Note : Les descriptions sont présentées dans la langue officielle dans laquelle elles ont été soumises.
8~330
The inven-tion rela-tes to a process for the protection of
software stored in at least one command and/or data memory
against unauthorized copying, with the commands and/or data
fed to a microprocessor on inquiry and converted in respect of
code during this operation, at least part of the commands
and/or data withdrawn from the memory (memories), preferably
all of the commands, being replaced by or converted to new
commands and/or data which are then fed to the microprocessor
as new, valid commands and/or data, and to a device, in
particular for performing -the process mentioned above, for the
protection of software stored in at least one command and/or
data memory against unauthorized copying, with the commands
and/or data fed to the microprocessor on inquiry via a code
converter optionally hybridized or potted therewith for
further processing and at least part of the commands and/or
data withdrawn from the memory (memories), preferably all of ;
the commands, being replaced by predetermined new commands
and/or data or converted to these in the code converter which
are then fed to the microprocessor as new valid commands
and/or data.
IN THE DRAWINGS:
Figure 1 is a block diagram of a known microprocessor
system;
Figure 2 is a block diagram of a know system using a code
converter;
Figure 3 is a block diagram of a system in accordance with
the presen-t invention;
Figures 4 and 5 show a first circuit for changing the
coding;
Figures 6 shows a second circuit for changing the coding;
and
Figure 7 schematically shows a device for linking incoming
signals for changing the coding.
The microprocessor system according to Fig. 1 on principle
functions as follows:
By a signal on the reset line R, a mlcroprocessor MP is
placed in a defined starting state. It thereupon starts with
the routine of a program stored in a memory 4, 5 at a very
definite address determined by the manufacturer. A commercial
MP Z80, for instance, always starts at the address 0000. The
program is not contained in the memories 4,5 in plain
language, but instead in the form of figures of a certain
meaning, i.e~ a figure or sequence of figures is associated
with each command defined for the microprocessor. Which
commands are defined and what is the associated figure is the
same for all microprocessors of the same type and can be found
in the data sheet supplied by the manufacturer.
/
~ ,
. _ .
- 2a -
~L'~30 8 3C)
Programs can be stored in read-only memories 4 (ROM, PROM, EPROM,...)
and/or read-write memories 5 (RAM), while the microprocessor can store
data only in read-write memories 5. The input and output of data already
processed is effected via the input-output block 6.
The microprocessor thus appl1es the address 0000 to the address bus
AB. This address is directed to a certain byte in a certain memory module
which is transferred to the microprocessor via the data bus DB. In the
program example, this byte on address 0000 has the value 3E. (All
addresses and data or commands are represented here not in the decimal
but in the hexadecimal system; so, for instance, hexadecimal 3E corre-
sponds to the decimal figure 62.) For the MP Z80, the symbol 3E means
"LD A,. " (load register A with the byte stored under the immediately
following address). For the complete execution of the command, the
microprocessor has to~apply the address 0001 to the address bus AB and
load the byte transferred via ~he data bus into the register A. In our
example, this following byte has the value 10, i.e. the complete command
reads "LD A, 10" or "3E,10".
The execution of the first command is now completed and the second
command follows.
This command is unloaded from the next following address because
the microprocessor performs the program step by step, with the commands
to be executed consecut1vely stored in consecutive memories.
The microprocessor now applies the address 0002 to the address bus.
Via the data bus DB, it receives the byte 47 which means "LD B, A" for
the MP Z80 (load the content of register A into regisber B). After
execution of this command, the next address, 0003, is applied to the
address bus and the command,in our example 47, ("LD B~ A"~ is carried
out.
The execution of the program does not always have to take place
from consecutive memory units. Exceptions may essentially be reduced
to two:
-- 3 --
~L~ 8 0 8 3 0
The first exception are the socalled jumps (conditional, uncondi-
tional, subroutine call, subroutine return). It is possible that the
code C3 appears in the program, this means "JMP..." for the MP Z80
(continue routine at the position addressed by the following two
bytes, jump to address....) If, for instance, the code C3 12 34 is
stored in the memory, th~s means "JMP 3412" (the address half of the
lower value is transferred first, the address half of the higher value
last, this means "jump with the routine to address 3412").
The second exception are the socalled interrupts. Almost any micro-
processor has the possibility to have at least one program performed
via an interrupt. An interrupt is a hardware signal which causes the
microprocessor to immediately interrupt the execution of the instant
program and to execute an "interrupt routine" written by the micro-
processor user and stored in the program memory at an address deter-
mined by the manufaturer of the microprocessor; it is essential that
the microprocessor remember the position of interruption and continue
with the routine precisely there after termination of the interrupt
program. The significance of such a possibility resides in the fast
~ response to external events or synchronization with external events.
