WO2007034382A2

WO2007034382A2 - Furtive timed execution control

Info

Publication number: WO2007034382A2
Application number: PCT/IB2006/053276
Authority: WO
Inventors: Philippe Teuwen
Original assignee: Koninklijke Philips Electronics N.V.
Priority date: 2005-09-19
Filing date: 2006-09-14
Publication date: 2007-03-29
Also published as: WO2007034382A3

Abstract

The present invention relates to a method and a device (101) for enabling time-controlled operation of an object (104). A basic idea of the present invention is to control, in a deterministic manner, operation time of an object, e.g. an electronic appliance such as a mobile phone or a computer, a software program such as an echo-cancellation algorithm implemented in a mobile phone or a piece of executable code implemented in a computer, etc, resulting in a physical output signal (105). The manner in which the operation time is controlled should be obfuscated such that a malicious intruder cannot identify the control iunction that determines the operation time of the object by means of probing and/or reverse engineering the object to eliminate, remove or bypass the control function.

Description

Furtive timed execution control

The present invention relates to a method and a device for enabling time- controlled operation of an object.

Time-controlled operation is a feature that typically is required and implemented in various electronic devices that are delivered to potential customers for demonstration purposes. For example, a mobile phone delivered for demonstration purposes will be programmed in such a manner that it only will be up-and-running for a predetermined time period. When the period expires, the mobile phone will be turned off or in some other appropriate way be controlled to change its behavior such that it becomes useless. For instance, time-controlled execution may be used in a GSM speech enhancing demonstration program to be run on a mobile phone. When a predetermined time period of e.g. 30 seconds has expired, the program terminates. However, by employing reverse engineering, a hacker or malicious third party may disable or bypass the time-controlled operation such that usage of the electronic device can be continued.

In the prior art, time-controlled operation may e.g. be implemented by means of continuously checking a clock value in an electronic appliance to see if the predetermined clock value has expired or to use a counter that for instance counts the number of software instructions that have been processed. These methods of implementing time-controlled operation have the disadvantage that they are relatively easy to discover and manipulate by an intruder to eliminate or bypass the operation control and thus continue to use the electronic appliance.

An object of the present invention is to mitigate the previously mentioned problems in the prior art and to hamper elimination or bypassing of time-controlled operation in an electronic appliance. This object is attained by a method of enabling time-controlled operation of an object in accordance with claim 1 and a device for enabling time-controlled operation of an object in accordance with claim 12.

A basic idea of the present invention is to control, in a deterministic manner, operation time of an object, e.g. an electronic appliance such as a mobile phone or a computer, a software program such as an echo-cancellation algorithm implemented in a mobile phone or a piece of executable code implemented in a computer, etc, resulting in a physical output signal. The manner in which the operation time is controlled should be obiuscated such that a malicious intruder cannot identify the control function that determines the operation time of the object by means of probing and/or reverse engineering the object to eliminate, remove or bypass the control function.

A parameter which controls the physical output signal of the object is set to a start value and is subsequently updated regularly in a recursive manner. The parameter may for example define gain, degree of noise reduction, current intensity, etc. For instance, the object to be controlled is a mobile phone, and the parameter is gain. The resulting output signal may be an audio signal coming out of the mobile phone earpiece, which audio signal is dependent on the gain. By setting the start operating value of the parameter, the output signal is set to a nominal value. Thereafter, when a fixed time period has expired, a new parameter value is computed based on the previous value(s), and the output signal is controlled in accordance with the new parameter value. Typically, there is a clock signal present in the object to be controlled, and this clock signal is used to regularly compute a new parameter value based on the previous parameter value.

