Systems and methods for secure transaction management and electronic rights protection

A secure processing unit comprising a CPU microprocessor or microcontroller and components designed to perform security-related functions, said components including:

• a secure, tamper-resistant barrier operating to render unauthorized interference with or access to the contents or operations of the secure processing unit more difficult;
• a clock;
• an encryption/decryption engine including
• first encryption/decryption circuitry which encrypts and decrypts information using a first encryption algorithm;
• second encryption/decryption circuitry which encrypts and decrypts information using a second encryption algorithm different from said first encryption algorithm;
• said second encryption algorithm imparting a higher degree of cryptographic security to encrypted information than said first encryption algorithm;
• a random number generator;
• secure memory;
• and
• means for creation of one or more secure objects said secure objects comprising at least one control information and content governed by said at least one control information.

A secure processing unit comprising a CPU, microprocessor or microcontroller and components designed to perform security-related functions, said components including:

• a secure, tamper-resistant barrier operating to render unauthorized interference with or access to the contents or operations of the secure processing unit more difficult;
• a clock;
• an encryption/decryption engine;
• a random number generator;
• secure memory;
• said secure memory further comprising:
• circuitry protecting the contents of said memory from unauthorized access or alteration;
• and
• random access memory including volatile random access memory and non-volatile random access memory;
• said non-volatile random access memory storing one or more cryptographic keys;
• budget information and;
• and information loaded into such memory during an initialization process involving communication with a VDE administrator
• means for creation of one or more secure obiects, said secure objects comprising at least one control information and content governed by said at least one control information.

A secure processing unit comprising a CPU, microprocessor or microcontroller and components designed to perform security-related functions, said components including:

• a secure, tamper-resistant barrier operating to render unauthorized interference with or access to the contents or operations of the secure processing unit more difficult;
• a clock;
• an encryption/decryption engine;
• a random number generator;
• secure memory including
• circuitry protecting the contents of said memory from unauthorized access or alteration,
• read only memory storing an RPC services table, said RPC services table comprising information used for routing requests for services;
• means for creation of one or more secure objects, said secure objects comprising at least one control information and content governed by said at least one control information.

A method of operating a secure processing unit comprising a real time clock, said method including the following steps:

• initializing said real time clock through the following steps:
• receiving time synchronization signals from an external source, said time synchronization signals being based on Greenwich Mean Time;
• determining whether said external source is secure;
• using said time synchronization signals for said initialization if said external source is determined to be secure;
• comparing the time recorded in said real time clock with external time synchronization signals on a regular basis;
• if said time recorded in said real time clock is determined to be out of synchronization with said external time synchronization signals,
• determining the extent of the difference between said time recorded in said real time clock and said external time synchronization signals;
• and
• setting an indicator if said time difference exceeds a specified threshold.

A method of operating a secure processing unit comprising the steps of:

• receiving an encrypted transmission from an electronic appliance;
• using an encryption/decryption engine to determine the type of encryption used for such transmission;
• determining that said transmission was encrypted using public key encryption;
• using public key decryption techniques to decrypt said transmission;
• obtaining a symmetric key from said decrypted transmission;
• using said symmetric key to encrypt a transmission to said electronic appliance;
• and
• using said symmetric key to decrypt at least one additional transmission from said electronic appliance
• said at least one additional transmission comprising a secure object including at least one control information and controlled content;
• and
• gaining access to said controlled content by complying with at least a portion of said at least one control information.

A secure processing unit comprising a CPU, microprocessor or microcontroller and components designed to perform security-related functions, said components including:

