WO2003012604A2

WO2003012604A2 - Method for protecting a software using a so-called renaming principle against its unauthorised use

Info

Publication number: WO2003012604A2
Application number: PCT/FR2002/002340
Authority: WO
Inventors: Jean-Christophe Cuenod; Gilles Sgro
Original assignee: Validy
Priority date: 2001-07-31
Filing date: 2002-07-04
Publication date: 2003-02-13
Also published as: BR0211375A; TNSN04013A1; KR20040032858A; WO2003012604A3; MA26127A1; ZA200400350B; HK1070154A1; MXPA04000596A; FR2828303B1; IL159951A0; CA2454094A1; HRP20040048A2; CN1535408A; YU5604A; HUP0400232A2; PL367440A1; JP3949105B2; CN1288524C; EP1412837A2; JP2004537800A

Abstract

The invention concerns a method for protecting, from a unit, a vulnerable software against unauthorised use, said vulnerable software operating on a data processing system. The inventive method consists in defining: a set of dependent functions whereof the dependent functions are executable in a unit; a set of triggering commands, said triggering commands capable of being executed in the data processing system and of triggering execution of the dependent functions in a unit; for each triggering command, an instruction; a method for renaming the instructions; and reinstating means for implementation in a unit during a use phase, and enabling to recover the dependent function to be executed, from the renamed instruction.

Description

METHOD FOR PROTECTING SOFTWARE USING A SAID "RENAME" PRINCIPLE AGAINST ITS UNAUTHORIZED USE

The present invention relates to the technical field of data processing systems in the general sense and it relates, more specifically, to the means for protecting, against its unauthorized use, software running on said data processing systems.

The object of the invention relates, more particularly, to the means for protecting software against its unauthorized use, from a processing and storage unit, such a unit being commonly embodied by a smart card or by a hardware key on USB port. In the above technical area, the main drawback concerns the unauthorized use of software by users who have not paid license fees. This unlawful use of software causes obvious damage to software publishers, software distributors and / or any person integrating such software into products. To avoid such illegal copies, various solutions have been proposed in the state of the art to protect software.

Thus, a protection solution is known which consists in implementing a material protection system, such as a physical element called a protection key or "dongle" in English terminology. Such a protection key should guarantee the execution of the software only in the presence of the key. However, it must be noted that such a solution is ineffective because it has the disadvantage of being easily circumvented. A malicious person or hacker can, using specialized tools, such as disassemblers, remove the control key control instructions. It then becomes possible to make illegal copies corresponding to modified versions of software that no longer have any protection. In addition, this solution cannot be generalized to all software, since it is difficult to connect more than two protection keys on the same system.

The object of the invention is precisely to remedy the drawbacks stated above by proposing a method for protecting software against its unauthorized use, from an ad hoc processing and storage unit, in the since the presence of such a unit is necessary for the software to be fully functional.

To achieve such an objective, the object of the invention relates to a method for protecting, from at least one blank unit comprising at least processing means and storage means, vulnerable software against its unauthorized use, said vulnerable software running on a data processing system. The method according to the invention consists: -> in a protection phase:

• to be defined: - a set of dependent functions whose dependent functions are capable of being executed in a unit,

a set of triggering commands for this set of dependent functions, these triggering commands being capable of being executed in the data processing system and of triggering the execution in a unit, of dependent functions,

- for each triggering command, a set point corresponding at least in part to the information transmitted from the data processing system to a unit, in order to trigger the execution of the corresponding dependent function in a unit, this set point being under the form of at least one argument of the triggering command,

- a method of renaming the instructions making it possible to rename the instructions in order to obtain triggering commands with renowned instructions, - and recovery means intended to be implemented in a unit during a phase of use, and allowing to find the dependent function to be executed, from the renamed setpoint,

• to build operating means making it possible to transform the virgin unit into a unit capable of implementing the means of recovery,

• to create protected software: - by choosing, at least one algorithmic processing which, during the execution of the vulnerable software, uses at least one operand and makes it possible to obtain at least one result,

- by choosing at least a portion of the source of the vulnerable software containing at least one chosen algorithmic processing,

- by producing the source of the protected software from the source of the vulnerable software, by modifying at least a selected portion of the source of the vulnerable software to obtain at least a modified portion of the source of the protected software, this modification being such that:

> during the execution of the protected software a first part of execution is executed in the data processing system and a second part of execution is executed in a unit, obtained from the blank unit after loading of information ,> the second execution part performs at least the functionality of at least one chosen algorithmic processing,

> at least one chosen algorithmic processing is broken down so that during the execution of the protected software, this algorithmic processing is executed, by means of the second execution part, using dependent functions,

> for at least one chosen algorithmic processing, triggering commands with renamed instructions are integrated into the source of the protected software, so that during the execution of the protected software, each triggering command with renamed instructions is executed by the first part of execution and triggers in the unit, the restoration, by means of restoration, of the setpoint and the execution, by means of the second part of execution, of the corresponding dependent function,> and a sequencing of the triggering commands at renamed instructions is chosen from among all the schedules allowing the execution of the protected software, - and by producing:

> a first object part of the protected software, from the source of the protected software, this first object part being such that during the execution of the protected software, a first execution part appears which is executed in the data processing system and at least a portion of which takes into account that the triggering commands with renowned instructions are executed according to the chosen scheduling,

> and a second object part of the protected software, containing the operating means, this second object part being such that, after loading into the blank unit and during the execution of the protected software, the second part of execution appears at means by which the setpoints are restored and the dependent functions are executed, • and the second object part is loaded into the blank unit, with a view to obtaining the unit, -> and in a use phase during which the protected software is executed:

• in the presence of the unit and each time that a triggered command with a renowned setpoint, contained in a portion of the first part of execution requires it, to restore in the unit, the identity of the corresponding dependent function and to execute it, so that this portion is executed correctly and that, therefore, the protected software is fully functional, • and in the absence of the unit, despite the request for a portion of the first part of execution to trigger the execution of a dependent function in the unit, not being able to respond correctly to this request, so that at least this portion is not executed correctly and that, consequently, the software protected is not fully functional. According to an alternative embodiment, the method according to the invention consists:

-> in the protection phase:

• to define for at least one dependent function, a family of functions algorithmically equivalent dependent, but triggered by triggering commands whose renamed instructions are different,

• and modify the protected software:

- by choosing in the source of the protected software at least one triggered command with a renowned setpoint,

- And by modifying at least a selected portion of the source of the protected software by replacing at least the renamed setpoint of a triggering command with selected renown setpoint, by another renamed setpoint, triggering a function dependent on the same family.

According to an alternative embodiment, the method according to the invention consists: - in the protection phase:

• to define :

- as a method of renaming the instructions, an encryption method for encrypting the instructions,

- And as recovery means, means implementing a decryption method to decrypt the renowned instructions and thus restore the identity of the dependent functions to be performed in the unit. According to a preferred embodiment, the method according to the invention consists:

- in the protection phase:

• to modify the protected software:

- by choosing at least one variable used in at least one chosen algorithmic processing, which during the execution of the protected software, partially defines the state of the protected software,

- by modifying at least a selected portion of the source of the protected software, this modification being such that during the execution of the protected software, at least one chosen variable or at least one copy of the chosen variable resides in the unit, - and producing:

> the first part, object of the protected software, this first part object being such that during the execution of the protected software, at least a portion of the first part of execution also takes into account that at least one variable or at least one copy of variable resides in the unit,> and the second object part of the protected software, this second object part being such that, after loading into the unit and during the execution of the protected software, the second part of execution appears by means of which at least one chosen variable, or at at least one copy of the chosen variable also resides in the unit,

-> and in the use phase:

• in the presence of the unit whenever a portion of the first part of execution requires it, to use a variable or a copy of variable residing in the unit, so that this part is executed correctly and that , therefore, the protected software is fully functional,

• and in the absence of the unit, despite the request from a portion of the first part of execution to use a variable or a copy of variable residing in the unit, not being able to respond correctly to this request, so that at least this portion is not executed correctly and that, therefore, the protected software is not fully functional.

According to another preferred embodiment, the method according to the invention consists: -> in the protection phase:

• to be defined: - a set of elementary functions, subset of the set of dependent functions, - and a set of elementary commands for this set of elementary functions, this set of elementary commands being a subset of the set triggering commands, “to build the operating means allowing the unit, to also execute the elementary functions of said game, the execution of these elementary functions being triggered by the execution in the processing system data, elementary commands whose setpoint has been renamed,

• and modify the protected software:

- by modifying at least a selected portion of the source of the protected software, this modification being such that the decomposition of at least one chosen algorithmic processing into dependent functions uses only elementary functions,

- by producing:

> the first object part of the protected software, this first object part being such that during the execution of the protected software, at least a portion of the first execution part also executes the elementary commands according to the scheduling chosen,

> and the second object part of the protected software also containing the operating means, this second object part being such that, after loading into the unit and during the execution of the protected software, the second part of execution appears using from which the elementary functions triggered by the first execution part are also executed, - and in the use phase:

• in the presence of the unit and whenever an elementary command contained in a portion of the first part of execution requires it, to execute the corresponding elementary function in the unit, so that this part is executed correctly and therefore the protected software is fully functional,

• and in the absence of the unit, despite the request for a portion of the first part of execution, to trigger the execution of an elementary function in the unit, not being able to respond correctly to this request , so that at least this portion is not executed correctly and that, therefore, the protected software is not fully functional. According to another preferred embodiment, the method according to the invention consists:

- ^ in the protection phase:

• to define : - at least one software execution characteristic, capable of being monitored at least in part in the unit,

- at least one criterion to be observed for at least one software execution characteristic, - detection means to be implemented in the unit and making it possible to detect that at least one software execution characteristic does not comply with the minus an associated criterion,

- and means of coercion to be implemented in the unit and making it possible to inform the data processing system and / or to modify the execution of a software, when at least one criterion is not met,

• to build the operating means allowing the unit, to also implement the detection means and the means of coercion,

• and modify the protected software: - by choosing at least one software execution characteristic to be monitored, from among the execution characteristics likely to be monitored,

- by choosing at least one criterion to be respected for at least one characteristic of software execution chosen, - by choosing in the source of the protected software, elementary functions for which at least one characteristic of software execution chosen, is to be monitored ,

- by modifying at least a selected portion of the source of the protected software, this modification being such that during the execution of the protected software, at least one selected execution characteristic is monitored by means of the second part of execution, and the non-compliance with a criterion results in information to the data processing system and / or a modification of the execution of the protected software,

- And by producing the second object part of the protected software containing the operating means also implementing the detection means and the coercion means, this second object part being such that, after loading into the unit and during the execution of the protected software, at least one characteristic of software execution is monitored and non-compliance with a criterion results in information to the data processing system and / or to a modification of the execution of the protected software,

-> and in the use phase:

• in the presence of the unit:

- as long as all the criteria corresponding to all the monitored execution characteristics of all the modified portions of the protected software are met, to allow the nominal operation of these portions of the protected software and therefore to allow the nominal operation of the protected software,

- and if at least one of the criteria corresponding to a monitored execution characteristic of a portion of the protected software is not met, to inform the data processing system and / or to modify the operation of the portion of the software protected, so that the operation of the protected software is changed. According to an alternative embodiment, the method according to the invention consists: - in the protection phase: • to be defined:

- as a software execution characteristic capable of being monitored, a variable for measuring the use of a software functionality,

- as a criterion to be respected, at least one threshold associated with each measurement variable,

- and updating means making it possible to update at least one measurement variable,

• to build the operating resources allowing the unit to also implement the updating means, • and to modify the protected software:

- by choosing as a software execution characteristic to monitor, at least one variable for measuring the use of a software functionality,

- by choosing :

> at least one feature of the protected software whose use is likely to be monitored using a measurement variable,

> at least one measurement variable used to quantify the use of said functionality,

> at least one threshold associated with a chosen measurement variable corresponding to a limit of use of said functionality,> and at least one method for updating a measurement variable chosen as a function of the use of said functionality,

- And by modifying at least a selected portion of the source of the protected software, this modification being such that, during the execution of the protected software, the measurement variable is updated by means of the second part of execution, as a function of the use of said functionality and at least one threshold crossing is taken into account, -> and in the use phase, in the presence of the unit, and in the event that at least one threshold crossing corresponding to at least one usage limit, to inform the data processing system and / or to modify the operation of the portion of the protected software, so that the operation of the protected software is modified. According to an alternative embodiment, the method according to the invention consists: - in the protection phase:

• to be defined: - for at least one measurement variable, several associated thresholds,

- and different means of coercion corresponding to each of these thresholds,

• and modify the protected software:

- by choosing in the source of the protected software, at least one chosen measurement variable to which must be associated several thresholds corresponding to different limits of use of the functionality, - by choosing at least two thresholds associated with the chosen measurement variable,

and by modifying at least a selected portion of the source of the protected software, this modification being such that, during the execution of the protected software, the overruns of the various thresholds are taken into account, by means of the second part of execution, differently, - and in the use phase:

• in the presence of the unit: - in the event that it is detected that a first threshold has been exceeded, to instruct the protected software to no longer use the corresponding functionality,

- And in the event that it is detected that a second threshold has been exceeded, rendering the corresponding functionality and / or at least a portion of the protected software inoperative.

To define reloading means making it possible to credit at least one additional use for at least one software functionality monitored by a measurement variable,

• to build the operating resources also allowing the unit to implement the recharging means,

• and modify the protected software:

- by choosing in the source of the protected software, at least one chosen measurement variable making it possible to limit the use of a functionality to which at least one additional use must be able to be credited,

- and by modifying at least one chosen portion, this modification being such that in a so-called reloading phase, at least one additional use of at least one functionality corresponding to a chosen measurement variable can be credited, -> and in the recharging phase:

• updating at least one chosen measurement variable and / or at least one associated threshold, so as to allow at least one additional use of the functionality. According to an alternative embodiment, the method according to the invention consists:

- in the protection phase:

• to define :

- as a software execution characteristic liable to be monitored, a software usage profile, - and as a criterion to be respected, at least one software execution feature,

• and modify the protected software:

- by choosing as a software execution characteristic to monitor at least one software use profile, - by choosing at least one execution feature that at least one chosen use profile must comply with,

- and by modifying at least a selected portion of the source of the protected software, this modification being such that, during the execution of the protected software, the second part of execution respects all the selected execution features,

-> and in the use phase in the presence of the unit, and in the event that it is detected that at least one performance feature is not observed, to inform the data processing system and / or to modify the operation of the portion of the protected software, so that the operation of the protected software is modified.