The computation of the parameter value is arranged such that the parameter value is maintained within a desired operating interval until a critical instant of time is reached, which occurs when the parameter value reaches and exceeds a threshold region. Hence, the parameter value is continually updated, but lies within a desired operating interval, i.e. it does not change noticeably, until the critical point of time is reached. When the threshold region is reached, the value of the parameter is still gradually changed, but only moderately. However, when the threshold region is exceeded, and the critical point in time is reached, the parameter value preferably changes in a rapid manner, which has as an effect that it controls the physical output of the object to substantially deviate from its nominal value. For instance, assuming that the parameter to be computed is gain, the gain is rapidly increased (or decreased or oscillated) when the parameter value exceeds the threshold region (which threshold region is determined by the update operation performed on the parameter and a tolerance region in which the parameter is allowed to fluctuate under normal operation), and a predetermined time period has hence expired. At this point, the volume of the audio signal coming out of the mobile phone earpiece increases (or decreases or oscillates) rapidly. Hence, it is possible to maintain the object in its "normal" operating mode, i.e. keep its output signal at the nominal value, for a predetermined time period. When the period has expired, the output signal deteriorates such that the object cannot be used. A skilled person realizes that there exist a great number of parameters that may be used to control the output signal, depending on what type of object is to be controlled. By arranging the threshold region of the parameter value (and the frequency of the update operation used to update the parameter) such that the time it takes to advance from the initial parameter value to a value in or after the threshold region corresponds to the predetermined time period for which the object is to be set in its operating mode, it is possible to deterministically control the execution time. It should be noted that the parameter typically is updated to follow an exponential function, so it does not exist one single parameter value where the output signal can be considered to rapidly change. Rather, with respect to the parameter value, there is a relatively short transitional period (that herein is referred to as the threshold region) where the output signal goes from its nominal value to a value that substantially differs from the nominal. Further, if the parameter has reached its saturation value, the parameter is preferably held saturated at that value (rather than being reset), such that the output signal is kept at a value which differs greatly from the nominal value.

The present invention is advantageous for a number of reasons. First, it is an easy and cost-effective way of implementing the time-controlled operation. Second, the time-controlled operation may be "hidden" in data processing blocks instead of being hidden in control processing blocks, as is typically done in prior art. Since the time-controlled operation of the present invention mimics other typical signal processing computation steps, the operation control is difficult to identify.

The invention may advantageously be implemented in embedded realizations of digital processing functions such as DSP algorithms, codecs, etc. Algorithms that are to be considered as valuable intellectual property blocks and that are delivered to third parties for demonstrations purposes in embedded devices may advantageously be protected by means of the present invention. Further, the invention is not limited to discrete domain implementation, but a skilled person realizes that it easily may be implemented in analog domain. Further features of, and advantages with, the present invention will become apparent when studying the appended claims and the following description. Those skilled in the art realize that different features of the present invention can be combined to create embodiments other than those described in the following.

A detailed description of exemplifying embodiments of the present invention will be given in the following with reference made to the accompanying drawings, in which:

Fig. 1 shows an exemplifying embodiment of the present invention using a microprocessor to control an object; and

Fig. 2 shows gain F as a function of time expressed in the number of update operations that has been performed.

Figure 1 shows an exemplifying embodiment of the present invention using a standard microprocessor 101, but an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a complex programmable logic device (CPLD) or some other appropriate hardware device may alternatively be used. The microprocessor 101 is clocked with an appropriate clock signal 102 to perform updates at regular intervals and enable setting of a predetermined time period during which an object 104 should be operated to produce an output signal 105 having an appropriate nominal value. The clock signal 102 determines output sampling rate, and is typically not the same clock signal as a master clock signal driving the microprocessor. A parameter which controls the physical output signal 105 of the object 104 is set to a start value by using the microprocessor 101. Block 101 may alternatively be implemented by means of a software program which performs the computation of the parameter. The actual parameter value 103 controls the behavior of the physical output signal 105.

In an example, the parameter to be controlled is gain F, i.e. relation between input and output signal magnitude, of the object 104 to be controlled. The output signal is typically directly proportional to the gain.

The gain F may be computed as: «-10000

1000

F = I + - (1),

100

where n is time (expressed in update operations). Typically, n is the number of clock pulses 102 that has lapsed since a given start time. With this particular gain function, a first requirement on the gain F may be that for the first 10,000 clock pulses, the gain F should not exceed unit gain (i.e. a nominal value of 1 is chosen for the gain F) with more than 1%. As the parameter reaches a threshold region, which in this example starts at approximately 10,000 expired clock pulses, the value of the parameter gradually changes, see Figure 2. A second requirement on the gain F may be that the output signal is considered to have deteriorated to such an extent that the object cannot be used in a meaningful manner, when the nominal value of the gain (and hence the physical output signal 105) is increased by 50%, which happens when approximately 14,000 clock pulses has lapsed.

Now, if a counter (not shown) should be employed to feed the microprocessor with counter values to be used as time variable n in the function defined by (1), an attacker can fairly easy freeze the counter to maintain the output signal 105 at its nominal value. Hence, even though the predetermined time period has expired, the output signal maintains its nominal value. Usage of counters for enabling time-controlled operation of objects is common in the prior art, but such usage and continuous computation of control parameters based on each counter value is a major security risk with respect to manipulation of the time- controlled operation of the object, since the counter may be identified and stopped by an attacker.

