Abstract: Non-contact interfaces to cryptographic modules include non-contact inputs, which may contain magnetic coupling, RF coupling, infrared coupling, optical coupling or acoustical coupling to load cryptographic data into cryptographic modules. By using non-contact methods of coupling, the physical inputs to the module can be hidden, as no external connectors to input cryptographic data are required. In addition, several non-contact inputs can be disposed within a cryptographic module, at orientations and spacings which require the specific placement of transmitting units, thereby increasing the security of the module. In addition, by having several inputs to the cryptographic module, the cryptographic function may be made to be dependent on a sequencing of data between the inputs and/or may require simultaneous inputs on two or more sensors.

Abstract: A personal key having an inexpensive and robust integrated USB connector is disclosed. The apparatus comprises a circuit board having a processor and a plurality of conductive traces communicatively coupling the processor to a peripheral portion of the circuit board. The plurality of conductive traces includes, for example, a power trace, a ground trace, and at least two signal traces. The apparatus also comprises a first housing, having an aperture configured to accept the periphery of the circuit board therethrough, thereby presenting the plurality of conductive traces exterior to the aperture. The apparatus also comprises a shell, surrounding the plurality of conductive traces, the shell including at least one locking member interfacing with the first housing.

Abstract: A system for managing licenses for protected software on a communication network is disclosed. The system comprises at least one client computer and a pool of license servers coupled to the communication network. The client computers request authorization to use the protected software, and the license servers manage a distribution of allocations to use the protected software. The pool of license servers includes a selected current leader server for managing the distribution of allocations for all license servers in the pool. The first license server to be started is selected as the current leader server. However, if no license server is started first, the license server with the highest priority according to a leader priority list is selected as the current leader server.

Abstract: A bending token for providing conditional access to data stored therein is disclosed. The token comprises a first member, for insertion into a USB-compliant host computer female connector along a first longitudinal axis, USB-compliant host computer female connector having a plurality of host conductive surfaces; a second member, disposed along a second longitudinal axis, the second member having a processor providing conditional access to data stored in a memory; a flexible conductor, electrically coupling the processor and the plurality of host conductive surfaces when the first member is inserted into the USB-compliant host computer female connector; and a bendable member, coupled to the first member and the second member, the bendable member permitting the second longitudinal axis rotated away from the first longitudinal axis.

Abstract: A method, apparatus, and article of manufacture for protecting a shelled computer program with a startup code featuring multiple-route execution. In one embodiment, the startup code comprises a sequence of tasks, collectively executing a startup code, wherein one or more of the tasks is selectably performed by one of a plurality of task code variations as selected by a selection code associated with the task.

Abstract: A method and apparatus for communicating information between a token and a host computer having a host computer operating system (OS) supplied inherent driver for communicating with an OS-supported USB-compliant device. The method comprising the steps of coupling to the host computer, and emulating the OS-supported USB-compliant device. In one embodiment, the step of emulating the OS-supported USB-compliant device comprises the steps of accepting a message from the OS-supplied inherent driver in the token, the message transmitted according to a format and protocol for the OS-supported USB-compliant device; generating a second message from the accepted first message; and providing a second message from the token to the OS-supplied inherent driver.

Abstract: A method and apparatus for secure authentication of a hardware token is disclosed. In one embodiment, a host computer fingerprint is used to generate a partial seed for a challenge-response authentication which is performed on the hardware token. In another embodiment, the host computer fingerprint is used as a personal identification number for the hardware token.

Abstract: A method and apparatus for booting a computer. The method comprises the steps of emulating a floppy disk drive communicatively coupled to a computer in a token via a USB-compatible interface, and booting the computer using the token. The apparatus comprises means for performing these functions, including a token with a processor having one or more memories storing processor instructions and data for performing the method steps. The memory may also securely store sensitive data.

Abstract: A method, apparatus, article of manufacture, and a memory structure for a USB-compliant personal key has been described. The personal key includes an integrated connector design that is simple and easy to manufacture, and allows broken or defective connecting pins to be easily replaced. In the several embodiments disclosed, the personal key also comprises a biometric sensor for authenticating the identity of the user, and visual and aural sensors for providing information to the user.

Abstract: A method, apparatus, and article of manufacture provide the ability to rapidly generate a large prime number to be utilized in a cryptographic key of a cryptographic system. A candidate prime number is determined and a mod remainder table is initialized for the candidate prime number using conventional mod operations. If all mod remainder entries in the table are non-zero, the candidate number is tested for primality. If the candidate prime number tests positive for primality, the candidate number is utilized in a cryptographic key of a cryptographic system. If any of the table entries is zero, the candidate number and each mod remainder entry are decremented/incremented. If any mod remainder entry is less than zero or greater than the corresponding prime number, the corresponding prime number is added/subtracted to/from the mod remainder. The process then repeats until a satisfactory number is obtained.