; ; The microprocessor with interrupt facility is comparable to a person
that works (program) and interrupts its work as soon as the telephone
rings, p~cks up the receiver, speaks,~.... finally puts down the receiver
again (end of the interrupt program) in order to continue work at the
position of interruption. A person without interrupt facility would have
to keep watching the telephone, which might have two results: either the
caller has to wait until the person checks the phone again or the person
has to check so many times that its work is essentially slowed down. In
the instant microprocessor Z80,one type of interrupt actuates a jump
to the memory unit 0066, the interrupt address (return) is stored in
the read-write memory (RAM) for the later return to the main program.
'' ` :
~80~330
At the end of the specification, two program examples for the
circuit shown in Fig. 1 are given; these do not represent meaningful
programs, but only the flow of data, con~ands and addresses.The second
program example could be in the memory instead of the first one and
differs from the first example only in one command (6F) (=l byte).
The circuit according to Fig. 1 is now explained. The microprocessor
and the memory modules are standard modules anyone can buy. The command
codes and their meanings are known and indicated in the data sheet of
the respective microprocessor. For this reason, the softwalne can be
copied by anyone, in particular if existing~apparatus are to be equipped
with new software: one buys a memory EPROM with new software and copies
it by means of a commercial progran~ing attachment into further EPROMS
which then merely have to be inserted into the other attachments.
The lo~ for the software manufacturer is cons;derable.
For this reason, it is desirable to encrypt the software in such a
manner that lt wlll no longer be operable on a standard microprocessor.
For this purpose, the command codes are encrypted prior to programming
:: :: .:
the EPROM, i.e. each command code is associated with a certain different
code. During the operation of the program, each code is decoded, the
code converter 2 required for this purpose is preferably hybridized with
the~m;croprocessor as it would otherwise by easy to analyze and copy
(Fig~. 2).
The software manufacturer sells~not only the memory with the program,
but in addition the microprocessor with the code converter 2.
The program flow is as follows, with the same program to be performed
as in the circuit according to Fig. 1.
After the reset via R, the microprocessor applies the address OOOO
to the address bus, an encrypted byte comes via the data bus, in the
present case byte 57, to the code converter 2. This converts the value
57 to 3E according to a certain algorithm. Byte 3E reaches the micro-
processor which interprets it as "LD A,..." as beFore and performs it.
~X~30830
For this purpose,` it applies the address 0001 to the address bus,
the byte lO is transferred and enters the microprocessor unchanged
(data are not encrypted in this particular case, as this increases the
effect of encrypting). Next the address 0002 is applied to the address
bus. Byte 3E reaches the code converter 2, is there converted to 47
and reaches the microprocessor. The next command is read by address
0003 in the same way, decoded and executed, and so forth.
Data destined for the read-write memory or for output bypass the
code converter 2 (data bus l) and are stored without encrypting.
The interrupt IR and the reset signal R function as in the circuit
according to Fig. 1.
The second program example flows like the first one (it could be
in the memory in its place), only one command is different, namely,
that address 0004 contains the byte 72 which is converted to 6F by the
code converter 2, which in turn the microprocessor understands to mean
"LD L, A" (load content of register A into register L).
The protection by methods of this type is the better the more difflcult
; ~ :
it~lS to analyze the type of coding and to copy the code converter.
The method mentioned above is comparatively simple to decode by
simple means, as any microprocessbr betrays itself by its hardware
reaction. So it is quite possible to analyze an encrypted MP Z80 within
30 hours. ~ ~
An improvement in protection is offered by the method according
to Fig. 3. In this circuit, the code converter 2 contains several code
converters according to Fig. 2 ( in the instant example three of them),
which are associated with different addresses.The code conversion is
thus not effected merely as a function of the byte found in a certain
position, but also b~ the address itself to which the access is directed.
In the program example, there are three code conversion "pages" or
"lists" associated with the variaus memory positions and addresses as
follows:
- 6 -
~2~30830
Page 1 0000 0004 0008 OOOC 0010 0014 0018 ....
Page 2 0001 0005 0009 OOOD 0011 0015 0019 ....
Page 3 0002 0006 OOOA OOOE 0012 0016 001~- ....
Page 2 0003 0007 OOOB OOOF 0013 0017 OOlB ....
