Enablement of system features with improved feature key

• US 20060122945A1
• Filed: 12/03/2004
• Published: 06/08/2006
• Est. Priority Date: 12/03/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Burton, Helena C., Ripberger, Richard A.
• Granted Patent: US 7,899,754 B2
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06Q 20/3829 involving key management

Abstract

A feature key is provided to enable a specific feature in a target system, such as an IBM® Enterprise Storage Server®. The key includes fields identifying at least a portion of a serial number of the target system, identifying the feature on the target system to be enabled, and identifying a quantity associated with the feature to be enabled. Including the serial number ensures that the feature key will enable the feature on only the designated system and including the quantity ensures that only the quantity (of storage space, for example) paid for by the customer will be enabled. Additional fields may also be included identifying a storage architecture on which the feature is to be enabled, identifying a machine on which the feature is to be enabled, and identifying a sequence of prior feature keys generated for the feature on the target system. Preferably, the key is encrypted with an algorithm which uses at least a portion of the serial number of the target system, thereby ensuring that the feature key may be decrypted only by the target system.

Claims

1. A method for generating a key to enable an authorized feature on a computerized system, comprising:

receiving a request for a key to enable an authorized feature on a target system, the request including a serial number of the target system;

generating a machine identifier identifying at least a portion of the serial number of the target system;

generating a key type identifying a feature to be enabled on the target system;

generating a key data value identifying a quantity associated with the feature to be enabled;

encrypting the machine identifier, the key type and the key data value into a feature key; and

transmitting the machine identifier, the key type and the key data value to the target system;

whereby;

the feature is enabled if the machine identifier corresponds with the portion of the serial number of the target system and the key type identifies a feature supported on the target system; and

only the quantity indicated by the key data value is enabled on the target system for the key type.

2. The method of claim 1, wherein the target system includes a storage system, the method further comprising:

generating a resource scope identifying on which of a plurality of storage architectures the feature is to be enabled; and

encrypting the storage type into the feature key;

whereby the feature key is rejected by the target system if the resource scope identifies a resource not installed in the target system.

3. The method of claim 2, wherein the storage architectures are selected from the group comprising count key data (CKD) architecture and fixed block architecture.

4. The method of claim 2, further comprising:

generating a machine identifier to identify a partition of the storage system; and

encrypting the machine identifier into the feature key;

whereby the feature key is applicable to the identified partition.

5. The method of claim 1, further comprising:

generating a key generation number identifying a next number in a sequence relative to prior feature keys generated for the feature to be enabled on the target system; and

encrypting the key generation number into the feature key;

whereby the feature key is rejected by the target system if the key generation number is not one greater than the key generation number of a currently installed feature key for the feature type.

6. The method of claim 1, wherein:

the quantity identified in the key data comprises a base equal to 2^N, a mantissa having 2N bits, and an exponent (exp); and

the quantity is calculated as the mantissa*base^exp.

7. The method of claim 1, wherein the request further includes a machine signature, the method further comprising:

using the serial number of the target system to decrypt the machine signature and verify the validity of the request; and

verifying that the machine signature includes the serial number of the target system.

8. The method of claim 1, wherein encrypting the machine identifier, the key type and the key data value into a feature key comprises employing at least part of the serial number of the target system in an encryption algorithm.

9. An apparatus for generating a key to enable an authorized feature on a computerized system, comprising:

means for generating a machine identifier identifying at least a portion of a serial number of a target system;

means for generating a key type identifying a feature to be enabled on the target system;

means for generating a key data value identifying a quantity associated with the feature to be enabled;

means for encrypting the machine identifier, the key type and the key data value into a feature key; and

means for transmitting the feature key to the target system;

whereby;

the feature is enabled if the machine identifier corresponds with the portion of the serial number of the target system and the key type identifies a feature supported on the target system; and

only the quantity indicated by the key data value is enabled on the target system for the key type.

10. The apparatus of claim 9, wherein the target system includes a storage system, the apparatus further comprising:

means for generating a resource scope identifying on which of a plurality of storage architectures the feature is to be enabled; and

means for encrypting the storage type into the feature key;

whereby the feature key is rejected by the target system if the resource scope identifies a resource not installed in the target system.

11. The apparatus of claim 10, wherein the storage architectures are selected from the group comprising count key data (CKD) architecture and fixed block architecture.

12. The apparatus of claim 10, further comprising:

means for generating a machine identifier to identify a partition of the storage system; and

means for encrypting the machine identifier into the feature key;

whereby the feature key is applicable to the identified partition.

13. The apparatus of claim 9, further comprising:

means for generating a key generation number identifying a next number in a sequence relative to prior feature keys generated for the feature to be enabled on the target system; and

means for encrypting the key generation number into the feature key;

whereby the feature key is rejected by the target system if the key generation number is not one greater than the key generation number of a currently installed feature key for the feature type.

