Enabling bits sealed to an enforceably-isolated environment

• US 20060288238A1
• Filed: 06/16/2005
• Published: 12/21/2006
• Est. Priority Date: 06/16/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: England, Paul, Ray, Kenneth D., Biddle, Peter Nicholas
• Granted Patent: US 7,529,946 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Prevention of unpermitted use of enabling bits is achieved by sealing the enabling bits to an environment in such a way that the bits can only be unsealed by or from the environment, and by using an isolation mechanism to isolate the environment from other environments on the machine on which the environment operates. The environment is trusted not to use the enabling bits except in accordance with a set of rules governing the bits. The enabling bits may be a decryption key for DRM-protected content, and the rules may be a license governing the use of that content. Trust that the enabling bits will not be misused is established by trusting the environment not to use the enabling bits contrary to the rules, trusting the isolation mechanism to isolate the environment, and trusting the unsealing mechanism only to unseal the bits for the environment.

Claims

1. A method of enforcing rules on the use of first data, the method comprising:

establishing a first trust in a first component that said first component will unseal data only for an entity to which the data is sealed;

establishing a second trust in a second component that said second component will provide mutually isolated spaces within a machine, such that each of the spaces on the machine is isolated from acts arising in other spaces on the machine;

establishing a third trust in an environment, the first data being sealed to said environment, said environment being configured to enforce a rule as to the first data, or to executes software that enforces said rule as to the use of the first data, said trust representing an expectation that said environment will not use the first data in a manner contrary to said rule;

providing the first data in a secure form, and said rule, to said environment;

using said first component to isolate said environment;

using said second component to unseal the first data for said environment;

using, by said environment, the first data only in a manner permitted by said rule.

2. The method of claim 1, wherein said first data comprises a key that decrypts a content item, wherein said rule specifies a manner in which said content item is permitted to be used, and wherein using the first data only in a manner permitted by said rule comprises decrypting said content item with said key and enforcing a limit on usage of the content item.

3. The method of claim 1, wherein said first data enables the use of information, wherein a party has an economic, proprietary, or secrecy interest in said information, and wherein said first trust, said second trust, and said third trust are established to the satisfaction of, or to a standard established by, said party.

4. The method of claim 3, wherein said party need not trust said environment'"'"'s ability to resist having said environment'"'"'s behavior influenced by events that arise outside of said environment.

5. The method of claim 1, wherein there are a plurality of entities that trust said environment, and wherein trust of said environment by said plurality of entities is established prior to delivery of said first data to said machine.

6. The method of claim 1, wherein said first data comprises source code that is subject to a first set of license terms, and wherein said rule comprises a requirement that any software derived from said source code is to be provided with a second set of license terms, said second set of license terms being either the same as, or different from, said first set of license terms.

7. The method of claim 1, further comprising:

establishing fourth trust in said machine;

wherein said first data is sealed to said environment in such a manner that said first data is only unsealable when said environment is executing on said machine, and not when said environment is executing on any device other than said machine.

8. A computer-readable medium encoded with sets of computer-executable instructions, the sets of instructions comprising:

a first set of instructions that performs acts comprising;

instantiating plural environments on a computing device; and

maintaining a level of isolation between said plural environments; and

a second set of instructions distinct from said first set of instructions that, when instantiated, constitutes one of said plurality of environments, and that performs acts comprising;

issuing a request to unseal first data that has been sealed to said second set of instructions;

receiving a set of rules associated with said first data; and

enforcing said set of rules such that said first data is not used in a manner contrary to said set of rules;

wherein said first data comprises a hash of said second set of instructions and wherein said request to unseal said first data is received by a module that will not unseal said first data unless said request to unseal has been received from said first set of instructions, or from software that operates within the environment constituted by said first set of instructions.

9. The computer-readable medium of claim 8, wherein said first data comprises a key that decrypts a content item, wherein said set of rules specifies a manner in which said content item is permitted to be used, and wherein said enforcing act comprises decrypting said content item with said key and enforcing a limit on usage of the content item.

10. The computer-readable medium of claim 8, where said first data is used to decrypt information in which a party has an economic, proprietary, or secrecy interest, and wherein said party has trust comprising:

a first trust that said first set of instructions will maintain said level of isolation between said plurality of environments, said level meeting a standard established or imposed by said party;

a second trust that said second set of instructions will not use said first data in a manner contrary to said set of rules; and

a third trust that said module will not unseal said first data unless the request to unseal said first data has been received from said environment or from software operating under said environment.

11. The computer-readable medium of claim 10, wherein said party need not trust said second set of instructions'"'"' ability to resist being influenced by behavior arising outside of said environment, which behavior, in the absence of said level of isolation maintained by said first set of instructions, would cause said second set of instructions to use said first data, or said information decrypted by said first data, in a manner contrary to said set of rules.

12. The computer readable medium of claim 8, wherein there are a plurality of entities that trust said second set of instructions, and wherein trust of said second set of instructions by said plurality of entities is established prior to delivery of said first data to said computing device.

13. The computer-readable medium of claim 8, further comprising:

establishing trust in said computing device;

wherein said first data is sealed to said environment in such a manner that said first data is only unsealable when said second set of instructions is executing on said computing device, and not when said environment is executing on any machine other than said computing device.

14. In system that comprises:

an isolation mechanism that enables a plurality of environments to be instantiated on a computing device and that maintains a level of isolation among said plurality of environments; and

an unsealing mechanism that receives a request to unseal data and that unseals the data only if the request has been received from an entity to which the data is sealed;

the improvement comprising;

an environment that can be on the computing device and that can be isolated from other environments on said computing device by said isolation mechanism, said environment issuing a request to said unsealing mechanism to unseal first data, said environment enforcing a set of rules governing the use of said first data, said environment,

wherein an owner of said first data, or a party having an interest in said first data, has established first trust in said isolation mechanism and second trust in said unsealing mechanism, and relies on said environment preventing said first data from being used contrary to said set of rules based on said first trust and on said second trust, without establishing trust that said environment will resist attempts from outside of said environment to misuse said first data.

15. The system of claim 14, wherein said first data comprises a key that decrypts a content item, wherein said set of rules specifies a manner in which said content item is permitted to be used, and wherein enforcing said set of rules comprises decrypting said content item with said key and enforcing a limit on usage of the content item.

16. The system of claim 14, wherein said first data enables the use of information, wherein said owner or said party has an economic, proprietary, or secrecy interest in said information, and wherein said first trust and said second trust are established to a standard established or imposed by said owner or said party.

17. The system of claim 16, wherein said owner or said party need not trust said environment'"'"'s ability to resist having said environment'"'"'s behavior influenced by events that arise outside of said environment which, in the absence of said isolation mechanism, would cause said environment to use said first data, or said information that is enabled by the use of said first data, in a manner contrary to said set of rules.

18. The system of claim 14, wherein said owner or said party has established a third trust that said environment will not, in the absence of influence from outside of said environment, use said first data in a manner that is contrary to said set of rules.

19. The system of claim 14, wherein there are a plurality of entities that trust said environment, and wherein trust of said environment by said plurality of entities is established prior to delivery of said first data to said computing device.

20. The system of claim 14, further comprising:

establishing third trust in said computing device;

wherein said first data is sealed to said environment in such a manner that said first data is only unsealable when said environment is executing on said computing device, and not when said environment is executing on any machine other than said computing device.