The authors propose a new system for protecting software using tamperproof smart cards in this paper. Their idea is to transfer some of the encryption process and execution of the protected software to the smart card. This transfer would take place in ways that defeat attack and are amenable to commercial exploitation. To do this, some of the code is encrypted in the factory and shipped and packaged independently of the smart card that has the decryption key. At execution, the encrypted code is sent to the smart card with processing data, and the code is decrypted and executed using the data. Enhancements are suggested to fight attacks and to deal with issues such as transferring licenses.

The authors’ scheme does offer greater protection at a minimal disruption to the product distribution process, though the explanation and diagrams in section 3.1 could be a bit clearer. It will be interesting to see the counterattacks for their scheme. Can any system be, overall, truly tamperproof?

As in many similar papers, the authors include a nice bibliography of related journal articles and conference papers. I would like to suggest that such authors also start including references to at least a few related patents, given the increasing importance of patents in commercial affairs. Anyone wanting to use the authors’ techniques might have to deal with such patents.