Method and apparatus for provisioning software

• US 20060107335A1
• Filed: 11/15/2004
• Published: 05/18/2006
• Est. Priority Date: 11/15/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Xu, Zhangwei, Frank, Alexander, Duffus, James S., Phillips, Thomas G., Xu, Zeyong, Steeb, Curt Andrew, Holladay, Martin L., Light, Mark C., Sutton, Paul Christopher
• Granted Patent: US 7,610,631 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/725 operating on a secure reference time value
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A dynamic software provisioning system allows provisioning software on a number of different computing devices based upon a desired business process. The dynamic software provisioning system allows a user to request usage of the operating system for a specific period of time, for a specific amount of usage, or in any other desired manner from an operating system provisioning service or from a third party. The provisioning service processes the request from the user or from the third party to provision the use of the operating system and in response to the request provisions use of the operating system for a specific device specified by the request. The dynamic software activation system also includes a local provisioning module located on the device using the operating system, wherein the local provisioning module activates and deactivates the operating system based on instructions received from the provisioning service.

Claims

1. A method of provisioning a service on a provisioned device, the method comprising:

receiving a registration request for registering the provisioned device, wherein the registration request includes a provisioned device hardware identification;

generating a provisioned device certificate;

receiving a packet generation request for generating a provisioned device packet, wherein the packet generation request includes a provisioned device initialization key;

generating the provisioned device packet, wherein the provisioned device packet includes information authorizing a first amount of usage of the service on the provisioned device; and

storing the provisioned device packet and the provisioned device certificate.

2. A method of claim 1, wherein the provisioned device packet further includes the provisioned device initialization key, the provisioned device certificate and the provisioned device hardware identification

3. A method of claim 1, wherein the provisioned device hardware identification includes at least one of:

(1) a identification for a personal computer;

(2) hardware configuration of the personal computer; and

(3) a cellular phone identification card.

4. A method of claim 1, wherein the service is one of a:

(1) computer software;

(2) a computer operating system; and

(3) a digitally recorded media.

5. A method of claim 1, wherein generating the provisioned device certificate further includes:

receiving a private key from a public key infrastructure; and

encoding the provisioned device certificate with the private key.

6. A method of claim 1, wherein the first amount of usage of the service on the provisioned device includes at least one of:

(1) amount of time for the usage of the service; and

(2) an expiration time for the usage of the service.

7. A method of claim 1, further comprising:

receiving a client certificate request from a client device for the provisioned device certificate wherein the client certificate request includes a client device hardware identification;

retrieving the provisioned device certificate if the client device hardware identification is determined to match the provisioned device hardware identification; and

transmitting the provisioned device certificate to the client device.

8. A method of claim 1, further comprising:

receiving a client packet request from a client device for the provisioned device packet wherein the client packet request includes;

(a) a client device hardware identification;

(b) a client device initialization key; and

(3) a client device signature;

verifying the client device signature;

retrieving the provisioned device packet if;

(1) the client device hardware identification is determined to match the provisioned device hardware identification; and

(2) the client device initialization key is determined to match the provisioned device initialization key; and

transmitting the provisioned device packet to the client device.

9. A method of claim 8, wherein transmitting the provisioned device packet further includes:

increasing a client delivery count;

transmitting the provisioned device packet if the client delivery count is less than a maximum client delivery count;

setting a provisioned device status to error status if the client delivery count is not less than a maximum client delivery count;

receiving an acknowledgement from the client device; and

resetting the client delivery count if the acknowledgement is received.

10. A method of claim 8, further comprising updating a client usage account by the first amount of usage of the service.

11. A method of claim 8, wherein the client signature includes a private key generated by a public key infrastructure and used to encode the provisioning device certificate.

12. A method of claim 8, wherein the client packet request is received over the Internet.

13. A method of claim 1, wherein the provisioned device packet is an XML based provisioning packet.

14. A provisioning packet for provisioning a service on a provisioned device, the packet comprising:

a provisioned device hardware identification;

a provisioned device initialization key; and

information authorizing a first amount of usage of the service on the provisioned device.

15. A provisioning packet of claim 14, wherein the provisioning packet is an XML based packet.

16. A provisioning packet of claim 14, wherein the provisioning packet is encoded using a private key from a public key infrastructure.

