Factoring middleware for anti-piracy

Embodiments are disclosed that relate to hindering unauthorized use or distribution of a middleware program contained within an application. One example embodiment provides a method for hindering unauthorized use or distribution of a middleware program contained within an application. The method comprises acquiring factored middleware code, the factored middleware code having a missing function residing on a remote computing device, and building an application around the factored middleware code such that the application is configured to call to the remote computing device for execution of the missing function during use. The application may be configured to send a call to the remote computing device for execution of the missing function during use.

BACKGROUND

Computer programs for personal computers are prone to reverse engineering. For example, license enforcement code in such programs may be detected and disabled by editing a program's machine code. As a consequence, once a computer program hits the market, adversarial users may reverse engineer its protection mechanism and produce a new copy that appears functionally equivalent to the genuine copy, but with disabled anti-piracy enforcement.

SUMMARY

Various embodiments are disclosed that relate to hindering unauthorized use or distribution of a middleware program contained within an application. For example, one disclosed embodiment provides a method for hindering unauthorized use or distribution of a middleware program contained within an application. The method comprises acquiring factored middleware code, the factored middleware code having a missing function residing on a remote computing device, and building an application around the factored middleware code such that the application is configured to call to the remote computing device for execution of the missing function during use. Such an application may be configured to send a call to the remote computing device for execution of the missing function during use.

DETAILED DESCRIPTION

Recent developments in anti-piracy technology have led to the development of split computational anti-piracy methods. Split computational methods involve partitioning, or factoring, a program into two or more pieces that are executed remotely from one another. For example, in some implementations, a smaller, functionally important piece of a program is located on a server, while the remainder of the program is located on a client. The client executes the program up to a point where the control flow leads to the server partition. The client then may prepare the appropriate data as input and make a remote procedure call to the functionality present at the server. If the client copy of the program is authorized, the server executes the call and returns results to the client. On the other hand, if the client copy is not authorized or if the server detects tampering attempts, the server will refuse to execute the call or will execute the call differently than it would for authorized clients, thereby disrupting execution of the program on the client.

In some examples, such programs may be built around middleware code provided by a middleware developer. Middleware developers create products that allow developers of applications to incorporate pre-built elements (middleware code) into program applications thus easing development of graphics, sounds, physics, and artificial intelligence functions. For example, a video game application may be built around middleware game engine code, in order to accelerate development of the application. The middleware then remains part of the application which is built around it.

Middleware programs are also prone to reverse engineering and often do not have a direct connection with an end user to ensure that anti-piracy methods are implemented. Further, application developers which utilize middleware code in application development may not have sufficient incentive to ensure that the middleware code included in an application is piracy-protected. Further, for the purposes of this disclosure, middleware may include a variety of program types including but not limited to scripts, programs, interpreted code, etc. Likewise an application may include a variety of executables, virtual machine code, run-time environments, sandboxes, etc.

Accordingly, embodiments are disclosed that relate to hindering unauthorized use or distribution of a middleware program contained within an application. Prior to discussing hindering unauthorized use or distribution of a middleware program contained within an application, an embodiment of an example use environment is described with reference toFIG. 1.

Use environment100includes a first computing device A102, on which an authorized copy of application code104is running. The authorized copy of application code104on computing device A includes a copy of authorized middleware code105from which the application is built around. Use environment100also includes and a second computing device B106on which an unauthorized copy107of the application code is running. The unauthorized copy of application code on computing device B includes an unauthorized copy109of middleware code.

In the depicted embodiment, both the authorized and unauthorized versions of the application code are missing one or more functions that instead reside on an application server system110that is accessible via network112. It will be understood that the term “function” and the like as used herein to describe factored code may signify any code portion separated from the rest of an application or program. The missing function i may be selected for separation from the rest of the application code based upon various considerations, including but not limited to an importance of the use of function108to a satisfying user experience, a difficulty of inferring an operation of the function108from an input/output analysis, any economic and/or computing resource costs associated with the remote hosting of the function108, and other such considerations. While the missing function i is depicted as being stored on an application server system110, it will be understood that the missing function may be stored on any suitable remote computing device. Further, it will be understood that the term “server” as utilized herein may refer to any such remote computing device that hosts one or more missing functions.

