, and comprising, in particular, the following programs: file editors, assemblers, pre-processors, compilers, interpreters, debuggers and linkers.
Fig. 120 illustrates an exemplary embodiment of a pre-unit personalization 30 making it possible to at least partially load the means of transfer 13 and / or the operating means in at least one blank unit 60 in view to obtain at least one pre-personalized unit 66. This pre-personalized unit personalization 30 includes a read and write means 31 allowing befor-electrically customize a blank unit 60 so as to obtain a pre-personalized unit 66 in which the transfer means 13 and / or were loaded. The pre-personalization unit 30 can also include physical personalization means 32 of (blank unit 60 up for example, in the form of a printer. In the case where (unit 6 is consisting of a smart card 7 and its reader 8, the pre-personalization concerned usually only the smart card 7.
Fig. 130 illustrates an embodiment of a system 35 allowing make the tools to help generate protected software or automate software protection. Such a system 35 includes a unit of development of program or workstation presenting itself conventionally under the shape of a computer comprising a central unit, a screen, peripheral devices of the keyboard-mouse type, and comprising, in particular, the following programs:
publishers files, assemblers, pre-processors, compilers, interpreters, debuggers and link publishers.
Fig. 140 illustrates an exemplary embodiment of a system 40 making it possible to directly create 2p protected software or modify vulnerable software 2v in to obtain protected software 2p. Such a system 40 includes a unit of development of program or workstation presenting itself conventionally under the shape of a computer comprising a central unit, a screen, peripheral devices of the keyboard-mouse type, and comprising, in particular, the following programs:
publishers files, assemblers, pre-processors, compilers, interpreters, debuggers and linkers, as well as tools to help generate software protected or automate software protection.
Fig. 150 illustrates an exemplary embodiment of a personalization unit allowing to load the second object part 2pou in at least one unit virgin 60 in order to obtain at least one unit 6 or part of the second object part 2pou in at least one pre-personalized unit 66 in order to obtain at least one unit 6.
This personalization unit 45 includes a means of reading and writing for electrically personalizing at least one blank unit 60 or at least one pre-personalized unit 66, so as to obtain at least one unit 6.
A (from this personalization, a unit 6 contains the information required to (execution of the protected software 2p. The personalization unit 45 can also include physical personalization means 47 for at least one unit 6 can be for example, in the form of a printer. In the case or a unit 6 is constituted by a smart card 7 and its reader 8, the personalization generally only concerns the smart card 7.
The protection method of the invention can be implemented with the following improvements ~ Several treatment units can be used together and of storage in which the second part object 2pou is distributed protected software Zp so that their joint use allows 7s to run protected 2p software, the absence of at least one of these processing and storage preventing the use of protected software 2p.
~ Similarly, after the S13 pre-personalization stage and during the customization 523, the part of the second part object 2 can be necessary to transform the pre-personalized unit 66 into a unit 6 can be contained in a processing and storage unit used by the personalization unit 45 in order to limit access to this part of the second part object 2pou. Of course, this part of the second part 2pou object can be distributed in several processing units and memorization so that this part of the second object part 2pou only accessible during (joint use of these processing and memorization.