If the addresses are checked consecutively, the associated pages
are thus 1,2,3,2, 1,2,3,2, 1,2,3,2, ......
Reset line R and interrupt line IR function as previously described.
After the reset, the microprocessor applies the address 0000 to the
address bus; from the program memory, the value 57 is transferred via
the data bus D8 and converted to 3E by the code converter 2 (ADR. 0000
~ page 1); the code converter is supplied via an additional bus
9 with corresponding information which is again correctly executed by
the MP Z80 as "LD A,...". For this purpose~ the address 0001 is again
applied to the address bus and the byte 10 reaches the microprocessor
unchanged. Now the address 0002 ~ > page 3) is applied to the address
bus, the byte 33 is read and converted to 47, and recognized by the
microprocessor as "LD B, A". Next follows the address 0003 ~>>page 2)
by which the byte 12 is read, this is converted to 47; the microprocessor
again receives the command "LD B,A". This means that byte 47 ;s converted
to 47 in address 0002, while byte 12 is converted to 47 in address 0003;
although a byte 12 appearing in address 0002 would have been subjected
to an entirely different conversion.
By this, it is achieved that the knowledge of the encoding of 47
("LD B, A") in address 0002 does not allow a conclusion as to the
encoding of 47 in address 0003, which makes it difficult for an un-
initiated person to "draw out" programs, change them or write them.
The disadvantage is that the expenditure for decoding increases
relatively little at strongly increasing expenditure for code conversion.
In this c;rcuit, as well, the data for RAM 4 and output 6 are bypassed
around the code converter by means of the data bus 1.
- 7 -
iL2 8 0 8 3~)
The two protection methods previously described under reference
to Fig. 2 and 3 are known.
Some new methods which are essentially more difficult to analyze
are to be described in the following. One feature common to all these
methods is that the function of code conversion does not or not exclusive-
ly depend on the address and/or the transferred byte, but also on one
or more previously executed commands. This means that it is not enough
to consider a byte isolatedly in a certain position, instead one must -
n order to be able to analyze a program or a microprocessor - know the
previous program flow; the code converter thus needs a sort of memory
for its proper functioning.
- According to the invention, a process of the type initially mentioned
comprises the improvement that the mode of code conversion of at least one
; requested command and/or data byte is changed as a function of at least
one~previously requested command~and/or data byte. In a device of the
type initially mentioned, it is provided according to the invention that
the code converting function of the code converter be changeable for at
least one command and/or data byte follow;ng at least one arrived
command and/or data byte converted in the mode provided for. According
to a~preferred embodiment of the invention, it is provided that the code
~: :
converter have an identification or conversion circuit for the incoming
commands and/or data by means of which the code converter is shiftable
on matching of at least one incoming command and/or data byte with at
least one predetermined command and/or data byte contained in the
ident1fication circuit for changing the code conversion of a predetermined
number of subsequently incoming commands and/or data, for instance
replacement of the commands and/or data by other command and/or data
bytes, for instance by changing the access to a d1fferent command and/or
data memory associated with the code converter or contained therein by
conversion, e.g. summing, of the incoming commands and/or data in a pre-
~L'~86~8 3 0
determined manner or the like or that a logical element for the directlinking of command and/or data bytes received with command and/or data
bytes coming in for changing the received command and/or data bytes, for
instance by bit- or bytewise addition, subtraction~ exclusive OR-
operation or the like is provided.
The invention is explained in the following under reference to
Fig. 4 to 7 of the drawing. Fig. 4, 5 show a first circuit for changing
the coding, Fig. 6 shows a second circuit for changing the coding and
Fig. 7 schematically shows a device for linking incoming signals for
changing their coding.
In the simplest case of such a code conversion with memory, a certain
byte reaching the microprocessor switches the code converter 2 for the
next following command. Th's is to be explained under reference to
Fig. 4 and the known program examples.
Example 1
Address Data 1 ~Data 2 UM Command
0000 57 3E LD A,
~: ~ O
:~ 000~1 10, 10 ` 10
0002 33 47 LD B,A
O
~ 0003 33 47 LD B,A
O
0004 33 47 LD B,A
O
0005 33 47 LD B, A
0006 33 47 LD B, A
o
0007 33 47 LD B, A
Il 11 11 11 .
ll ll ll ll ll
ll ll ll ll ll
~281~)830
. .
