Controlling Execution of a Software Application on an Execution Platform in a Local Network

• US 20150169852A1
• Filed: 06/16/2014
• Published: 06/18/2015
• Est. Priority Date: 12/18/2013
• Status: Active Grant

• Current Assignee: Thales DIS CPL Deutschland GmbH (Thales SA)
• Original Assignee: SFNT Germany GmbH (Thales SA)
• Inventors: Lange, Andreas, Kumar, Pratyush, Zunke, Michael
• Granted Patent: US 10,120,986 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

A method for controlling an execution of a software application on an execution platform in a first local network comprises: determining a first environment fingerprint including a first network fingerprint characteristic for the first local network using predetermined rules; generating a license including the first environment fingerprint and defining terms of allowed execution of the software application; and controlling the execution by: determining a second environment fingerprint including a second network fingerprint of a local network in which an execution platform for the software application is included using the predetermined rules; comparing the second environment fingerprint with the first environment fingerprint of the license; allowing execution of the software application according to the terms of the license where the second environment fingerprint complies with the first environment fingerprint, and preventing the execution of the software application where the second environment fingerprint does not comply with the first environment fingerprint.

Claims

1. Method for controlling an execution of a software application on an execution platform in a first local network, comprising:

a) determining a first environment fingerprint including a first network fingerprint of the first local network by using predetermined rules, wherein said first network fingerprint is characteristic for the first local network and is operative to distinguish the first local network from other local networks,

b) generating a license including said first environment fingerprint, wherein said license defines terms of allowed execution of the software application on an execution platform in the first local network, and

c) controlling the execution by

determining a second environment fingerprint including a second network fingerprint of a candidate local network in which a candidate execution platform for said software application is included by using said predetermined rules,

comparing the second environment fingerprint with the first environment fingerprint of the license,

allowing the execution of the software application according to the terms of the license where the second environment fingerprint complies with the first environment fingerprint, and

preventing the execution of the software application where the second environment fingerprint does not comply with the first environment fingerprint.

2. Method according to claim 1, wherein allowing the execution of the software application according to step c) comprises allowing the execution of the software application within a virtual machine.

3. Method according to claim 1, wherein the first network fingerprint includes at least one feature of the first local network which is already present and which is not generated by the method for controlling.

4. Method according to claim 1, further comprising amending the first local network in order to create a unique feature of the first local network before carrying out step a).

5. Method according to claim 1, wherein the first network fingerprint includes at least two different features and wherein in step c) the compliance of the two environment fingerprints is considered as being present if at least one of the two features is the same in both network fingerprints.

6. Method according to claim 1, wherein in step c) the compliance of the two environment fingerprints is considered as being present if a predetermined partial compliance of the two environment fingerprints is present.

7. Method according to claim 1, wherein the license includes a predetermined compliance algorithm which carries out the step of comparing the two environment fingerprints in step c).

8. Method according to claim 1, wherein the first network fingerprint includes at least two features and the method includes:

checking whether all features of the first network fingerprint are present; and

where not all but only some features of the first network fingerprint are present, replacing at least one of the not present features by another feature of the first local network.

9. Method according to claim 1, wherein the first network fingerprint is amended such that an additional feature characterizing the first local network is added to the first network fingerprint.

10. Method according to claim 1, wherein the first environment fingerprint includes a first execution platform fingerprint which is characteristic for said execution platform in said first local network and which is determined in step a), wherein the second environment fingerprint includes a second execution platform fingerprint which is determined in step c), and wherein in step c) the two execution platform fingerprints are compared.

11. Non-transitory computer readable storage medium, which comprises software code executable on a computer to cause the computer to carry out the method of claim 1.

12. Control system for controlling an execution of a software application on an execution platform in a first local network, comprising a computer hardware control module operative to:

a) determine a first environment fingerprint including a first network fingerprint of the first local network by using predetermined rules, said first network fingerprint being characteristic for the first local network and being usable to distinguish the first local network from other local networks,

b) generate a license including said first environment fingerprint, said license defining terms of allowed execution of the software application on an execution platform in the first local network, and

c) control the execution by;

determining a second environment fingerprint including a second network fingerprint of the local network in which the execution platform for said software application is included by using said predetermined rules,

comparing the second environment fingerprint with the first environment fingerprint of the license, and

allowing the execution of the software application according to the terms of the license in case of the second environment fingerprint complies with the first environment fingerprint, and preventing the execution of the software application in case of the second environment fingerprint does not comply with the first environment fingerprint.