WO2013083224A1 - Method and device for protecting a computer program against unauthorised use - Google Patents

Abstract

The invention relates to a method, to a device (20), and to a system (1) for protecting a computer program (2) against unauthorised use. The method comprises the steps of: storing (S1) a computer program (3), which is encrypted by an external device (10) by means of a key (12), in a computer program storage unit (23); storing (S2) a key (12) provided for decrypting the encrypted computer program (3) in a SRAM region (25) of a working storage unit (24); and decrypting (S3) the encrypted computer program (3) by means of the key (12), wherein the decrypted computer program (4) or decrypted computer program parts (4) are stored in a RAM region (26) of the working storage unit (24).

Description

 METHOD AND DEVICE FOR PROTECTING ONE

COMPUTERPROG RAMMS AGAINST THE UNMATCHED

USE

Description

The present invention relates to a method and apparatus for protecting a computer program against

unauthorized use. The method and the device can be used in particular in a control device for controlling a machine tool.

US 7,092,783 B2 discloses a method for programming and executing a control program of an industrial control. An executable control sequence of the control program is encrypted with a user or customization password. This means that the executable control sequence of

Control program itself is not encrypted.

EP 1 556 743 B2 discloses a method for avoiding erroneous machine control by

 Maschlnensteuerparameter a machine tool. Here, the Maschlnensteuerparameter be encrypted by means of a cipher. Subsequently, the Maschlnensteuerparameter be decoded and checked on the machine tool.

However, the methods used are the ones used

Computer program and / or parts thereof not encrypted. This means that the methods mentioned used the

Computer programs are not completely unauthorized Protection or use. For example, program parts can be viewed during the course of the computer program. This is a copy of the

Computer program or at least of program parts possible. As a result, the above methods can not keep secret of technological knowledge through encryption

to guarantee unrestricted. As a result, unauthorized use of OEM (Original Equipment Manufacturer) cycles (OEMs) can not be prevented. Because of this, there is sufficient protection in terms of

Investment costs not given.

It is therefore an object of the present invention to provide a method and a device for protecting a computer program against unauthorized use, with which the aforementioned problems can be solved. In particular, a method and a device for protecting a

Computer program are provided against unauthorized use, which in particular subroutines ago

unauthorized access and / or use.

This object is achieved by a method for protecting a

Computer program against unauthorized use after

Claim 1 solved.

The object is also achieved by a device for protecting a computer program against unauthorized use according to claim 8. The object is, moreover, solved by a system for protecting a computer program against unauthorized use according to claim 10.

 Advantageous further embodiments of the method and the device are specified in the dependent claims.

The described method and the described device as well as the system ensure that also at the end of the

Process no program content can be displayed on a display device, which give an indication of the content of the program. Only programmed notes and / or diagnostic messages are output.

With the described method and described

Device and the system can be ensured that only an original equipment manufacturer (OEM) and / or authorized by him and / or institutions can decrypt the encrypted contents of the computer program. Thus, an (unwanted) disclosure to third parties on the part of the manufacturer or operator of a machine tool on which the method and the device can be applied excluded.

Other possible implementations of the invention also include combinations of previously or not explicitly mentioned combinations

The following described with respect to the embodiments features or embodiments. The skilled person will also add individual aspects as improvements or additions to the respective basic form of the invention.

The invention is described below with reference to FIGS

attached drawing and described in more detail with reference to an embodiment. Show it: 1 is an overview image of a system according to an embodiment; and

2 is a flowchart of a method according to a

Embodiment.

In the figures, identical or functionally identical elements are provided with the same reference numerals, unless stated otherwise.

1 shows a system 1 for protecting a computer program 2 against unauthorized use. The system 1 has an external device 10, which may be a personal computer (PC) available from an original equipment manufacturer (OEM) or an OEM

other user is provided. In addition, the system 1 has a device 20 for protecting the computer program 2 against unauthorized use. The device 20 may be a numerically controlled machine tool (NC machine), which

Objects in a predetermined shape, workpieces, manufactures.