• a secure, tamper-resistant barrier operating to render unauthorized interference with or access to the contents or operations of the secure processing unit more difficult;
• a clock;
• an encryption/decryption engine;
• a random number generator;
• secure memory;
• means for the creation of one or more secure objects, said secure objects comprising control information and at least one file governed by said control information;
• and
• a secure mode interface switch operatively connected to place the secure processing unit into one of at least two distinct security-related states;
• a first of said security-related states being a higher-security state;
• and
• a second of said security-related states being a lower-security state.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit
• mass storage operatively connected to said central processing unit and said main memory;
• said main memory storing tamper resistant software designed to be loaded into said main memory and executed by said central processing unit said tamper resistant software comprising:
• programming which uses at least one confounding algorithm to create critical values required for correct operation of at least certain functions of said host processing environment
• at least one of said confounding algorithms constitutes the MD5 algorithm;
• whereby, said critical values are not stored in said mass storage and are therefore resistant to discovery.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit
• mass storage operatively connected to said central processing unit and said main memory;
• said main memory storing tamper resistant software designed to be loaded into said main memory and executed by said central processing unit, said tamper resistant software comprising:
• programming which uses a multiplicity of confounding algorithms to create critical values required for correct operation of at least certain functions of said host processing environment each of said multiplicity of differing algorithms using at least one different variable, but said differing algorithms being otherwise identical;
• at least one of said critical values consisting of a multiplicity of fields,
• said prooramming including critical value creation programming which
• generates a different value for each field of said multiplicity of fields,
• said generation using a different one of said multiplicity of confounding algorithms to generate said value for each field of said multiplicity of fields, and
• combines said fields to create said critical value.
• a clock, and
• programming which uses values from said clock to compare the duration of execution of one or more of said confounding algorithms to an expected value or range;
• said programming setting an indication depending on the results of said comparison;
• and
• programming which checks said indication and undertakes one or more actions in the event that said indication indicates that said duration of execution did not match said expected value or fall within said expected range;
• whereby, said critical values are not stored in said mass storage and are therefore resistant to discovery.

A virtual distribution environment comprising

• a host processing environment comprising
• an operating system.
• a central processing unit;
• main memory operatively connected to said central processing unit
• mass storage operatively connected to said central processing unit and said main memory;
• said main memory storing tamper resistant software designed to be loaded into said main memory and executed by said central processing unit, said tamper resistant software comprising:
• programming which uses at least one confounding algorithm to create critical values required for correct operation of at least certain functions of said host processing environment
• one or more storage locations including one or more memory locations allocated by an operating system to a boot record file but not used by such file, said memory locations being located after the end of said file but before the end of the memory sector allocated by said operating system to said file, said one or more storagc locations storing
• variables used as inputs to said confounding algorithm and/or
• one or more cryptographic keys;
• whereby, said critical values arc not stored in said mass storage and are therefore resistant to discovery.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory said mass storage comprising
• a secure storage area storing information at least some of which is encrypted, said information including one or more applications programs, each of said applications programs comprising one or more applications modules, and at least two encrypted applications modules, one of said encrypted applications modules having been encrypted using a first encryption key and a second of said encrypted applications modules having been encrypted using a second encryption key different from said first encryption key, and a non-secure storage area storing information;
• one or more storage locations including one or more memory locations allocated by an operating system to a boot record file, but not used by such file, said memory locations being located after the end of said file but before the end of the memory sector allocated by said operating system to said file,
• said one or more storage locations storing one or more cryptographic keys;
• one or more storage locations storing at least one of said encryption keys.
• programming which controls said host processing environment so as to load said applications modules from said secure storage area into said main memory, said programming further comprising,
• programming which decrypts said applications modules during said loading process, and
• programming which removes at least certain of said application modules from said main memory as soon as execution of each said application module has at least temporarily completed, even if the area of said main memory occupied by said application module is not yet required for other information,
• whereby the duration of residency of at least certain applications modules in an unencrypted state in said main memory is limited so as to render analysis of said applications modules more difficult.

A method for protecting one or more programs from analysis or alteration, said method operating on a host processing environment comprising a central processing unit, a main memory and one or more mass storage devices, said method comprising the following steps:

• encrypting one or more modules of said one or more programs;
• storing at least one of said one or more encrypted modules in at least one of said one or more mass storage devices,
• decrypting at least one of said one or more modules;
• storing said decrypted module in said main memory;
• executing at least one instruction from said decrypted module on said CPU;
• determining whether the next instruction or instruction sequence to be executed by said CPU is contained within said decrypted module,
• deleting said decrypted module from said main memory if said next instruction or instruction sequence is not contained within said decrypted module,
• said deletion taking place without consideration of whether said next instruction or instruction sequence is currently resident in said main memory outside of said decrypted module;
• whereby, said decrypted module is removed from main memory at the earliest reasonable opportunity, thereby rendering analysis of said module more difficult.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory,
• a communications port,
• a clock, and
• trusted server time programming comprising programming which controls said communications port to contact a trusted server and programming which obtains a time value from said trusted server, and
• clock initialization programming which synchronizes said clock to said time value obtained from said trusted server,
• said clock initialization programming determining whether said time value specified by said clock is the same or within a specified range as the time value obtained from said trusted server, and
• if said determination results in an affirmative conclusion, said clock initialization programming setting an indication indicating that said clock has been synchronized with said time value obtained from said trusted server, and
• if said determination results in a negative conclusion, said clock initialization programming performing at least one of the following actions:
• setting said time value specified by said clock to be the same as or within a specified range of the time value obtained from said trusted server, or
• storing a time offset value indicating the difference between said time value specified by said clock and the time value obtained from said trusted server.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, a clock, and a clock initialization flag, said method comprising the following steps:

• specifying an acceptable time value range,
• using said communications port to contact a trusted server,
• obtaining a trusted time value from said trusted server,
• storing information relating to said trusted time value in said host processing environment,
• determining whether said time value on said clock is within said acceptable time value range of said trusted time value, and
• setting an indication if said time value on said clock is not within said acceptable time value range of said trusted time value;
• reading said indication,
• if said indication has been set,
• at least temporarily halting further processing.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, a clock, and a clock initialization flag, said method comprising the following steps:

• specifying an acceptable time value range,
• using said communications port to contact a trusted server,
• obtaining a trusted time value from said trusted server,
• storing information relating to said trusted time value in said host processing environment,
• determining whether said time value on said clock is within said acceptable time value range of said trusted time value, and
• setting an indication if said time value on said clock is not within said acceptable time value range of said trusted time value;
• reading said indication,
• if said indication has been set,
• at least temporarily disabling certain functions.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, a clock, and a clock initialization flag, said method comprising the following steps:

• specifying an acceptable time value range,
• using said communications port to contact a trusted server,
• obtaining a trusted time value from said trusted server,
• storing information relating to said trusted time value in said host processing environment,
• determining whether said time value on said clock is within said acceptable time value range of said trusted time value, and
• setting an indication if said time value on said clock is not within said acceptable time value range of said trusted time value;
• reading said indication,
• if said indication has been set,
• displaying a message to the user.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory,
• a clock,
• a storage location constituting one or more memory locations allocated by an operating system to a boot record file, but not used by such file, said memory locations being located after the end of said file but before the end of the memory sector allocated by said operating system to said file,
• execution timing integrity circuitry, said execution timing integrity circuitry operatively connected to said clock and to said storage location and further comprising,
• comparison circuitry comparing the duration of time taken for execution of a program routine with a time duration stored in said storage location,
• an indicator indicating whether said expected duration of time matches the actual duration;
• programming stored in said main memory, said programming including
• commands which cause said host pocessing environment to execute program sequences and
• commands which record the time taken for such execution in said storage location.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• executing a program module,
• calculating the duration of said execution, using said clock,
• storing said duration,
• executing said program module a second time,
• calculating the duration of said second execution,
• comparing the duration of said second execution to said stored duration,
• setting an indicator based on the result of said comparison,
• if said indicator indicates that said comparison determined that said duration of said second execution was different than or outside a specified range of said stored duration,
• at least temporarily halting further processing.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• executing a program module,
• calculating the duration of said execution, using said clock,
• storing said duration,
• executing said program module a second time,
• calculating the duration of said second execution,
• comparing the duration of said second execution to said stored duration,
• setting an indicator based on the result of said comparison,
• if said indicator indicates that said comparison determined that said duration of said second execution was different than or outside a specified range of said stored duration,
• at least temporarily disabling certain functions.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• executing a program module,
• calculating the duration of said execution, using said clock,
• storing said duration,
• executing said program module a second time,
• calculating the duration of said second execution,
• comparing the duration of said second execution to said stored duration,
• setting an indicator based on the result of said comparison,
• if said indicator indicates that said comparison determined that said duration of said second execution was different than or outside a specified range of said stored duration,
• displaying a message to the user.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• executing a program module,
• calculating the duration of said execution, using said clock,
• storing said duration,
• executing said program module a second time,
• calculating the duration of said second execution,
• comparing the duration of said second execution to said stored duration,
• setting an indicator based on the result of said comparison,
• if said indicator indicates that said comparison determined that said duration of said second execution was different than or outside a specified range of said stored duration,
• initiating communications with a trusted server.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• executing a program module at least once,
• calculating the duration of said execution, using said clock,
• storing a value reflecting said duration,
• said value constituting either the duration of a single said execution or a combination or averaging of multiple said executions;
• executing said program module a second time,
• calculating the duration of said second execution,
• comparing the duration of said second execution to said stored value,
• setting an indicator based on the result of said comparison,
• if said indicator indicates that said comparison determined that said duration of said second execution was different than or outside a specified range of said stored value,
• encrypting at least some information.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• executing a program module at least once,
• calculating the duration of said execution, using said clock,
• storing a value reflecting said duration,
• said value constituting either the duration of a single said execution or a combination or averaging of multiple said executions;
• executing said program module a second time,
• calculating the duration of said second execution,
• comparing the duration of said second execution to said stored value,
• setting an indicator based on the result of said comparison,
• if said indicator indicates that said comparison determined that said duration of said second execution was different than or outside a specified range of said stored value,
• deleting at least some information.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory,
• a communications port,
• a storage location storing one or more values indicating the number of designated operations which have occurred since initialization of said one or more values, said storage location operatively connected to said communications port,
• said storage location constituting one or more memory locations allocated by an operating system to a boot record file, but not used by such file, said memory locations being located after the end of said file but before the end of the memory sector allocated by said operating system to said file,
• updating circuitry operatively connected to increment said one or more values upon the occurrence of one of said designated operations,
• whereby, a remote device can access said one or more values through said communications port.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory,
• checksum calculation circuitry which calculates one or more checksums based on the value of certain contents of said main memory and/or said mass storage
• a storage location operatively connected to said checksum calculation circuitry and storing one or more checksums calculated by said checksum calculation circuitry,
• integrity verification circuitry operatively connected to said storage location, and to said checksum calculation circuitry said integrity verification circuitry including
• circuitry which causes said checksum calculation circuitry to calculate a new checksum,
• circuitry which compares said new checksum to one or more checksums stored in said storage location,
• indication circuitry which stores and/or communicates an indication based on the results of said comparison;
• and
• programming and/or circuitry which undertakes one or more actions if the state of said indication circuitry indicates that said checksum comparison resulted in a determination that said checksums were not the same;
• said one or more actions including at least temporarily halting further processing.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory,
• checksum calculation circuitry which calculates one or more checksums based on the value of certain contents of said main memory and/or said mass storage
• a storage location operatively connected to said checksum calculation circuitry and storing one or more checksums calculated by said checksum calculation circuitry,
• integrity verification circuitry operatively connected to said storage location, and to said checksum calculation circuitry, said integrity verification circuitry including
• circuitry which causes said checksum calculation circuitry to calculate a new checksum,
• circuitry which compares said new checksum to one or more checksums stored in said storage location,
• indication circuitry which stores and/or communicates an indication based on the results of said comparison, and
• programming and/or circuitry which undertakes one or more actions if the state of
• said indication circuitry indicates that said checksum comparison resulted in a
• determination that said checksums were not the same;
• said one or more actions including at least temporarily disabling certain functions.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory,
• checksum calculation circuitry which calculates one or more checksums based on the value of certain contents of said main memory and/or said mass storage
• a storage location operatively connected to said checksum calculation circuitry and storing one or more checksums calculated by said checksum calculation circuitry,
• integrity verification circuitry operatively connected to said storage location, and to said checksum calculation circuitry, said integrity verification circuitry including
• circuitry which causes said checksum calculation circuitry to calculate a new checksum,
• circuitry which compares said new checksum to one or more checksums stored in said storage location,
• indication circuitry which stores and/or communicates an indication based on the results of said comparison;
• and
• programming and/or circuitry which undertakes one or more actions if the state of said indication circuitry indicates that said checksum comparison resulted in a determination that said checksums were not the same;
• said one or more actions including displaying a message to the user.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory,
• checksum calculation circuitry which calculates one or more checksums based on the value of certain contents of said main memory and/or said mass storage
• a storage location operatively connected to said checksum calculation circuitry and storing one or more checksums calculated by said checksum calculation circuitry,
• integrity verification circuitry operatively connected to said storage location, and to said checksum calculation circuitry, said integrity verification circuitry including
• circuitry which causes said checksum calculation circuitry to calculate a new checksum,
• circuitry which compares said new checksum to one or more checksums stored in said storage location,
• indication circuitry which stores and/or communicates an indication based on the results of said comparison;
• and
• programming and/or circuitry which undertakes one or more actions if the state of said indication circuitry indicates that said checksum comparison resulted in a determination that said checksums were not the same;
• said one or more actions including deleting at least some information.