Advantageously, the present invention provides an algorithm for computing the parameter value 103, which algorithm is recursive rather than using - which is typically done in the prior art - direct computation.

For a function y(ή) =f(x(n)), y at time n is a result of application of function/ to x at time n, i.e. a direct approach is employed. Equation (1) is a result of such an approach. For a function implemented in the discrete domain, which function is calculated is y(n+l) = g(y(n)), y at time n+1 will be computed based ony at time n, i.e. a recursive approach is employed. Hence, when using the recursive approach, there is no need to store x(n) = n, which must be done if a counter is employed as described in the above. In case a counter is used, x(n) = n is the actual counter value that must be stored. Instead, the previous value, y(n), of the parameter is stored. With reference made to (1), the parameter (which is exemplified as gain F) is calculated as:

«-10000

1000

F(n) = \ + -

100

and consequently:

0+I)-IOOOO , 1000 1

F(n + l) = l + = l + (F(n) - l) * e ϊooo

100

As can be seen, F(n+1) can be expressed by means of F(n), and a continuously increased counter value n is not required. Computationally, F(n+1) is derived easily from F(n):

subtract 1, - multiply by a constant e^1/1000 ~ 1.001001 , and add l.

If the gain F(n) is expressed as the unit gain augmented by an error term ε(n), computation of the error term is made with one single operation, which is very difficult to spot by an attacker:

F(n+l)=\+ε(n+l), ε(n+l)=ε(n)*\.00\00\ (2).

Here, the error term is stored instead of the gain parameter value. Hence, equation (1) is only required to calculate a start value ε(0) = e^"10/100 ~ 0.0000004540. Then, ε(l) = 0.0000004540*1.001001 ~ 0.0000004545, ε(2) = 0.0000004545*1.001001 ~ 0.0000004549, ε(3) = 0.0000004549*1.001001 ~ 0.0000004554, and so on.

Thus, with reference made to Figure 2 (which shows gain F as a function of time expressed in clock pulses, given that an update operation is performed at every clock pulse) and Fig. 1, the error term is set to a start value of e^"10/100 and the object 104 is set in an operating mode. Further, the physical output signal 105 of the object 104 is controlled by the parameter to adopt a nominal value. At the next clock pulse 102, the value 103 of the parameter is fed back to the microprocessor 101 and a new value 103 of the parameter is computed based on the previous parameter value that was fed back, in accordance with (2). As can be seen in Figure 2, the parameter value is maintained within a desired operating interval (ε < 1%) until the parameter reaches a threshold region, which is reached when approximately 10,000-11,000 clock pulses have lapsed, wherein the value of the parameter is gradually changed. When approximately 11,000 clock pulses have elapsed, the parameter value starts changing rather rapidly. Consequently, when approximately 11,000 clock pulses have lapsed, the physical output 105 of the object 104 starts to deviate substantially - and rapidly - from its nominal value.

If the second requirement mentioned hereinabove is to be complied with, namely that the output signal 105 is considered to have deteriorated to such an extent that the object 104 no longer can be used in a meaningful manner when the nominal value of the gain F is increased by 50% (i.e. ε > 50%), the predetermined time period during which the object 104 is considered to be maintained in its normal operating mode is calculated as:

13,913 (number of lapsed clock pulses) x 1 /clock frequency.

Note that the value 13,913 is obtained when the direct approach equation (1) is used setting F(n) = 1.5. Simulations show that a value which is very close to that is obtained when using the recursive approach equation (2). Hence, if the output sampling rate is IkHz, the object 104 will operate correctly the first 10 seconds with ε kept under 1%, then the degradation will increase exponentially to go beyond 50% after (approximately) 14s. By properly tuning the terms of F one can choose the desired operational time, given distortion constraints of the system. Also note that in this particular example, an update operation is performed at every clock pulse. The skilled person realizes that the update operation may be performed at every second pulse, every fifth pulse, every tenth pulse, etc.