According to an alternative embodiment, the method according to the invention consists: -> in the protection phase:

• to define :

- a set of instructions, the instructions of which can be executed in the unit,

- a set of instruction commands for this set of instructions, these instruction commands being capable of being executed in the data processing system and of triggering the execution of the instructions in the unit,

- as a usage profile, the sequence of instructions, - as an execution feature, a desired sequence for the execution of instructions,

- as detection means, means making it possible to detect that the sequence of instructions does not correspond to that desired,

- and as means of coercion, means making it possible to inform the data processing system and / or to modify the operation of the portion of software protected when the sequence of instructions does not correspond to that desired,

• to build the operating means also allowing the unit to execute the instructions of the instruction set, the execution of these instructions being triggered by the execution in the data processing system, of the commands of instructions ,

• and modify the protected software:

- by modifying at least a selected portion of the source of the protected software:> by transforming elementary functions into instructions,

> by specifying the sequence that at least some of the instructions must comply with when they are executed in the unit,

> and by transforming the elementary commands into command commands corresponding to the instructions used, -> and in the use phase, in the presence of the unit, in the event that it is detected that the sequence of instructions executed in the The unit does not correspond to that desired, to inform the data processing system thereof and / or to modify the operation of the portion of the protected software, so that the operation of the protected software is modified. According to an alternative embodiment, the method according to the invention consists:

- in the protection phase:

• to define : - as a set of instructions, a set of instructions of which at least certain instructions work on registers and use at least one operand in order to render a result,

- for at least part of the instructions working on registers:> a part defining the functionality of the instruction,

> and a part defining the desired sequence for the execution of the instructions and comprising bit fields corresponding to:

0 an instruction identification field, 0 and for each operand of the instruction:

* a flag field,

* and a planned identification field of the operand,

- for each register belonging to the operating means and used by the instruction set, a generated identification field in which the identification of the last instruction having rendered its result in this register is automatically stored,

- as detection means, means making it possible, during the execution of an instruction, for each operand, when the flag field requires it, to check the equality between the identification field generated corresponding to the register used by this operand, and the expected identification field of the origin of this operand,

- and as means of coercion, means making it possible to modify the result of the instructions, if at least one of the equality checked is false. According to another preferred embodiment, the method according to the invention consists: - in the protection phase:

• to modify the protected software:

- by choosing in the source of the protected software, at least one conditional connection made in at least one chosen algorithmic processing, - by modifying at least a selected portion of the source of the protected software, this modification being such that during the execution of the protected software, the functionality of at least one conditional connection chosen, is executed, by means of the second part of execution, in unity,

- and by producing:

> the first object part of the protected software, this first object part being such that during the execution of the protected software, the functionality of at least one selected conditional connection is executed in the unit,

> and the second object part of the protected software, this second object part being such that, after loading into the unit and during the execution of the protected software, the second execution part appears by means of which the functionality of least one conditional branch chosen is executed,

-> and in the use phase:

• in the presence of the unit and whenever a portion of the first part of execution requires it, to execute the functionality of at least one conditional connection in the unit, so that this part is executed correctly and therefore the protected software is fully functional,

• and in the absence of the unit and despite the request from a portion of the first part of execution to perform the functionality of a conditional connection in the unit, not being able to respond correctly to this request, so that at least this portion is not executed correctly and therefore the protected software is not fully functional. According to an alternative embodiment, the method according to the invention consists, in the protection phase, of modifying the protected software: - by choosing, in the source of the protected software at least one series of selected conditional connections,

- by modifying at least a selected portion of the software source protected, this modification being such that during the execution of the protected software, the global functionality of at least one selected series of conditional connections is executed by means of the second execution part, in the unit, - and by producing :

> the first object part of the protected software, this first object part being such that during the execution of the protected software, the functionality of at least one selected series of conditional connections is executed in the unit,> and the second object part of the protected software, this second object part being such that, after loading into the unit and during the execution of the protected software, the second execution part appears by means of which the overall functionality of at least one selected series of conditional branching is performed.

The method according to the invention thus makes it possible to protect the use of software by the implementation of a processing and storage unit which has the particularity of containing part of the software being executed. It follows that any version derived from the software attempting to operate without the processing and storage unit requires recreating the part of the software contained in the processing and storage unit during execution, on pain of this version derived from the software is not fully functional.

Various other characteristics will emerge from the description given below with reference to the appended drawings which show, by way of nonlimiting examples, embodiments and implementation of the subject of the invention.

The fîg. 10 and 11 are functional block diagrams illustrating the various representations of software respectively unprotected and protected by the method according to the invention.

Figs. 20 to 22 illustrate, by way of examples, various embodiments of a device for implementing the method according to the invention.

Figs. 30 and 31 are functional block diagrams explaining the general principle of the method according to the invention. Figs. 40 to 43 are diagrams illustrating the protection method according to the invention implementing the principle of protection by variable.

Figs. 60 to 64 are diagrams illustrating the protection method according to the invention implementing the principle of protection by elementary functions. Figs. 70 to 74 are diagrams illustrating the protection method according to the invention implementing the principle of protection by detection and coercion.

Figs. 80 to 85 are diagrams illustrating the protection method according to the invention implementing the principle of protection by renaming.

Figs. 90 to 92 are diagrams illustrating the protection method according to the invention implementing the principle of protection by conditional branching. Fig. 100 is a diagram illustrating the different phases of implementation of the subject of the invention.

Fig. 110 illustrates an exemplary embodiment of a system allowing the implementation of the stage of construction of the protection phase according to the invention. Fig. 120 illustrates an exemplary embodiment of a pre-personalization unit used in the protection method according to the invention.

Fig. 130 illustrates an embodiment of a system allowing the implementation of the tool-making stage of the protection phase according to the invention. Fig. 140 illustrates an embodiment of a system allowing the implementation of the protection method according to the invention.

Fig. 150 illustrates an embodiment of a personalization unit used in the protection method according to the invention.

In the following description, the following definitions will be used: • A data processing system 3 is a system capable of executing a program. • A processing and storage unit is a unit capable of:

- to accept data supplied by a data processing system 3, - to restore data to the data processing system 3,

- to store data at least in part secretly and to keep at least part of them even when the unit is off,

- and to carry out algorithmic processing on data, part or all of this processing being secret.

• A unit 6 is a processing and storage unit implementing the method according to the invention.

A blank unit 60 is a unit which does not implement the method according to the invention, but which can receive information transforming it into a unit 6.

• A pre-personalized unit 66 is a blank unit 60 having received part of the information allowing it, after receiving additional information, to be transformed into a unit 6.

The loading of information into a blank unit 60 or a pre-personalized unit 66 corresponds to a transfer of information into the blank unit 60 or the pre-personalized unit 66, and to a storage of said transferred information. Optionally, the transfer may include a change in information format.

• A variable, data or function contained in the data processing system 3 will be indicated by a capital letter, while a variable, data or function contained in unit 6 will be indicated by a small letter.

• "Protected software" is software that has been protected by at least one protection principle implemented by the process according to the invention.

• "Vulnerable software" is software that has not been protected by any protection principle implemented by the process according to the invention. • In the case where the differentiation between vulnerable software and protected software does not matter, the term "software" is used.

• A software comes in various representations depending on the moment considered in its life cycle:

- a source representation, - an object representation,

- a distribution, - or a dynamic representation.

• A source representation of software is understood as a representation which, after transformation, gives an object representation. A source representation can be presented at different levels, from an abstract conceptual level to a level executable directly by a data processing system or a processing and storage unit.

• An object representation of a software corresponds to a level of representation which after transfer to a distribution and then loading into a data processing system or a processing and storage unit, can be executed. It can be, for example, a binary code, an interpreted code, etc.

• A distribution is a physical or virtual medium containing the object representation, this distribution must be made available to the user to enable him to use the software.

• A dynamic representation corresponds to the execution of the software from its distribution.

A portion of software corresponds to any part of software and may, for example, correspond to one or more instructions, consecutive or not, and / or to one or more functional blocks consecutive or not, and / or to one or more functions, and / or one or more subroutines, and / or one or more modules. A portion of software can also correspond to all of this software.

Figs. 10 and 11 illustrate the various representations respectively of vulnerable software 2v in the general sense, and of protected software 2p according to the method according to the invention.

Fig. 10 illustrates various representations of vulnerable software 2 appearing during its life cycle. Vulnerable 2v software can thus appear under one of the following representations: • a 2 s source representation,

• a 2o object representation, • a 2vd distribution. This distribution can be commonly presented in the form of a physical distribution means such as a CDROM or in the form of files distributed across a network (GSM, Internet, etc.),

• or a dynamic representation 2ve corresponding to the execution of the vulnerable software 2v on a data processing system 3 of all known types, which conventionally comprises at least one processor 4. FIG. 11 illustrates various representations of 2p protected software appearing during its life cycle. Protected 2p software can thus appear under one of the following representations:

• a 2ps source representation comprising a first source part intended for the data processing system 3 and a second source part intended for the unit 6, a part of these source parts possibly commonly being contained in common files, • a 2in object representation comprising a first object part 2pos intended for the data processing system 3 and a second object part 2pou intended for the unit 6,

• a 2pd distribution comprising:

a first 2pds distribution part containing the first 2pos object part, this first 2pds distribution part being intended for the data processing system 3 and which can commonly be in the form of a physical distribution means such as a CDROM, or in the form of files distributed over a network (GSM, Internet, etc.), - and a second part of 2pdu distribution in the form:

> at least one pre-personalized unit 66 on which part of the second object part 2pou has been loaded and for which the user must complete the personalization by loading additional information, in order to obtain a unit 6, this information being obtained, for example, by uploading or downloading over a network, > or at least one unit 6 on which the second object part 2pou has been loaded, • or a dynamic representation 2pe corresponding to the execution of the protected software 2p. This dynamic representation 2pe comprises a first part of execution 2pes which is executed in the data processing system 3 and a second part of execution 2peu which is executed in unit 6. In the case where the differentiation between the different representations of protected software 2p does not matter, the expressions first part of the protected software and second part of the protected software are used.

The implementation of the method according to the invention in accordance with the dynamic representation of FIG. 11, uses a device lp comprising a data processing system 3 connected by a link 5 to a unit 6. The data processing system 3 is of all types and comprises, in a conventional manner, at least one processor 4. The system 3 may be a computer or be part, for example, of various machines, devices, fixed or mobile products, or vehicles in the general sense. The link 5 can be made in any possible way, such as for example by a serial line, a USB bus, a radio link, an optical link, a network link or a direct electrical connection on a circuit of the data processing system 3 , etc. It should be noted that the unit 6 can possibly be physically inside the same integrated circuit as the processor 4 of the data processing system 3. In this case, the unit 6 can be considered as a coprocessor with respect to to processor 4 of the data processing system 3 and the link 5 is internal to the integrated circuit. Figs. 20 to 22 show, by way of illustration and without implied limitation, various embodiments of the lp device allowing the implementation of the protection method according to the invention.

In the exemplary embodiment illustrated in FIG. 20, the protection device lp comprises, as a data processing system 3, a computer and, as a unit 6, a smart card 7 and its interface 8 commonly called a card reader. The computer 3 is connected to the unit 6 by a link 5. When executing protected software 2p, the first part of execution 2pes which is executed in the computer 3 and the second execution part 2peu which is executed in the chip card 7 and its interface 8, both must be functional so that the protected software 2p is fully functional.

In the exemplary embodiment illustrated in FIG. 21, the lp protection device equips a product 9 in the general sense, comprising various members 10 adapted to the function or functions assumed by such a product 9. The lp protection device comprises, on the one hand, a data processing system 3 embedded in the product 9 and, on the other hand, a unit 6 associated with the product 9. For the product 9 to be fully functional, the protected software 2p must be fully functional. Thus, during the execution of the protected software 2p, the first part of execution 2pes which is executed in the data processing system 3 and the second part of execution 2peu which is executed in the unit 6, must all two be functional. This 2p protected software therefore makes it possible, indirectly, to protect against unauthorized use, the product 9 or one of its functionalities. For example, the product 9 can be an installation, a system, a machine, a toy, a household appliance, a telephone, etc.

In the exemplary embodiment illustrated in FIG. 22, the protection device lp includes several computers, as well as part of a communication network. The data processing system 3 is a first computer connected by a network type link 5, to a unit 6 constituted by a second computer. For the implementation of the invention, the second computer 6 is used as a license server for 2p protected software. When running the protected software 2p, the first part of execution 2pes which is executed in the first computer 3 and the second part of execution 2peu which is executed in the second computer 6, both must be functional so that the protected 2p software is fully functional.

Fig. 30 makes it possible to explain more precisely, the protection method according to the invention. It should be noted that vulnerable software 2v is considered to be executed completely in a data processing system 3. On the other hand, in the case of the implementation of protected software 2p, the data processing system 3 comprises transfer means 12 connected by the link 5, to transfer means 13 forming part of the unit 6 making it possible to make communicate between them, the first part of execution 2pes and the second part of execution 2peu of the protected software 2p.

It must be considered that the transfer means 12, 13 are of software and / or hardware nature and are capable of ensuring and, if necessary, optimizing the communication of data between the data processing system 3 and the unit 6. These transfer means 12, 13 are adapted to allow protected software 2p to be available which is preferably independent of the type of link 5 used. These transfer means 12, 13 are not part of the object of the invention and are not described more precisely because they are well known to those skilled in the art. The first part of the 2p protected software includes commands. During the execution of the protected software 2p, the execution of these commands by the first part of execution 2pes allows the communication between the first part of execution 2pes and the second part of execution 2peu. In the following description, these commands are represented by IN, OUT or TRIG. As illustrated in fig. 31, to allow the implementation of the second part of execution 2peu of the protected software 2p, the unit 6 comprises protection means 14. The protection means 14 comprise storage means 15 and processing means 16.

For the sake of simplification in the following description, it is chosen to consider, during the execution of the protected software 2p, the presence of unit 6 or the absence of unit 6. In reality, a unit 6 having protection means 14 unsuitable for the execution of the second execution part 2peu of the protected software 2p is also considered to be absent, each time that the execution of the protected software 2p is not correct. In other words: • a unit 6 physically present and comprising protection means 14 adapted to the execution of the second execution part 2peu of the protected software 2p, is always considered to be present, • a unit 6 physically present but comprising unsuitable protection means 14, that is to say not allowing the correct implementation of the second execution part 2peu of the protected software 2p is considered to be present, when it functions correctly, and as absent when 'it doesn't work properly, • and a unit 6 physically absent is always considered to be absent.

In the case where the unit 6 is constituted by a smart card 7 and its interface 8, the transfer means 13 are broken down into two parts, one of which is located on the interface 8 and the other of which is located on the smart card 7. In this exemplary embodiment, the absence of the smart card 7 is considered to be equivalent to the absence of the unit 6. In other words, in the absence of the smart card 7 and / or its interface 8, the protection means 14 are not accessible and therefore do not allow the execution of the second execution part 2peu of the protected software, so that the protected software 2p is not completely functional.

According to the invention, the protection method aims to implement a protection principle, known as "renaming", a description of which is given in relation to FIGS. 80 to 85.