Claims (36)

CLAIMS: 1 - Method for protecting, from at least one blank unit (60) comprising at least storage means (15) and processing means (16), a vulnerable software (2v) against its unauthorized use, said software vulnerable (2v) operating on a data processing system (3), characterized in what he is:
.fwdarw. in a protection phase (P):
.cndot. create protected software (2p) - by choosing in the source of the vulnerable software (2vs), at least one conditional connection, - by choosing at least a portion of the source of the vulnerable software (2vs) containing at least one selected conditional branch, - by producing the source of the protected software (2ps) from the source of the vulnerable software (2vs), by modifying at least a selected portion of the source of vulnerable software (2vs) to get at least a portion modified from the source of the protected software (2ps), this modification being such as when running protected software (2p):
~ a first part of execution (2pes) is executed in the data processing system (3) and a second part of execution (2peu) is executed in a unit (6), obtained at from the blank unit (60) after loading information, ~ and the second part of execution (2peu) executes at least the functionality of at least one conditional branch chosen and makes available to the data processing system (3) a information allowing the first part of execution (2pes) to continue its execution at the chosen location, - and by producing:
~ a first object part (2pos) of the protected software (2p), from from the source of the protected software (2ps), this first object part (2pos) being such that during the execution of the protected software (2p), a first execution part (2pes) appears which is executed in the data processing system (3) and of which at least one portion takes into account that at least one connection chosen conditional is executed in unit (6), ~ and a second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading in the blank unit (60) and during the execution of the protected software (2p), appears the second part of execution (2peu) by means of which each conditional branch chosen is executed, .cndot. and to load the second object part (2pou) into the blank unit (60), in sight to obtain unity (6), .fwdarw. and in a use phase (U) during which is executed The software protected (2p):
.cndot. in the presence of the unit (6) and each time that a portion of the first execution part (2pes) requires it, to execute the functionality of a conditional connection in the unit (6), so that this portion is executed correctly and therefore the protected software (2p) is fully functional, .cndot. and in the absence of the unit (6) and despite the request for a portion of the first part execution (2pes) to execute the functionality of a conditional connection in unit (6), not being able to respond correctly to this request, so that at least this portion is not executed correctly and therefore the protected software (2p) is not not fully functional. 2 - Method according to claim 1, characterized in that it consists, in the protection phase (P), to modify the protected software (2p):
- by choosing, in the source of the protected software (2ps) at least one selected conditional branching series, - by modifying at least a selected portion of the software source protected (2ps), this modification being such that during the execution of the protected software (2p), the overall functionality of at least one series of conditional branching is executed by means of the second part of execution (2peu), in unit (6), - and by producing:
~ the first object part (2pos) of the protected software (2p), this first part object (2pos) being such that during the execution of the protected software (2p), the functionality of at least one series chosen conditional branching is executed in the unit (6) ~ and the second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading in unit (6) and when running protected software (2p), appears the second part of execution (2peu) by means of which the overall functionality of at least one selected set of conditional branching is executed. 3 - Method according to claim 1 or 2, characterized in that it consists:
~ in the protection phase (P):
.cndot. to modify the protected software (2p):
- by choosing in the source of the protected software (2ps):
~ at least one algorithmic processing which during the execution of the protected software (2p), uses at least one operand, and allows determine, at least in part, the result of a connection conditional chosen, ~ and at least one portion containing at least one treatment chosen algorithmic, - by modifying at least a selected portion of the software source protected (2ps), this modification being such that:
at least the functionality of at least one algorithmic processing chosen is executed by means of the second part of execution (2peu) ~ at least one chosen algorithmic processing is broken down by so that when running protected software (2p) appear by means of the second part of execution (2peu), several distinct stages, namely:
~ the provision of at least one operand for the unit (6), ~ the realization in unit (6) of the functionality of the algorithmic processing on at least this operand, ~ and possibly, the provision of at least one result, by unit (6) for the processing system data (3), for at least one chosen algorithmic processing, commands steps are defined so that when running the protected software (2p), each step command is executed by the first part of execution (2pes) and triggers in the unit (6), execution by means of the second execution part (2peu), of a stage, and a sequencing of the step commands is chosen from all the orders allowing the execution of the protected software (2p), - and by producing:
the first object part (2pos) of the protected software (2p), this first part object (2pos) being such that during the execution of the protected software (2p), step commands are executed depending on the order chosen, and the second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading in unit (6) and when running protected software (2p), appears the second part of execution (2peu) by means of which are executed the steps triggered by the first part execution (2pes), and in the use phase (U):
~ in the presence of the unit (6) and each time a step command contained in a portion of the first part of execution (2pes) requires it, to execute the corresponding step in unit (6), so that this portion is executed correctly and therefore the software protected (2p) is fully functional, .cndot. and in the absence of the unit (6), despite the request for a portion of the first part of execution (2pes) to trigger the execution of a step in unit (6), not being able to respond correctly to this request, so that at least this portion is not executed correctly and that, by Consequently, the protected software (2p) is not fully functional. 4 - Method according to claim 3, characterized in that it consists:
in the protection phase (P):
.cndot. to modify the protected software (2p):
- by choosing at least one variable used in at least one chosen algorithmic processing, which when running the software protected (2p), partially defines the state of the protected software (2p), - by modifying at least a selected portion of the software source protected (2ps), this modification being such that during the execution of the protected software (2p), at least one variable chosen or at least one copy of selected variable resides in (unit (6), - and by producing:
the first object part (2pos) of the protected software (2p), this first part object (2pos) being such that during the execution of the protected software (2p), at least a portion of the first part of execution (2pes) also takes into account that at least one variable or at least one copy of variable resides in unit (6), and the second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading in unit (6) and when running protected software (2p), appears the second part of execution (2peu) by means of which at minus one chosen variable, or at least one copy of variable chosen also resides in unit (6), and in the use phase (U):
.cndot. in the presence of the unit (6) each time that a portion of the first part of execution (2pes) requires it, to use a variable or a copy of variable residing in (unit (6), so this portion is executed correctly and therefore the protected software (2p) is fully functional, .cndot. and in (absence of (unit (6), despite the request for a portion of the first part of execution (2pes) to use a variable or a copy of variable residing in unit (6), unable to respond correctly to this request, so that at least this portion is not executed correctly and therefore the protected software (2p) is not fully functional. - Method according to claim 3, characterized in that it consists ~ in the protection phase (P):
.cndot. to define:
- a set of elementary functions whose elementary functions are likely to be executed in unit (6), - and a set of elementary commands for this set of functions elementary, these elementary commands being likely to be executed in the data processing system (3) and trigger the execution in unit (6) of elementary functions, .cndot. to build operating resources allowing the unit (6), to run the basic functions of said game, the execution of these functions elementary being triggered by execution in the processing system data (3), basic commands, .cndot. and modify the protected software (2p):
- by choosing in the source of the protected software (2ps), at least one step which during the execution of the protected software (2p), realizes the functionality of algorithmic processing, - by modifying at least a selected portion of the software source protected (2ps), this modification being such that at least one chosen step is broken down so that when (execution of protected software (2p), this step is executed at means of the second part of execution (2peu), using elementary functions, ~ for at least one chosen step, elementary commands are integrated into the source of the protected software (2ps), so that when running the protected software (2p), each command elementary is executed by the first part of execution (2pes) and triggers in (unit (6), execution by means of the second execution part (2peu), of an elementary function, ~ and a scheduling of elementary orders is chosen among all the orders allowing the execution of the protected software (2p), - and by producing ~ the first object part (2pos) of the protected software (2p), this first part object (2pos) being such that during the execution of the protected software (2p), basic commands are executed depending on the order chosen, ~ and the second object part (2pou) of the protected software (2p) also containing the operating resources, this second part object (2pou) being such that, after loading in the unit (6) and when running the protected software (2p), the second appears execution part (2peu) by means of which the elementary functions triggered by the first part execution (2pes), ~ and in the use phase (U) .cndot. in the presence of the unit (6) and each time a command elementary contained in a portion of the first part of execution (2pes) (requires, to execute the corresponding elementary function in unit (6), so this portion is executed correctly and, therefore, the protected software (2p) is fully functional, .cndot. and in the absence of the unit (6), despite the request for a portion of the first part of execution (2pes), to trigger the execution of a function elementary in (unit (6), not being able to respond correctly to this request, so that at least this portion is not executed correctly and therefore the protected software (2p) is not fully functional. 6 - Method according to claim 5, characterized in that it consists in the protection phase (P):
