Method and apparatus for enabling trial period use of software products: Method and apparatus for utilizing a decryption block

• US 5,598,470 A
• Filed: 04/25/1994
• Issued: 01/28/1997
• Est. Priority Date: 04/25/1994
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Cooper, Thomas E., Pryor, Robert F., Philips, Hudson W.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/235,031
• Time in Patent Office: 1,009 Days
• Field of Search: 380/4, 380/25, 380/23, 380/9, 380/20, 380/49, 380/50
• US Class Current: 713/165
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/1063 Personalisation
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/126 Interacting with the operating system
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

A method and apparatus is provided in a data processing system for securing access to particular files which are stored in a computer-accessible memory media. A file management program is provided as an operating system component of the data processing system. A plurality of files are stored in a computer-accessible memory media, including at least one encrypted file and at least one unencrypted file. For each encrypted file, a preselected portion of the file is recorded in memory, a decryption block is generated which includes information which can be utilized to decrypt the file, and the decryption block is incorporated in the file in lieu of the preselected portion which has been recorded in memory. Then, a file management program is utilized to monitor data processing system calls for files stored in the computer-accessible memory media. The file management program determines whether the called file has an associated decryption block. The called file is processed in a particular manner dependent upon whether or not the called file has an associated decryption block.

Claims

1. A method in a data processing system of securing access to particular files which are stored in a computer-accessible memory media, comprising the method steps of:

providing a file management program as an operating system component of said data processing system;

storing a plurality of files including at least one encrypted file and at least one unencrypted file in said computer-accessible memory media;

for each of said at least one encrypted file;

(a) recording in said computer-accessible memory media a preselected portion of said at least one encrypted file;

(b) generating a decryption block which includes information which can be utilized to decrypt said at least one encrypted file;

(c) inserting said decryption block in said at least one encrypted file in the place of said preselected portion;

utilizing said file management program to (a) monitor data processing system calls for a called file stored in said computer-accessible memory media, and (b) determine whether said called file has an inserted decryption block, and (c) process said called file in one manner if said called file has an inserted decryption block, and process said called file in a different manner if said called file does not have an inserted decryption block.

2. A method according to claim 1:

wherein each of said at least one encrypted file has a particular file size;

wherein insertion of said decryption block does not change said particular file size for each of said at least one encrypted file.

3. A method according to claim 1, further comprising:

inserting said preselected portion in said at least one encrypted file in the place of said decryption block following expiration of a specific interval, wherein said interval defines a customer trial period; and

decrypting said at least one encrypted file.

4. A method according to claim 1, wherein said step of generating a decryption block comprises:

combining (a) a unique identifier for each of said at least one encrypted file, with at least (b) an address to said preselected portion for each of said at least one encrypted file.

5. A method according to claim 1, wherein said step of generating a decryption block comprises:

combining (a) a unique identifier for each of said at least one encrypted file, with at least (b) a name for a key file which contains decryption keys for each of said at least one encrypted file.

6. A method according to claim 1, wherein said step of generating a decryption block comprises:

combining (a) a unique identifier for each of said at least one encrypted file, with at least (b) a validation segment comprising an encrypted segment of each of said at least one encrypted file.

7. A method according to claim 1, wherein said step of generating a decryption block comprises:

combining (a) a unique identifier for each of said at least one encrypted file, with at least (b) an identifier of which particular one of a plurality of available encryption operations has been utilized to encrypt said at least one encrypted file.

8. A method according to claim 1, wherein said step of utilizing said file management program to process said called file comprises intercepting said called file and at least one of:

(a) utilizing said decryption block to retrieve a name for a key file and reading a key for said called file;

(b) decrypting a validation segment of said decryption block, and comparing said decrypted validation segment to a selected segment of said called file, and continuing operations only if said decrypted validation segment matches said selected segment; and

(c) decrypting said called file at the same time as it is passed for further processing.