Binding a device to a provider

• US 20070079127A1
• Filed: 10/05/2005
• Published: 04/05/2007
• Est. Priority Date: 10/05/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Raciborski, Bohdan, Hall, Martin, Phillips, Thomas, Frank, Alexander, Duffus, James, Sutton, Paul, Herold, Jeffrey
• Granted Patent: US 8,073,442 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A pay-per-use or pay-as-you-go computer uses a secure memory to store individual unique program identifiers. Each unique program identifier is associated with a particular hardware or software component, or service, or the entire computer available to a user. By combining the unique program identifier with a computer hardware identifier uniquely identified transactions may be tracked for both billing and reconciliation. Certificates associated with each unique program identifier, and coupled to the hardware identifier, provide a cryptographic basis for mutual verification of messages, requests, configuration instructions, and provisioning.

Claims

1. A computer configured for licensed operation comprising:

an input mechanism for bidirectional movement of information with the computer;

a memory storing a unique program identifier corresponding to at least one authorized party and a hardware identifier corresponding to the computer; and

a processing unit operable to determine an operating mode of the computer corresponding to an instruction received from the at least one authorized party via the input mechanism, the instruction being digitally signed by the authorized party and includes a form of the unique program identifier and the hardware identifier, whereas the computer only accepts the instruction when the digital signature, the unique program identifier and the hardware identifier are confirmed.

2. The computer of claim 1 further comprising a lower provisioning module for storing the unique program identifier and the hardware identifier in a tamper-resistant manner.

3. The computer of claim 2, wherein the lower provisioning module sets a limited capability operating mode until the unique program identifier is verified as originating from the authorized party and is stored in the memory.

4. The computer of claim 1, further comprising a function available only to the authorized party and activated by the instruction after confirming the digital signature, the unique program identifier and the hardware identifier.

5. The computer of claim 4, wherein the function changes the unique program identifier.

6. The computer of claim 4, wherein the function receives a heartbeat signal from the authorized party.

7. The computer of claim 3, wherein a hierarchy of functions are available to authorized parties associated with a plurality of unique program identifiers, wherein lower priority unique program identifiers have access to fewer functions than higher priority unique program identifiers.

8. The computer of claim 7, wherein the plurality of unique program identifiers correspond to one or more of a system service provider, a clearing house, a manufacturer, a service provider and a system supplier.

9. The computer of claim 1, wherein a registration request is sent via the I/O mechanism, the request comprising at least one of the unique and the hardware identifiers.

10. A method for configuring and provisioning a computer for metered operation comprising:

receiving at least a portion of a unique program identifier from a scheme owner, the at least a portion of the unique program identifier representing at least one of a product, a program or a service;

receiving a request for a registration document for the computer, the request comprising a full unique program identifier and a hardware identifier, the hardware identifier associated with the computer for uniquely identifying the computer within a domain;

sending the registration document to the computer, the registration document digitally signed and includes the hardware identifier and the complete version of the unique program identifier;

receiving a provisioning request;

preparing a provisioning instruction that is digitally signed and comprises the unique program identifier and the hardware identifier for use in qualifying the provisioning instruction; and

providing the provisioning instruction to the computer for configuring the computer according to the provisioning instruction.

11. The method of claim 10, wherein the at least a portion of the unique program identifier comprises a business code.

12. The method of claim 10, wherein the unique program identifier comprises a business code and a model code.

13. The method of claim 10, further comprising storing a second unique identifier wherein the second unique program identifier comprises the business code and a second model code.

14. The method of claim 13, wherein the second unique program identifier comprises a second business code and a second model code.

15. The method of claim 10, further comprising:

providing the complete unique program identifier to a supply chain entity for installation in the computer in a tamper-resistant memory;

16. Where a service provider makes available a product or service for use on an electronic device, a method of binding the electronic device to the service provider comprising:

storing in the electronic device a unique program identifier corresponding to the product or service and a device identifier uniquely identifying the electronic device within a domain;

receiving a provisioning packet from an authorized party associated with the service provider for setting an operating parameter associated with use of the product or service;

verifying that the provisioning packet is from the authorized party, the verifying including that a form of the unique program identifier is included in the provisioning packet;

accepting the provisioning packet when the verifying the provisioning packet is successful; and

operating the electronic device in accordance with the operating parameter associated with the use of the product or service.

17. The method of claim 16, wherein verifying that the provisioning packet is from the authorized party further comprises verifying that a form of the device identifier is present in the provisioning packet.

18. The method of claim 16, further comprising rejecting the provisioning packet when the provisioning packet is not verified as coming from the authorized party and that a form of the unique program identifier cannot be verified and when a form of the device identifier cannot be verified.

19. The method of claim 16, further comprising:

storing in the electronic device a second unique program identifier corresponding to a second product or service;

receiving a second provisioning packet from a second authorized party for setting a second operating parameter associated with use of the second product or service;

verifying that the second provisioning packet is from the second authorized party, and that a form of the second identifier is included in the provisioning packet; and

accepting the second provisioning packet only after verifying that a form of the second identifier is included in the authorization.

20. The method of claim 16 wherein the service provider offer is one of an ability to reconfigure the electronic device and an ability to authorize use of the resource associated with the service provider.