SOFTWARE PROTECTION USING AN INSTALLATION PRODUCT HAVING AN ENTITLEMENT FILE

• US 20100218182A1
• Filed: 02/26/2009
• Published: 08/26/2010
• Est. Priority Date: 02/26/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Waidner, Michael P., Palmer, Bernard P. JR., Whitmore, James J., Hahn, Timothy J.
• Granted Patent: US 9,946,848 B2
• Time in Patent Office: Days
• US Class Current: 717/178
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/68 Special signature format, e.g. XML format
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Techniques for establishing entitlement to a computer program product are provided, and include providing a client identity in a registration process to produce an entitlement file, obtaining an encoded version of a computer program product, and transforming the computer program product into an installation product in a computer storage medium, wherein the installation product comprises the entitlement file to establish entitled use of the computer program product. Also, techniques for facilitating security compliance of a computer program product include providing an encoded version of a computer program product, and providing an installation product builder for the computer program product, wherein the installation product builder creates an installation product in a computer storage medium using a client identity and the encoded version of the computer program product during a registration process, and wherein the created installation product comprises an entitlement file to facilitate security compliance of the computer program product.

Claims

1. A method for establishing entitlement to a computer program product, comprising the steps of:

providing a client identity in a registration process to produce an entitlement file;

obtaining an encoded version of a computer program product; and

transforming the computer program product into an installation product in a computer storage medium, wherein the installation product comprises the entitlement file to establish entitled use of the computer program product.

2. The method of claim 1, further comprising installing the computer program product by applying a signature key that generates evidence of ownership.

3. The method of claim 1, wherein the encoded version of the computer program product comprises a licensed program and a program identification, wherein the licensed program and the program identification are embedded together and encoded with a public key of a licensee.

4. The method of claim 3, further comprising decoding, by the licensee, the encoded version of the computer program product with a private key to receive clear versions of the licensed program and the program identification.

5. The method of claim 4, further comprising comparing a decoded version of the program identification obtained from a licensor to the clear version of the program identification to verify that the correct software is received.

6. The method of claim 1, wherein the installation product comprises an embedded copy of the client identity.

7. The method of claim 1, further comprising the steps of:

enabling a subsequent licensee to create another installation product with an identity of the subsequent licensee embedded therein; and

enabling a subsequent licensee to change an original licensee identity in an original installation product.

8. The method of claim 1, wherein transforming the computer program product into an installation product in a computer storage medium comprises changing a content of a downloadable binary object by inserting the entitlement file.

9. The method of claim 1, wherein transforming the computer program product into an installation product in a computer storage medium comprises sending the entitlement file separately during a same download session.

10. A method for establishing compliance for use of a computer program product, comprising the steps of:

during creation of an installation product for the computer program product in a computer storage medium of a system, creating an entitlement record for the computer program product;

joining the entitlement file to the installation product;

installing the computer program product in a computer storage medium of a system; and

using the entitlement file to establish compliance for use of the computer program product, wherein the entitlement file is tamper evident.

11. The method of claim 10, further comprising auditing the computer program product for compliance, wherein the audit is based on integrity and content of the entitlement file.

12. The method of claim 11, wherein auditing the computer program product for compliance comprises the steps of:

scanning a target system for the computer program product and associated entitlement file; and

taking one or more actions based one or more pre-defined requirements.

13. The method of claim 10, wherein the entitlement file comprises a format for an encoded entitlement document.

14. The method of claim 10, wherein the entitlement file comprises at least one of a vendor identifier, a user identifier, one or more transaction identifiers, an asset identifier and one or more terms of entitlement.

15. The method of claim 10, wherein the entitlement file is used to create one or more instances of an entitlement document with one or more embedded integrity metrics.

16. The method of claim 10, wherein using the entitlement file to establish compliance for use of the computer program product comprises applying each term of an entitlement agreement throughout the lifecycle of the computer program product based on integrity and content of the entitlement file.

17. The method of claim 10, wherein using the entitlement file to establish compliance for use of the computer program product comprises examining the entitlement file, wherein examining the entitlement file comprises at least one of checking for integrity using a public cryptographic operation, checking for integrity using a private cryptographic operation, checking each party, and checking each term of entitlement.

18. The method of claim 10, further comprising providing a computer program product installation process, wherein the computer program product installation process comprises the steps of:

accessing the entitlement file in the computer program product;

checking integrity of the entitlement file;

presenting content of the entitlement file to a user for review;

continuing the computer program product installation process if the user acknowledges acceptance of the entitlement file and intent to continue;

presenting end user license agreement (EULA) information to the user for review; and

completing the computer program product installation if the user acknowledges acceptance of the EULA and intent to continue.

19. A method for facilitating security compliance of a computer program product, comprising, in a computer storage memory:

providing an encoded version of a computer program product; and

providing an installation product builder for the computer program product, wherein the installation product builder creates an installation product in a computer storage medium using a client identity and the encoded version of the computer program product during a registration process, and wherein the created installation product comprises an entitlement file to facilitate security compliance of the computer program product.

20. A system for facilitating security compliance of a computer program product, comprising:

a memory; and

at least one processor coupled to the memory and operative to;

provide an encoded version of a computer program product; and

provide an installation product builder for the computer program product, wherein the installation product builder creates an installation product in a computer storage medium using a client identity and the encoded version of the computer program product during a registration process, and wherein the created installation product comprises an entitlement file to facilitate security compliance of the computer program product.

21. The system of claim 20, wherein the entitlement file is tamper evident.

22. The system of claim 20, wherein the entitlement file is joined to the created installation product.

23. The system of claim 20, wherein the entitlement file comprises at least one of a vendor identifier, a user identifier, one or more transaction identifiers, an asset identifier and one or more terms of entitlement.

24. The system of claim 20, wherein facilitating security compliance of the computer program product comprises applying each term of an entitlement agreement throughout the lifecycle of the software based on integrity and content of the entitlement file.

25. A computer program product comprising a tangible computer readable recordable storage medium including computer useable program code for facilitating security compliance of a computer program product, the computer program product including:

computer useable program code for providing an encoded version of a computer program product; and

computer useable program code for providing an installation product builder for the computer program product, wherein the installation product builder creates an installation product in a computer storage medium using a client identity and the encoded version of the computer program product during a registration process, and wherein the created installation product comprises an entitlement file to facilitate security compliance of the computer program product.

26. The computer program product of claim 25, wherein the entitlement file is tamper evident.

27. The computer program product of claim 25, wherein the entitlement file is joined to the created installation product.

28. The computer program product of claim 25, wherein the computer useable program code is stored in a computer readable storage medium in a data processing system, and wherein the computer useable program code was downloaded over a network from a remote data processing system.

29. The computer program product of claim 25, wherein the computer useable program code is stored in a computer readable storage medium in a server data processing system, and wherein the computer useable program code are downloaded over a network to a remote data processing system for use in a computer readable storage medium with the remote system.

30. The computer program product of claim 25, wherein the entitlement file comprises at least one of a vendor identifier, a user identifier, one or more transaction identifiers, an asset identifier and one or more terms of entitlement.