In addition, in the depicted embodiment, both the authorized and unauthorized versions of the middleware code included in the application are missing one or more middleware functions that instead reside on a middleware server system122that is accessible via network112. As above, the missing function j may be selected for separation from the rest of the middleware code based upon various considerations, including but not limited to an importance of the use of function j120to a satisfying user experience when included in an application, a difficulty of inferring an operation of function j120from an input/output analysis, any economic and/or computing resource costs associated with the remote hosting of function j120, and other such considerations. While the missing function j is depicted as being stored on a middleware server system122, it will be understood that the missing function j may be stored on any suitable remote computing device. It will further be understood that the middleware server system122may be different from the application server system.

The application code may additionally include a code map103. The code map indicates the location of the code to be run by the application. For example, the code map103may be a library such as a manifest file or xml document which includes location information of both application and middleware functions called by the application.

Application server system110comprises a factored function store114in which missing function i is stored, and also comprises an authorized user information store116in which information on authorized users may be stored. As an example,FIG. 1depicts a “user A license”118, corresponding to the user of computing device A102, as being stored on application server system110. In contrast, no license is stored for the unauthorized copy running on computing device B.

Likewise, middleware server system122comprises a factored function store124in which missing function j is stored, and also comprises an authorized user information store126in which information on authorized users may be stored. As an example,FIG. 1depicts a “user A license”128, corresponding to the user of computing device A102, as being stored on middleware server system122. In contrast, no such license is stored for the unauthorized copy of middleware code running on computing device B.

FIG. 1also illustrates example communication between application server system110and computing devices A and B. As computing device A executes the application code, upon reaching a point in code at which it needs to utilize the missing function108, computing device A calls the missing function108at the application server system110via network112, illustrated as call1. Application server system110receives the call, determines that computing device A is running an authorized copy of the application code, and then executes the function and returns a result to computing device A, illustrated as return1. On the other hand, when computing device B calls the missing function108, illustrated as call3, application server system110determines that computing device B is not running an authorized copy of the application code, and does not execute missing function108and return a result to computing device B. In this case, various different failure modes are possible.

FIG. 1also illustrates example communication between middleware server system122and computing devices A and B. As computing device A executes middleware code, upon reaching a point in the middleware code at which it needs to utilize the missing function j120, computing device A calls the missing function120at the middleware server system122via network112, illustrated as call2. Middleware server system110receives the call, determines that computing device A is running an authorized copy of the middleware code, and then executes the function and returns a result to computing device A, illustrated as return2. On the other hand, when computing device B calls the missing function j120, illustrated as call4, middleware server system110determines that computing device B is not running an authorized copy of the middleware code, and does not execute missing function j120and return a result to computing device B. As above, various different failure modes are possible.

FIGS. 2-4show example embodiments of methods for hindering unauthorized use or distribution of a middleware program contained within an application. As a non-limiting example, the application may be a video game and the middleware may be a game engine. An application including middleware code may be executed on a client device, including but not limited to a personal computer, mobile device, server, notepad computer, notebook computer, video game console, television, or on any other suitable device.

Turning now toFIG. 2, an embodiment of a method200of hindering unauthorized use or distribution of a middleware program contained within an application is shown and described from the point of view of a developer of an application which integrates middleware code in its development.

At202, method200includes acquiring factored middleware code, wherein the acquired factored middleware code has a missing function residing on a remote computing device. For example, referring briefly back toFIG. 1, a developer of an application may acquire middleware code which is missing function j that resides on middleware server system122. In some examples, the missing function may additionally be encrypted with one or more keys or the like residing on a remote computing device, e.g., residing on middleware server system122.

In some examples, a middleware program may include one or more configuration files or metafiles and an execution library or libraries for interpreting the one or more configuration files or metafiles to render middleware output. Thus, acquiring middleware code may include acquiring an execution library for interpreting a configuration file of the middleware code.

Middleware may include user-time code and machine-time code. For example, in a video game application, middleware user-time code may render interactions and camera movements of non-player characters or other independent entities interacting with a rendered environment when executed by the application. The intelligence around how these systems move or interact or how a world map is interpreted, applied, and generated, etc. are all part of the user-time updates. On the other hand, machine-time code may render and output updates at each frame of an output to a display when executed. For example, middleware machine-time code may render lighting effects, shimmers, moving clouds, actual running of pixel shaders and vertex shaders, etc.

Thus, acquiring factored middleware code at202may include acquiring a machine-time portion of the middleware program such that the missing function is a user-time portion of the middleware program. In this way, machine-time code may be run on a local device, e.g., computing device A102, whereas at least a portion of the user-time middleware code may reside on a remote device, such as middleware server system122. For example, the high level logic and tools for interpreting metafiles created by a middleware program may be factored out onto a remote server, e.g., middleware server system122, and the intermediary state may be shuttled back to a client computing device for interpretation by execution libraries of the product, e.g., when the metafiles are included in an application provided to a user. In other words, a middleware developer can create hosted tools that application developers can interact with, where the hosted tools produce the metafiles around which applications may be built. In this way, these hosted middleware tools can create metafiles that are protected because they reside on a protected remote server or because they are encrypted with keys residing on a protected remote server.