For the implementation of the principle of protection by renaming, it is defined: • a set of dependent functions, whose dependent functions are capable of being executed, by means of the second execution part 2peu, in unit 6 , and possibly to transfer data between the data processing system 3 and the unit 6, this set of dependent functions can be finite or infinite, • a set of triggering commands for these dependent functions, these triggering commands being capable of be executed in the data processing system 3 and trigger in unit 6, the execution of corresponding dependent functions,

• for each triggering command, an instruction corresponding at least in part to the information transmitted by the first part of execution

2pes, at the second execution part 2peu, in order to trigger the execution of the corresponding dependent function, this instruction being in the form of at least one argument of the triggering command,

• a method of renaming the instructions intended to be implemented when the vulnerable software is modified, such a method making it possible to rename the instructions in order to obtain triggering commands with renowned instructions making it possible to conceal the identity of the functions corresponding dependents,

• and recovery means 20 intended to be implemented in the unit 6 during the use phase and making it possible to find the initial setpoint, from the renamed setpoint, in order to find the dependent function to be executed.

For the implementation of the principle of protection by renaming, operating means are also constructed making it possible to transform a blank unit 60 into a unit 6 using at least the recovery means 20.

For the implementation of the principle of protection by renaming, it is also chosen, in the source of the vulnerable software 2vs:

• at least one algorithmic processing using at least one operand and rendering at least one result,

• and at least a portion of the source of the vulnerable 2vs software, containing at least one chosen algorithmic processing. The source of the vulnerable 2vs software is then modified, so as to obtain the source of the protected 2ps software. This modification is such that in particular:

• during the execution of the protected software 2p, at least a portion of the first part of execution 2pes, which is executed in the data processing system 3, takes into account that the functionality of at least one chosen algorithmic processing is executed in unit 6,

During the execution of the protected software 2p, the second execution part 2peu, which is executed in the unit 6, performs at least the functionality of at least one chosen algorithmic processing,

• each chosen algorithmic processing is broken down so that during the execution of the protected software 2p, each chosen algorithmic processing is executed, by means of the second execution part 2peu, using dependent functions. Preferably, each chosen algorithmic processing is broken down into dependent functions fd _n (with n varying from 1 to N), namely: - possibly one or more dependent functions allowing the provision of one or more operands for the unit 6 - dependent functions, some of which use the operand (s) and which, in combination, execute the functionality of the chosen algorithmic processing, using this or these operand (s),

- and possibly one or more dependent functions allowing the unit 6, for the data processing system 3, to make available the result of the chosen algorithmic processing,

• during the execution of the protected software 2p, the second execution part 2peu executes the dependent functions fd „,

• during the execution of the protected 2p software, the dependent functions are triggered by triggering commands with renowned instructions,

• and a schedule of triggering commands is chosen from all the schedules allowing the execution of the protected software 2p.

The first execution part 2pes of the protected software 2p, executed in the data processing system 3, executes triggering commands with renamed setpoints transferring renamed setpoints to unit 6, and initiating recovery in unit 6 by means recovery means 20, instructions, then execution by means of the second execution part 2peu, of each of the dependent functions fd _n previously defined. In other words, the principle of protection by renaming consists in renaming the instructions of the triggering commands, so as to obtain triggering commands with renowned instructions whose execution in the data processing system 3, triggers in the unit 6 , the execution of the dependent functions which would have been triggered by the triggering commands with instructions not renamed, without however that the examination of the protected software 2p does not make it possible to determine the identity of the dependent functions executed.

Fig. 80 illustrates an example of execution of a vulnerable 2v software. In this example, it appears during the execution of the vulnerable software 2v in the data processing system 3, at a given instant, the calculation of Z <- F (X, Y) corresponding to the assignment to a variable Z of the result of an algorithmic processing represented by a function F and using the operands X and Y. Figs. 81 and 82 illustrate an example of implementation of the invention. Fig. 81 illustrates the partial implementation of the invention. In this example, during the execution in the data processing system 3 of the first part of execution 2pes of the protected software 2p and in the presence of the unit 6, it appears: • at times ti, t ₂ , l execution of the triggering commands CDi, CD ₂ triggering in the unit 6, the execution by means of the second execution part 2peu, of the dependent functions fdi, fd ₂ which ensure the transfer of the data X, Y from the system processing data 3 to storage areas respectively x, y located in the storage means 15 of the unit 6, these commands triggering

CDi, CD ₂ being represented respectively by OUT (x, X), OUT (y, Y),

• at times t ₃ to t _N .i, the execution of the triggering commands CD ₃ to CDN- _I , triggering in unit 6, the execution by means of the second part of execution 2peu, of dependent functions fd ₃ to fd _N -i corresponding, these triggering commands CD ₃ to CD _N - _I being represented, respectively, by TRIG (fd ₃ ) to TRIG (fdN-ι). The sequence of dependent functions fd ₃ to fd -ι executed in combination is algorithmically equivalent to function F. More precisely, the execution of these triggering commands leads to the execution in unit 6, of dependent functions fd ₃ to fdN -i which use the content of the storage areas x, y and render the result in a storage area z of the unit 6,

• and at instant ts, the execution of a triggering command CD _N triggering in unit 6, the execution by means of the second execution part 2peu, of the dependent function fdN ensuring the transfer of the result of the algorithmic processing contained in the storage area z from the unit 6 to the data processing system 3, in order to assign it to the variable Z, this command being represented by IN (z).

In this example, to implement the invention completely, the first argument of the triggering commands OUT and the argument of the triggering commands TRIG and IN is chosen as a setpoint. The instructions thus chosen are renamed by the renaming method. In this way, the instructions of the triggering commands CDi to CDN, namely x, y, fd ₃ , fd -i, z are renamed so as to obtain respectively R (x), R (y), R (fd ₃ ). ., R (fdN-ι), R (z). Fig. 82 illustrates the full implementation of the invention. In this example, during the execution in the data processing system 3, of the first part of execution 2pes of the protected software 2p, and in the presence of the unit 6, it appears:

• at times ti, t ₂ , the execution of triggering commands with renamed setpoints CDCRi, CDCR ₂ , transferring to unit 6, the renamed setpoints R (x), R (y) as well as the data X, Y triggering in the unit 6 re-establishing, by means of re-establishing means 20, renamed instructions for re-establishing the instructions, namely the identity of the storage areas x, y, then execution by means of the second execution part 2peu, of the corresponding dependent functions fdi, fd ₂ which ensure the transfer of the data X, Y from the data processing system 3 to the storage areas respectively x, y located in the storage means 15 of the unit 6, these commands triggering at renamed setpoints CDCRi, CDCR ₂ being represented respectively by OUT (R (x), X), OUT (R (y), Y),

• at times t ₃ to tN-i, the execution of triggering commands with renamed setpoints CDCR ₃ to CDCR _N - _I , transferring to unit 6, the setpoints renamed R (fd ₃ ) to R (fdN-ι), triggering in unit 6 the recovery by means of recovery 20, instructions, namely fd ₃ to fd _N -i, then the execution by means of the second execution part 2peu, dependent functions fd ₃ to fdjy-i, these triggering commands with renamed setpoints CDCR ₃ to CDCRN- _I being represented respectively by TRIG (R (fd ₃ )) to TRIG (R (fd _N _!! )),

And at the instant tN, the execution of the triggering command at a renamed setpoint CDCR _N transferring to the unit 6, the renamed setpoint R (z) triggering in unit 6 the recovery by means of the recovery means 20, of the instruction, namely the identity of the storage area z, then the execution by means of the second execution part 2peu, of the dependent function fdN ensuring the transfer of the result of the algorithmic processing contained in the storage area z of the unit 6 to the data processing system 3, in order to assign it to the variable Z, this command triggering at renamed setpoint CDCR _N being represented by IN (R (z)).

In the example illustrated, the triggering commands with setpoints renamed 1 to N are executed successively. It should be noted that two improvements can be made:

• The first improvement concerns the case where several algorithmic treatments are deported to unit 6 and at least the result of an algorithmic processing is used by another algorithmic processing. In this case, certain triggering commands with renowned instructions used for the transfer can be possibly deleted.

• The second improvement aims to opt for a relevant scheduling of triggering commands with renowned instructions among all the scheduling allowing the execution of the protected software 2p. In this regard, it is preferable to choose a sequencing of the triggering commands with renamed instructions which temporally dissociates the execution of the dependent functions, by interposing between them portions of code executed in the data processing system 3 and comprising or not triggering commands with renowned instructions used to determine other data. Figs. 83 and 84 illustrate the principle of such an embodiment.

Fig. 83 shows an example of execution of vulnerable 2v software. In this example, it appears, during the execution of the vulnerable software 2v, in the data processing system 3, the execution of two algorithmic processing leading to the determination of Z and Z ', such that Z - F ( X, Y) and Z '<- F' (X ',

Y ').

Fig. 84 illustrates an example of implementation of the method according to the invention for which the two algorithmic treatments chosen in FIG. 83 are deported to unit 6. According to such an example, during the execution in the data processing system 3 of the first execution part 2pes of the protected software 2p and in presence of the unit 6, it appears, as explained above, the execution of the triggering commands with renamed setpoints CDCRi to CDCR _N corresponding to the determination of Z and the execution of the triggering commands with renamed setpoints CDCR'i to CDCR ' _M corresponding to the determination of Z'. As illustrated, the triggering commands with renamed setpoints CDCRi to CDCR _N are not executed consecutively, insofar as the triggering commands with renamed setpoints CDCR'i to CDCR 'and other portions of code are interleaved. In the example, the following scheduling is thus carried out: CDCRi, portion of interleaved code, CDCR'i, CDCR ₂ , portion of interleaved code, CDCR'2, CDCR ' ₃ , portion of interleaved code, CDCR', CDCR ₃ , CDCRt, ..., CDCRN, CDCR'M

It should be noted that, during the execution of a portion of the first execution part 2pes of the protected software 2p, the triggering commands with renamed instructions executed in the data processing system 3, trigger in the unit 6 the re-establishment of the identity of the corresponding dependent functions then the execution of these. Thus, it appears that in the presence of the unit 6, this portion is executed correctly and that, consequently, the protected software 2p is completely functional.

Fig. 85 illustrates an example of an attempt to execute the protected software 2p, while the unit 6 is absent. In this example, during the execution in the data processing system 3 of the first part of execution 2pes of the protected software 2p, at all times, the execution of a triggering command with a renamed setpoint cannot trigger restoring the setpoint or executing the corresponding dependent function, due to the absence of unit 6. The value to be assigned to variable Z cannot therefore be determined correctly.

It therefore appears that, in the absence of the unit 6, at least one request for a portion of the first part of execution 2pes of the protected software 2p, to trigger the reestablishment of an instruction and the execution of a dependent function in the unit 6 cannot be satisfied correctly, so that at least this portion is not executed correctly and that, as a result, the protected software 2p is not fully functional.

Thanks to this principle of protection by renaming, the examination in the software protected 2p from triggering commands with renamed setpoints does not allow the identity of the dependent functions to be executed in unit 6 to be determined. Note that the renaming of setpoints is carried out when the vulnerable 2v software is changed to software protected 2p. According to a variant of the principle of protection by renaming, it is defined for at least one dependent function, a family of dependent functions algorithmically equivalent but triggered by triggering commands with different renamed setpoints. According to this variant, for at least one algorithmic processing using dependent functions, this algorithmic processing is broken down into dependent functions which for at least one of them is replaced by a dependent function of the same family instead of keeping several occurrences of the same dependent function. To this end, triggering commands with renamed setpoints are modified to take account of the replacement of dependent functions by dependent functions of the same family. In other words, two dependent functions of the same family have different instructions and therefore triggering commands with different renamed instructions and, it is not possible, on examination of the protected software 2p, to detect that the functions called dependents are algorithmically equivalent.

According to a first preferred embodiment of the variant of the principle of protection by renaming, it is defined for at least one dependent function, a family of algorithmically equivalent dependent functions, by concatenating a noise field with the information defining the functional part of the function. dependent to be executed in unit 6.

According to a second preferred embodiment of the variant of the principle of protection by renaming, it is defined for at least one dependent function, a family of algorithmically equivalent dependent functions using identification fields.

According to a preferred embodiment of the principle of protection by renaming, it is defined as a method for renaming the instructions an encryption method making it possible to encrypt the instructions in order to transform them into renowned instructions. It is recalled that the renaming of the instructions is carried out in the protection phase P. For this preferred variant, the recovery means 20 are means implementing a decryption method making it possible to decrypt the renamed instructions and thus to restore the identity of the dependent functions to be executed in unit 6. These recovery means are implemented in unit 6 and can be of software or hardware. These recovery means 20 are requested in the use phase U each time a triggering command with a renamed setpoint is executed in the data processing system 3 with the aim of triggering in unit 6, the execution of 'a dependent function.

According to another advantageous characteristic of the invention, the protection method aims to implement a protection principle known as "variable", a description of which is given in relation to FIGS. 40 to 43.

For the implementation of the principle of protection by variable, it is chosen in the source of the vulnerable software 2vs at least one variable which during the execution of the vulnerable software 2v, partially defines the state of this one. By state of a software, it must be understood all the information, at a given time, necessary for the complete execution of this software, so that the absence of such a chosen variable harms the complete execution of this software. It is also chosen at least a portion of the source of the vulnerable software 2vs containing at least one chosen variable.

At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the protected 2ps software. This modification is such that during the execution of the protected software 2p, at least a portion of the first part of execution 2pes which is executed in the data processing system 3, takes into account that at least one chosen variable or at least one copy of the chosen variable resides in unit 6. FIG. 40 illustrates an example of execution of a vulnerable software 2v. In this example, it appears during the execution of the vulnerable software 2v in the data processing system 3:

• at time ti, the assignment of the data X to the variable Vi, represented by Nι <- X, • at time t ₂ , the assignment of the value of the variable Vi to the variable Y, represented by Y <- Vi, • and at time t ₃ , the assignment of the value of the variable Vi to the variable Z, represented by Z - Vi.

Fig. 41 illustrates an example of a first embodiment of the invention for which the variable resides in unit 6. In this example, during the execution in the data processing system 3 of the first part d 2pes execution of the protected software 2p, and in the presence of unit 6, it appears:

• at time ti, the execution of a transfer command triggering the transfer of the data X from the data processing system 3 to the variable vi located in the storage means 15 of the unit 6, this command transfer being represented by OUT (vι, X) and corresponding in the end to the assignment of the data X to the variable vi,

• at time t ₂ , the execution of a transfer command triggering the transfer of the value of the variable i residing in the unit 6 to the data processing system 3 in order to assign it to the variable Y , this transfer command being represented by IN (vι) and corresponding ultimately to the assignment of the value of the variable vi to the variable Y,

• and at time t ₃ , the execution of a transfer command triggering the transfer of the value of the variable i residing in the unit 6 to the data processing system 3 in order to assign it to the variable Z, this transfer command being represented by IN (vι) and corresponding ultimately to the assignment of the value of the variable i to the variable Z.

It should be noted that during the execution of the protected software 2p, at least one variable resides in the unit 6. Thus, when a portion of the first part of execution 2pes of the protected software 2p requires it, and in presence of unit 6, the value of this variable residing in unit 6 is transferred to the data processing system 3 to be used by the first 2pes execution part of the protected software 2p, so that this portion is executed correctly and therefore the 2p protected software is fully functional.

