US 5,757,914 A · System and method for protecting use of dynamically linked executable modules

Abstract

A computer system has a program module verifier and at least first and second program modules. Each program module includes a digital signature and an executable procedure The first program module furthermore includes a procedure call to the second procedure module, a procedure call to the program module verifier that is logically positioned in the first program module so as to be executed prior to execution of the procedure call to the second program module, and instructions preventing execution of the procedure call to the second program module when the procedure call to the program module verifier results in a verification denial being returned by the program module verifier. The second program module includes an executable procedure to be performed in response to the procedure call by the first program module to the second program module, a procedure call to the program module verifier that is logically positioned in the second program module so as to be executed prior to completion of execution of the second program module's executable procedure, and instructions preventing completion of execution of that executable procedure when the program module verifier returns a verification denial with respect to the first program module. The program module verifier responds to procedure calls by verifying the authenticity of any specified program module and by returning a verification confirmation or denial. When the program module verifier fails to verify the authenticity of a program module, the calling program module throws an exception and aborts its execution.

Claims21

Dependent claims

A computer system comprising:

memory for storing programs and data;
a data processing unit for executing programs stored in the memory;
a program module verifier, stored in the memory and executable by the data processing unit, configured to respond to procedure calls to said program module verifier by verifying authenticity of any specified program module and by returning a verification confirmation or denial in response to each such procedure call;
a first program module, stored in the memory;
and
a second program module, stored in the memory;
said first program module including procedures executable by the data processing unit, the first program module's procedures including:
a procedure call to said second program module;
a procedure call to said program module verifier for verifying the second module's authenticity, wherein the procedure call to said program module verifier is logically positioned in said first program module so as to be executed prior to execution of said procedure call to said second program module;
and
instructions preventing execution of said procedure call to said second program module when said procedure call to said program module verifier results in a verification denial being returned by said program module verifier;
said second program module including procedures executable by the data processing unit, the second program module's procedures including:
an executable procedure to be performed in response to said procedure call to said second program module;
a procedure call to said program module verifier for verifying the first module's authenticity, wherein the procedure call to said program module verifier is logically positioned in said second program module so as to be executed prior to execution of said executable procedure;
and
instructions preventing execution of said executable procedure when said procedure call to said program module verifier results in a verification denial being returned by said program module verifier.

13 more elements

A computer system comprising:

memory for storing programs and data;
a data processing unit for executing programs stored in the memory;
(A) a program module verifier, stored in the memory and executable by the data processing unit, the program module verifier configured to respond to procedure calls to said program module verifier by verifying authenticity of any specified program module and by returning a verification confirmation or denial in response to each such procedure call;
(B) a first program module, stored in the memory, having a first procedure executable by the data processing unit;
and
(C) a second program module, stored in the memory;
said first program module including a procedure call to said second program module;
said second program module including:
(C1) a second procedure, executable by the data processing unit, to be performed in response to said procedure call to said second program module;
(C2) a procedure call to said program module verifier for verifying the first module's authenticity, wherein the procedure call to said program module verifier is logically positioned in said second program module so as to be executed prior to completion of execution of said second executable procedure;
and
(C3) instructions preventing completion of execution of said second executable procedure when said procedure call to said program module verifier results in a verification denial being returned by said program module verifier.

9 more elements

A computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism comprising:

(A) a program module verifier configured to respond to procedure calls to said program module verifier by verifying authenticity of any specified program module and by returning a verification confirmation or denial in response to each such procedure call;
(B) a first program module;
and
(C) a second program module;
said first program module including:
(B1) a procedure call to said second program module;
(B2) a procedure call to said program module verifier logically positioned in said first program module so as to be executed prior to execution of said procedure call to said second program module;
and
(B3) instructions preventing execution of said procedure call to said second program module when said procedure call to said program module verifier results in a verification denial being returned by said program module verifier;
said second program module including:
(C1) an executable procedure to be performed in response to said procedure call to said second program module;
(C2) a procedure call to said program module verifier for verifying the first module's authenticity, wherein the procedure call to said program module verifier is logically positioned in said second program module so as to be executed prior to completion of execution of said executable procedure;
and
(C3) instructions preventing completion of execution of said executable procedure when said procedure call to said program module verifier results in a verification denial being returned by said program module verifier.

11 more elements

A computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism comprising:

(A) a program module verifier configured to respond to procedure calls to said program module verifier by verifying authenticity of any specified program module and by returning a verification confirmation or denial in response to each such procedure call;
(B) a first program module having a first executable procedure;
and
(C) a second program module;
said first program module including a procedure call to said second program module;
said second program module including:
(C1) a second executable procedure to be performed in response to said procedure call to said second program module;
(C2) a procedure call to said program module verifier for verifying the first module's authenticity, wherein the procedure call to said program module verifier is logically positioned in said second program module so as to be executed prior to completion of execution of said second executable procedure;
and
(C3) instructions preventing completion of execution of said second executable procedure when said procedure call to said program module verifier results in a verification denial being returned by said program module verifier.

7 more elements

A method of linking program modules, comprising the steps of:

(A) storing a first program module and a second program module in a computer memory;
executing a procedure in the first program module, and while executing the procedure in the first program module, but prior to making a procedure call from the first program module to the second program module, verifying the second program module's authenticity;
(B) upon verifying the second program module's authenticity, making the procedure call from the first program module to the second program module;
(C) upon failing to verify the second program module's authenticity, preventing the procedure call from the first program module to the second program module;
(D) prior to completing execution of a procedure in the second program module, verifying the first program module's authenticity;
(E) upon verifying the first program module's authenticity, completing executing the procedure in the second program module to generate a result and returning the result to the first program module's procedure;
and
(F) upon failing to verify the first program module's authenticity, preventing completion of execution of the procedure in the second program module.

5 more elements

A method of linking program modules, comprising the steps of:

(A) storing a first program module and a second program module in a computer memory;
executing a procedure in the first program module, and while executing the procedure in the first program module making a procedure call from the first program module to the second program module;
(B) executing a procedure in the second program module, and prior to completing execution of the procedure in the second program module, verifying the first program module's authenticity;
(C) upon verifying the first program module's authenticity, completing execution of the procedure in the second program module to generate a result and returning the result to the first program module procedure;
and
(D) upon failing to verify the first program module's authenticity, preventing completion of execution of the procedure in the second program module.

3 more elements

Dependencies are inferred from the claim text.

System and method for protecting use of dynamically linked executable modules

Life of this patent

System and method for protecting use of dynamically linked executable modules

Life of this patent

Abstract

Claims21