Continuing inFIG. 2, at204, method200includes building an application around the acquired factored middleware code such that the application is configured to call to the remote computing device for execution of the missing function during use. For example, a developer of an application may incorporate middleware code into an application and configure the application to call a middleware server system to execute the missing function when the application is executed. The application may be further configured to locate the missing function residing on a remote computing device, for example, via a code map, and restrict access to the missing function to allow authorized users to execute the missing function to the exclusion of unauthorized users.

In some examples, non-middleware portions of the application may be factored by an application developer in addition to middleware portions. In this case, the application may be configured to identify a first remote location of a factored application function and a second remote location of a factored middleware function, e.g., via a code map. Following identification of the remote locations of the application function and the middleware function, the application may be configured to send a first call to the application function and receive a first return response and in response to the first return response, execute the application function; and send a second call to the middleware function and receive a second return response; and in response to the second return response, execute the middleware function. In this way, both the middleware code and the application code may utilize split computational anti-piracy methods so that both the application developer and the middleware developer protect their respective code from piracy.

Continuing inFIG. 2, at206, method200includes providing the application to users. For example, after developing an application which incorporates factored middleware code, a developer may publish the application or provide access to the application so that users may execute the application.

Turning now toFIG. 3, another embodiment of a method300of hindering unauthorized use or distribution of a middleware program contained within an application is shown and described from the point of view of a middleware developer.

At302, method300includes factoring a middleware program into a machine-time portion and a user-time portion. For example, this step may be performed by a middleware developer who desires to provide middleware code to application developers while implementing split computational anti-piracy methods prior to the middleware's incorporation into an application.

At304, method300includes providing the machine-time portion to users. For example, the user-time portion of the middleware may reside on a remote computing device, e.g., middleware server system122, and a developer of the middleware code may supply the machine-time portion of the middleware code to an application developer for use in an application. In some examples, the user-time portion may be encrypted with one or more keys residing on the network-accessible server for additional piracy protection. As described above, the user-time portion may include a configuration file and providing the machine-time portion to users may include providing an execution library for interpreting the configuration file when users execute the application.

At306, method300includes locating the user-time portion on a network accessible server, e.g., middleware server system122. Locating the user-time portion on a network-accessible server may be performed via a code map, for example. At308, method300includes restricting access to the user-time portion to allow authorized users to execute the user-time portion to the exclusion of unauthorized users.

As described above, in some examples, the application may be factored by an application developer in addition to the factoring performed on the middleware code by the middleware developer. Thus, at310, method300includes locating a remote location of an application function via a code map, where the remote location is different from a location of the user-time portion on the network-accessible server. For example, as shown inFIG. 1, an application may locate function108on the application server system110and missing function120on the middleware server system122.

At312, method300includes restricting access to the application function to allow authorized users to execute the application function to the exclusion of unauthorized users. For example, the application function may be configured to execute for authorized users, and enable a failure mode if an unauthorized user attempts to execute the function.

Turning now toFIG. 4, another embodiment of a method400of hindering unauthorized use or distribution of a middleware program contained within an application, is shown and described from the point of view of a client device, e.g., computing device A shown inFIG. 1.

At402, method400includes executing the application. The application may be executed on a client device, including but not limited to a personal computer, mobile device, server, notepad computer, notebook computer, video game console, television, etc.

At404, method400includes identifying a first remote location of an application function via a code map. In some examples, the application function may be encrypted with a first key residing on the first remote location, e.g., on application server system110.

At406, method400includes identifying a second remote location of a middleware function via the code map, the second remote location being different from the first remote location.

At408, method400includes sending a first call to the application function. At410, method400includes receiving a first return response. At412, method400includes, in response to the first return response, executing the application function.

At414, method400includes sending a second call to the middleware function. At416, method400includes receiving a second return response. At418, method400includes executing the middleware function in response to the second return response. In some embodiments, the called middleware function is a user-time function.

In the embodiment ofFIG. 4, both the middleware and non-middleware portions of the application are factored, but it will be understood that, in other embodiments, one or the other of the middleware and non-middleware functions may be factored.