When using a clock signal in conjunction with a recursive algorithm instead of a counter to operate to object 104, the time-controlled operation cannot easily be manipulated. This clock signal cannot be frozen, as it typically represents the master sampling rate clock for the object and electronics included therein. If the master clock is stopped, the object will simply stop providing output samples. The time-controlled operation may for example be implemented in an electronic appliance such as a mobile phone to control a speech enhancing algorithm. Initialization of the algorithm may be undertaken at power on of the mobile phone, wherein the start value of the parameter is set and the algorithm is started. The value of the parameter is steadily increased by means of the clock signal. At the same time, one or more operations defined by algorithm is performed. When the parameter reaches the threshold region, the algorithm controls the physical output signal (i.e. speech) such that the quality of the speech gradually (and rapidly) deteriorates.

It should be noted that a number of objects in the form of software programs or electronic appliances may be controlled with the same parameter, and the predetermined time period may be different for different objects by choosing different threshold regions.

In the detailed example of the invention given hereinabove, an increase of the parameter value is described by implementing a simple unstable feedback system controlling the parameter. The corresponding discrete transfer function representation of (1) is expressed as:

K

H(z) = (3).

\ - e^aTz^~l

Equation (3) is unstable for a > 0. However, a decrease of the parameter value or even an oscillating parameter value is envisaged. A more complex feed back system may be implemented, as long as it is unstable (i.e. by definition becoming unbound after a certain period of time) and this instability can be manifested by an increase/decrease or oscillation of the output signal.

If the invention is to be used in the analog domain, this can be implemented by employing the corresponding analog feedback system. The continuous-domain representation of (3) is expressed as:

H(s) = ^K s - a

which is unstable for a > 0, while

is a conventional proportional- integral-derivative (PID) transfer function, which becomes unstable and begins oscillating if K (i.e. the gain) is too great. When oscillating, at least two exemplifying scenarios may be envisaged: rapid oscillations that render the output unusable, or slow oscillations that enable usage of an object for a long time but with periodical degradations. A user is informed of these degradations and accepts them as part of a demo. However, these periodical degradations render the object unsuitable for commercial purposes. Even though the invention has been described with reference to specific exemplifying embodiments thereof, many different alterations, modifications and the like will become apparent for those skilled in the art. The described embodiments are therefore not intended to limit the scope of the invention, as defined by the appended claims.

Claims

CLAIMS:

1. A method of enabling time-controlled operation of an object (104) resulting in a physical output signal (105), which method comprises the steps of: setting a parameter (103) to a start value, which parameter controls the physical output signal of the object, and setting the object in an operating mode, wherein the parameter start value results in the output signal being set to a nominal value; and regularly computing a new value of the parameter based on a previous parameter value, the computation being arranged such that the parameter value is maintained within a desired operating interval until the parameter value reaches a threshold region, wherein the value of the parameter is gradually changed, thereby controlling the physical output of the object to substantially deviate from its nominal value.

2. The method according to claim 1, wherein the object (104) to be controlled is an electronic appliance.

3. The method according to claim 1, wherein the object to be controlled is a software program.

4. The method according to claim 1, wherein the step of setting the parameter (103) to a start value is triggered by an object event.

5. The method according claim 4, wherein the object event comprises start-up of the object (104).

6. The method according to claim 1, wherein the parameter is an output (103) of an unstable feedback system (101) computed by using an exponential iunction in which with the number of computations of a new parameter value is an exponent.

7. The method according to claim 1, wherein the physical output (105) is controlled to deviate from its nominal value by increasing its value.

8. The method according to claim 1, wherein the physical output (105) is controlled to deviate from its nominal value by decreasing its value.

9. The method according to claim 1, wherein the physical output (105) is controlled to deviate from its nominal value by oscillating the output signal.

10. The method according to claim 1, wherein the step of regularly computing a new value of the parameter (103) is performed continuously in case the method is implemented in an analog domain.

11. The method according to claim 1 , wherein the step of regularly computing a new value of the parameter (103) is performed at regular intervals in case the method is implemented in a digital domain.

12. A device ( 101 ) for enabling time-controlled operation of an obj ect ( 104) resulting in a physical output signal (105), which device is arranged to set a parameter (103) to a start value, which parameter controls the physical output signal of the object, and set the object in an operating mode, wherein the parameter start value results in the output signal being set to a nominal value, and which device further is arranged to regularly compute a new value of the parameter based on a previous parameter value, the computation being arranged such that the parameter value is maintained within a desired operating interval until it reaches a threshold region, wherein the value of the parameter is gradually changed, thereby controlling the physical output of the object to substantially deviate from its nominal value.

13. A computer program product comprising computer-executable components for causing a device (101) to perform the steps recited in any one of claims 1-11 when the computer-executable components are run on a processing unit included in the device.