Fig. 42 illustrates an example of a second embodiment of the invention for which a copy of the variable resides in the unit 6. In this example, during execution in the data processing system 3 of the first part of 2pes execution of protected software 2p, and in the presence of unit 6, it appears:

• at time ti, the assignment of the data X to the variable Vi located in the data processing system 3, as well as the execution of a transfer command triggering the transfer of the data X from the system of data processing 3 to the variable vi located in the storage means 15 of the unit 6, this transfer command being represented by OUT (vι, X),

• at time t ₂ , the assignment of the value of the variable Vi to the variable Y, • and at time t ₃ , the execution of a transfer command triggering the transfer of the value of the variable i residing in unit 6 to the data system 3 in order to assign it to variable Z, this transfer command being represented by IN (vι).

It should be noted that during the execution of the protected software 2p, at least one copy of a variable resides in the unit 6. Thus, when a portion of the first part of execution 2pes of the protected software 2p the imposes, and in the presence of unit 6, the value of this copy of variable residing in unit 6 is transferred to the data processing system 3 to be used by the first execution part 2pes of the protected software 2p, so this portion is executed correctly and therefore the 2p protected software is fully functional.

Fig. 43 illustrates an example of an attempt to execute the protected software 2p, while the unit 6 is absent. In this example, during the execution in the data processing system 3 of the first 2pes execution part of the protected software

2p: • at time ti, the execution of the transfer command OUT (vι, X) cannot trigger the transfer of the data X to the variable i, given the absence of the unit 6,

• at time t ₂ , the execution of the transfer command IN (vι) cannot trigger the transfer of the value of the variable i to the data processing system 3, taking into account the absence of l 'unit 6,

• and at time t ₃ , the execution of the transfer command IN (vι) cannot trigger the transfer of the value of the variable i to the data processing system 3, taking into account the absence of the unit 6.

It therefore appears that in the absence of unit 6, at least one request for a portion of the first part of 2pes execution to use a variable or a copy of variable residing in unit 6, cannot not be satisfied correctly, so that at least this portion is not executed correctly and that, as a result, the protected 2p software is not fully functional.

It should be noted that the data transfers between the data processing system 3 and the unit 6 illustrated in the preceding examples use only simple assignments but that the skilled person will be able to combine them with other operations to achieve complex operations such as for example OUT (vl,

2 * X + 3) or Z <- (5 * vl + v2).

According to another advantageous characteristic of the invention, the protection method aims to implement a protection principle, known as "elementary functions", a description of which is given in relation to FIGS. 60 to 64.

For the implementation of the principle of protection by elementary functions, it is defined:

• a set of elementary functions whose elementary functions are capable of being executed, by means of the second execution part 2peu, in unit 6, and possibly of transferring data between the data processing system 3 and l 'unit 6,

• and a set of elementary commands for this set of elementary functions, these elementary commands being capable of being executed in the data processing system 3 and of triggering the execution in unit 6, of the corresponding elementary functions.

For the implementation of the principle of protection by elementary functions, there is also constructed operating means making it possible to transform a blank unit 60 into a unit 6 capable of performing the elementary functions, the execution of these elementary functions being triggered by the execution in the data processing system 3 of elementary commands.

For the implementation of the principle of protection by elementary functions, it is also chosen, in the source of the vulnerable software 2vs, at least one processing algorithmic using at least one operand and rendering at least one result. It is also chosen at least a portion of the source of the vulnerable software 2vs containing at least one chosen algorithmic processing.

At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the protected 2ps software. This modification is such that in particular:

• each chosen algorithmic processing is broken down so that during the execution of the protected software 2p, each chosen algorithmic processing is executed, by means of the second execution part 2peu, using elementary functions. Preferably, each chosen algorithmic processing is broken down into elementary functions fe (with n varying from 1 to N), namely: - possibly one or more elementary functions allowing the provision of one or more operands for the unit 6, - elementary functions, some of which use the operand (s) and which, in combination, execute the functionality of the chosen algorithmic processing, using this or these operands, - and possibly one or more elementary functions enabling the unit to make them available 6 , for the data processing system 3 of the result of the chosen algorithmic processing,

• and a scheduling of elementary commands is chosen from all the scheduling allowing the execution of the protected software 2p.

The first part of 2pes execution of the protected 2p software, which is executed in the data processing system 3, executes elementary commands

CFE _n (with n varying from 1 to N), triggering in unit 6, the execution by means of the second execution part 2peu, of each of the elementary functions fe _n previously defined. Fig. 60 illustrates an example of execution of vulnerable 2v software. In this example, it appears, during the execution of the vulnerable software 2v in the data processing system 3, at a given instant, the calculation of Z <- F (X, Y) corresponding to the assignment to a variable Z of the result of an algorithmic processing represented by a function F and using operands X and Y. FIG. 61 illustrates an example of implementation of the invention for which the algorithmic processing chosen in FIG. 60 is deported to unit 6. In this example, during the execution in the data processing system 3 of the first part of execution 2pes of the protected software 2p and in the presence of unit 6, it appears: • at times ti, t ₂ , the execution of elementary commands CFEi, CFE ₂ triggering in unit 6, the execution by means of the second execution part 2peu, of corresponding elementary functions fei, fβ2 which ensure the transfer data X, Y from the data processing system 3 to storage areas respectively x, y located in the storage means 15 of the unit 6, these elementary commands

CFEi, CFE ₂ being represented respectively by OUT (x, X), OUT (y, Y),

• at times t ₃ to t -i, the execution of the elementary commands CFE ₃ to

CFEjy-i, triggering in unit 6, the execution by means of the second execution part 2peu, of the elementary functions fe ₃ to fβN-i corresponding, these elementary commands CFE ₃ to CFE _N - _I being represented, respectively , by TRIG (fe ₃ ) to TRIG (feιy_ι). The sequence of elementary functions fe ₃ to fβN-i executed in combination is algorithmically equivalent to the function F. More precisely, the execution of these elementary commands leads to the execution in unit 6, of the elementary functions fe ₃ to fβN -i which use the content of the storage areas x, y and render the result in an area of storage z of unit 6,

• and at time t, the execution of an elementary command CFE _N triggering in unit 6, the execution by means of the second execution part 2peu, of the elementary function fβN ensuring the transfer of the result of algorithmic processing, contained in the storage area z from the unit 6 to the data processing system 3, in order to assign it to the variable Z, this elementary command CFE _N being represented by IN (z).

In the example illustrated, the elementary commands 1 to N are executed successively. It should be noted that two improvements can be made: “The first improvement concerns the case where several algorithmic treatments are deported to unit 6 and at least the result of an algorithmic treatment is used by another algorithmic treatment.

In this case, some elementary commands used for the transfer, can possibly be deleted. “The second improvement aims to opt for a relevant scheduling of elementary orders among all the scheduling allowing the execution of the protected software 2p. In this regard, it is preferable to choose a scheduling of elementary commands which temporally dissociates the execution of elementary functions, by interposing, between them portions of code executed in the data processing system 3 and comprising or not commands elementary for the determination of other data. Figs. 62 and 63 illustrate the principle of such an embodiment.

Fig. 62 shows an example of execution of vulnerable 2v software. In this example, it appears during the execution of the vulnerable software 2v, in the data processing system 3, the execution of two algorithmic treatments leading to the determination of Z and Z ', such as Z - F (X , Y) and Z '<-F' (X ', Y').

Fig. 63 illustrates an example of implementation of the method according to the invention for which the two algorithmic treatments chosen in FIG. 62 are deported to unit 6. According to such an example, during the execution in the data processing system 3 of the first part of execution 2pes of the protected software 2p and in the presence of unit 6, it appears , as explained above, the execution of elementary commands CFEi to CFE _N corresponding to the determination of Z and the execution of the elementary commands CFE'i to CFE ' _M corresponding to the determination of Z'. As illustrated, the elementary commands CFEi to CFE _N are not executed consecutively, insofar as the elementary commands CFE'i to CFE ' _M , as well as other portions of code are interleaved. In the example, the following scheduling is thus carried out: CFEi, portion of interleaved code, CFE'i, CFE ₂ , portion of interleaved code, CFE ' ₂ , CFE' ₃ , portion of interleaved code, CFE ' ₄ , CFE ₃ , CFE ₄ , ..., CFE _N , CFE ' _M.

It should be noted that, during the execution of the protected software 2p, in the presence of the unit 6, each time that an elementary command contained in a portion of the first part of execution 2pes of the protected software 2p l imposes, the corresponding elementary function is executed in unit 6. Thus, it appears, that in the presence of unit 6, this portion is executed correctly and that, consequently, the protected software 2p is completely functional. Fig. 64 illustrates an example of an attempt to execute the protected software 2p, while the unit 6 is absent. In this example, during the execution in the data processing system 3, of the first part of execution 2pes of the protected software 2p, at all times, the execution of an elementary command cannot trigger the execution of the corresponding elementary function, due to the absence of unit 6. The value to be assigned to the variable Z cannot therefore be determined correctly.

It therefore appears that, in the absence of unit 6, at least one request for a portion of the first 2pes execution part of the protected software 2p, to trigger the execution of an elementary function in the unit 6 cannot be satisfied correctly, so that at least this portion is not executed correctly and therefore the protected software 2p is not fully functional.

According to another advantageous characteristic of the invention, the protection method aims to implement a protection principle, known as "detection and coercion", a description of which is given in relation to FIGS. 70 to 74. For the implementation of the principle of protection by detection and coercion, it is defined:

• at least one characteristic of software execution likely to be at least partially monitored in unit 6,

• at least one criterion to be respected for at least one characteristic of software execution,

Detection means 17 to be implemented in unit 6 and making it possible to detect that at least one software execution characteristic does not meet at least one associated criterion,

• and coercion means 18 to be implemented in the unit 6 and making it possible to inform the data processing system 3 and / or to modify the execution of a software, when at least one criterion is not not respected.

For the implementation of the principle of protection by detection and coercion, operating means are also constructed making it possible to transform a virgin unit 60 into a unit 6 using at least the detection means 17 and the coercion means 18 Fig. 70 illustrates the means necessary for the implementation of this principle of protection by detection and coercion. The unit 6 comprises the detection means 17 and the coercion means 18 belonging to the processing means 16. The coercion means 18 are informed of the non-compliance with a criterion by the detection means 17. More precisely , the detection means 17 use information coming from the transfer means 13 and / or the storage means 15 and / or the processing means 16, in order to monitor one or more characteristics of software execution. At least one criterion to be respected is attached to each software execution characteristic. In the case where it is detected that at least one characteristic of software execution does not meet at least one criterion, the detection means 17 inform the coercion means 18. These coercion means 18 are adapted to modify, de appropriately, the condition of the unit 6.

For the implementation of the principle of protection by detection and coercion, it is also chosen:

At least one execution characteristic of software to be monitored, among the execution characteristics liable to be monitored, • at least one criterion to be respected for at least one characteristic of software execution chosen,

• in the source of the vulnerable software 2vs, at least one algorithmic processing for which at least one characteristic of software execution is to be monitored,

• and in the source of the vulnerable 2vs software, at least a portion containing at least one chosen algorithmic processing.

At least a selected portion of the source of the vulnerable 2vs software is then modified, so as to obtain the source of the protected 2ps software. This modification is such as in particular when running the 2p protected software:

• at least a portion of the first 2pes execution part, which is executed in the data processing system 3, takes into account that at least one chosen software execution characteristic is to be monitored, at least partly in the unit 6, • and the second execution part 2peu, which is executed in the unit 6, monitors at least in part, a selected software execution characteristic. During the execution of the protected software 2p, protected by this principle of protection by detection and coercion, in the presence of the unit 6: • as long as all the criteria corresponding to all the performance characteristics monitored of all the modified portions of the 2p protected software is respected, these modified portions of the 2p protected software operate in a nominal manner and, consequently, the 2p protected software functions in a nominal manner, • and if at least one of the criteria corresponding to a performance characteristic monitored by a portion of the protected software 2p is not respected, the data processing system 3 is informed thereof and / or the operation of the portion of the protected software 2p is modified, so that the operation of the protected software 2p is modified. Of course, in the absence of the unit 6, at least one request for a portion of the first 2pes execution part of the protected software 2p to use the unit 6 cannot not be satisfied correctly so that at least this portion does not run correctly and therefore the 2p protected software is not fully functional.

For the implementation of the principle of protection by detection and coercion, two types of software execution characteristics are preferably used.

The first type of software execution characteristic corresponds to a variable for measuring the execution of software and the second type corresponds to a usage profile for software. These two types of characteristics can be used independently or in combination.

For the implementation of the principle of protection by detection and coercion using, as an execution characteristic, a variable for measuring the execution of software, it is defined:

In the storage means 15, the possibility of storing at least one measurement variable serving to quantify the use of at least one software functionality,

In the detection means 17, the possibility of monitoring at least one threshold associated with each measurement variable,

• and updating means making it possible to update each measurement variable according to the use of the functionality with which it is associated. Operating means are also constructed using, in addition to the detection means 17 and coercion means 18, the updating means. It is also chosen, in the source of the vulnerable 2vs software: • at least one functionality of the vulnerable 2v software whose use is likely to be monitored by means of a measurement variable,

• at least one measurement variable used to quantify the use of said functionality,

At least one threshold associated with the measurement variable corresponding to a limit of use of said functionality,

• and at least one method for updating the measurement variable according to the use of said functionality. The source of the vulnerable software 2vs is then modified, so as to obtain the source of the protected software 2ps, this modification being such that, during the execution of the protected software 2p, the second part of execution 2peu:

• updates the measurement variable according to the use of said functionality,

• and takes into account at least one threshold crossing.

In other words, when the protected software 2p is executed, the measurement variable is updated according to the use of said functionality, and when the threshold is exceeded, the detection means 17 inform the means of coercion 18 which take a suitable decision to inform the data processing system 3 and / or modify the processing carried out by the processing means 16 making it possible to modify the operation of the portion of the protected software 2p, so that the operation of the software protected 2p is changed.

For the implementation of a first preferred embodiment of the principle of protection by detection and coercion using, as a characteristic, a measurement variable, it is defined:

• for at least one measurement variable, several associated thresholds,

• and different means of coercion corresponding to each of these thresholds. It is also chosen, in the source of the vulnerable software 2vs: • at least one measurement variable used to quantify the use of at least one functionality of the software and to which must be associated several thresholds corresponding to different limits of use of said functionality,

• and at least two thresholds associated with the measurement variable. The source of the vulnerable software 2vs is then modified, so as to obtain the source of the protected software 2ps, this modification being such that, during the execution of the protected software 2p, the second part of execution 2peu:

• updates the measurement variable according to the use of said functionality, • and takes into account, in a different way, the overruns of the various thresholds. In other words, conventionally, during the execution of the protected software 2p, when the first threshold is exceeded, the unit 6 informs the data processing system 3 directing the protected software 2p to no longer use this functionality . If the 2p protected software continues to use this functionality, the second threshold may be exceeded. In the event that the second threshold is exceeded, the coercion means 18 can render the chosen functionality inoperative and / or render the protected software 2p inoperative.