14. The apparatus of claim 9, wherein:

the quantity identified in the key data comprises a base eaqul to 2^N, a mantissa having 2N bits, and an exponent (exp); and

the quantity is calculated as the mantissa*base^exp.

15. A method for enabling a feature in a computerized system, comprising:

requesting a feature key from a function server to enable a feature on the system;

receiving an encrypted key from the server;

decrypting the key into a machine identifier, a key type identifying the feature to be enabled on the system and a key data value identifying a quantity associated with the feature to be enable;

verifying that the machine identifier corresponds with at least a predetermined portion of a serial number of the system;

verifying that the feature identified by the key type is supportable on the system;

verifying that the quantity identified by the key data value is supportable on the system; and

enabling the feature on the system in the quantity identified by the key data value for the key type.

16. The method of claim 15, wherein the system comprises a storage system, the method further comprising:

further decrypting the feature key into a resource scope identifying on which of a plurality of storage architectures the feature is to be enabled; and

rejecting the feature key if the resource scope identifies a resource not installed on the system.

17. The method of claim 16, wherein the storage architectures are selected from the group comprising count key data (CKD) architecture and fixed block architecture.

18. The method of claim 16, wherein the feature key is further decrypted into a machine identifier to identify a partition of the storage system, whereby the feature key is applicable to the identified partition.

19. The method of claim 15, further comprising:

further decrypting the feature key into a key generation number identifying a next number in a sequence relative to prior feature keys generated for the feature to be enabled on the system;

whereby the feature key is rejected by the system if the key generation number is not one greater than the key generation number of a currently installed feature key for the feature type.

20. The method of claim 18, further comprising:

further decrypting the feature key into a key signature ; and

allocating the quantity associated with the feature type among a plurality of partitions on the system.

21. The method of claim 15, wherein requesting the key comprises transmitting the request to the server over the Internet.

22. A data structure generated by a feature server for use by a target system, comprising:

a machine identifier field identifying at least a portion of a serial number of the target system;

a key type field identifying a feature to be enabled on the target system;

a key data field identifying a quantity associated with the feature to be enabled;

whereby;

after the data structure is transmitted to the target system, the feature is enabled if the machine identifier field corresponds with the portion of the serial number of the target system and the key type field identifies a feature supported on the target system; and

only the quantity indicated by the key data field is enabled on the target system for the feature identified by the key type field.

23. The data structure of claim 22, wherein the target system includes a storage system and the data structure further comprises a resource scope field identifying on which of a plurality of storage architectures the feature is to be enabled, whereby the data structure is rejected by the target system if the resource scope identifies a resource not installed in the target system.

24. The data structure of claim 23, wherein the storage architectures are selected from the group comprising count key data (CKD) architecture and fixed block architecture.

25. The data structure of claim 23, further comprising a machine identifier field identifying a partition of the storage system, whereby the data structure is applicable to the identified partition.

26. The data structure of claim 22, further comprising a generation number field identifying the sequence of the data structure relative to prior data structures generated for the feature to be enabled on the target system, whereby the data structure is rejected by the target system if the generation number is not one greater than the generation number of a currently installed data structure for the feature type.

27. The data structure of claim 22 wherein the data structure is encrypted employing at least part of the serial number of the target system in an encryption algorithm

28. A computer program product of a computer readable medium usable with a programmable computer, the computer program product having computer-readable code embodied therein for generating a feature-enabling key, the computer-readable code comprising instructions for:

receiving a request for a key to enable an authorized feature on a target system, the request including a serial number of the target system;

generating a machine identifier identifying at least a portion of the serial number of the target system;

generating a key type identifying a feature to be enabled on the target system;

generating a key data value identifying a quantity associated with the feature to be enabled;

encrypting the machine identifier, the key type and the key data value into a feature key; and

transmitting the feature key to the target system;

whereby;

the feature is enabled if the machine identifier corresponds with the portion of the serial number of the target system and the key type identifies a feature supported on the target system; and

only the quantity indicated by the key data value is enabled on the target system for the key type.

29. The program product of claim 28, wherein the target system includes a storage system, the program product further comprising instructions for:

generating a resource scope identifying on which of a plurality of storage architectures the feature is to be enabled; and

encrypting the storage type into the feature key;

whereby the feature key is rejected by the target system if the resource scope identifies a resource not installed in the target system.

30. The program product of claim 29, wherein the storage architectures are selected from the group comprising count key data (CKD) architecture and fixed block architecture.

31. The program product of claim 28, further comprising instructions for:

generating a machine identifier to identify a partition of the storage system; and

encrypting the machine identifier into the feature key;

whereby the feature key is applicable to the identified partition.

