Generating a verifiable download code

• US 10,262,310 B1
• Filed: 09/07/2011
• Issued: 04/16/2019
• Est. Priority Date: 09/07/2011
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Lobb, Franklin L., Kulkarni, Sanjay Govindrao, McGoogan, Andrew
• Primary Examiner(s): Qayyum, Zeshan
• Application Number:
  US13/227,127
• Time in Patent Office: 2,778 Days
• Field of Search: 705 51
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: G06Q 2220/10 Usage protection of distributed data files
• CPC Class Codes: G06Q 2220/18 Licensing

Abstract

Disclosed are various embodiments for generating a verifiable download authorization code. A computing device obtains a transaction identifier that corresponds to an acquisition of a digital product by a user. The computing device generates a download authorization code based at least in part on the transaction identifier.

Claims

1. A method comprising:

obtaining, by a computing device, a transaction identifier corresponding to an acquisition of a digital product by a user; and

generating, by the computing device, a download authorization code based at least in part on the transaction identifier by;

concealing the transaction identifier by hashing the transaction identifier wherein a salt value used for a hash function for the hashing corresponds to a time of the transaction;

combining the hashed transaction identifier with a fixed predetermined verification value that is uniquely associated with a network site through which the user acquired the digital product; and

encrypting the combined transaction identifier to produce the download authorization code.

2. The method of claim 1, wherein the generating is performed in response to the obtaining of the transaction identifier.

3. The method of claim 1, wherein the obtaining comprises retrieving the transaction identifier from storage accessible to the computing device.

4. The method of claim 1, wherein the obtaining comprises receiving the transaction identifier from an electronic commerce network site through which the user acquired the digital product.

5. The method of claim 1, wherein the download authorization code limits the user to a predetermined number of downloads.

6. The method of claim 1, wherein the fixed predetermined verification value is uniquely associated with the digital product.

7. The method of claim 1, wherein the combining comprises a method selected from the group consisting of prefixing and concatenating.

8. The method of claim 1, wherein the generating further comprises:

encoding the encrypted transaction identifier to produce the download authorization code.

9. The method of claim 1, the generating comprising:

truncating the hashed transaction identifier; and

wherein the combining further comprises prefixing the truncated transaction identifier with the fixed predetermined verification value.

10. The method of claim 1, wherein the generating, by the computing device, the download authorization code based at least in part on the transaction identifier further comprises:

truncating the hashed transaction identifier;

wherein the combining comprises prefixing the truncated transaction identifier with the fixed predetermined verification value; and

encoding the encrypted transaction identifier to produce the download authorization code.

11. The method of claim 1, wherein the fixed predetermined verification value is associated with a predetermined subset of digital products.

12. A system, comprising:

at least one computing device;

a first module executed by the at least one computing device, the first module, when executed, causing the at least one computing device to at least;

obtain a transaction identifier corresponding to an acquisition of a digital product by a user through a network site; and

generate a download authorization code based at least in part on the transaction identifier and on a verification value by hashing the transaction identifier with a salt value corresponding to a time of the transaction, combining the transaction identifier with the verification value and encrypting the combined transaction identifier to produce the download authorization code, the verification value being fixed and predetermined, the verification value further being uniquely associated with the network site; and

a second module executed by in the at least one computing device, the second module causing the at least one computing device to at least;

provide the digital product to the user in response to a download request for the digital product and to a separate transaction that includes the generated download authorization code, wherein the generated download authorization code is received in a transaction related to the download request.

13. The system of claim 12, wherein the download authorization code provides non-repudiation of an entity that generated the download authorization code.

14. The system of claim 12, wherein the acquisition is selected from the group consisting of a purchase, a rental, and a free offer.

15. The system of claim 12, wherein the first module causes the at least one computing device to encode the encrypted combined transaction identifier to produce the download authorization code.

16. The system of claim 12, wherein the first module causes the at least one computing device to:

truncate the hashed transaction identifier; and

prefix the truncated transaction identifier with a fixed predetermined verification value to generate a prefixed transaction identifier.

17. The system of claim 12, wherein the verification value is associated with a predetermined subset of digital products.

18. A non-transitory computer-readable medium embodying a program executable in a computing device, the program, when executed, causing the computing device to at least:

obtain a transaction identifier corresponding to an acquisition of a digital product by a user; and

generate a download authorization code based at least in part on the transaction identifier by hashing the transaction identifier with a salt value corresponding to a time of the transaction, combining the transaction identifier with a fixed predetermined verification value and encrypting the combined transaction identifier to produce the download authorization code, wherein the fixed predetermined verification value is uniquely associated with a network site through which the user acquired the digital product and is associated with a predetermined subset of digital products.

19. The non-transitory computer readable medium of claim 18, wherein the download authorization code limits the user to a predetermined number of downloads.

20. The non-transitory computer readable medium of claim 18, wherein the download authorization code provides non-repudiation of an entity that generated the download authorization code.