A virtual distribution environment comprising

• a host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory,
• checksum calculation circuitry which calculates one or more checksums based on the value of certain contents of said main memory and/or said mass storage
• a storage location operatively connected to said checksum calculation circuitry and storing one or more checksums calculated by said checksum calculation circuitry,
• said storage location further comprising one or more memory locations allocated by an operating system to a boot record file, but not used by such file, said memory locations being located after the end of said file but before the end of the memory sector allocated by said operating system to said file,
• integrity verification circuitry operatively connected to said storage location, and to said checksum calculation circuitry, said integrity verification circuitry including
• circuitry which causes said checksum calculation circuitry to calculate a new checksum,
• circuitry which compares said new checksum to one or more checksums stored in said storage location, and
• indication circuitry which stores and/or communicates an indication based on the results of said comparison.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• initializing a storage location to a known value,
• performing a specified operation,
• incrementing the value contained in said storage location for each performance of said specified operation,
• using said communications port to communicate the value contained in said storage location to an external trusted server,
• said external trusted server
• comparing the results of said contents with expected results, and
• setting an indication based on said comparison, and
• undertaking at least one action in response to the setting of said indication, said at least one action including
• sending a communication to said host processing environment,
• said communication causing said host processing environment to at least temporarily halt further processing.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• initializing a storage location to a known value,
• performing a specified operation,
• incrementing the value contained in said storage location for each performance of said specified operation,
• using said communications port to communicate the value contained in said storage location to an external trusted server,
• said external trusted server
• comparing the results of said contents with expected results,
• setting an indication based on said comparison, and
• undertaking at least one action in response to the setting of said indication, said at least one action including
• sending a communication to said host processing environment,
• said communication causing said host processing environment to at least temporarily disable certain functions.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• initializing a storage location to a known value,
• performing a specified operation,
• incrementing the value contained in said storage location in response to performance of said specified operation,
• using said communications port to communicate the value contained in said storage location to an external trusted server,
• said external trusted server
• comparing the results of said contents with expected results,
• setting an indication based on said comparison, and
• undertaking at least one action in response to the setting of said indication, said at least one action including
• sending a communication to said host processing environment,
• said communication causing said host processing environment to delete at least some information.

A virtual distribution environment comprising:

• a central processing unit;
• volatile main memory operatively connected to said central processing unit;
• non-volatile storage operatively connected to said central processing unit and said volatile main memory;
• and
• key loading circuitry operatively connected so as to transfer one or more cryptographic keys from said non-volatile storage to said volatile main memory;
• said key loading circuitry deleting each of said one or more cryptographic keys from said non-volatile memory once said cryptographic key has been transferred to said volatile main memory;
• said key loading circuitry further comprising circuitry restoring said one or more cryptographic keys to said non-volatile memory upon detection of a shut-down event.
• whereby, detection of said one or more cryptographic keys from said non-volatile memory may be rendered more difficult.

A method of providing security for a host processing environment comprising a central processing unit, a main memory, mass storage, a communications port, and a clock, said method comprising the following steps:

• copying a cryptographic key from said mass storage to said main memory,
• deleting said cryptographic key from said mass storage once said cryptographic key has been copied to main memory,
• using said cryptographic key to encrypt or decrypt information,
• copying said cryptographic key from said main memory to said mass storage, and
• deleting said cryptographic key from said main memory once said cryptographic key has been copied to said mass storage,
• whereby detection of said cryptographic key is rendered more difficult.

