Emulation-based software protection

A method of emulation-based page granularity code signing comprising the steps of:

• copying guest operating system instructions and associated hash message authentication codes and/or digital signatures of each guest operating instruction from an untrusted guest operating system memory into a trusted host operating system memory;
• recomputing the hash message authentication codes using a secret key in the trusted host operating system memory;
• maintaining the secret key in the trusted host operating system memory and inaccessible by the untrusted guest operating system instructions;
• translating each guest operating system instruction that has a valid hash message authentication code to a set of host operating system instructions;
• executing the decrypted guest operating system instructions in the trusted host operating system;
• and
• modifying the guest operating system memory and registers when the set of translated host operating instructions executes in the trusted host operating system, such that it appears as if the original guest operating system instructions had been executed in the untrusted guest operating system.

A non-transitory storage medium which embodies instructions executable by a computer for emulating an untrusted guest operating system on a trusted host operating system, comprising:

• a first segment including emulator code, wherein the emulator code copies encrypted guest operating system instructions from an untrusted guest operating system memory into a trusted host operating system memory;
• a second segment including decryption code for decrypting the encrypted guest operating system instructions in the trusted host operating system memory;
• a third segment including translating code for translating the decrypted guest operating system instructions to a set of instructions to be executed in the trusted host operating system;
• and
• a fourth segment including code for executing the decrypted and translated guest operating system instructions in the trusted host operating system and modifying the untrusted guest operating system memory and registers when those instructions are executed in the trusted host operating system, such that it appears as if the original encrypted guest operating system instructions had been executed in the untrusted guest operating system.

A method of emulating an untrusted guest operating system, comprising the steps of:

• copying guest operating system instructions and hash message authentication codes or digital signatures from an untrusted guest operating system memory into a trusted host operating system memory;
• recomputing each hash message authentication code or signature of the imported guest operating system instructions using a secret key that is stored in the trusted host operating system memory;
• translating or interpreting each guest operating instruction that has a valid hash message authentication code or digital signature into one or more host operating system instructions;
• executing each of the translated or interpreted guest operating system instructions in the trusted host operating system;
• and
• modifying the state of the untrusted guest operating system memory and registers such that it appears as if the original guest operating system instructions that were executed in the trusted host operating system memory have been executed on the untrusted guest operating system memory.

A computer system, comprising:

• a processor;
• a program storage device readable by the computer system, tangibly embodying a program of instructions executable by the computer system to emulate an untrusted guest operating system in a trusted host operating system, wherein the program of instructions includes the steps of
• copying encrypted guest operating system instructions from an untrusted guest operating system memory into a trusted host operating system memory;
• decrypting the guest operating system instructions in the trusted host operating system memory;
• maintaining the decrypted guest operating system instructions out-of-band of the untrusted guest operating system and inaccessible by the untrusted guest operating system;
• translating the decrypted guest operating system instructions to a set of host operating system instructions;
• executing the decrypted guest operating system instructions in the trusted host operating system;
• and
• modifying the guest operating system memory and registers when the set of translated host operating instructions executes in the trusted host operating system such that it appears as if the original guest operating instructions had been executed.

An apparatus for emulating an untrusted guest operating system in a trusted host operating system comprising:

• a processor;
• a storage device storing a program of instructions executable by the processor to emulate an untrusted guest operating system in a trusted host operating system, wherein the program of instructions includes the steps of
• copying encrypted guest operating system instructions from an untrusted guest operating system memory into a trusted host operating system memory;
• decrypting the guest operating system instructions in the trusted host operating system memory;
• maintaining the decrypted guest operating system instructions out-of-band of the untrusted guest operating system and inaccessible by the untrusted guest operating system;
• translating the decrypted guest operating system instructions to a set of host operating system instructions;
• executing the decrypted and translated guest operating system instructions in the trusted host operating system;
• and
• modifying the untrusted guest operating system memory and registers when the set of translated host operating instructions executes in the trusted host operating system such that it appears as if the original guest operating instructions had been executed in the untrusted guest operating system.