The external device 10 has a

Key generating device 1 1, from which a key 12 is generated, a display device 13, a

Key memory device 14 and a

File Encryption Device 1 5. The

 Key generator 1 1 may provide a key for encrypting and decrypting the computer program. However, the key generator 1 1 can also be two different keys, ie an encryption key for encryption and a decryption key for

Deploy Decrypt. Hereinafter, for the sake of simplicity, only the key 12 is mentioned.

The key 12 may be displayed on the display device 13, and may be stored in the key storage device 14 get saved. The key 12 can be over

Key download, for example by means of OpenSSL (= Open Source Execute the SSL and TLS protocols), for the device 20 for

Decrypting the encrypted computer program 1 1 are provided. In addition, the key 12 of the file encryption device 1 5 can be provided.

The file encryption device 15 has a

Encryption device 16 and a

 Encryption Display Setup 17. The

 File encryption device 15 may be the unencrypted

Computer program 2 using the key 12 by means of the encryption device 16 in an encrypted

Encrypt computer program 3. The encryption can be displayed and monitored by means of the encryption display device 17.

The apparatus 20 has a device display device 21, a controller 22, a computer program memory device 23, a RAM 24 having an SRAM section 25 and a RAM section 26, and a decryption device 27. The SRAM section is a random access static memory (SRAM = static random access memory), which does not have to be refreshed periodically. The RAM area is also a random access memory (RAM) and is preferably a dynamic random access memory (DRAM) which must be periodically refreshed, but may also be a static random access memory Be access. The controller 22 performs the functions of

 Downloading device for downloading the key 12 provided by an external device 10 and a

Storage management device off. The controller 22 may also perform the function of the decryption device 27 for decrypting the encrypted computer program 3.

The control device 22 as a memory space management device manages the memory space such that the encrypted

Computer program 3 is stored in the computer program storage device 23 and is. In the

Computer program storage means 23 stored in principle can be displayed with the device display device 21. This is indicated by the white block arrow A. For encrypted program parts or for the entire encrypted computer program 3, however, the restrictions described below apply.

The control device 22 as a memory space management device also manages the memory space such that the key 12, more precisely the decryption key for decrypting the encrypted computer program 3, is stored in the SRAM area 25. With the key 12, the encrypted computer program 3 invisible in a decrypted

Computer program 4 are decrypted. That with the

 Decryption key, the key 12, decrypted computer program 4 or decrypted program parts 4 are, however, by the controller 22 as

 Memory management device stored in the RAM area 26 of the workstation memory 24.

In the system 1, all places are taken into account, where contents of the computer program ms 2 are stored, that is, after the Encryption in the storage devices 23 and 24

saved, or visible, so the

 Device display device 21, be. Here is too

take into account that table data used in computer program 2 will not be encrypted.

Fig. 2 illustrates a method for protecting the

 Computer program 2 against unauthorized use. After starting the method, a computer program 3 encrypted by the external device 110 with the key 12 is stored in the computer program storage device 23 in a step S 1. The computer program storage device 23 is preferably a network file system in which files usable over a data network

are stored. The encryption of the computer program 2 thus takes place on the external device 10

Post-encryption of a new computer program 2 is possible offline. For this purpose, all keys 12 generated by the key generation device 11 are stored in the key management device 14. After the step S 1, the flow advances to the step S2.

At step S2, a decryption key provided to decrypt the encrypted computer program 3, the key 12, in the SRAM area 25 of FIG

Memory device 24 is stored. Here, the key 12 generated by the external device 10 can be picked up by the device 20, more specifically the controller 22 as the downloading device, from the external device 10

be downloaded. The explicitly generated key 12 ensures that only the original equipment manufacturer can decrypt the encrypted contents. After the step S2, the flow of the process goes to a step S3. At step S3, the decryption device 27 decrypts the encrypted computer program 3 with the

Decryption key, the key 12. Here are the decrypted computer program 4 or decrypted

Computer program parts 4 in the RAM area 26 of

Memory device 24 is stored. After the step S3, the flow advances to a step S4.