.cndot. to define :
- at least one software execution characteristic, capable of being at least partially monitored in the unit (6), - at least one criterion to respect for at least one characteristic software execution, - detection means (17) to be implemented in the unit (6) and making it possible to detect that at least one performance characteristic of software does not meet at least one associated criterion, - and coercion means (18) to be implemented in the unit (6) and to inform the data processing system (3) and / or modify the execution of a software, when at least one criterion is not met, .cndot. to build the operating resources allowing the unit (6), to to put also use the detection means (17) and the coercion means (18) .cndot. and modify the protected software (2p):
- by choosing at least one software execution characteristic to monitor, among the performance characteristics likely to be monitored, - by choosing at least one criterion to respect for at least one selected software execution characteristic, - by choosing in the source of the protected software (2ps), functions elementary for which at least one performance characteristic of software chosen, is to be monitored, - by modifying at least a selected portion of the software source protected (2ps), this modification being such that during the execution of the protected software (2p), at least one execution characteristic chosen is monitored by means of the second part of execution (2peu), and the non-compliance with a criterion results in information to the data processing (3) and / or a modification of the execution of the protected software (2p), - and by producing the second object part (2pou) of the protected software (2p) containing the operating resources also implementing the detection means (17) and coercion means (18), this second object part (2pou) being such that, after loading in the unit (6) and when running the protected software (2p), at least one software execution characteristic is monitored and non-compliance of a criterion leads to information from the processing system data (3) and / or a modification of the execution of the protected software (2P) .fwdarw. and in the use phase (U):
.cndot. in the presence of the unit (6):
- as long as all the criteria corresponding to all the characteristics monitored execution of all modified portions of the software protected (2p) are respected, to allow nominal operation of these portions of the protected software (2p) and therefore allow the nominal operation of protected software (2p), - and if at least one of the criteria corresponding to a characteristic supervised execution of a portion of the protected software (2p) is not complied with, to inform the data processing system (3) and / or to modify the operation of the portion of protected software (2p), so that the operation of the protected software (2p) is modified. 7 - Method according to claim 6, to limit the use of software protected (2p), characterized in that it consists:
.fwdarw. in the protection phase (P):
.cndot. to define:
- as a feature of software execution likely to be monitored, a variable measuring the use of a functionality software, - as a criterion to be respected, at least one threshold associated with each measurement variable, - and updating means making it possible to update at least one measurement variable, .cndot. to build the operating resources allowing the unit (6) to to put also implement the means of updating, .cndot. and modify the protected software (2p):
- by choosing as a software execution characteristic to monitor, at least one variable measuring the use of a software functionality, - by choosing:
~ at least one feature of the protected software (2p) including usage is likely to be monitored by a variable of measurement, ~ at least one measurement variable used to quantify the use of said functionality, ~ at least one threshold associated with a chosen measurement variable corresponding to a limit of use of said functionality, ~ and at least one method for updating a measurement variable chosen according to the use of said functionality, - and by modifying at least a selected portion of the software source protected (2ps), this modification being such that, during the execution of the protected software (2p), the measurement variable is updated using the second part of execution (2peu), depending on the use of said functionality and at least one threshold crossing is taken into account account, .fwdarw. and in the use phase (U), in the presence of the unit (6), and in case it at least one threshold violation corresponding to at least one is detected usage limit, to inform the data processing system (3) and to modify the operation of the protected software portion (2p), so that the operation of the protected software (2p) is modified. 8 - Method according to claim 7, characterized in that it consists .fwdarw. in the protection phase (P):
.cndot. to define:
- for at least one measurement variable, several associated thresholds, - and different means of coercion corresponding to each of these thresholds, .cndot. and modify the protected software (2p):
- by choosing in the source of the protected software (2ps), at least one chosen measurement variable to which several must be associated thresholds corresponding to different limits of use of the feature - by choosing at least two thresholds associated with the measurement variable selected, - and by modifying at least a selected portion of the software source protected (2ps), this modification being such that, during the execution of the protected software (2p), the overruns of the various thresholds are taken into account account, by means of the second part of execution (2peu), so different, .fwdarw. and in the use phase (U):
.cndot. in the presence of the unit (6):
- in the event that a first threshold is exceeded, at order the protected software (2p) to no longer use the functionality correspondingly, - and in the event that a second threshold is exceeded, at render the corresponding functionality and / or at least one inoperative portion of the protected software (2p). 9 - Method according to claim 7 or 8, characterized in that it consists in the protection phase (P):
.cndot. to define reloading means allowing to credit at least a additional use for at least one software feature monitored by a measurement variable, .cndot. to build the operating resources also allowing the unit (6) of implement the recharging means, .cndot. and modify the protected software (2p):
- by choosing in the source of the protected software (2ps), at least one chosen measurement variable to limit the use of a functionality to which at least one additional use must can be credited, - and by modifying at least one selected portion, this modification being such as in a so-called recharging phase, at least one use additional of at least one functionality corresponding to a selected measurement variable can be credited, .fwdarw. and in the recharging phase:
.cndot. to update at least one selected measurement variable and / or at least a associated threshold, so as to allow at least one use additional functionality. - Method according to claim 6, characterized in that it consists:
.fwdarw. in the protection phase (P):
.cndot. to define:
- as a feature of software execution likely to be monitored, a software usage profile, - and as a criterion to be respected, at least one performance trait of software, .cndot. and modify the protected software (2p) - by choosing as a software execution characteristic to monitor at least one software usage profile, - by choosing at least one performance trait than at least one profile of use chosen must respect, - and by modifying at least a selected portion of the software source protected (2ps), this modification being such that, during the execution of the protected software (2p), the second part of execution (2peu) respects all selected performance traits, .fwdarw. and in the use phase (U) in the presence of the unit (6), and in case it is detected that at least one performance trait is not respected, to be informed the data processing system (3) and / or to modify the functioning of the portion of the protected software (2p), so that the operation of the software protected (2p) is modified. 11 - Method according to claim 10, characterized in that it consists:
.fwdarw. in the protection phase (P):
.cndot. to define:
- a set of instructions whose instructions are likely to be executed in unit (6), - a set of instruction commands for this set of instructions, these instruction commands being capable of being executed in the data processing system (3) and trigger in the unit (6) the execution of instructions, - as a usage profile, the sequence of instructions, - as an execution feature, a desired sequence for the execution of instructions, - as detection means (17), means making it possible to detect that the sequence of instructions does not match that wish, - And as means of coercion (18), means allowing to inform the data processing system (3) and / or to modify the operation of the portion of protected software (2p) when the sequence of instructions does not correspond to that desired, .cndot. to build the operating resources also allowing the unit (6) to execute the instructions in the instruction set, the execution of these instructions being triggered by execution in the processing system data (3), instruction commands, .cndot. and modify the protected software (2p):
- by modifying at least a selected portion of the software source protected (2ps):
~ by transforming elementary functions into instructions, ~ by specifying the sequence that must respect at least some of the instructions when executed in unit (6), ~ and by transforming elementary commands into commands instructions corresponding to the instructions used, .fwdarw. and in the use phase (U), in the presence of the unit (6), in the case where it is detected that the sequence of instructions executed in the unit (6) does not does not correspond to the desired one, to inform the processing system of data (3) and / or modify the operation of the software portion protected (2p), so that the operation of the protected software (2p) is changed. 12 - Method according to claim 11, characterized in that it consists:
.fwdarw. in the protection phase (P):
.cndot. to define:
- as a set of instructions, a set of instructions of which at least some instructions work on registers and use at least an operand to render a result, - for at least part of the instructions working on registers ~ a part (PF) defining the functionality of the instruction, ~ and a part defining the desired sequence for execution instructions and having corresponding bit fields at:
~ an instruction identification field (CII), ~ and for each operand of the instruction:
* a flag field (CD k), * and a planned identification field (CIP k) of operand, - for each register belonging to the operating resources and used by the instruction set, a generated identification field (CIG v) in which the identification of the last instruction having returned its result in this register, - As detection means (17), means allowing, during the execution of an instruction, for each operand, when the field flag (CD k) requires it, to control the equality between the field generated identification (CIG v) corresponding to the register used by this operand, and the expected identification field (CIP k) of the origin of this operand, - And as means of coercion (18), means making it possible to modify the result of the instructions, if at least one of the ties controlled is false. 13 - Method according to claim 5 or 11 characterized in that it consists in the protection phase (P):
.cndot. to define:
- as a triggering command, a basic command or an instruction command, - as a dependent function, an elementary function or a instruction, - as an instruction, at least one argument for an order triggering, corresponding at least in part to the information transmitted by the data processing system (3) to the unit (6), so trigger the execution of the corresponding dependent function, - a method of renaming the instructions allowing renaming of the instructions in order to obtain triggering orders with instructions renamed, - and recovery means (20) intended to be implemented in the unit (6) during the use phase (U), and allowing find the dependent function to be executed, from the setpoint fame, .cndot. to build operating resources allowing the unit (6) to to put also implement the means of recovery, .cndot. and modify the protected software (2p):
- by choosing in the source of the protected software (2ps), commands triggering, - by modifying at least a selected portion of the software source protected (2ps) by renaming the command instructions selected triggers, in order to conceal the identity of the functions corresponding dependents, - and by producing ~ the first object part (2pos) of the protected software (2p), this first part object (2pos) being such that during the execution of the protected software (2p), triggering commands with instructions renames are executed, ~ and the second object part (2pou) of the protected software (2p) containing the operating resources also implementing the recovery means (20), this second object part (2pou) being such that, after loading into the unit (6) and during the execution of the protected software (2p), the identity of the functions dependents whose execution is triggered by the first part of execution (2pes) is restored by means of the second part execution (2peu), and the dependent functions are executed at means of the second part of execution (2peu), .fwdarw. and in the use phase (U):
.cndot. in the presence of the unit (6) and each time a command triggering at renowned instruction, contained in a portion of the first part of execution (2pes) requires it, to restore in the unit (6), the identity of the corresponding dependent function and to execute it, so that this portion is executed correctly and therefore the software protected (2p) is fully functional, .cndot. and in the absence of the unit (6), despite the request for a portion of the first part of execution (2pes), to trigger the execution of a function dependent in unit (6), not being able to respond correctly to this request, so that at least this portion is not executed correctly and therefore the protected software (2p) is not fully functional. 14- Method according to claim 13, characterized in that it consists:
.fwdarw. in the protection phase (P):
.cndot. to define for at least one dependent function, a family of functions algorithmically equivalent dependent, but triggered by triggering commands whose renamed instructions are different, .cndot. and modify the protected software (2p):
- by choosing in the source of the protected software (2ps) at least one triggering command with renamed setpoint, - and by modifying at least a selected portion of the software source protected (2ps) by replacing at least the renamed setpoint of a trigger command with renamed setpoint chosen, by another renamed setpoint, triggering a function dependent on the same family. 15 - Process according to claim 14, characterized in that it consists .fwdarw. in the protection phase (P), to be defined, for at least one function dependent, a family of algorithmically dependent functions equivalent:
- by concatenating a noise field to the information defining the part functional of the dependent function to be executed in unit (6), - or by using the instruction identification field (CII) and the expected identification fields (CIP k) of the operands. 16 - Process according to claim 13, 14 or 15, characterized in that it is:
.fwdarw. in the protection phase (P):
.cndot. to define:
- as a method of renaming the instructions, a method of encryption to encrypt the instructions, - and as recovery means (20), means putting in uses a decryption method to decipher the instructions renamed and thus re-establish the identity of the functions dependent on run in unit (6). 17 - Method according to one of claims 1 to 16, characterized in that it consists in breaking down the protection phase (P) into a sub-phase of protection upstream (P1), independent of the software to be protected and a sub-phase of protection downstream (P2), dependent on the software to be protected. 18 - Process according to claim 17, characterized in that it consists, during of the upstream protection sub-phase (P1), to involve a definitions (S11) in which all definitions are made. 19- A method according to claim 18, characterized in that it consists, after the definition stage (S11), involving a construction stage (S12) in which are built the operating means. 20 - Method according to claim 19, characterized in that it consists, after the construction stage (S12), involving a pre-personalization (S13), consisting in loading into a blank unit (60), at least part of the means for obtaining a pre-personalized unit (66). 21 - Process according to claim 18 or 19, characterized in that it consists during the upstream protection sub-phase (P1), to involve a making tools (S14) in which tools are made for help to generate protected software or to automate software protection. 22 - Process according to claims 17 and 20, characterized in that it consists of decompose the downstream protection sub-phase (P2), by .cndot. a creation stage (S21) in which the protected software is created (2p), at from vulnerable software (2v), .cndot. optionally, a modification stage (S22) in which is modified the protected software (2p), .cndot. and a personalization stage (S23) in which - the second object part (2pou) of the protected software (2p) containing possibly the means of exploitation is loaded in at least a blank unit (60) in order to obtain at least one unit (6), - or part of the second object part (2pou) of the protected software (2p) possibly containing the operating resources is loaded into at least one pre-personalized unit (66) in order to obtain at least a unit (6). 23 - Method according to claims 21 and 22, characterized in that it consists during the creation stage (S21) and possibly the modification stage (S22), at use at least one of the tools to help generate protected software or software protection automation. 24 - System for implementing the method according to claim 19, characterized in that it includes a program development unit, using, during the construction stage (S12), to carry out the construction of the means for the unit (6), taking into account the definitions intervened in definition stage (S11). 25 - System for implementing the method according to claim 20, characterized in that it includes a pre-personalization unit (30) allowing to load at least part of the operating resources into at least one unit blank (60), in order to obtain at least one pre-personalized unit (66). 26 - System for implementing the method according to claim 21, characterized in that it includes a program development unit, for to be carried out during the tool-making stage (S14), the tool-making help with generation of protected software or protection automation software. 27 - System for implementing the method according to claim 22 or 23, characterized in that it includes a development unit for programs used to create or modify protected software (2p). 28 - System for implementing the method according to claim 22, characterized in that it includes a personalization unit (45) allowing of charge:
.cndot. the second object part (2pou) in at least one blank unit (60), view obtain at least one unit (6), .cndot. or part of the second object part (2pou) in at least one pre- unit customized (66), in order to obtain at least one unit (6). 29 - Pre-personalized unit (66), characterized in that it is obtained by the system according to claim 25. 30 - Unit (6) for running protected software (2p) and preventing his unauthorized use, characterized in that it contains the second object part (2pou) protected software (2p) loaded using a personalization (45) according to claim 28. 31 - Set of units (6), characterized in that the second object part (2pou) protected software (2p), loaded using a customization unit (45) according to claim 28, is distributed over several units of treatment and memorization so that their joint use makes it possible to execute the software protected (2p). 32 - Distribution set (2pd) of protected software (2p), characterized by this that it includes:

.cndot. a first distribution part (2pds) containing the first part object (2pos) and intended to operate in a processing system data (3), .cndot. and a second distribution part (2pdu) presenting itself under the form:
- a blank unit (60), - or a pre-personalized unit (66) according to claim 29, capable after loading personalization information, of transform into a unit (6), - or a unit (6) according to claim 30. 33 - Distribution set (2pd) of protected software (2pd) according to the claim 32, characterized in that the first dispensing part (2pds) present in the form of a physical distribution medium, CDROM for example, or as files distributed across a network. 34 - Distribution package (2pd) of protected software (2p) according to the claim 32, characterized in that the second distribution part (2pdu), in the form of blank units (60), pre-personalized units (66) or units (6), comprises at least one smart card (7). 35 - Processing and storage unit characterized in that it contains the part of the second object part (2pou) necessary to transform a unit pre-customized (66) according to claim 29 into a unit (6) according to the claim 30. 36 - Set of processing and storage units characterized in that the processing and storage units used jointly, contain the part of the second object part (2pou) necessary to transform a unit pre-customized (66) according to claim 29 into a unit (6) according to the claim 30.