A virtual distribution environment comprising

• a first host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory;
• said mass storage storing tamper resistant software designed to be loaded into said main memory and executed by said central processing unit, said tamper resistant software comprising:
• a multiplicity of software identifier storage locations,
• a first of said software identifier storage locations containing an integrity value embedded in said tamper resistant software at least in part for the purpose of identifying said tamper resistant software;
• and
• a second of said software identifier storage locations containing a string of bits of the same length as said integrity value, said string of bits embedded in said tamper resistant software at least in part for the purpose of obscuring said integrity value.

A virtual distribution environment comprising

• a first host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory;
• said mass storage storing tamper resistant software designed to be loaded into said main memory and executed by said central processing unit, said tamper resistant software comprising:
• machine check programming which derives information from one or more aspects of said host processing environment,
• one or more storage locations storing said information said one or more storage locations including one or more memory locations allocated by an operating system to a boot record file, but not used by such file, said memory locations being located after the end of said file but before the end of the memory sector allocated by said operating system to said file, integrity programming which causes said machine check programming to derive said information,
• compares said information to information previously stored in said one or more storage locations, and
• generates an indication based on the result of said comparison.

A virtual distribution environment comprising

• a first host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory;
• said mass storage storing tamper resistant software designed to be loaded into said main memory and executed by said central processing unit, said tamper resistant software comprising:
• machine check programming which derives information from one or more aspects of said host processing environment,
• one or more storage locations storing said information;
• integrity programming which causes said machine check programming to derive said information, compares said information to information previously stored in said one or more storage locations, and
• generates an indication based on the result of said comparison;
• and
• programming which takes one or more actions based on the state of said indication;
• said one or more actions including at least temporarily halting further processing.

A virtual distribution environment comprising

• a first host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory;
• said mass storage storing tamper resistant software designed to be loaded into said main memory and executed by said central processing unit, said tamper resistant software comprising:
• machine check programming which derives information from one or more aspects of said host processing environment,
• one or more storage locations storing said information;
• integrity programming which
• causes said machine check programming to derive said information,
• compares said information to information previously stored in said one or more storage locations, and
• generates an indication based on the result of said comparison;
• and
• programming which takes one or more actions based on the state of said indication;
• said one or more actions including at least temporarily disabling certain functions.

A virtual distribution environment comprising

• a first host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• mass storage operatively connected to said central processing unit and said main memory;
• said mass storage storing tamper resistant software designed to be loaded into said main memory and executed by said central processing unit, said tamper resistant software comprising:
• machine check programming which derives information from one or more aspects of said host processing environment, one or more storage locations storing said information;
• integrity programming which causes said machine check progamming to derive said information compares said information to information previously stored in said one or more storage locations, and
• generates an indication based on the result of said comparison;
• and
• programming which takes one or more actions based on the state of said indication;
• said one or more actions including displaying a message to the user.

A virtual distribution environment comprising

• a first host processing environment comprising
• a central processing unit;
• main memory operatively connected to said central processing unit;
• a database,
• said database being at least in part secure,
• mass storage operatively connected to said central processing unit and said main memory;
• said mass storage storing tamper resistant software designed to be loaded into said main memory and executed by said central processing unit, said tamper resistant software comprising:
• database check programming which derives information from one or more aspects of the state of said database,
• one or more storage locations storing said information;
• and
• integrity programming which
• causes said database check programming to derive said information,
• compares said information to information previously stored in said one or more storage locations, and
• generates an indication based on the result of said comparison.

A method for protecting information from analysis or alteration, said method operating on a first host processing environment comprising a central processing unit, a main memory, one or more mass storage devices, and a secure database, said method comprising the following steps:

• deriving information from one or more aspects of said host processing environment on at least a first occasion,
• storing said information in a storage location,
• deriving said information from said one or more aspects of said host processing environment on at least a second occasion,
• comparing said information derived at least in part on said second occasion with said information stored in said storage location,
• if said comparison indicates that said information derived at least in part from said second occasion is different from said information stored in said storage location, setting an indicator,
• checking said indicator, and
• taking at least one action if said indicator is set said at least one action comprising halting processing.

