System and method for administering licenses stored in an electronic module, and product unit comprising said module

• US 20150302534A1
• Filed: 12/08/2014
• Published: 10/22/2015
• Est. Priority Date: 04/17/2014
• Status: Active Grant

• Current Assignee: Silvair sp. z o.o.
• Original Assignee: Seed Labs Sp. Z O.O.
• Inventors: Langman, Maciej, Slupik, Szymon, Gembala, Adam
• Granted Patent: US 9,965,816 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 50/184 Intellectual property management
• CPC Class Codes: H04L 2463/103 applying security measure for protecting copyright
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: Y02P 90/845 Inventory and reporting systems for greenhouse gases [GHG]

Abstract

The product unit disclosed herein has identification data that are stored internally in memory. This stored identification data can be viewed as the product unit'"'"'s “digital nameplate,” in that the data can represent the product unit'"'"'s identifier, brand, and so on. Each data set is digitally signed while on the production line by using an encryption technique. The digitally signed data set is then written into the product unit'"'"'s memory where it can be used for verification. A first digitally-signed data set can be used to control the use of one or more software modules that are provided by a software owner. The data that are undergoing signature contain at least one globally-unique identifier, which can be used to identify cloning attempts. Additionally, more than one digital signature can be used, in order to protect and control the use of features other than the software, such as the product brand.

Claims

1. A method for manufacturing one or more product units, comprising:

receiving, by a test rig of a manufacturing system, a first identifier from a product unit, wherein the first identifier identifies the product unit;

transmitting, by the manufacturing system, the first identifier to a first server computer, wherein the manufacturing system and the first server computer are controlled by separate business entities;

receiving, by the test rig from the first server computer, a first digitally-signed document comprising a first digital signature that is determined mathematically by using the first identifier; and

installing into a memory of the product unit, by the test rig, the first digitally-signed document after being received from the first server computer.

2. The method of claim 1 wherein the first identifier comprises a globally unique communications address of the product unit, and wherein the first digital signature of the installed first digitally-signed document reflects the globally unique communications address.

3. The method of claim 2 wherein the globally unique communications address of the product unit is a media access control (MAC) address.

4. The method of claim 1 wherein the product unit is configured to perform a predetermined task outside of the manufacturing system.

5. The method of claim 1, further comprising assessing performance of the product unit, by the test rig, wherein the transmitting of the first identifier by the manufacturing system is also based on the assessing.

6. The method of claim 1, further comprising:

receiving, by the test rig from a second server computer, a second digitally-signed document comprising a second digital signature that is determined mathematically by using a second identifier, wherein the second identifier identifies a brand; and

installing into a memory of the product unit, by the test rig, the second digitally-signed document after being received from the second server computer;

wherein the manufacturing system and the second server computer are controlled by separate business entities.

7. A system for manufacturing one or more product units, comprising:

a first server computer configured to

i) receive a first identifier originating from a product unit, wherein the first identifier identifies the product unit, and

ii) transmit the received first identifier to another server computer, wherein the first server computer and the other server computer are controlled by separate business entities; and

a test rig configured to

i) read the first identifier from the product unit;

ii) receive, from the first server computer, a first digitally-signed document comprising a first digital signature that is determined mathematically by using the first identifier; and

iii) installing, into a memory of the product unit, the first digitally-signed document after being received from the first server computer.

8. The system of claim 7 wherein the first identifier comprises a globally unique communications address of the product unit, and wherein the first digital signature of the installed first digitally-signed document reflects the globally unique communications address.

9. The system of claim 8 wherein the globally unique communications address of the product unit is a media access control (MAC) address.

10. The system of claim 7 wherein the product unit is configured to perform a predetermined task outside of the manufacturing system.

11. The system of claim 7 wherein the test rig is further configured to assess performance of the product unit, and wherein the first server computer is further configured to transmit the first identifier based on the performance assessed.

12. The system of claim 7 wherein the test rig is further configured to:

receive, from the first server computer, a second digitally-signed document comprising a second digital signature that is determined mathematically by using a second identifier, wherein the second identifier identifies a brand; and

install, into the memory of the product unit, the second digitally-signed document after being received from the first server computer;

wherein the manufacturing system and the second server computer are controlled by separate business entities.

13. A product unit comprising:

a memory configured to store a first digitally-signed document when received by the product unit from a first device;

a network adapter configured to

i) transmit a first identifier to the first device, wherein the first identifier comprises a globally unique communications address that identifies the product unit,

ii) receive the first digitally-signed document comprising a first digital signature from the first device, wherein the first digital signature is determined mathematically by using the globally unique communications address transmitted to the first device, and

iii) transmit the stored first digitally-signed document to a second device when requested by the second device; and

a processor configured to enable performance, by the product unit, of a predetermined task when instructed to perform the task and based on the network adapter receiving a message that comprises the globally unique communications address.

14. The product unit of claim 13 wherein the globally unique communications address of the product unit is a media access control (MAC) address.

15. The product unit of claim 13 wherein the network adapter is further configured to transmit i) the first identifier to the first device and ii) the first digitally-signed document to the second device, in separate wireless networks.

16. The product unit of claim 13 wherein the network adapter is further configured to:

receive a second digitally-signed document comprising a second digital signature from the first device, wherein the second digital signature is determined mathematically by using a second identifier, and wherein the second identifier identifies a brand; and

transmit the second digitally-signed document to the second device when requested by the second device.

17. The product unit of claim 13 further comprising a sensor component configured to perform the task of detecting a physical condition, only when performance of the task is enabled, wherein performance of the task is further based on determining the first digital signature to be valid.

18. The product unit of claim 17 wherein the physical condition is temperature.

19. The product unit of claim 13 wherein the processor is further configured to deactivate a predetermined function otherwise performed by the product unit, based on determining the first digital signature to be invalid.

20. The product unit of claim 19 wherein the processor is further configured to determine that the first digital signature is invalid.