For the implementation of a second preferred variant embodiment of the principle of protection by detection and coercion using, as a characteristic, a measurement variable, reloading means are defined making it possible to credit at least one additional use for at least one software functionality monitored by a measurement variable.

Operating means are also constructed using, in addition to detection means 17, coercion means 18 and updating means, reloading means.

It is also chosen, in the source of the vulnerable software 2vs, at least one measurement variable serving to limit the use of at least one functionality of the software and to which at least one additional use must be able to be credited. The source of the vulnerable software 2vs is then modified, so as to obtain the source of the protected software 2ps, this modification being such that, in a phase known as reloading, at least one additional use of at least one functionality corresponding to a variable of selected measure can be credited.

In the reloading phase, at least one selected measurement variable and / or at least one associated threshold is updated, so as to allow at least one additional use of the corresponding functionality. In other words, it is possible, in the reloading phase, to credit additional uses of at least one feature of the protected software 2p. For the implementation of the principle of protection by detection and coercion using, as a characteristic, a software usage profile, it is defined as a criterion to be respected for this usage profile, at least one performance trait of software.

It is also chosen, in the source of the vulnerable 2vs software:

• at least one use profile to monitor,

• and at least one performance feature that at least one chosen use profile must comply with.

The source of the vulnerable software 2vs is then modified, so as to obtain the source of the protected software 2ps, this modification being such that, during the execution of the protected software 2p, the second part of execution 2peu respects all the features of selected execution. In other words, the unit 6 itself monitors the way in which the second execution part 2peu is executed and can inform the data processing system 3 and / or modify the operation of the protected software 2p, in the case where at least one performance line is not respected.

During the execution of the protected software 2p, protected by this principle, in the presence of unit 6: • as long as all the execution features of all the modified portions of the protected software 2p are respected, these modified portions of the protected software 2p operate nominally and, therefore, protected software 2p operate nominally,

• and if at least one performance feature of a portion of protected software 2p is not respected, the data processing system 3 is informed thereof and / or the operation of the portion of protected software 2p is modified, so that the operation of the protected 2p software is modified. It is possible to envisage monitoring different execution traits, such as for example monitoring the presence of instructions comprising a marker or monitoring the execution sequence for at least part of the instructions. For the implementation of the principle of protection by detection and coercion using as execution line to be respected, the monitoring of the execution sequence for at least part of the instructions, it is defined:

• a set of instructions, the instructions of which can be executed in unit 6,

• a set of instruction commands for this set of instructions, these instruction commands are likely to be executed in the data processing system 3. The execution of each of these instruction commands in the data processing system 3 triggers in unit 6, the execution of the 'corresponding instruction, • detection means 17 making it possible to detect that the sequence of instructions does not correspond to that desired,

• and coercion means 18 making it possible to inform the data processing system 3 and / or to modify the execution of software when the sequence of instructions does not correspond to that desired. It is also constructed operating means allowing, at unit 6, to also execute the instructions of the instruction set, the execution of these instructions being triggered by the execution in the data processing system 3 of instruction commands.

It is also chosen, in the source of the vulnerable software 2vs, at least one algorithmic processing to be deported to unit 6 and for which the sequence of at least part of the instructions is to be monitored.

The source of the vulnerable software 2vs is then modified so as to obtain the source of the protected software 2ps, this modification is such that, during the execution of the protected software 2p: • the second part of execution 2peu executes at least the functionality of the chosen algorithmic processing,

• the chosen algorithmic processing is broken down into instructions,

• the sequence that at least some of the instructions must respect when they are executed in unit 6 is specified, • and the first part of execution 2pes of the protected software 2p executes instruction commands which trigger the execution of the instructions in unit 6.

During the execution of the protected software 2p, protected by this principle, in the presence of unit 6: • as long as the sequence of instructions of all the modified portions of the protected software 2p corresponds to that desired, these modified portions of the 2p protected software operates nominally and, therefore, 2p protected software operates nominally, • and if the sequence of instructions for a portion of 2p protected software executed in unit 6 does not correspond to that desired, the data processing system 3 is informed thereof and / or the operation of the portion of the protected software 2p is modified, so that the operation of the protected software 2p is modified. Fig. 71 illustrates an example of implementation of the principle of protection by detection and coercion using, as an execution trait to respect the monitoring of the execution sequence of at least part of the instructions, in the case where the sequence desired is respected.

The first execution part 2pes of the protected software 2p, executed in the data processing system 3, executes instruction commands C1 triggering, in the unit 6, the execution of the instructions ii belonging to the instruction set. In the instruction set, at least some of the instructions each include a part defining the functionality of the instruction and a part making it possible to check the desired sequence for the execution of the instructions. In this example, the Cli instruction commands are represented by TRIG (ii) and the desired sequence for the execution of the instructions is i _n , i _{n +} ι and i „ _{+ 2} - Execution in unit 6, of the instruction i _n gives the result a and the execution of the instruction i „+ ι gives the result b. The instruction i _{n +} 2 uses as operand, the results a and b of the instructions i _n and i „+ ι and its execution gives the result c.

Given that this sequence of instructions executed in unit 6 corresponds to that desired, this results in normal or nominal operation of the protected software 2p.

Fig. 72 illustrates an example of implementation of the principle of protection by detection and coercion using, as an execution trait to be observed, monitoring the execution sequence of at least part of the instructions, in the case where the desired sequence is not respected. According to this example, the desired sequence for the execution of the instructions is always i „, i _n + ι and i _{n +} 2. However, the sequence of execution of the instructions is modified by replacing the instruction i _n by the instruction i ' _n , so that the sequence actually executed is i '„, i _n + ι and i„ ₊₂ . The execution of the instruction i ' _n gives the result a, that is to say the same result as the execution of the instruction i „. However, at the latest during the execution of the instruction i _{n + 2} , the detection means 17 detect that the instruction i ' _n does not correspond to the desired instruction to generate the result used as the operand of the instruction i _n + ₂ - The detection means 17 inform the coercion means 18 which consequently modify the operation of the instruction i _{n +} 2, so that the execution of the instruction i „ ₊₂ gives the result c 'may be different from c. Of course, if the execution of the instruction i '„gives a result a' different from the result a of the instruction i„, it is clear that the result of the instruction i „ ₊₂ can also be different from c .

Insofar as the sequence of execution of the instructions executed in the unit 6 does not correspond to that desired, it can therefore be obtained a modification of the operation of the protected software 2p.

Figs. 73 and 74 illustrate a preferred embodiment of the principle of protection by detection and coercion using, as an execution trait to be observed, monitoring of the execution sequence of at least part of the instructions. According to this preferred variant, a set of instructions is defined, at least certain instructions of which work on registers and use at least one operand in order to render a result. As illustrated in fig. 73, it is defined for at least some of the instructions working on registers, a part PF defining the functionality of the instruction and a part PE defining the desired sequence for the execution of the instructions. The PF part corresponds to the operation code known to those skilled in the art. The PE part defining the desired sequence, includes bit fields corresponding to:

• a CH instruction identification field,

• and for each operand k of the instruction, with k varying from 1 to K, and K number of operands of the instruction:

- a CD _k flag field, indicating whether it is necessary to verify the origin of the operand k,

- and a planned identification field ClPk of the operand, indicating the expected identity of the instruction having generated the content of operand k. As illustrated in fig. 74, the instruction set includes V registers belonging to the processing means 16, each register being named R _v , with v varying from 1 to V. For each register R _v , two fields are defined, namely: • a field functional CF _V , known to those skilled in the art and making it possible to store the result of the execution of the instructions,

• and a generated identification field CIG _V making it possible to store the identity of the instruction that generated the content of the functional field CF _V. This CIG _V generated identification field is automatically updated with the content of the instruction identification field

CH having generated the functional field CF _V. This CIG _V generated identification field is neither accessible nor modifiable by any instruction and is used only for the detection means 17.

During the execution of an instruction, the detection means 17 perform the following operations for each operand k:

• the CD flag field is read,

• if the CD flag field _k requires it, the expected identification field ClPk and the generated identification field CIG _V corresponding to the register used by the operand k are both read, • the equality of the two fields CIP _k and CIG _V is checked,

• and if the equality is false, the detection means 17 consider that the sequence of execution of the instructions is not respected.

The coercion means 18 make it possible to modify the result of the instructions when the detection means 17 have informed them of a chain of instructions that has not been observed. A preferred embodiment consists in modifying the functional part

PF of the instruction in progress or the functional part PF of subsequent instructions.

According to another advantageous characteristic of the invention, the protection method aims to implement a protection principle known as "conditional connection", the description of which is given in relation to FIGS. 90 to 92.

For the implementation of the principle of protection by conditional connection, it is chosen in the source of the vulnerable 2vs software, at least one conditional connection BC. It is also chosen at least a portion of the source of the vulnerable software 2vs containing at least one conditional branch BC chosen.

At least a portion of the first execution part 2pes, which is executed in the data processing system 3, takes into account that the functionality of at least one conditional branching BC chosen is executed in unit 6,

• and the second execution part 2peu, which is executed in the unit 6, executes at least the functionality of at least one conditional connection BC chosen and makes available to the data processing system 3, information allowing the first part of 2pes execution, to continue its execution at the chosen location.

The first execution part 2pes of the protected software 2p, executed in the data processing system 3, executes conditional branching commands, triggering in unit 6, the execution by means of the second execution part 2peu, of remote conditional branches bc whose functionality is equivalent to the functionality of the selected conditional branches BC.

Fig. 90 illustrates an example of execution of vulnerable 2v software. In this example, it appears, during the execution of the vulnerable software 2v in the data processing system 3 at a given instant, a conditional connection BC indicating to the vulnerable software 2v the place where to continue its unfolding, namely the '' one of the three possible places Bi, B ₂ or B ₃ . It should be understood that the conditional branch BC takes the decision to continue executing the software at location Bi, B ₂ or B ₃ .

Fig. 91 illustrates an example of implementation of the invention for which the conditional branch chosen to be deported to the unit 6, corresponds to the conditional branch BC. In this example, during the execution in the data processing system 3 of the first part of execution 2pes of the protected software 2p and in the presence of the unit 6, it appears: At time ti, the execution of the conditional branching command CBCi triggering in unit 6, the execution by means of the second execution part 2peu, of the remote conditional branching bc algorithmically equivalent to the conditional branching BC, this conditional branching command CBCi being represented by

TRIG (bc)

• and at time t ₂ , the transfer from unit 6 to the data processing system 3, of information allowing the first part of execution 2pes, to continue its execution at the chosen location, at know location Bi, B2 or B ₃ .

It should be noted that during the execution of a portion of the first execution part 2pes of the protected software 2p, the conditional branch commands executed in the data processing system 3 trigger the execution of the corresponding remote conditional branches in unit 6. Thus, it appears that in the presence of unit 6, this portion is executed correctly and that consequently, the protected software 2p is completely functional.

Fig. 92 illustrates an attempt to execute the protected software 2p, while the unit 6 is absent. In this example, when the first 2pes execution part of the protected software 2p is executed in the data processing system 3:

• at time ti, the execution of the conditional branching command CBCi, cannot trigger the execution of the remote conditional branching bc, given the absence of unit 6,

• and at time t ₂ , the transfer of information allowing the first part of execution 2pes to continue at the chosen location fails taking into account the absence of the unit 6.

It therefore appears that in the absence of unit 6, at least one request from a portion of the first 2pes execution part to trigger the execution of a deported conditional connection in unit 6, cannot not be satisfied correctly, so that at least this portion is not executed correctly and that, as a result, the protected 2p software is not fully functional. In the foregoing description in relation to FIGS. 90 to 92, the object of the invention aims to deport in unit 6, a conditional connection. Of course, a preferred embodiment of the invention can consist in deporting in unit 6, a series of conditional branches whose overall functionality is equivalent to all of the functionalities of the conditional branches which have been deported. The execution of the global functionality of this series of deported conditional connections results in the provision, for the data processing system 3, of information allowing the first part of execution 2pes of the protected software 2p to continue its execution at the chosen location. In the foregoing description in relation to FIGS. 40 to 92, five different principles of software protection have been explained in general independently of each other. The protection method according to the invention is implemented using the principle of protection by renaming, possibly associated with one or more other principles of protection. In the case where the principle of protection by renaming is supplemented by the implementation of at least one other principle of protection, the principle of protection by renaming is advantageously supplemented by the principle of protection by variable and / or the principle of protection by elementary functions and / or the principle of protection by conditional connection. And when the principle of protection by elementary functions is also implemented, this can in turn be supplemented by the principle of protection by detection and coercion and / or the principle of protection by conditional branching.

And when the principle of protection by detection and coercion is also implemented, this can in turn be supplemented by the principle of protection by conditional connection.

According to the preferred embodiment, the principle of protection by renaming is supplemented by the principle of protection by variable and by the principle of protection by elementary functions, supplemented by the principle of protection by detection and coercion, supplemented by the principle of protection by conditional connection.

If a protection principle is applied, in addition to the protection by renaming principle, its description made previously must include, to take account of its combined implementation, the following modifications:

• the concept of vulnerable software must be understood as vulnerable software vis-à-vis the protection principle being described. Thus, in the case where a protection principle has already been applied to vulnerable software, the expression “vulnerable software” must be interpreted by the reader as the expression “software protected by the protection principle (s) already applied (s) ";

• the concept of protected software must be understood as protected software with respect to the protection principle being described. Thus, in the case where a protection principle has already been applied, the expression "protected software" must be interpreted by the reader as the expression "new version of the protected software";

• and the choice (s) made for the implementation of the protection principle being described must (wind) take into account the choice (s) made (s) for the implementation of the principle (s) of protection already applied. The following description provides a better understanding of the implementation of the protection method according to the invention. This protection method according to the invention involves, as appears more precisely in FIG. 100:

First, a protection phase P during which vulnerable software 2v is modified into protected software 2p,

• then, a use phase U during which the protected software 2p is implemented. In this phase of use U: - in the presence of the unit 6 and each time that a portion of the first 2pes execution part executed in the data processing system 3 requires it, an imposed functionality is executed in unit 6, so that this portion is executed correctly and that, therefore, the protected software 2p is fully functional, - in the absence of unit 6 and despite the request for a portion of the first part of execution 2pes to execute a functionality in unit 6, this request cannot be honored correctly, so that at least this portion is not executed correctly and that therefore the 2p protected software is not fully functional,

• and possibly a recharging phase R during which at least one additional use of a functionality protected by the implementation of the second preferred variant of realization of the principle of protection by detection and coercion is credited using as a characteristic, a variable of measurement.

The protection phase P can be broken down into two protection sub-phases Pi and P ₂ . The first, known as the upstream protection sub-phase Pi, is implemented independently of the vulnerable software 2v to be protected. The second, called downstream protection sub-phase P _2, is dependent on the vulnerable software 2v to be protected.

It should be noted that the upstream protection sub-phases Pi and downstream P ₂ can be carried out advantageously by two different people or two different teams. For example, the upstream protection sub-phase Pi can be carried out by a person or a company ensuring the development of software protection systems, while the downstream protection sub-phase P2 can be carried out by a person or a company ensuring the development of software to be protected.

