# US 10,311,217 B2 · Application piracy prevention with secure enclave protection of automatically modularized functions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,311,217 B2 - Document ID: US10311217B2 - Status: Granted - Kind: B2 - Application number: 15/374,948 - Filed: 2016-12-09 - Published: 2018-06-14 - Granted: 2019-06-04 - Earliest claimed: 2016-12-09 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Olaf Alexander Miller; Ling Tony Chen; Hakki Tunc Bostanci - Web page: https://patentgrep.com/patent/US10311217B2 ## CPC - G06F 21/12: Protecting executable software - G06F 8/51: Source to source - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/629: {to features or functions of an application} - G06F 8/40: Transformation of program code - G06F 2221/2149: Restricted operating environment - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A compiler automatically modularizes identified functions or portions of source code, thereby enabling developers to merely identify portions of source code that represent functionality that is to be protected, including going back and identifying such portions after the programming of the software application program has been substantially completed. Such identification can be inline, within the source code itself, or specified in an external file. During compilation of such source code, a compiler recognizes such identifications and appropriately compiles the source code such that the relevant portions of the software application program are appropriately modularized, including inserting functionality to provide for marshaling of parameters between functionality that will be protected and functionality that will be executed outside of the enclave, as well as appropriately modifying pointers or addresses to be position independent based upon where the functionality making reference to such pointers or addresses will be executed. ## Claims ### Claim 1 A computing device comprising: one or more processing units; and one or more computer-readable storage media comprising computer-executable instructions which, when executed by the one or more processing units, cause the computing device to: obtain annotated source code, portions of which are identified as protected functionality; modify a call to a protected function, defined by the identified portions, to marshal parameters provided as part of the call to the protected function prior to the modification; modify one or more references to an instruction pointer or a program counter within the identified portions to be position-independent; compile the annotated source code such that the identified portions are compiled into one or more protected modules; and identify the one or more protected modules as being executable only within an enclave. ### Claim 2 (depends on 1) The computing device of claim 1, wherein the identified portions are identified by keywords inline in the annotated source code. ### Claim 3 (depends on 1) The computing device of claim 1, wherein the identified portions are identified in a file separate from files comprising the source code. ### Claim 4 (depends on 1) The computing device of claim 1, wherein the computer-executable instructions causing the modification of the call comprise further computer-executable instructions, which, when executed by the one or more processing units, cause the computing device to: modify the call to pass only a single parameter that is associated with an array, wherein elements of the array are, individually, associated with one of the parameters provided as part of the call to the protected function. ### Claim 5 (depends on 1) The computing device of claim 1, wherein the computer-executable instructions causing the modification of the call comprise further computer-executable instructions, which, when executed by the one or more processing units, cause the computing device to: modify the call to the protected function to marshal parameters comprising output of the protected function. ### Claim 6 (depends on 1) The computing device of claim 1, wherein the computer-executable instructions causing the modification of the call comprise further computer-executable instructions, which, when executed by the one or more processing units, cause the computing device to: replace the call to the protected function with a call to a gatekeeper function, the gatekeeper function then, in turn, calling the protected function. ### Claim 7 (depends on 1) The computing device of claim 1, wherein the protected function is associated with a determination of life points in a game comprised, in part, of the one or more protected modules. ### Claim 8 (depends on 1) The computing device of claim 1, wherein the computer-readable media comprise further computer-executable instructions which, when executed by the one or more processing units, cause the computing device to: insert, into the annotated source code, a call to a decryption function to decrypt at least some of the one or more protected modules within the enclave. ### Claim 9 (depends on 1) The computing device of claim 1, wherein the computer-readable media comprise further computer-executable instructions which, when executed by the one or more processing units, cause the computing device to: insert, into the annotated source code, a verification of computer-executable instructions performing the protected function prior to proceeding with the call to the protected function. ### Claim 10 (depends on 1) The computing device of claim 1, wherein the computer-readable media comprise further computer-executable instructions which, when executed by the one or more processing units, cause the computing device to: encrypt the one or more protected modules based on the metadata associated therewith; and associate cryptographic information useable to decrypt the encrypted one or more protected modules with a license to a software application program comprising the encrypted one or more protected modules. ### Claim 11 A system comprising: a developer computing device comprising: one or more developer computing device processing units; and one or more developer computing device computer-readable storage media comprising computer-executable instructions which, when executed by the one or more developer computing device processing units, cause the developer computing device to: obtain annotated source code, portions of which are identified as protected functionality; modify a call to a protected function, defined by the identified