Electronic software distribution method and system using a digital rights management method based on hardware identification

• US 20060064488A1
• Filed: 09/17/2004
• Published: 03/23/2006
• Est. Priority Date: 09/17/2004
• Status: Abandoned Application

• Current Assignee: Inventec Appliances Corporation (Inventec Corporation)
• Original Assignee: Inventec Appliances Corporation (Inventec Corporation)
• Inventors: Ebert, Robert F.
• Application Number:
  US10/943,595
• Publication Number:
  US 20060064488A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

An electronic software distribution (ESD) method is provided for digitally distributing a software application. The method starts by receiving a set of user data, and then generates from the user data a digital hardware signature having a hardware identification attribute. The digital hardware signature is then appended to a software application to generate a software application package. The digital hardware signature assures that the software application package is fully executable only on a hardware device having a matching hardware identification attribute.

Claims

1. An electronic software distribution (ESD) method comprising:

receiving a set of user data from which a hardware identification attribute can be determined;

generating a digital hardware signature having the hardware identification attribute;

appending the digital hardware signature to a software application to generate a software application package which is fully executable only on a hardware device having a matching hardware identification attribute; and

distributing the software application package.

2. The method of claim 1 wherein receiving the set of user data comprises reading the hardware identification attribute stored on the hardware device.

3. The method of claim 1 wherein the set of user data comprises a user identification, and the hardware identification attribute is automatically determined by matching the user identification to a database comprising hardware identification attributes associated with respective user identifications.

4. The method of claim 1 wherein the set of user data is received via a user interface.

5. The method of claim 4 wherein the user interface comprises a Web browser.

6. The method of claim 1 wherein the set of user data is received at a point-of-sale from a buyer purchasing a copy of the software package.

7. The method of claim 1 wherein the hardware identification attribute is unique to the hardware device, such that the software application is fully executable only if installed on the hardware device.

8. The method of claim 1 wherein the digital hardware signature is generated using a hash data set and a first key.

9. The method of claim 8 wherein the data set comprises the hardware identification attribute.

10. The method of claim 8 wherein the hash data is generated from an application signature of the software application.

11. The method of claim 8 wherein the digital hardware signature is validated by a second key stored on the hardware device.

12. The method of claim 8 wherein the digital hardware signature is validated by an encrypted authorization key, which in turn is validated by a second key stored on the hardware device.

13. The method of claim 1 wherein the software application package is a downloadable executable file.

14. The method of claim 13 wherein the executable file is a PalmOS resource file (.prc).

15. The method of claim 1, wherein the digital hardware signature is merged with the software application such that the software application cannot be separately executed even if the main code component is non-encrypted or decrypted.

16. The method of claim 1 wherein generating the digital hardware signature and appending the digital hardware signature with the software application are performed automatically.

17. The method of claim 1 wherein receiving the set of user data is performed by a first server, and generating the digital hardware signature is performed by a second server.

18. The method of claim 17 wherein the first server is an Electronic Software Distribution server configured to store the software application component, and the second server is a digital signature server configured to store private keys for generating the digital hardware signature.

19. The method of claim 18 wherein the digital signature server is configured to return the generated digital hardware signature to the Electronic Software Distribution server to form the software application package.

20. The method of claim 1 wherein distributing the software application package comprises sending the software application package directly to a buyer.

21. The method of claim 1 wherein distributing the software application package comprises sending the software application package to a retailer.

29. The ESD system of claim 1 further comprising storing the software application package on a removable ROM or RAM device.

22. An electronic software distribution (ESD) system comprising:

a user interface for receiving a set of user data from which a hardware identification attribute can be determined;

a server system configured to generate a digital hardware signature based on the set of user data upon a request from the user interface, and further configured to append the digital hardware signature to a software application component to form a software application package; and

a distribution channel for distributing the software application package.

23. The ESD system of claim 22 wherein receiving the set of user data comprises reading the hardware identification attribute stored on the hardware device.

24. The ESD system of claim 22 wherein the set of user data comprises a user identification, and the hardware identification attribute is automatically determined by matching the user identification to a database comprising hardware identification attributes associated with respective user identifications.

25. The ESD system claim 22 wherein the user interface comprises a Web browser.

26. The ESD system of claim 22, wherein the hardware identification attribute is unique to the hardware device, such that the software application is fully executable only if installed on the hardware device.

27. The ESD system of claim 22 wherein the server system comprises an Electronic Software Distribution server storing the software application component, and a digital signature server storing private keys for generating the digital hardware signature.

28. The ESD system of claim 27 wherein the digital signature server is configured to return the generated digital hardware signature to the Electronic Software Distribution server to form the software application package.

30. An electronic software distribution (ESD) method comprising:

receiving a set of user data from which a hardware identification attribute can be determined;

requesting from a server system a digital hardware signature having the hardware identification attribute; and

receiving from the server system a software application package having a main code component and a digital hardware signature appended thereto, the software application package being executable only on a hardware device having a matching hardware identification attribute.

31. The ESD method of claim 30 wherein receiving the set of user data is performed through a Web browser.

32. The ESD method of claim 30 wherein receiving the set of user data is performed at a retail store.

33. The ESD method of claim 30 wherein requesting the server system for generating the digital hardware signature is performed through a network.