Abstract: A method and apparatus for protecting computer software from unauthorized execution or duplication using a hardware key is disclosed. The apparatus comprises a means for communicating with the computer to receive command messages from the computer in the hardware key and to provide response messages to the computer, a memory for storing data for translating command messages into response messages enabling software execution, and a processor coupled to the communicating means for translating command messages into response messages using the data stored in the memory. The processor further comprises a memory manager, including means for logically segmenting the memory storing the data into at least one protected segment, and a means for controlling access to the protected segment.

Abstract: A “dual” personal key/token is disclosed. The “dual” personal key is useful for installing drivers and other command interfaces which allow the personal key to be coupled to and used with a host computer. In a first embodiment, the personal key operates as a USB hub, and reports two devices, a storage device and a personal key, to the host computer. In a second embodiment presents a single device, and different portions of the personal key are activated as required.

Abstract: A system and method in which the operating system of the user computer loads the software application and a DLL having a portion of the application execution code stored therein into memory is disclosed. At selected points during its execution, the software application calls the DLL to execute a portion of the application code that was saved into the DLL before delivery to the end user. Since this code is encrypted and the encryption key is stored in a hardware security device and not in the DLL or the software application, the application code portion cannot be executed without recovering the key.

Abstract: A method and apparatus for protecting computer software from unauthorized execution or duplication using a hardware key is disclosed. The apparatus comprises a means for communicating with the computer to receive command messages from the computer in the hardware key and to provide response messages to the computer, a memory for storing data for translating command messages into response messages enabling software execution, and a processor coupled to the interface port for translating command messages into response messages using the data stored in the memory. The processor further comprises a memory manager, for logically segmenting the memory storing the data into at least one protected segment, and for controlling access to the protected segment.

Abstract: A personal key having an inexpensive and robust integrated USB connector is disclosed. The apparatus comprises a circuit board having a processor and a plurality of conductive traces communicatively coupling the processor to a peripheral portion of the circuit board. The plurality of conductive traces includes, for example, a power trace, a ground trace, and at least two signal traces. The apparatus also comprises a first housing, having an aperture configured to accept the periphery of the circuit board therethrough, thereby presenting the plurality of conductive traces exterior to the aperture. The apparatus also comprises a shell, surrounding the plurality of conductive traces, the shell including at least one locking member interfacing with the first housing.

Abstract: The computer-based software protection systems are provided using methods that improve the protection of vendor's software against unauthorized use. A code generator generates randomized protection code, which is then used to protect the application software. Because the code is unique for each protected software, potential crackers have to analyze and crack every instance of the protection, so that generic hack is almost impossible. Some embodiments of the present invention also randomize license verification module, add and randomize a specific anti-hacking code, and randomize the protection code execution sequence(s). The same embodiments can also select which instructions and how many instructions are randomized. Moreover, these embodiments select where the data is being stored, in which register, memory address and stack position, and also randomize variable offsets. Other embodiments of the present invention are used for interpreted code.

Abstract: A computationally efficient multiplication method and apparatus for modular exponentiation. The apparatus uses a preload register, coupled to a multiplier at a second input port via a KN bit bus to load the value of the “a” multiplicand in the multiplier in a single clock pulse. The “b” multiplicand (which is also KN bits long) is supplied to the multiplier N bits at a time from a memory output port via an N bit bus coupled to a multiplier first input port. The multiplier multiplies the N bits of the “b” multiplicand by the KN bits of the “a” multiplicand and provides that product at a multiplier output N bits at a time, where it can be supplied to the memory via a memory input port.

Abstract: A method and apparatus for performing high-speed computation of a Montgomery value defined as 22k mod(n) for an arbitrary modulus n is disclosed. After loading the value of 2(h*m)+1 into a first register and the value of the modulus n in a second register, the bits of modulus n are shifted in a most significant bit direction before a repeated modular reduction and squaring process. This allows the computation of the Montgomery value for modulus values of arbitrary sizes while reducing the number of computations required by a processor with a limited operand size.

Abstract: A compact hardware key for protecting software executing on a computer is disclosed. The hardware key uses a two piece insulator design in which each insulator piece provides a double layer insulator body for protection from tampering, insulator areas for electrically isolating I/O connector pins, and an integral circuit board support portion for securely mounting the circuit board assembly. The compact hardware key also comprises a unique coaxially displaced interrupt pin structure.

Abstract: A method of protecting computer software on installation is provided by providing an installation media containing an installation program supplied to the user along with an hardware security electrical device (HSED). The HSED must be connected to the user's computer before the software from the installation media can be entered on the user's computer. The HSED contains a variety of secret installation data which is used to install a program to be protected. In general the secret installation data is checked to see if a specific HSED is present and if it contains information to enable the installation process for that particular piece of software to continue. The exact nature of the secret installation data will depend on the process used for protection. The HSED is also used in a method of metering the amount of computer service used such that payment can be made at the time of delivery of the HSED to the end user.