Method for controlling distribution and use of software products with net-work-connected computers

• US 6,850,915 B1
• Filed: 08/27/1998
• Issued: 02/01/2005
• Est. Priority Date: 09/02/1997
• Status: Expired due to Fees

• Current Assignee: Siemens It Solutions and Services GmbH (Atos SE)
• Original Assignee: Siemens AG
• Inventors: Wiehler, Gerhard
• Primary Examiner(s): Trammell, James P.
• Assistant Examiner(s): Greene, Daniel L
• Application Number:
  US09/486,942
• Time in Patent Office: 2,350 Days
• Field of Search: 705/57, 705/51, 705/53, 705/56, 705/58, 380/3, 380/4, 380/25, 717168-178, 713176-181
• US Class Current: 705/57
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

The distribution in controlled by means of central certificates acting as a link between the authorization granted to various users and the right-of-access code allocated to the software products in connection with a special separated control program. The certificates are issued to users on request and intended for calling the wanted software products. Such certificates can be supplemented with distinct control functions. Said functions are executed by the control program, which is supplemented accordingly, especially for recording data on the utilization volume. The invention also relates to the following items: key safety, use of a chip card, integrated copy protection.

Claims

1. A method of controlling a distribution and/or use of computer-based objects including data collections and/or computer programs, the computer-based objects being stored in a server computer and made available on demand at least temporarily for a use in a client computer interconnected to the server computer via a data network, comprising the steps of:

providing an user-specific access right indicator for granting a user an access right to a computer-based object depending on a user role;

the user-specific access right indicator being digitally signed with a private signature key of an access rights administration entity;

upon a user request for the computer-based object, transmitting the user-specific access right indicator to the client computer;

sending a request to the server computer for a transmission of the computer-based object from the server computer to the client computer;

validating the user-specific access right indicator in the server computer by a public signature key of the access rights administration entity for checking authorization of the request for the transmission of the computer-based object to the client computer;

transmitting the computer-based object to the client computer after a successful validation of the user-specific access right indicator; and

controlling access to the computer-based object in the client computer by a dedicated control program validating the user-specific access right indicator.

2. A method according to claim 1 wherein the control program resides in a data carrier and is at least partially implemented thereat.

3. A method according to claim 1, further comprising the step of:

coupling the data carrier to arbitrary computers of the data network.

4. A method according to claim 1, further comprising the step of:

checking whether requested software objects are already available on the computer and, given a positive result, initiating a local offering of the software object.

5. A method according to claim 1, further comprising the steps of:

following transmission of the certificates,

presenting a list of the software objects corresponding to the certificates on the picture screen of the requesting computer, and

triggering the request for the respectively desired software object by the user.

6. A method according to claim 1, further comprising the step of:

offering of the software objects with various computers in the network.

7. A method according to claim 1, further comprising the step of:

modifying control parameters contained in the certificates by the user without an existing integrity protection being lost.

8. A method according to claim 1, further comprising the step of:

automatically requesting a further program called as a software object during run time of a program and that is referenced in one of existing certificates, said further program being requested by a separate control program and subsequently transmitted to the computer making the request.

9. A method according to claim 1, wherein deletion of software objects automatically ensues at an end of their use.

10. A method according to claim 1, wherein the certificates contain particulars about a nature of the acquisition of the usage scope of the software objects transmitted to a requesting computer;

and a separate control program controls the acquisition of the scope of usage on the basis of said particulars.

11. A method according to claim 10, wherein the scope of usage ensues by counting the transmitted software objects.

12. A method according to claim 10, wherein the disclosed above usage ensues by counting periodically recurring clock pulses.

13. A method according to claim 1, further comprising the step of:

each administration instance in data networks having a plurality of independent administration instances for software objects producing usage certificates for the software objects belonging to its area of competence.

14. A method according to claim 1, wherein all connection set ups in the data network and transmissions ensue protected by keys.

15. A method according to claim 14, wherein the keys are contained on the data carrier.

16. A method according to claim 1, further comprising the step of:

securing software objects subject to copying protection against copying by additional control parameters in the appertaining certificate and corresponding control functions in the separate control program.