A virtual distribution environment comprising:

• a first host processing environment, said first host processing environment comprising a registry containing one or more installation keys;
• a second host processing environment comprising:
• a central processing unit;
• main memory operatively connected to said central processing unit mass storage operatively connected to said central processing unit and said main memory;
• a communications port;
• and
• secure software, said secure software including:
• encrypted operational materials and installation materials, said installation materials including:
• encrypted installation materials, said encrypted installation materials including:
• programming which causes at least certain portions of said operational materials to be decrypted, and confounding algorithm programming which uses at least one confounding algorithm to create critical values required for correct operation of said operational materials on said second host processing environment;
• at least one of said confounding algorithms constituting the MD5 algorithm, and
• unencrypted installation materials, said unencrypted installation materials including:
• programming which causes the decryption of said encrypted installation materials,
• programming which uses said communications port to establish communication with said first host processing environment,
• programming which includes a secure key exchange protocol,
• programming which receives an installation key from said registry, and
• programming which uses said installation key to decrypt at least a portion of said encrypted installation materials;
• whereby, said installation materials are decrypted and installed and cause said operational materials to be decrypted and installed.

A virtual distribution environment comprising:

• a first host processing environment, said first host processing environment comprising a registry containing one or more installation keys;
• a second host processing environment comprising:
• a central processing unit;
• an operating system.
• main memory operatively connected to said central processing unit
• mass storage operatively connected to said central processing unit and said main memory;
• a communications port;
• and
• secure software, said secure software including:
• encrypted operational materials and installation materials said installation materials including:
• encrypted installation materials, said encrypted installation materials including:
• programming which causes at least certain portions of said operational materials to be decrypted, and confounding algorithm programming which uses at least one confounding algorithm to create critical values required for correct operation of said operational materials on said second host processing environment;
• at least one of said confounding algorithms constituting the MD5 algorithm, and
• unencrypted installation materials, said unencrypted installation materials including:
• programming which causes the decryption of said encrypted installation materials,
• programming which uses said communications port to establish communication with said first host processing environment,
• programming which includes a secure key exchange protocol,
• programming which receives an installation key from said registry, and
• programming which uses said installation key to decrypt at least a portion of said encrypted installation materials;
• and
• one or more storage locations including one or more memory locations allocated by an operating system to a boot record file, but not used by such file said memory locations being located after the end of said file but before the end of the memory sector allocated by said operating system to said file, said one or more storage locations storing variables used as inputs to said confounding algorithm, said one or more storage locations including a storage location on a writeable, non-volatile semiconductor memory device, which storage location is normally allocated for firmware;
• whereby, said installation materials are decrypted and installed and cause said operational materials to be decrypted and installed.

A virtual distribution environment comprising

• a first host processing environment said first host processing environment comprising a registry containing one or more installation keys;
• a second host processing environment comprising:
• a central processing unit;
• a clock,
• main memory operatively connected to said central processing unit mass storage operatively connected to said central processing unit and said main memory;
• a communications port;
• and
• secure software, said secure software including:
• encrypted operational materials and installation materials, said installation materials including:
• encrypted installation materials, said encrypted installation materials comprising.
• programming which causes at least certain portions of said operational materials to be decrypted, and trusted server time programming comprising programming which controls said communications port to contact a trusted server and programming which obtains a time value from said trusted server, and clock initialization programming which synchronizes said clock to said time value obtained from said trusted value, said clock initialization programming determining whether said time value specified by said clock is the same or within a specified range as the time value obtained from said trusted server, if said determination results in an affirmative conclusion, said clock initialization programming setting an indication indicating that said clock has been synchronized with said time value obtained from said trusted server, and if said determination results in a negative conclusion, said clock initialization programming performing at least one of the following actions:
• setting said time value specified by said clock to be the same as or within a specified range of the time value obtained from said trusted server, or storing a time offset value indicating the difference between said time value specified by said clock and the time value obtained from said trusted server;
• and
• unencrypted installation materials said unencrypted installation materials including:
• programming which causes the decryption of said encrypted installation materials
• programming which uses said communications port to establish communication with said first host processing environment,
• programming which includes a secure key exchange protocol,
• programming which receives an installation key from said registry, and
• programming which uses said installation key to decrypt at least a portion of said encrypted installation materials;
• whereby, said installation materials are decrypted and installed and cause said operational materials to be decrypted and installed.