In step S4, it is checked whether a core dump of the RAM area 26 of the working memory device 24 should be executed, whether with the encrypted computer program 3

Simulation should be executed, whether the encrypted

Computer program 3 is to be displayed by means of the device display device 21, or whether with the

Device display device 21 of the

Decryption device 27 decrypted

Computer program parts 4 or that of the

 Decryption device 27 decrypted computer program 4 should be displayed. If the answer is NO at step S4, the procedure is ended. On the other hand, if the answer is YES in step S4, the flow proceeds to step S5. The step S4 and the step S5 are executed continuously during the execution of the decrypted computer program 4 in the device 20.

At step S5, a coredump is prevented when the decrypted computer program is 4 or decrypted

Computer program parts 4 in the RAM area 26 of

Main memory 27 are. A core dump represents the recorded state of the main memory

 Computer program at a predetermined time. The coredump shows only a hint at the relevant points

File encryption. In general, the predetermined time is the Time when the computer program ended abnormally.

In addition, in step S5, a simulation with the

encrypted computer program 3 prevents the decrypted computer program 4 or decrypted

Computer program parts 4 in the RAM area 26 of

Memory device 24 are. Further, in step S5, display of the encrypted computer program 3 by means of the device display device 21 is prevented when the encrypted computer program 3 is displayed for display on the computer

Device display device 21 is to be opened. In this case, the device display device 21 becomes a

Error message issued. In addition, in step S5, it is prevented that the computer program 4 decrypted by the decryption means 27 or that of the

Decryption device 27 decrypted

Computer program parts are displayed with the device display device 21.

After the step S5, the process is finished. By preventing the coredump, when the decrypted computer program 4 or the decrypted

Computer program parts 4 are in the RAM area 26, it is prevented that the encryption of the computer program 2 is canceled. This would be the case, for example, if visible program parts of the decrypted computer program 4 were not deleted or rendered unrecognizable in a core dump.

In addition, the step S5 causes that at a

Simulation program, such as EWB (Electronics

Workbench), encrypted programs, such as the encrypted computer program 3, are ignored during an analysis. In the above-described system 1, the VREC / I REC functions do not allow DI N-code outputs of encrypted ones

Computer programs 3. In addition, deliver the items NCS, OPC and SCP for the encrypted computer program 3 none

Program code.

In the system 1 described above is an additional

 Encryption over a CF card number for copy protection is not required since the key 12 remains on the controller 22, more precisely in the SRAM area 25. Due to the above-described Fu nktionalität the system 1 is a third party support for the encrypted

Computer program 3 not possible.

With the system 1 described above, it is possible that an encrypted computer program 3 has no effect on the runtime behavior of the device 20.

Is in the previously described system 1 is an exchange of

Control device 22 made, it is advantageous if the key 12 from the external device 10 in the new

 Control device 22 is brought. Alternatively, it is also possible to re-encrypt all computer programs 2 with the new key 12. The key generation at the external device 10 can be done on demand via freely available software (freeware). Key generation should not be integrated with Indraworks.

In the described system 1, all places are considered in technology protection, where contents of the

Computer program 2 are stored (file system) or visible (user interface or display device 21). These are the NC-Editor (processing device of the numeric Control unit), the NC block display, the NC analyzer (NC analyzer), the simulation, the

Computer program navigator and the file system.

In the NC editor, encrypted programs can not be opened. On the display device 21 come in the status bar a note and an empty display window.

For the NC block display, the block display window contains only one reference line in the case of encrypted program parts

"encrypted program".

In the NC analyzer, the program display window contains only one "encrypted program" information line in the case of encrypted program parts.

In the computer program navigator encrypted files receive a special identification.

In the file system, the computer program storage device 23, all files to be protected are present only in encrypted form.

When an archive is created, all encrypted files stored in the computer program storage device 23

saved.

With the system 1 described above and the method which provide NC program protection, subroutines or cycles can be encrypted and then protected in the

Control device 22 are stored. The processing in the numerical control (NC) is possible without restriction but any insight into the NC program, the computer program 3, is blocked. As a result, the internal know-how is protected. The NC program can, however, in the encrypted form, ie as Computer program 3, to be copied. Thus, the use of other machines is possible. If this should also be prevented, the NC program can be replaced by a

encryption supplement to be firmly bound to an NC or CNC hardware.