17. A provisioning system for generating the provisioning packet of claim 14, the provisioning system comprising:

a first module adapted to receive a registration request for registering the provisioned device, wherein the registration request includes a provisioned device hardware identification;

a second module adapted to generate a provisioned device certificate;

a third module adapted to receive a packet generation request for generating the provisioning packet, wherein the packet generation request includes a provisioned device initialization key; and

a fourth module adapted to generate the provisioning packet.

18. A provisioning system of claim 17, wherein the service is one of (1) a computer software;

(2) a computer operating system; and

(3) a digitally recorded media.

19. A provisioning system of claim 17, further comprising an additional module adapted to receive a private key from a public key infrastructure and to encode the provisioning packet with the private key.

20. A provisioning system of claim 17, further comprising:

an additional module adapted to receive a client packet request from a client device for the provisioning packet;

wherein the client packet request includes;

(a) a client device hardware identification;

(b) a client device initialization key; and

(3) a client device signature;

an additional module adapted to verify the client device signature;

an additional module adapted to retrieve the provisioning packet if (1) the client device hardware identification is equal to the provisioned device hardware identification and (2) the client device initialization key is equal to the provisioned device initialization key; and

an additional module adapted to transmit the provisioning packet to the client device.

21. A computer-readable medium having computer-executable instructions for performing a method comprising:

(1) receiving a registration request for registering a provisioned device, wherein the registration request includes a provisioned device hardware identification;

(2) generating a provisioned device certificate;

(3) receiving a packet generation request for generating a provisioned device packet, wherein the packet generation request includes a provisioned device initialization key; and

(4) generating the provisioned device packet, wherein the provisioned device packet includes information authorizing a first amount of usage of a service on the provisioned device.

22. A computer-readable medium of claim 21, having further computer-executable instructions for performing the method of:

(1) receiving a client certificate request from a client device for the provisioned device certificate wherein the client certificate request includes a client device hardware identification;

(2) retrieving the provisioned device certificate if the client device hardware identification is equal to the provisioned device hardware identification; and

(3) transmitting the provisioned device certificate to the client device.

23. A computer-readable medium of claim 21, wherein the service is one of:

(1) a computer software; and

(2) a computer operating system.

24. A network communicating with a plurality of computing devices, the plurality of computing device comprising:

a billing system adapted to sell an amount of usage for a service on a provisioned device;

a provisioning system adapted to provision the amount of usage for the service on the provisioned device, the provisioning system including;

a registration module adapted to receive a registration request from the billing system for registering the provisioned device, wherein the registration request includes a provisioned device hardware identification,

a certificate module adapted to generate a provisioned device certificate,

a distribution module adapted to receive a packet generation request for generating the provisioning packet, wherein the packet generation request includes a provisioned device initialization key,

a packet generation module adapted to generate the provisioning packet, and

the distribution module further adapted to transmit the provisioning packet to the provisioned device; and

the provisioned device adapted to use the service, the provisioned device including;

a packet request module adapted to send the packet generation request to the provisioning system and to download the provisioning packet,

a storage module adapted to securely store the provisioning packet,

a balance module adapted to analyze the provisioning packet to generate a balance value, and

an enforcement module adapted to;

(1) activate the service on the provisioned device if the balance value is above a threshold; and

(2) de-activate the service on the provisioned device if the balance value is not above the threshold.

25. A network of claim 24, wherein the provisioning system is further adapted to request a private key for the provisioned device and to encode the certificate with the private key.

26. A network of claim 24, wherein the billing system is further adapted:

(1) to generate a pre-paid card printed with the initialization key; and

(2) to sell the prepaid card to a user via a retail store.

27. A network of claim 26, wherein the provisioned device further includes:

an activation module adapted to receive the initialization key from the user; and

the request module further adapted to generate the packet generation request with the initialization key.

28. A network of claim 24, wherein the provisioned device is one of:

(1) a personal computer;

(2) a cell phone;

(3) a gaming device and (4) a media player.

29. A network of claim 24, wherein the provisioning packet is an XML based provisioning packet.

30. A network of claim 24, wherein the provisioned device communicates with the network using the Internet.