A method for installing protected software on a host processing environment, said method comprising the following steps:

• generating installation programming comprising a stub portion and a non-stub portion;
• encrypting said non-stub portion of said installation programming,
• generating operational programming,
• encrypting said operational programming,
• communicating said installation programming and said operational programming to said host processing environment,
• said host processing environment executing programming contained in said stub portion of said installation programming,
• said programming contained in said stub portion of said installation programming causing said host processing environment to initiate communications with a remote trusted server,
• said remote trusted server providing a cryptographic key to said host processing environment,
• said host processing environment using said cryptographic key to decrypt said non-stub portion of said installation programming,
• said host processing environment executing programming contained in said non-stub portion of said installation programming,
• said programming contained in said non-stub portion of said installation programming causing said host processing environment to undertake one or more actions designed to render said operational programming more secure,
• following said one or more actions, said host processing environment installing said operational programming.

A virtual distribution environment comprising:

• an appliance comprising:
• a central processing unit,
• an appliance memory, said appliance memory containing decryption programming;
• an appliance communications port for communicating said decryption programming from said appliance memory to a memory of an associated printer;
• a printer comprising
• a printer communications port operationally connected to said appliance communications port,
• a microcontroller, and
• said printer memory containing decryption programming,
• said decryption program received from said appliance memory through said appliance communications port and said printer communications port;
• and
• said decryption programming being used for the decryption of files received from said appliance through said appliance communications port and said printer communications port.

A method of printing comprising the steps of:

• downloading a decryption program from a memory of an appliance to a memory of an attached printer,
• encrypting a file to be printed,
• downloading said encrypted file from said memory of said appliance to said memory of said attached printer,
• said attached printer using said decryption program to decrypt said file,
• said attached printer printing said file.

A method of printing comprising the steps of:

• downloading a fingerprinting program from a memory of an appliance to a memory of an attached printer, said fingerprinting program including a fingerprinting key,
• downloading at least two fonts from said memory of said appliance to said memory of said attached printer
• downloading a file to be printed from said memory of said appliance to said memory of said attached printer,
• said printer executing said fingerprinting program, said execution comprising the following steps:
• using said fingerprinting key to select among said fonts,
• applying at least two of said fonts to said file in accordance with said fingerprinting key, and
• printing said file using said fonts,
• whereby, said fonts constitute a fingerprint embedded in said printed file.

A method of secure printing comprising the following steps:

• generating a scrambled font set, said generating step comprising the following steps:
• downloading a standard font comprising a set of characters and command codes, said command codes related to specific characters,
• altering the relationship of characters to command codes in accordance with a specified formula,
• downloading said scrambled font set to a printer, information to be printed,
• downloading said print file to said printer,
• said printer using said scrambled font set to print a document based on said print file,
• whereby at least a portion of said document is printed in useable form on a printer containing said scrambled font set, but said portion is printed in a less useable or non-useable form on a printer not containing a scrambled font set but instead containing said standard font set.

A virtual distribution environment comprising:

• a first host processing environment comprising:
• an operating system.
• a central processing unit;
• one or more storage locations including one or more memory locations allocated by an operating system to a boot record file, but not used by such file, said memory locations being located after the end of said file but before the end of the memory sector allocated by said operating system to said file, said one or more storage locations storing cryptographic keys,
• said one or more storage locations including a storage location on a writeable, non-volatile semiconductor memory device, which storage location is normally allocated for firmware;
• main memory operatively connected to said central processing unit mass storage operatively connected to said central processing unit and said main memory;
• a communications port;
• and
• secure software, said secure software including:
• encrypted operational materials and installation materials, said installation materials including:
• encrypted installation materials, said encrypted installation materials including:
• programming which causes at least certain portions of said operational materials to be decrypted, and
• unencrypted installation materials, said unencrypted installation materials including:
• programming which causes the decryption of said encrypted installation materials, whereby, said installation materials are decrypted and installed and cause said operational materials to be decrypted and installed.