Example 2
Address Data 1 Data 2 UMCommand
ooO0 57 3E LD A,
o
0001 10 10 10
O
0002 33 47 LD B~ A
O
OOQ3 33 ~ 47 LD B, A
O
~; 0004 72 6F LD L, A *1*
57 47 LD B,A *2*
~: :
O
0006 33 47 LD B, A
O
33 47 LD B, A
O
11 11 "
" : " 11 " "
Example 1 of Fig. 4 operates like~Example 1 of Fig. 2, with the additi-
ional generation~of the~signal "UM", an ldentification circuit 7, which
has no significance in this case, however.
Example~2 is~;also identlcal in the beginning, although~the byte 6F
appears in program iine 0004, is ;dentified by the identification circu;t
;7 and thereupon switches a flip-flop or the like associated with the
: ~: : : :
identification circuit~7 or contained therein, whereby the line "UM"
also changes to 1. The code converter 2 consists of two code converters
according to Fig. 2~ meaning that it~has two sides, side 1 being
associated with UM = 0 and side 2 being associated with UM = 1. The sides
can be ~ormed, for instance, by different code lists.
Wh~le all bytes in Example 1 and most of the bytes in Example 2 are
converted according to page 1 (UM = 0), the byte 6F switches the code
- 10 -
'~ 8 0i33 0
converter 2 to page 2 in the line marked by *l* for the next following
command, marked by *2*. The byte 57 from address 0005 is thus converted
to 47 - corresponding to page 2 containing other codes, while it would
otherwise be converted to 3E; 33 would be converted to 47.
The code converter 2 thus converts the data 1 to data 2 as a
function of the previous history of the data (for instance preceding
command, preceding address or the like),which code conversion is effected
under the control of the identification circuit 7.
This dependence of the code conversion on the preceding history,
however, involves a problem: from the moment the code converter is
switched to page 2, no interrupt must be requested, because the first
command byte of the interrupt program has page 1 as a precondition and it
would be con~erted incorrestly by UM = l and thus also be executed
incorrectly. In order to prevent this, the interrupt has to be locked
by means of hardware after each commend changing the subsequent decoding.
This function is fulfilled by an interlock 3 arranged in the interrupt
line IR and preventlng passing of interrupt signals to the microprocessor
if UM = 1.
The circuit shown in Fig. 5 is a detailed circuit of the potted
module according to Fig. 4 (sketched in dotted lines).
Via the reset line R, the microprocessor is shifted to a defined
initlal state and at the same time~ the D-flip-flop 7' and thus also
the signal UM is set on 0, whereby the code converter page l is selected.
Via the address bus, the address 0000 gets out, the byte 57 arrives
at the data bus, it reaches the PROM as an address (comparable to a line
number in a reference table)7 the converted byte 3E appears at the out-
put of the PROM. From there, it is transferred to the microprocessor,
on the one hand, and to the input B of the comparator 7, which compares
the values present there to the input A, on the other hand, where the
predetermined~ e.g. listed, conversion commands are present, and, if
they match, sets its output "A = B" on l (initial value 0).
~L2 8 0 8 3 0
Next, the address 0001 is applied to the address bus, 10 appears on
the data bus and is "passed" unchanged to the PROM, which is made
possible by the fact that the microprocessor makes all commands and
data distinguishable by means of the signal on the line Ml (data:
Ml = 1, commands: Ml - O).
Now comes the address oOn2, the byte 33 is transferred and converted
b~ the PROM to 47 (LD B, A).
In the D-FF 7', the state of A = B, which then corresponds to the
signa~ UM, is stored at each command, controlled by Ml OR-operation with
RD (read).
When the byte 6F reaches the comparator 7, A = B 1 (on the basis of
the matching of incoming bytes and bytes present at input A) is taken
over into FF 7' and becomes UM = 1. The signal UM shifts the PROM
to another 'Ipage'' or "list" and interlocks the two (low active) interrupts
INT and NMI by means of the two OR-gates 10, 11.
Data which are to be transferred from the microprocessor to the memory
or to the periphery are bypassed by the (tri-state) buffer 1, which
corresponds to the line 1~ around the PROM. The direction of the data
flow is controlled by the microprocessor through the lines RD (read) and
WR (write) which release either PROM or buffer.
The circuit according to Flg. 6 functions similarly to Fig. 5.
The PAL, in the instant case a PAL20R4, a programmable logical circuit,
contains certain D-flip-flops, AND-gates and OR-gates whose circuîtry
can be selected and programmed once and is then determined by hardware.
In th;s example, it is programmed so that it fulfills the function of
the OR-gates 10, 11 of the comparator 7 and the D-FF 7'. For this pur-
pose, the lines Ml, RD, INT, NMI and the data bus are fed to the PAL.