Of course, it is clear that the upstream protection sub-phases Pi and downstream P2 can also be carried out by the same person or the same team.

The upstream protection sub-phase Pi involves several stages Su, ..., u for each of which different tasks or works are to be performed.

The first stage of this upstream protection sub-phase Pi is called "definition stage Su". During this Su definition stage: • it is chosen:

the type of unit 6. As an illustration, it may be chosen as unit 6, a reader 8 of smart cards and the smart card 7 associated with the reader,

- And the transfer means 12, 13 intended to be implemented respectively in the data processing system 3 and in the unit 6, during the use phase U and capable of ensuring the transfer of data between the data processing system 3 and unit 6, • it is defined:

- a set of dependent functions whose dependent functions are capable of being executed in a unit 6,

a set of triggering commands for this set of dependent functions, these triggering commands being capable of being executed in the data processing system 3 and of triggering the execution in a unit 6, of dependent functions,

- for each triggering command, a setpoint corresponding at least in part to the information transmitted from the data processing system 3 to a unit 6, in order to trigger the execution of the corresponding dependent function in a unit 6, this setpoint having in the form of at least one argument of the triggering command, - a method of renaming the instructions making it possible to rename the instructions in order to obtain triggering commands with renowned instructions,

- and recovery means 20 intended to be implemented in a unit 6 during a use phase U, and making it possible to find the dependent function to be executed, from the renamed setpoint,

• and in the case where the protection method according to the invention implements a variant of the principle of protection by renaming, it is also defined for at least one dependent function, a family of dependent functions algorithmically equivalent, but triggered by commands triggers whose famous instructions are different,

• and in the case where the protection method according to the invention implements a preferred variant of the principle of protection by renaming, it is also defined: - as a method for renaming the instructions, an encryption method for encrypting the instructions , - And as recovery means 20, means implementing a decryption method to decrypt the renowned instructions and thus restore the identity of the dependent functions to be executed in the unit 6. • and in the case where the process of protection according to the invention implements the principle of protection by elementary functions, it is also defined:

- a set of elementary functions, subset of all the dependent functions,

and a set of elementary commands for this set of elementary functions, this set of elementary commands being a subset of the set of triggering commands,

• and in the case where the protection method according to the invention implements the principle of protection by detection and coercion, it is also defined:

- at least one software execution characteristic, capable of being monitored at least in part in unit 6,

- at least one criterion to be respected for at least one characteristic of software execution,

detection means 17 to be implemented in unit 6 and making it possible to detect that at least one characteristic of software execution does not meet at least one associated criterion,

- and coercion means 18 to be implemented in the unit 6 and making it possible to inform the data processing system 3 and / or to modify the execution of a software, when at least one criterion is not not respected, • and in the case where the protection method according to the invention implements the principle of protection by detection and coercion using as a characteristic a variable for measuring the execution of the software, it is also defined:

- as a software execution characteristic capable of being monitored, a variable for measuring the use of a software functionality, - as a criterion to be respected, at least one threshold associated with each measurement variable,

- And updating means making it possible to update at least one measurement variable, “and in the case where the protection method according to the invention implements a first preferred variant of implementation of the principle of protection by detection and coercion using as a characteristic a variable for measuring the execution of the software, it is also defined:

- for at least one measurement variable, several associated thresholds, - and different coercion means corresponding to each of these thresholds,

• and in the case where the protection method according to the invention implements a second preferred alternative embodiment of the principle of protection by detection and coercion using as a characteristic a variable for measuring the execution of the software, it is also defined reloading means making it possible to credit at least one additional use for at least one software functionality monitored by a measurement variable,

• and in the case where the protection method according to the invention implements the principle of protection by detection and coercion using as characteristic a software use profile, it is also defined: as a characteristic of software execution likely to be monitored, a software usage profile,

- and as a criterion to be respected, at least one feature of software execution,

• and in the case where the protection method according to the invention implements the principle of protection by detection and coercion using as execution trait to be respected, monitoring of the execution sequence, it is also defined: an instruction set, the instructions of which can be executed in unit 6, a set of instruction commands for this set of instructions, these instruction commands being capable of being executed in the data processing system 3 and of triggering in unit 6 the execution of the instructions, as a usage profile, the sequence of instructions,

- as an execution trait, a desired sequence for the execution of instructions,

- as detection means 17, means making it possible to detect that the sequence of instructions does not correspond to that desired, - and as means of coercion 18, means making it possible to inform the data processing system 3 and / or modify the operation of the portion of protected software 2p when the sequence of instructions does not correspond to that desired, and in the case where the protection method according to the invention implements a preferred variant embodiment of the principle protection by detection and coercion using as execution trait to be respected, the monitoring of the execution sequence, it is also defined:

- as a set of instructions, a set of instructions of which at least certain instructions work on registers and use at least one operand in order to render a result,

- for at least part of the instructions working on registers:

> a PF part defining the functionality of the instruction,

0 an identification field of the CH instruction, 0 and for each operand of the instruction:

* a CD _k flag field,

* and a planned identification field ClPk of the operand, - for each register belonging to the operating means and used by the instruction set, an identification field generated CIG _V in which is automatically memorized the identification of the last instruction having rendered its result in this register,

- as detection means 17, means making it possible, during the execution of an instruction, for each operand, when the flag field CD _k requires it, to control the equality between the identification field generated CIG _V corresponding to the register used by this operand, and the expected identification field CHY of the origin of this operand,

- And as means of coercion 18, means making it possible to modify the result of the instructions, if at least one of the equality checked is false. During the upstream protection sub-phase, the definition stage Su is followed by a stage called "construction stage S ₁₂ ". During such a stage S ₁₂ , the transfer means 12, 13 and the operating means corresponding to the definitions of the definition stage Su are constructed.

During this stage of construction S ₁₂ , it is therefore proceeded:

• the construction of the transfer means 12, 13 allowing, during the use phase U, the transfer of data between the data processing system 3 and the unit 6, • the construction of the operating means allowing the unit 6, during the use phase U to implement the recovery means,

• and when the principle of protection by elementary functions is also implemented, in the construction of the operating means also allowing the unit 6, during the use phase U to execute the elementary functions of the game of elementary functions,

• and when the principle of protection by detection and coercion is also implemented, during construction:

operating means allowing the unit 6, during the use phase U to also implement the detection means 17 and the coercion means 18, - and possibly operating means allowing the unit 6, during the use phase U to also implement the updating means,

- and possibly operating means allowing the unit 6, during the recharging phase, to also use the recharging means,

- And possibly operating means also allowing the unit 6, during the use phase U to execute the instructions of the instruction set. The construction of the operating means is carried out in a conventional manner, by means of a program development unit taking into account the definitions intervened at the definition stage Su. Such a unit is described in the following description in FIG. 110.

During the upstream protection sub-phase Pi, the construction stage Su can be followed by a stage called "pre-personalization stage Sι ₃ ". During this stage of pre-personalization Sι ₃ at least part of the transfer means 13 and / or the operating means are loaded into at least one blank unit 60 in order to obtain at least one pre-personalized unit 66. It should be noted that part of the operating means, once transferred to a pre-personalized unit 66, is no longer directly accessible from outside this pre-personalized unit 66. The transfer of the operating means in a blank unit 60 can be achieved by means of a suitable pre-personalization unit, which is described in the following description in FIG. 120. In the case of a pre-personalized unit 66, consisting of a smart card 7 and its reader 8, the pre-personalization only concerns the smart card 7.

During the upstream protection sub-phase Pi, it can be implemented, after the definition stage Su and, possibly after the construction stage S ₁₂ , a stage called "tool making stage Sι ₄ ". During this stage of making tools Sι are made tools making it possible to help in the generation of protected software or to automate the protection of software. Such tools allow:

• to help choose or automatically choose in the vulnerable 2v software to protect: - the algorithmic processing (s) capable of being broken down into deportable dependent functions in unit 6 and for which the setpoints of the triggering commands can be renamed,

- the portion (s) likely to be modified, - and when the principle of protection by variable is also implemented, the variable (s) likely to be deported to unit 6,

- and when the principle of protection by elementary functions is also implemented, the algorithmic processing (s) likely to be broken down into elementary functions deportable in unit 6, - and when the principle of protection by detection and coercion is also put in use, the execution characteristic or characteristics to be monitored and, possibly, the algorithmic treatment or treatments capable of being broken down into deportable instructions in unit 6,

- and when the principle of protection by conditional branching is also implemented, the conditional branch (es) whose functionality is likely to be transferred to unit 6,

• and, possibly, help generate protected software or automate software protection.

These different tools can be produced independently or in combination and each tool can take various forms, such as preprocessor, assembler, compiler, etc.

The upstream protection sub-phase Pi is followed by a downstream protection sub-phase P ₂ dependent on the vulnerable software 2v to be protected. This downstream protection sub-phase P ₂ also involves several stages. The first stage corresponding to the implementation of the principle of protection by renaming is called "creation stage S21". During this creation stage S21, the choices made at the definition stage Su are used. Using these choices and possibly tools built at the stage of making tools S14, the protected software 2p is created:

By choosing, at least one algorithmic processing which, when the vulnerable 2v software is executed, uses at least one operand and makes it possible to obtain at least one result, • by choosing at least a portion of the source of the vulnerable 2vs software containing at least one chosen algorithmic processing,

• by producing the source of the 2ps protected software from the source of the vulnerable 2vs software, by modifying at least a selected portion of the source of the vulnerable 2vs software to obtain at least a modified portion of the source of the 2ps protected software, this modification being such that :

- during the execution of the protected software 2p a first part of execution 2pes is executed in the data processing system 3 and a second part of execution 2peu is executed in a unit 6, obtained from the blank unit 60 after loading information,

the second execution part 2peu executes at least the functionality of at least one chosen algorithmic processing,

- at least one chosen algorithmic processing is broken down so that during the execution of the protected software 2p, this algorithmic processing is executed, by means of the second part of execution

2 little, using dependent functions,

- for at least one chosen algorithmic processing, triggering commands with renamed instructions are integrated in the source of the protected software 2ps, so that during the execution of the protected software 2p, each triggering command with renamed instruction is executed by the first party 2pes execution and triggers in unit 6, the restoration, by means of recovery means 20, of the setpoint and the execution, by means of the second execution part 2peu, of the corresponding dependent function, - and an ordering of the triggering commands with renowned instructions is chosen from all the orders allowing the execution of the protected software 2p,

• and by producing:

- a first 2pos object part of the 2p protected software, from the source of the 2ps protected software, this first 2pos object part being such that during the execution of the 2p protected software, a first part of execution 2pes which is executed in the data processing system 3 and of which at least a portion takes into account that the triggering commands with renamed instructions are executed according to the scheduling chosen, - and a second part object 2pou of the software protected 2p, containing the operating means, this second object part 2pou being such that, after loading into the blank unit 60 and during the execution of the protected software 2p, the second execution part 2peu appears by means of which the instructions are restored and the dependent functions are executed.

For the implementation of a variant of the renaming protection principle, the 2p protected software is modified:

• by choosing in the source of the 2ps protected software at least one triggered command with a renowned instruction, • and by modifying at least a selected portion of the source of the protected software

2ps by replacing at least the renamed setpoint of a triggering command with selected renown setpoint, by another renamed setpoint, triggering a function dependent on the same family.

During the downstream protection sub-phase P2, and when at least one other protection principle is applied in addition to the renaming protection principle, a "modification stage S22" is implemented. During this modification stage S22, the definitions used at the definition stage Su are used. With the help of these definitions and possibly of tools constructed at the stage of making tools S ₁₄ , the protected software 2p is modified to allow the implementation of the protection principles according to one of the arrangements defined above.

When the variable protection principle is implemented, the protected 2p software is modified:

By choosing at least one variable used in at least one chosen algorithmic processing, which during the execution of the protected software 2p, partially defines the state of the protected software 2p,

• by modifying at least a selected portion of the source of the 2ps protected software, this modification being such that during the execution of the protected software 2p, at least one chosen variable or at least one copy of chosen variable resides in unit 6,

• and by producing:

- the first part 2pos object of the protected software 2p, this first part object 2pos being such that during the execution of the protected software

2p, at least a portion of the first 2pes execution part also takes into account that at least one variable or at least one copy of a variable resides in unit 6,

- And the second object part 2pou of the protected software 2p, this second object part 2pou being such that, after loading into the unit 6 and during the execution of the protected software 2p, the second execution part 2peu appears by means of which at least one chosen variable, or at least one copy of chosen variable also resides in unit 6. When the principle of protection by elementary functions is implemented, hereel protected 2p is modified:

• by modifying at least a selected portion of the source of the 2ps protected software, this modification being such that the decomposition of at least one chosen algorithmic processing into dependent functions uses only elementary functions, • by producing:

- the first part 2pos object of the protected software 2p, this first part object 2pos being such that during the execution of the protected software 2p, at least a portion of the first part of execution 2pes also executes the elementary commands according to the scheduling selected,

- and the second object 2pou part of the protected software 2p also containing the operating means, this second object part 2pou being such that, after loading into the unit 6 and during the execution of the protected software 2p, the second part appears of execution 2peu by means of which the elementary functions triggered by the first part of execution 2pes are also executed. When the protection by detection and coercion principle is implemented, the protected 2p software is modified:

By choosing at least one software execution characteristic to be monitored, from among the execution characteristics liable to be monitored,

By choosing at least one criterion to be respected for at least one characteristic of software execution chosen,

By choosing in the source of the protected 2ps software, elementary functions for which at least one characteristic of software execution chosen, is to be monitored,

• by modifying at least a selected portion of the source of the protected 2ps software, this modification being such that during the execution of the protected software 2p, at least one selected execution characteristic is monitored by means of the second execution part 2peu , and non-compliance with a criterion results in information to the data processing system 3 and / or to a modification of the execution of the protected software 2p,

• and by producing the second object part 2pou of the protected software 2p containing the operating means also implementing the detection means 17 and the coercion means 18, this second object part 2pou being such that, after loading into the unit 6 and during the execution of the protected software 2p, at least one characteristic of software execution is monitored and non-compliance with a criterion leads to information from the data processing system 3 and / or to a modification of the protected software 2p. For the implementation of the principle of protection by detection and coercion using as a characteristic a variable for measuring the execution of the software, the protected software 2p is modified:

By choosing as a software execution characteristic to be monitored, at least one variable for measuring the use of a software functionality,

• by choosing : - at least one functionality of the protected software 2p, the use of which can be monitored by means of a measurement variable,

- at least one measurement variable used to quantify the use of said functionality, - at least one threshold associated with a chosen measurement variable corresponding to a limit of use of said functionality,

- and at least one method for updating a measurement variable chosen as a function of the use of said functionality,

• and by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that, during the execution of the protected software 2p, the measurement variable is updated by means of the second execution part 2peu, in depending on the use of said functionality and at least one threshold crossing is taken into account.