FIG. 5schematically shows a nonlimiting computing system500that may perform one or more of the above described methods and processes. Computing system500may represent any of computing device A102, computing device B106, application server system110, and middleware server system122ofFIG. 1.

Computing system500is shown in simplified form. It is to be understood that any suitable computer architecture may be used without departing from the scope of this disclosure. In different embodiments, computing system500may take the form of a mainframe computer, server computer, desktop computer, laptop computer, tablet computer, home entertainment computer, network computing device, mobile computing device, mobile communication device, gaming device, etc.

Computing system500includes a logic subsystem502and a data-holding subsystem504. Computing system500may optionally include a display subsystem506, communication subsystem508, and/or other components not shown inFIG. 5. Computing system500may also optionally include user input devices such as keyboards, mice, game controllers, cameras, microphones, and/or touch screens, for example.

Logic subsystem502may include one or more physical devices configured to execute one or more instructions. For example, the logic subsystem502may be configured to execute one or more instructions that are part of one or more applications, services, programs, routines, libraries, objects, components, data structures, or other logical constructs. Such instructions may be implemented to perform a task, implement a data type, transform the state of one or more devices, or otherwise arrive at a desired result.

Logic subsystem502may include one or more processors that are configured to execute software instructions. Additionally or alternatively, logic subsystem502may include one or more hardware or firmware logic machines configured to execute hardware or firmware instructions. Processors of logic subsystem502may be single core or multicore, and the programs executed thereon may be configured for parallel or distributed processing. The logic subsystem may optionally include individual components that are distributed throughout two or more devices, which may be remotely located and/or configured for coordinated processing. One or more aspects of logic subsystem502may be virtualized and executed by remotely accessible networked computing devices configured in a cloud computing configuration.

Data-holding subsystem504may include one or more physical, non-transitory, devices configured to hold data and/or instructions executable by logic subsystem502to implement the herein described methods and processes. When such methods and processes are implemented, the state of data-holding subsystem504may be transformed (e.g., to hold different data).

Data-holding subsystem504may include removable media and/or built-in devices. Data-holding subsystem504may include optical memory devices (e.g., CD, DVD, HD-DVD, Blu-Ray Disc, etc.), semiconductor memory devices (e.g., RAM, EPROM, EEPROM, etc.) and/or magnetic memory devices (e.g., hard disk drive, floppy disk drive, tape drive, MRAM, etc.), among others. Data-holding subsystem504may include devices with one or more of the following characteristics: volatile, nonvolatile, dynamic, static, read/write, read-only, random access, sequential access, location addressable, file addressable, and content addressable. In some embodiments, logic subsystem502and data-holding subsystem504may be integrated into one or more common devices, such as an application specific integrated circuit or a system on a chip.

FIG. 5also shows an aspect of the data-holding subsystem in the form of removable computer-readable storage media510, which may be used to store and/or transfer data and/or instructions executable to implement the herein described methods and processes. Removable computer-readable storage media510may take the form of CDs, DVDs, HD-DVDs, Blu-Ray Discs, EEPROMs, and/or floppy disks, among others.

The term “program” may be used to describe an aspect of computing system500that is implemented to perform one or more particular functions. In some cases, such a program may be instantiated via logic subsystem502executing instructions held by data-holding subsystem504It is to be understood that different modules, programs, and/or engines may be instantiated from the same application, service, code block, object, library, routine, API, function, etc. Likewise, the same module, program, and/or engine may be instantiated by different applications, services, code blocks, objects, routines, APIs, functions, etc. The term “program” and “engine” is meant to encompass individual or groups of executable files, data files, libraries, drivers, scripts, database records, etc.

Display subsystem506may be used to present a visual representation of data held by data-holding subsystem504. As the herein described methods and processes change the data held by the data-holding subsystem, and thus transform the state of the data-holding subsystem, the state of display subsystem506may likewise be transformed to visually represent changes in the underlying data. Display subsystem506may include one or more display devices utilizing any suitable type of technology. Such display devices may be combined with logic subsystem502and/or data-holding subsystem504in a shared enclosure, or such display devices may be peripheral display devices.

Communication subsystem508may be configured to communicatively couple computing system508with one or more other computing devices. Communication subsystem508may include wired and/or wireless communication devices compatible with one or more different communication protocols. As nonlimiting examples, the communication subsystem may be configured for communication via a wireless telephone network, a wireless local area network, a wired local area network, a wireless wide area network, a wired wide area network, etc. In some embodiments, the communication subsystem may allow computing system500to send and/or receive messages to and/or from other devices via a network such as the Internet.