Out come the lines INT', NMI' and a control line A7 for the PROM by
means of which PROM "pages" can be exchanged for the purpose of changing
the coding as a function of a certain preceding operation.
12 -
-- 1 2 8 0 8 3 0
The buffer 1 has the same function as shown in Fig. 5.
On the way to the microprocessor, four data lines are bypassed around
the PROM and the other four (DO to D3) are converted as a function of
the data lines D5 and D4, of the address line AO(similar to Fig. 3) and
the control ine A7 of the PAL, which also attends to it that data are
not changed, and naturally as a function of the data lines DO to D3
themselves.
It can thus be said that this converter has 16 "pages", namely, 24 pages,
as the data lines D5 and D4, the address line AO (address of a byte odd
or even) and the control line~A7 can each assume or express two states.
On identificat;on of a switch command - controlled by the PAL or by
commands stored in a memory - the "pages" are exchanged for the next
command - which results in different conversions. Reference is made to
the program examples and the changed coding belonging to Fig. 6 and the
command LD B, A of address 0005 following command LD L, A (6F).
A further possibility to make the preceding history essential for
code convers1on is shown by the circuit in Fig. 7. This shows only the
most essential details, the remaining circuit functions in analogy to
the preceding figures.
The command bytes reach an adder circuit 12 where they are added to
the value of the previously executed command which was stored ;n a buffer
13. The sum reaches the microprocessor where the respective command is
carr;ed out, and moreover the buffer 13. When the next byte comes ;n
via the data bus, the content of the buffer 13 is added in the adder
; and the result is the correct command byte.
Instead of an addition, it is possible to carry out subtractions,
multiplications, exclusive OR-operations and the like. The buffer is
provided with a flip-flop for each bit.
Following program branchings, e.g. jump commands, the buffer 13 has
to be set on 0, as the jump targets can be reached from various
positions by ~arious commands and a defined code conversion still has
- 13 -
~ 8 0 ~33 0
.
to take place there. This purpose is served by the comparator 14 which
identifies the program branching commands or iump commands, then sets
the buffer to O and releases the interrupt interlock.
It would be possible to make up any given number of examples; the
principle on which some of the examples are based is briefly outlined:
*** Inverting of the following data and/or command b~te after certain
bytes already arrived;
*** exclusive OR-operation of the command last carried out with the
new byte (like Fig. 7 with exclusive OR-operation instead of adding);
*** exchanging of certain data bus bits as a function of the sum of
the executed commands.
In addition to the code~cnnverting methods enumerated up to now,
th;e mehtods enumerated can also be used jointly in any given combination.
Common to all of them is the presence of at least one flip-flop whose
state depends on one or several command(s) previously executed and
which influences the code converter so that the type of code conversion
is a function of the preceding history.
Program Examples
Code for circuit according to
Address Command Fig. 1 Fig. 2 Fig. 3 Fig. 4 ~ 5 Fig. 6 Fig. 7
oOOO LD~A, 10 3E 10 57 10 57 10 57 10 37 10 3E 10
0002 LD B, A 47 33 33 33 41 09
0003 LD B, A 47 33 12 33 43 00
0004 LD B, A 47 33 98 33 4F 00
0005 LD B, A 47 33 12 33 43 OD
0006 LD B, A 47 33 33 33 41 00
0007 LD B, A 47 33 12 33 43 00
0008 LD B, A 47 33 98 33 4F 00
0009 " " " " " " "
OOOA " " "
ODOB " ~ 1, " " "
- 14 -
.. ..
- ~L~30 8 3 0
Code for circuit according to
Address Command Fig. 1 Fig. 2 Fig. 3 Fig. 4 + 5 Fig. 6 Fig. 7
0000 LD A, 10 3E 10 57 10 57 10 57 10 37 10 3E 10
0002 LD B, A 47 33 33 33 41 09
0003 LD B, A 47 33 12 33 41 00
0004 LD L, A 6F 72 86 72 62 00 *1*
0005 LD B, A 47 33 12 57 48 00 *2*
0006 LD B, A 47 33 33 33 41 00
0007 LD B, A 47 33 12 33 43 00
0008 LD B, A 47 33 98 33 4F 00
~oos ~ ,. .. ..
OOOA
OOOB " ~ " " "
It is understood that all claims and all the features of the subject
matter of the application described in the specification can be
combined in any given meaningful manner.
- 15 -
.