For the implementation of a first preferred embodiment of the principle of protection by detection and coercion using, as a characteristic, a measurement variable, the protected software 2p is modified:

• by choosing in the source of the 2ps protected software, at least one chosen measurement variable to which several thresholds must be associated corresponding to different limits for using the functionality, • by choosing at least two thresholds associated with the measurement variable selected,

• and by modifying at least a selected portion of the source of the 2ps protected software, this modification being such that, during the execution of the 2p protected software, the overruns of the various thresholds are taken into account, by means of the second part of 2peu execution, in a different way.

For the implementation of a second preferred embodiment of the principle of protection by detection and coercion using as a characteristic, a measurement variable, the protected software 2p is modified:

By choosing in the source of the protected 2ps software, at least one chosen measurement variable making it possible to limit the use of a functionality to which at least one additional use must be able to be credited, • and by modifying at least one selected portion, this modification being such that in a so-called reloading phase, at least one additional use of at least one functionality corresponding to a chosen measurement variable can be credited. For the implementation of the principle of protection by detection and coercion using as a characteristic, a software usage profile, the protected 2p software is modified:

• by choosing as a software execution characteristic to monitor at least one software use profile, • by choosing at least one execution feature that at least one chosen use profile must comply with,

• and by modifying at least a selected portion of the source of the 2ps protected software, this modification being such that, during the execution of the 2p protected software, the second execution part 2peu respects all of the selected execution features.

For the implementation of the principle of protection by detection and coercion using as execution trait to be respected, the monitoring of the execution sequence, the protected software 2p is modified:

• by modifying at least a selected portion of the source of the 2ps protected software:

- by transforming elementary functions into instructions,

- by specifying the sequence that at least some of the instructions must comply with when they are executed in unit 6,

- and by transforming the elementary commands into command commands corresponding to the instructions used.

When the principle of protection by conditional connection is implemented, the protected software 2p is modified:

By choosing in the source of the 2ps protected software, at least one conditional connection made in at least one chosen algorithmic processing,

• by modifying at least a selected portion of the source of the protected software 2ps, this modification being such that during the execution of the protected software 2p, the functionality of at least one conditional branch chosen, is executed, by means of the second execution part 2peu, in the unit 6,

• and by producing: - the first part 2pos object of the protected software 2p, this first part object 2pos being such that during the execution of the protected software 2p, the functionality of at least one conditional connection chosen is executed in the unit 6

- And the second object part 2pou of the protected software 2p, this second object part 2pou being such that, after loading into the unit 6 and during the execution of the protected software 2p, the second execution part 2peu appears by means of which the functionality of at least one selected conditional branch is executed. For the implementation of a preferred embodiment of the principle of protection by conditional connection, the protected software 2p is modified:

By choosing, from the source of the 2ps protected software, at least one series of selected conditional connections,

• by modifying at least a selected portion of the source of the 2ps protected software, this modification being such that during the execution of the 2p protected software, the overall functionality of at least one selected series of conditional connections is executed by means of the second 2-inch execution part, in unit 6,

• and by producing:

2p, the functionality of at least one selected series of conditional connections is executed in unit 6,

- And the second object part 2pou of the protected software 2p, this second object part 2pou being such that, after loading into the unit 6 and during the execution of the protected software 2p, the second execution part 2peu appears by means of which the overall functionality of least a selected series of conditional branchings is executed.

Of course, the protection principles according to the invention can be applied directly during the development of new software without requiring the prior production of intermediate protected software. In this way, the stages of creation S ₂ ι and of modification S ₂₂ can be carried out concomitantly so as to obtain the protected software 2p directly.

During the downstream protection sub-phase P ₂ , it is implemented after the creation stage S ₂₁ of the protected software 2p, and possibly after the modification stage S ₂₂ , a stage called "personalization stage S2 ₃ ". During this personalization stage S ₂₃ , the second object part 2pou containing the operating means is loaded into at least one blank unit 60, with a view to obtaining at least one unit 6, or a part of the second object part 2pou possibly containing the operating means is loaded into at least one pre-personalized unit 66, with a view to obtaining at least one unit 6. Loading this personalization information makes it possible to make at least one unit 6 operational. It should be noted that part of this information, once transferred to a unit 6, is not directly accessible from outside this unit 6. The transfer of personalization information to a blank unit 60 or a pre-personalized unit 66 can be carried out by through a suitable personalization unit which is described in the following description in FIG. 150. In the case of a unit 6, consisting of a smart card 7 and its reader 8, the personalization only concerns the smart card 7.

For the implementation of the protection phase P, various technical means are described more precisely in relation to FIGS. 110, 120, 130, 140 and 150.

Fig. 110 illustrates an exemplary embodiment of a system 25 making it possible to implement the construction stage S ₁₂ taking into account the definitions intervened at the definition stage Su and during which the transfer means 12, 13 are constructed and possibly the operating means intended for unit 6. Such a system 25 includes a program development unit or workstation conventionally in the form of a computer comprising a central unit, a screen, peripherals of the keyboard type mouse, and having, in particular, the following programs: file editors, assemblers, preprocessors, compilers, interpreters, debuggers and linkers.

Fig. 120 illustrates an exemplary embodiment of a pre-personalization unit 30 making it possible to at least partially load the transfer means 13 and / or the operating means in at least one blank unit 60 in order to obtain at least one pre-unit -personalized 66. This prepersonalization unit 30 includes a reading and writing means 31 making it possible to electrically prepersonalize a blank unit 60, so as to obtain a pre-personalized unit 66 in which the transfer means 13 and / or operating have been loaded. The pre-personalization unit 30 can also include means for physical personalization 32 of the blank unit 60 which can be, for example, in the form of a printer. In the case where the unit 6 is constituted by a smart card 7 and its reader 8, the pre-personalization generally relates only to the smart card 7. FIG. 130 illustrates an exemplary embodiment of a system 35 making it possible to make the tools making it possible to help generate protected software or to automate software protection. Such a system 35 comprises a program development unit or workstation conventionally in the form of a computer comprising a central unit, a screen, peripherals of the keyboard-mouse type, and comprising, in particular, the following programs: file editors, assemblers, pre-processors, compilers, interpreters, debuggers and linkers.

Fig. 140 illustrates an embodiment of a system 40 allowing direct creation of 2p protected software or modification of vulnerable 2v software in order to obtain 2p protected software. Such a system 40 includes a program development unit or workstation conventionally in the form of a computer comprising a central unit, a screen, peripherals of the keyboard-mouse type, and comprising, in particular, the following programs: file editors, assemblers, pre-processors, compilers, interpreters, debuggers and linkers, as well as tools to help generate protected software or to automate software protection.

Fig. 150 illustrates an exemplary embodiment of a personalization unit 45 allowing the second object part 2pou to be loaded into at least one blank unit 60 in order to obtain at least one unit 6 or a part of the second object part 2pou in at least one pre-personalized unit 66 in order to obtain at least a unit 6. This personalization unit 45 comprises a reading and writing means 46 making it possible to electrically personalize at least one blank unit 60 or at least one pre-personalized unit 66, so as to obtain at least one unit 6. At the end of this personalization, a unit 6 includes the information necessary for the execution of the protected software 2p. The personalization unit 45 can also include physical personalization means 47 for at least one unit 6 which can be, for example, in the form of a printer. In the case where a unit 6 is constituted by a smart card 7 and its reader 8, the personalization generally relates only to the smart card 7.

The protection method of the invention can be implemented with the following improvements: • Provision may be made for jointly using several processing and storage units in which the second object part 2p or of the protected software 2p is distributed so that their joint use allows the 2p protected software to be executed, the absence of at least one of these processing and storage units preventing the use of the 2p protected software.

• Similarly, after the pre-personalization stage Sι ₃ and during the personalization stage S ₂₃ , the part of the second object part 2pou necessary to transform the pre-personalized unit 66 into a unit 6 can be contained in a unit processing and storage used by the personalization unit 45 in order to limit access to this part of the second object part 2pou. Of course, this part of the second object part 2pou can be distributed in several processing and storage units so that this part of the second object part 2pou is accessible only when the processing and storage units are used together. .

Claims

CLAIMS:

1 - Method for protecting, from at least one blank unit (60) comprising at least storage means (15) and processing means (16), vulnerable software (2v) against its unauthorized use, said vulnerable software

(2v) operating on a data processing system (3), characterized in that it consists of:

-^ in a protection phase (P): • to define: - a set of dependent functions whose dependent functions are likely to be executed in a unit (6),

- a set of triggering commands for this set of dependent functions, these triggering commands being capable of being executed in the data processing system (3) and of triggering the execution in a unit (6), of the dependent functions,

- for each triggering command, a setpoint corresponding at least in part to the information transmitted from the data processing system (3) to a unit (6), in order to trigger the execution of the corresponding dependent function in a unit

(6), this instruction being presented in the form of at least one argument of the triggering command,

- a method of renaming instructions allowing the instructions to be renamed in order to obtain triggering commands with renamed instructions,

- and recovery means (20) intended to be implemented in a unit (6) during a use phase (U), and making it possible to find the dependent function to be executed, from the renamed setpoint , “to construct operating means making it possible to transform the virgin unit (60) into a unit (6) capable of implementing the means of recovery (20), to create protected software (2p):

- by choosing at least one algorithmic processing which, during the execution of the vulnerable software (2v), uses at least one operand and makes it possible to obtain at least one result,

- by choosing at least one portion of the source of the vulnerable software (2vs) containing at least one chosen algorithmic processing,

- by producing the source of the protected software (2ps) from the source of the vulnerable software (2vs), by modifying at least one chosen portion of the source of the vulnerable software (2 s) to obtain at least one modified portion of the source of the protected software (2ps), this modification being such that:

> during the execution of the protected software (2p) a first execution part (2pes) is executed in the data processing system (3) and a second execution part (2peu) is executed in a unit (6 ), obtained from the blank unit (60) after loading information,

> the second execution part (2peu) executes at least the functionality of at least one chosen algorithmic processing, > at least one chosen algorithmic processing is decomposed so that during the execution of the protected software (2p), this processing algorithm is executed, by means of the second execution part (2bit), using dependent functions,

> for at least one chosen algorithmic processing, triggering commands with renamed setpoints are integrated into the source of the protected software (2ps), so that during the execution of the protected software (2p), each triggering command with renamed setpoint is executed by the first execution part (2pes) and triggers in the unit (6), the restoration, by means of the restoration means (20), of the setpoint and the execution, by means of the second execution part (2bit), of the corresponding dependent function, > and a schedule of triggering commands with renamed instructions is chosen from all the schedules allowing the execution of the protected software (2p),

- and by producing: > a first object part (2pos) of the protected software (2p), from the source of the protected software (2ps), this first object part (2pos) being such as during the execution of the protected software ( 2p), appears a first execution part (2pes) which is executed in the data processing system (3) and of which at least a portion takes into account that the triggering commands with renamed instructions are executed according to the chosen scheduling,

> and a second object part (2pou) of the protected software (2p), containing the operating means, this second object part (2pou) being such that, after loading into the blank unit (60) and during execution of the protected software (2p), the second execution part (2peu) appears by means of which the instructions are restored and the dependent functions are executed,

• and loading the second object part (2pou) into the blank unit (60), with a view to obtaining the unit (6), and in a use phase (U) during which the software is executed protected (2p):

• in the presence of the unit (6) and each time that a triggering command with a renamed setpoint, contained in a portion of the first execution part (2pes) requires it, to be reestablished in the unit (6) , the identity of the corresponding dependent function and to execute it, so that this portion is executed correctly and that, consequently, the protected software (2p) is completely functional,

• and in the absence of the unit (6), despite the request of a portion of the first execution part (2pes) to trigger the execution of a dependent function in the unit (6), to not being able to properly respond to this request, so at least this portion is not executed correctly and therefore the protected software (2p) is not fully functional.

2- Method according to claim 1, characterized in that it consists: -> in the protection phase (P): • to define for at least one dependent function, a family of algorithmically equivalent dependent functions, but triggered by commands triggers whose renowned instructions are different,

• and modify the protected software (2p):

- by choosing from the source of the protected software (2ps) at least one triggering command with a renamed setpoint,

- and by modifying at least one selected portion of the source of the protected software (2ps) by replacing at least the renamed setpoint of a triggering command with a chosen renamed setpoint, by another renamed setpoint, triggering a dependent function of the same family.

3 - Method according to claim 1 or 2, characterized in that it consists of: -^ in the protection phase (P):

• to define :

- as a method of renaming instructions, an encryption method for encrypting instructions,

- and as recovery means (20), means implementing a decryption method to decipher the renamed instructions and thus restore the identity of the dependent functions to be executed in the unit (6).

4 - Method according to one of claims 1 to 3, characterized in that it consists of:

-^ in the protection phase (P):

• to modify the protected software (2p):

- by choosing at least one variable used in at least one chosen algorithmic processing, which during the execution of the protected software (2p), partially defines the state of the protected software (2p),

- by modifying at least one selected portion of the software source protected (2ps), this modification being such that during the execution of the protected software (2p), at least one chosen variable or at least one copy of a chosen variable resides in the unit (6),

- and by producing: > the first object part (2pos) of the protected software (2p), this first object part (2pos) being such that during the execution of the protected software (2p), at least a portion of the first part execution (2pes) also takes into account that at least one variable or at least one copy of a variable resides in the unit (6), > and the second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading into the unit (6) and during execution of the protected software (2p), the second execution part (2pou) appears by means of which at least one variable chosen , or at least one copy of chosen variable also resides in unit (6),

-> and in the use phase (U):

• in the presence of the unit (6) each time that a portion of the first execution part (2pes) requires it, to use a variable or a copy of a variable residing in the unit (6), to so that this portion is executed correctly and, therefore, the protected software (2p) is completely functional,

• and in the absence of unit (6), despite the request of a portion of the first execution part (2pes) to use a variable or a copy of a variable residing in unit (6), not being able to respond correctly to this request, so that at least this portion is not executed correctly and, therefore, the protected software (2p) is not completely functional.