In the above-described system 1 and the method, it is not possible that the encrypted

Computer program 3 or other encrypted file can be decrypted locally by a service technician. The unencrypted computer program 2 or the unencrypted file must be provided by the external device operator 10, the OEM. Therefore, in the above-described system 1, no master key is used. The sense of responsibility lies with the OEM.

All of the above-described embodiments of the method and the device can be used individually or in all possible combinations. In addition, in particular are the following

Modifications conceivable.

Preferably, for encryption in the external

Device 10 uses an algorithm that is neither against

Export restrictions or embargo regulations violates. Here, two different keys are used for encryption and decryption. Must such export restrictions or

Embargo rules are ignored, it is also possible to use the same key for encryption and decryption. In this case, it is a symmetrical method. The data backup, version management and version control of the computer program 2 or 3 can be done automatically by re-encryption and comparison of the source text. Instead of preventing a coredu mps, it is also possible that, the evaluation of the coredump with only one

Development environment for the development of the computer program 2 and the source code of the computer program 2 is possible.

Claims

claims 1 . Method for protecting a computer program (2) against unauthorized use, comprising the steps  Storing (S 1) a computer program (3) encrypted by an external device (10) with a key (1 2) in a computer program storage device (23), Storing (S2) a key (12) provided for decrypting the encrypted computer program (3) in a SRAM area (25) of a working memory device (24), and  Decrypting (S3) the encrypted computer program (3) with the key (12), wherein the decrypted Computer program (4) or decrypted Computer program parts (4) in a RAM area (26) of the Memory device (24) are stored. The method of claim 1, wherein the step of storing (S2) the key (12) comprises that of the external one Device (10) generated and stored on its key (12) from the external device (10) by means of a Vorrichtu ng (20) is downloaded, which performs the method. 3. The method of claim 1 or 2, further comprising the step of preventing a coredump when the decrypted Computer program (4) or decrypted Computer program parts (4) in the RAM area (26) of Working memory device (24) stand. A method according to any one of the preceding claims, further comprising the step of preventing (S5) a simulation with the encrypted computer program (3) when the decrypted computer program (4) or decrypted computer program (4) Computer program parts (4) in the RAM area (26) of Working memory device (24) stand. A method according to any one of the preceding claims, further comprising the step of preventing (S5) a display of encrypted computer program (4) by means of a  Display device (21) and outputting an error message when the encrypted computer program (4) is to be opened for display on the display device (21). A method according to any one of the preceding claims, further comprising the step of preventing (S5) a display of the decrypted by said decryption means (27) Computer program (4) or by the decoding device (27) decrypted computer program parts (4) by means of a display device (21). 7. The method according to any one of the preceding claims, wherein in the computer program (2) used table data are not encrypted. 8. Device (20) for protecting a computer program (2) against unauthorized use, with a downloading device (22) for downloading a key provided by an external device (10) (12) for decrypting a computer program (3) encrypted by the external device (10) with the key, a decryption device (27) for decrypting the encrypted computer program (3), and a storage management device (22) for managing storage space such that the encrypted computer program (3) in one Computer program storage means (23) downloaded from the downloading means (22) Key in a SRAM area (25) one Memory device (24) is stored, and that decrypted by the decryption device (27) Computer program (4) or by the decryption device (27) decrypted computer program parts (4) in an SRAM area (25) of the working memory device (24) is stored / be. 9. Device (20) according to claim 8, wherein the device (20) is a control device for controlling a numerically controlled machine tool, the computer program (2) the Control program of the numerically controlled machine tool, and the computer program memory device (23) Network file system of the numerically controlled Machine tool is. 10. System (1) for the protection of a computer program (2) against unauthorized use, with  a device (20) according to claim 8 or 9, and  an external device (10) for generating, storing and providing a key (12) for encrypting the computer program (2) and / or decrypting the encrypted computer program (3).