32. The program product of claim 28, further comprising instructions for:

generating a key generation number identifying a next number in a sequence relative to prior feature keys generated for the feature to be enabled on the target system; and

encrypting the generation number into the feature key;

whereby the feature key is rejected by the target system if the key generation number is not one greater than the key generation number of a currently installed feature key for the feature type.

33. The program product of claim 28, wherein:

the quantity identified in the key data comprises a base equal to 2^N, a mantissa having 2N bits, and an exponent (exp);

the quantity is calculated as mantissa*base^exp.

34. The program product of claim 28, wherein the request further includes a machine signature, the instructions further comprising instructions for:

using the serial number of the target system to decrypt the machine signature and verify the validity of the request; and

verifying that the machine signature includes the serial number of the target system.

35. A computer program product of a computer readable medium usable with a programmable computer, the computer program product having computer-readable code embodied therein for enabling a feature, the computer-readable code comprising instructions for:

requesting a feature key from a function server to enable a feature on the system;

receiving an encrypted key from the server;

decrypting the key into a machine identifier, a key type identifying the feature to be enabled on the system and a key data value identifying a quantity associated with the feature to be enabled;

verifying that the machine identifier corresponds with at least a predetermined portion of a serial number of the system;

verifying that the feature identified by the key type is supportable on the system;

verifying that the quantity identified by the key data value is supportable on the system; and

installing the feature on the system in the quantity identified by the key data value for the key type.

36. The program product of claim 35, wherein the system comprises a storage system, the program product further comprising instructions for:

further decrypting the feature key into a resource scope identifying on which of a plurality of storage architectures the feature is to be enabled; and

rejecting the feature key if the resource scope identifies a resource not installed on the system.

37. The program product of claim 36, wherein the storage architectures are selected from the group comprising count key data (CKD) architecture and fixed block architecture.

38. The program product of claim 36, further comprising instructions for further decrypting the key into a machine identifier to identify a partition of the storage system, whereby the feature key is applicable to the identified partition.

39. The program product of claim 35, further comprising instructions for further decrypting the key into a key generation number identifying a next number in a sequence relative to prior previous feature keys generated for the feature to be enabled on the system;

whereby the feature key is rejected by the system if the key generation number is not one greater than the key generation number of a currently installed feature key for the feature type.

40. The program product of claim 35, further comprising instructions for:

further decrypting the feature key into a key signature ; and

allocating the quantity associated with the feature type among a plurality of partitions on the system.

41. The program product of claim 35, wherein the instructions for requesting the key comprise instructions for transmitting the request to the server over the Internet.

42. A method for deploying computing infrastructure, comprising integrating computer readable code into a computing system, wherein the code, in combination with the computing system, is capable of performing the following:

receiving a request for a key to enable an authorized feature on a target system, the request including a serial number of the target system;

generating a machine identifier identifying at least a portion of the serial number of the target system;

generating a key type identifying a feature to be enabled on the target system;

generating a key data value identifying a quantity associated with the feature to be enabled;

encrypting the machine identifier, the key type and the key data value into a feature key; and

transmitting the machine identifier, the key type and the key data value to the target system;

whereby;

the feature is enabled if the machine identifier corresponds with the portion of the serial number of the target system and the key type identifies a feature supported on the target system; and

only the quantity indicated by the key data value is enabled on the target system for the key type.

43. The method of claim 42, wherein the target system includes a storage system and the code is further capable of:

generating a resource scope identifying on which of a plurality of storage architectures the feature is to be enabled; and

encrypting the storage type into the feature key;

whereby the feature key is rejected by the target system if the resource scope identifies a resource not installed in the target system.

44. The method of claim 43, wherein the storage architectures are selected from the group comprising count key data (CKD) architecture and fixed block architecture.

45. The method of claim 43, wherein the code is further capable of:

generating a machine identifier to identify a partition of the storage system; and

encrypting the machine identifier into the feature key;

whereby the feature key is applicable to the identified partition.

46. The method of claim 42, wherein the code is further capable of:

generating a key generation number identifying a next number in a sequence relative to prior feature keys generated for the feature to be enabled on the target system; and

encrypting the key generation number into the feature key;

whereby the feature key is rejected by the target system if the key generation number is not one greater than the key generation number of a currently installed feature key for the feature type.

47. The method of claim 42, wherein:

the quantity identified in the key data comprises a base equal to 2^N, a mantissa having 2N bits, and an exponent (exp); and

the quantity is calculated as the mantissa*base^exp.

48. The method of claim 42, wherein the request further includes a machine signature, the code further capable of:

using the serial number of the target system to decrypt the machine signature and verify the validity of the request; and

verifying that the machine signature includes the serial number of the target system.

49. The method of claim 42, wherein encrypting the machine identifier, the key type and the key data value into a feature key comprises employing at least part of the serial number of the target system in an encryption algorithm.