5 - Method according to one of claims 1 to 3, characterized in that it consists of: -> in the protection phase (P): • to be defined:

- a set of elementary functions, a subset of all the dependent functions,

- and a set of elementary commands for this set of elementary functions, this set of elementary commands being a subset of all the triggering commands, • to construct the operating means allowing the unit (6), d 'also execute the elementary functions of said game, the execution of these elementary functions being triggered by the execution in the data processing system (3), of elementary commands whose instruction has been renamed, • and to modify the protected software (2p):

- by modifying at least one chosen portion of the source of the protected software (2ps), this modification being such that the decomposition of at least one chosen algorithmic processing into dependent functions only uses elementary functions, - by producing:

> the first object part (2pos) of the protected software (2p), this first object part (2pos) being such that during the execution of the protected software (2p), at least a portion of the first execution part (2pes ) also executes elementary commands according to the chosen schedule,

> and the second object part (2pou) of the protected software (2p) also containing the operating means, this second object part (2pou) being such that, after loading into the unit (6) and during execution of the protected software (2p), the second execution part (2peu) appears by means of which the elementary functions triggered by the first execution part (2pes) are also executed, and in the use phase (U):

• in the presence of the unit (6) and each time that an elementary command contained in a portion of the first execution part (2pes) requires it, to execute the corresponding elementary function in the unit (6) , so that this portion is executed correctly and, therefore, the protected software (2p) is completely functional,

• and in the absence of the unit (6), despite the request for a portion of the first execution part (2pes), to trigger the execution of an elementary function in the unit (6), not being able to respond correctly to this request, so that at least this portion is not executed correctly and, therefore, the protected software (2p) is not completely functional. 6 - Method according to claim 5, characterized in that it consists: in the protection phase (P):

• to define :

- at least one software execution characteristic, capable of being monitored at least in part in the unit (6),

- at least one criterion to be respected for at least one software execution characteristic,

- detection means (17) to be implemented in the unit (6) and making it possible to detect that at least one software execution characteristic does not respect at least one associated criterion,

- and coercion means (18) to be implemented in the unit (6) and making it possible to inform the data processing system (3) and/or to modify the execution of software, when at the less one criterion is not respected,

• to construct the operating means allowing the unit (6) to also implement the detection means (17) and the coercion means (18),

• and modify the protected software (2p):

- by choosing at least one software execution characteristic to be monitored, among the execution characteristics likely to be monitored, - by choosing at least one criterion to be respected for at least one chosen software execution characteristic, - by choosing from the source of the protected software (2ps), elementary functions for which at least one chosen software execution characteristic is to be monitored,

- by modifying at least one chosen portion of the source of the protected software (2ps), this modification being such that during the execution of the protected software (2p), at least one chosen execution characteristic is monitored by means of the second part execution (2peu), and non-compliance with a criterion results in information from the data processing system (3) and/or in a modification of the execution of the protected software (2p),

- and by producing the second object part (2pou) of the protected software (2p) containing the operating means also implementing the detection means (17) and the coercion means (18), this second object part (2pou) being such that, after loading into the unit (6) and during execution of the protected software (2p), at least one software execution characteristic is monitored and non-compliance with a criterion results in information of the data processing system (3) and/or a modification of the execution of the protected software

(2p), and in the use phase (U): • in the presence of the unit (6):

- as long as all the criteria corresponding to all the monitored execution characteristics of all modified portions of the protected software (2p) are respected, to allow the nominal operation of these portions of the protected software (2p) and consequently to allow operation nominal of the protected software (2p),

- and if at least one of the criteria corresponding to a monitored execution characteristic of a portion of the protected software (2p) is not respected, to inform the data processing system (3) and/or to modify the operation of the portion of the protected software (2p), so that the operation of the protected software (2p) is modified. 7 - Method according to claim 6, for limiting the use of protected software (2p), characterized in that it consists: -> in the protection phase (P):

• to define: - as a software execution characteristic capable of being monitored, a variable for measuring the use of a software functionality,

- as a criterion to be respected, at least one threshold associated with each measurement variable, - and updating means making it possible to update at least one measurement variable,

• to construct the operating means allowing the unit (6) to also implement the updating means,

• and to modify the protected software (2p): - by choosing as software execution characteristic to be monitored, at least one variable for measuring the use of a software functionality,

- by choosing :

> at least one functionality of the protected software (2p) whose use can be monitored using a measurement variable,

> at least one threshold associated with a chosen measurement variable corresponding to a limit of use of said functionality,

> and at least one method of updating a measurement variable chosen according to the use of said functionality,

- and by modifying at least one chosen portion of the source of the protected software (2ps), this modification being such that, during the execution of the protected software (2p), the measurement variable is updated by means of the second part of execution (2bit), depending on the use of said functionality and at least one threshold violation is taken into account, -> and in the use phase (U), in the presence of the unit (6), and in the case where at least one threshold violation is detected. threshold corresponding to at least one usage limit, to inform the data processing system (3) and/or to modify the operation of the portion of the protected software (2p), so that the operation of the protected software (2p ) is modified. 8 - Method according to claim 7, characterized in that it consists of: -> in the protection phase (P): • to be defined:

- for at least one measurement variable, several associated thresholds,

- and different means of coercion corresponding to each of these thresholds,

• and to modify the protected software (2p): - by choosing in the source of the protected software (2ps), at least one chosen measurement variable to which several thresholds corresponding to different limits of use of the functionality must be associated,

- by choosing at least two thresholds associated with the chosen measurement variable,

- and by modifying at least one selected portion of the source of the protected software (2ps), this modification being such that, during the execution of the protected software (2p), exceeding the various thresholds are taken into account, by means of the second part of execution (2bit), in a different way,

- and in the use phase (U):

• in the presence of the unit (6):

- in the case where it is detected that a first threshold has been exceeded, to instruct the protected software (2p) to no longer use the corresponding functionality,

- and in the case where it is detected that a second threshold has been exceeded, render inoperative the corresponding functionality and/or at least a portion of the protected software (2p).

9 - Method according to claim 7 or 8, characterized in that it consists: -> in the protection phase (P): • to define recharging means making it possible to credit at least one additional use for at least one functionality of software monitored by a measurement variable, • to construct the operating means also allowing the unit (6) to implement the reloading means, • and to modify the protected software (2p):

- by choosing from the source of the protected software (2ps), at least one chosen measurement variable making it possible to limit the use of a functionality to which at least one additional use must be able to be credited, - and by modifying at least one portion chosen, this modification being such that in a so-called reloading phase, at least one additional use of at least one functionality corresponding to a chosen measurement variable can be credited, - and in the reloading phase: • to update at least one chosen measurement variable and/or at least one associated threshold, so as to allow at least one additional use of the functionality.

10 - Method according to claim 6, characterized in that it consists of: -> in the protection phase (P): • to be defined:

- as a software execution characteristic capable of being monitored, a software usage profile,

- and as a criterion to be respected, at least one software execution feature, • and to modify the protected software (2p):

- by choosing as a software execution characteristic to monitor at least one software usage profile,

- by choosing at least one execution trait that at least one chosen usage profile must respect,

- and by modifying at least one chosen portion of the source of the protected software (2ps), this modification being such that, during the execution of the protected software (2p), the second execution part (2peu) respects all the features of 'chosen execution,

-> and in the use phase (U) in the presence of the unit (6), and in the case where it is detected that at least one execution trait is not respected, to inform the system data processing (3) and/or to modify the operation of the portion of the protected software (2p), so that the operation of the protected software (2p) is modified.

11 - Method according to claim 10, characterized in that it consists of: -^ in the protection phase (P): • to be defined:

- a set of instructions whose instructions can be executed in the unit (6),

- a set of instruction commands for this set of instructions, these instruction commands being capable of being executed in the data processing system (3) and triggering in the unit (6) the execution of the instructions,

- as a usage profile, the sequence of instructions,

- as an execution feature, a desired sequence for the execution of the instructions, - as detection means (17), means making it possible to detect that the sequence of instructions does not correspond to that desired,

- and as means of coercion (18), means making it possible to inform the data processing system (3) and/or to modify the operation of the portion of protected software (2p) when the sequence of instructions does not does not correspond to the desired one, • to construct the operating means also allowing the unit (6) to execute the instructions of the instruction set, the execution of these instructions being triggered by the execution in the data processing system (3) , instruction commands, • and to modify the protected software (2p):

- by modifying at least one selected portion of the protected software source (2ps):

> by transforming elementary functions into instructions,

> by specifying the sequence that at least some of the instructions must respect during their execution in unit (6),

> and by transforming the elementary commands into instruction commands corresponding to the instructions used,

- and in the use phase (U), in the presence of the unit (6), in the case where it is detected that the sequence of instructions executed in the unit (6) does not correspond to that desired, to inform the data processing system (3) and/or to modify the operation of the portion of the protected software (2p), so that the operation of the protected software (2p) is modified. 12 - Method according to claim 11, characterized in that it consists of: - in the protection phase (P): “to be defined:

- as an instruction set, a set of instructions of which at least certain instructions work on registers and use at least one operand in order to render a result,

- for at least part of the instructions working on registers: > a part (PF) defining the functionality of the instruction,

0 an instruction identification field (CH), 0 and for each operand of the instruction:

* a flag field (CDk), * and a planned identification field (ClP _k ) of the operand,

- for each register belonging to the operating means and used by the set of instructions, a generated identification field (CIG _V ) in which the identification of the last instruction having returned its result in this register is automatically stored,

- as detection means (17), means allowing, during the execution of an instruction, for each operand, when the flag field (CD _k ) requires it, to check the equality between the field d the generated identification (CIG _V ) corresponding to the register used by this operand, and the intended identification field (ClPk) of the origin of this operand,

- and as means of coercion (18), means making it possible to modify the result of the instructions, if at least one of the controlled equalities is false.

13 - Method according to one of claims 1 to 12, characterized in that it consists of: -> in the protection phase (P):

• to modify the protected software (2p): - by choosing from the source of the protected software (2ps), at least one conditional connection carried out in at least one chosen algorithmic processing,

- by modifying at least one chosen portion of the source of the protected software (2ps), this modification being such that during the execution of the protected software (2p), the functionality of at least one chosen conditional connection is executed, by means of the second execution part (2bit), in the unit (6),

- and by producing:

> the first object part (2pos) of the protected software (2p), this first object part (2pos) being such that during the execution of the protected software (2p), the functionality of at least one connection chosen conditional is executed in unit (6),

> and the second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading into the unit (6) and during execution of the protected software (2p), appears the second execution part (2peu) by means of which the functionality of at least one chosen conditional branch is executed, -> and in the use phase (U):

• in the presence of the unit (6) and each time that a portion of the first execution part (2pes) requires it, to execute the functionality of at least one conditional connection in the unit (6) , so that this portion is executed correctly and, therefore, the protected software (2p) is completely functional,

• and in the absence of the unit (6) and despite the request of a portion of the first execution part (2pes) to execute the functionality of a conditional branch in the unit (6), to not being able to respond correctly to this request, so that at least this portion is not executed correctly and therefore the protected software (2p) is not completely functional. 14 - Method according to claim 13, characterized in that it consists, in the protection phase (P), of modifying the protected software (2p):

- by choosing, in the source of the protected software (2ps) at least one series of selected conditional connections,

- by modifying at least one chosen portion of the source of the protected software (2ps), this modification being such that during the execution of the protected software (2p), the overall functionality of at least one chosen series of conditional connections is executed at means of the second execution part (2bit), in the unit (6),

- and by producing: > the first object part (2pos) of the protected software (2p), this first object part (2pos) being such that during the execution of the protected software (2p), the functionality of at least one selected series of conditional branches is performed in the unit

(6),

> and the second object part (2pou) of the protected software (2p), this second object part (2pou) being such that, after loading into the unit (6) and during execution of the protected software (2p), appears the second execution part (2bit) by means of which the overall functionality of at least one selected series of conditional branches is executed. 15 - Method according to one of claims 1 to 14, characterized in that it consists of decomposing the protection phase (P) into an upstream protection sub-phase (PI), independent of the software to be protected and a sub-phase downstream protection phase (P2), dependent on the software to be protected.

16 - Method according to claim 15, characterized in that it consists, during the upstream protection sub-phase (PI), of involving a definition stage (SU) in which all the definitions are carried out.

17- Method according to claim 16, characterized in that it consists, after the definition stage (SU), of involving a construction stage (S12) in which the operating means are constructed. 18 - Method according to claim 17, characterized in that it consists, after the construction stage (S12), of involving a pre-personalization stage (S13), consisting of loading into a blank unit (60), at minus part of the operating means in order to obtain a pre-personalized unit (66).

19 - Method according to claim 16 or 17, characterized in that it consists, during the upstream protection sub-phase (PI), of involving a tool making stage (S14) in which tools are made to help generate protected software or automate software protection.

20 - Method according to claims 15 and 18, characterized in that it consists of breaking down the downstream protection sub-phase (P2), into: • a creation stage (S21) in which the protected software (2p) is created , from the vulnerable software (2v), • possibly, a modification stage (S22) in which the protected software (2p), • and a personalization stage (S23) in which:

- the second object part (2pou) of the protected software (2p) containing the operating means is loaded into at least one blank unit (60) in order to obtain at least one unit (6),

- or part of the second object part (2pou) of the protected software (2p) possibly containing the operating means is loaded into at least one pre-personalized unit (66) in order to obtain at least one unit (6) . 21 - Method according to claims 19 and 20, characterized in that it consists, during the creation stage (S21) and possibly the modification stage (S22), of using at least one of the tools to assist in the generation of protected software or automation of software protection.

22 - System for implementing the method according to claim 17, characterized in that it comprises a program development unit, serving, during the construction stage (S 12), to carry out the construction of the means of operation intended for the unit (6), taking into account the definitions made at the definition stage (SU).

23 - System for implementing the method according to claim 18, characterized in that it comprises a pre-personalization unit (30) making it possible to load at least part of the operating means in at least one blank unit (60), with a view to obtaining at least one pre-personalized unit (66).

24 - System for implementing the method according to claim 19, characterized in that it comprises a program development unit, used to carry out, during the tool making stage (S14), the making of tools assisting in the generation of protected software or automating software protection.

25 - System for implementing the method according to claim 20 or 21, characterized in that it comprises a program development unit used to create or modify protected software (2p). 26 - System for implementing the method according to claim 20, characterized in that it comprises a personalization unit (45) making it possible to load: • the second object part (2pou) in at least one blank unit (60), with a view to obtaining at least one unit (6),

• or part of the second object part (2pou) in at least one pre-personalized unit (66), with a view to obtaining at least one unit (6). 27 - Pre-personalized unit (66), characterized in that it is obtained by the system according to claim 23.

28 - Unit (6) making it possible to execute protected software (2p) and prevent its unauthorized use, characterized in that it contains the second object part (2pou) of the protected software (2p) loaded using a personalization unit (45) according to claim 26.

29 - Set of units (6), characterized in that the second object part (2pou) of the protected software (2p), loaded using a customization unit (45) according to claim 26, is distributed on several processing and storage units so that their joint use makes it possible to execute the protected software (2p).

30 - Distribution assembly (2pd) of protected software (2p), characterized in that it comprises:

• a first distribution part (2pds) containing the first object part (2pos) and intended to operate in a data processing system (3),

• and a second distribution part (2pdu) in the form:

- a blank unit (60),

- or a pre-personalized unit (66) according to claim 27, capable, after loading of personalization information, of transforming into a unit (6),

- or a unit (6) according to claim 28.

31 - Distribution assembly (2pd) of protected software (2p) according to claim 30, characterized in that the first distribution part (2pds) is in the form of a physical distribution means, CDROM for example, or in the form of files distributed across a network.

32 - Distribution set (2pd) of protected software (2p) according to the claim 30, characterized in that the second distribution part (2pdu), in the form of blank units (60), pre-personalized units (66) or units (6), comprises at least one smart card (7).

33 - Processing and storage unit characterized in that it contains the part of the second object part (2pou) necessary to transform a pre-personalized unit (66) according to claim 27 into a unit (6) according to claim 28 .

34 - Set of processing and storage units characterized in that the processing and storage units used jointly contain the part of the second object part (2pou) necessary to transform a pre-personalized unit (66) according to claim 27 into a unit (6) according to claim 28.