portions, to marshal parameters provided as part of the call to the protected function prior to the modification; modify one or more references to an instruction pointer or a program counter within the identified portions to be position-independent; compile the annotated source code such that the identified portions are compiled into one or more protected modules; and identify the one or more protected modules as being executable only within an enclave; and a product store computing device comprising: one or more product store computing device processing units; and one or more or more product store computing device computer-readable storage media comprising computer-executable instructions which, when executed by the one or more product store computing device processing units, cause the product store computing device to: encrypt the one or more protected modules based on the identification of the one or more protected modules as being executable only within an enclave. ### Claim 12 (depends on 11) The system of claim 11, wherein the one or more or more developer computing device computer-readable media comprise further computer-executable instructions which, when executed by the one or more developer computing device processing units, cause the developer computing device to: compile the annotated source code such that portions other than the identified portions are compiled into one or more unprotected modules; and wherein further the one or more or more product store computing device computer-readable media comprise further computer-executable instructions which, when executed by the one or more product store computing device processing units, cause the product store computing device to: construct a software application program package from the encrypted one or more protected modules and the one or more unprotected modules. ### Claim 13 (depends on 11) The system of claim 11, wherein the one or more or more product store computing device computer-readable media comprise further computer-executable instructions which, when executed by the one or more product store computing device processing units, cause the product store computing device to: associate cryptographic information useable to decrypt the encrypted one or more protected modules with a license to a software application program comprising the encrypted one or more protected modules. ### Claim 14 (depends on 11) The system of claim 11, further comprising a client computing device comprising: one or more client computing device processing units; and one or more or more client computing device computer-readable media comprising computer-executable instructions which, when executed by the one or more client computing device processing units, cause the client computing device to: decrypt, within a first enclave, a first cryptographic information; provide the first cryptographic information from the first enclave to a second enclave through a secure channel established between the first and second enclaves; and execute a software application program by decrypting the encrypted one or more protected modules, within the second enclave, utilizing the first cryptographic information, and then executing the one or more protected modules from the second enclave. ### Claim 15 (depends on 14) The system of claim 14, wherein the one or more client computing device computer-readable media comprise further computer-executable instructions which, when executed by the one or more client computing device processing units, cause the client computing device to: obtain identifiers from two or more components of the client computing device; and receive, based on the obtained identifiers, a second cryptographic information; wherein the decrypting of the first cryptographic information is performed with the received second cryptographic information. ### Claim 16 (depends on 14) The system of claim 14, wherein the one or more client computing device computer-readable media have stored thereon the first cryptographic information in an encrypted form. ### Claim 17 A system comprising: a product store computing device comprising: one or more product store computing device processing units; and one or more or more product store computing device computer-readable storage media comprising computer-executable instructions which, when executed by the one or more product store computing device processing units, cause the product store computing device to: encrypt one or more protected modules of a software application program based on the metadata associated therewith; and a client computing device comprising: one or more client computing device processing units; and one or more or more client computing device computer-readable storage media comprising computer-executable instructions which, when executed by the one or more client computing device processing units, cause the client computing device to: decrypt, within a first enclave, a first key; provide the first key from the first enclave to a second enclave through a secure channel established between the first and second enclaves; and execute the software application program by decrypting, within the second enclave, the encrypted one or more protected modules with the first key, and then executing the decrypted one or more protected modules from the second enclave. ### Claim 18 (depends on 17) The system of claim 17, wherein the one or more client computing device computer-readable media comprise further computer-executable instructions which, when executed by the one or more client computing device processing units, cause the client computing device to: obtain identifiers from two or more components of the client computing device; and receive, based on the obtained identifiers, a second key; wherein the decrypting of the first key is performed with the received second key. ### Claim 19 (depends on 11) The system of claim 11, wherein the identified portions are identified in a file separate from files comprising the source code. ### Claim 20 (depends on 11) The system of claim 11, wherein the one or more or more product store computing device computer-readable media comprise further computer-executable instructions which, when executed by the one or more product store computing device processing units, cause the product store computing device to: insert, into the annotated source code, a verification of computer-executable instructions performing the protected function prior to proceeding with the call to the protected function.