Method and system for enforcing access to a computing resource using a licensing attribute certificate

• US 6,904,523 B2
• Filed: 07/11/2002
• Issued: 06/07/2005
• Est. Priority Date: 03/08/1999
• Status: Expired due to Term

• Current Assignee: SPEX Technologies, Inc.
• Original Assignee: Spyrus, Inc.
• Inventors: Linsenbardt, Duane J., Housley, Russell D., Bialick, William P., Moore, Charles R. J.
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US10/195,059
• Publication Number:
  US 20020184508A1
• Time in Patent Office: 1,062 Days
• Field of Search: 713/155, 713/156, 713/165, 713/169, 713/170, 713/201, 713/189, 705/59, 709/217
• US Class Current: 713/156
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A licensing attribute certificate enables a trusted computing base to enforce access to a computing resource by a computer application. The licensing attribute certificate can contain enforcement data which limits the use of the computing resource. The licensing attribute certificate can also contain information allowing for the tracking of licensing data about the use of the computing resource. The use of a licensing attribute certificate to enforce access to a computing resource can allow products to be fielded which have their capability limited to a specific subset of functions. The enforcement data, the licensing data, and the data limiting the application to a specific subset of functions are cryptographically bound to the computing resource using a licensing attribute certificate according to the invention. Prior to allowing access to the computing resource by the computer application, a trusted computing base strongly authenticates that usage via the licensing attribute certificate.

Claims

1. A method for enforcing access by a computer application to a computing resource controlled by a trusted computing base, comprising the steps of:

generating enforcement data identifying usage of said computing resource by said computer application;

embedding said enforcement data in a licensing attribute certificate;

cryptographically binding said licensing attribute certificate to said computing resource using a private key;

associating said licensing attribute certificate with said computer application; and

authenticating in said trusted computing base the use of said computing resource by said computer application using a public key corresponding to said private key.

2. A method as in claim 1 wherein said generating step further comprises generating enforcement data in response to a request message for a licensing attribute certificate received from a user.

3. A method as in claim 2 wherein said generating step is performed by a vendor.

4. A method as in claim 1 wherein said binding step further comprises computing a digital signature on said enforcement data.

5. A method as in claim 4 wherein said generating step further comprises generating library attribute data.

6. A method as in claim 5 wherein said generating step further comprises generating token attribute data.

7. A method as in claim 6 wherein said library attribute data further comprises accessible tokens data and sub-functionality data.

8. A method as in claim 7 wherein said generating step further comprises generating enforcement data corresponding to a particular set of access rights, comprising the steps of:

determining appropriate content of token attribute data; and

determining appropriate content of library attribute data.

9. A method as in claim 8 wherein said binding step further comprises:

computing a second digital signature on said token attribute data; and

including said second digital signature in said licensing attribute data.

10. A method as in claim 9 wherein the same private key is used to compute said second digital signature as that used to compute said first digital signature.

11. A method as in claim 10 wherein said private key used to compute said first and second digital signatures is a private key of a vendor of a library.

12. A method as in claim 9 wherein a different private key is used to compute said second digital signature from that used to compute said first digital signature.

13. A method as in claim 12 wherein said private key used to compute said second digital signature is the private key of a vendor of said computing resource.

14. A method as in claim 1 wherein said binding step further comprises encrypting said enforcement data with a private key.

15. A method as in claim 1 wherein said associating step further comprises compiling computer application source code with said licensing attribute certificate.

16. A method as in claim 1 wherein said associating step further comprises providing an entry identifying said licensing attribute certificate in a system registry of a computer operating system.

17. A method as in claim 1 wherein said trusted computing base comprises a computer operating system.

18. A method as in claim 1 wherein said trusted computing base comprises a cryptographic token.

19. A method as in claim 18 wherein said binding step further comprises computing a digital signature on said enforcement data.

20. A method as in claim 1 wherein said licensing attribute certificate comprises an attribute certificate in X.509 attribute certificate format.

21. A method as in claim 1 wherein said authenticating step further comprises authenticating with a public key received in X.509 identity certificate format.

22. A method for allowing a trusted computing base to use a licensing attribute certificate to track usage of a computing resource by a computer application, comprising the steps of:

generating usage data regarding usage of said computing resource by said computer application;

embedding said usage data in said licensing attribute certificate;

cryptographically binding said licensing attribute certificate to said computing resource using a private key;

associating said licensing attribute certificate with said computer application;

updating a usage database within said trusted computing base in accordance with the usage of said computing resource by said computer application;

authenticating in said trusted computing base the use of said computing resource by said computer application;

validating said usage database against said usage data for permitted usage of said computing resource by said computer application; and

disallowing usage of said computing resource by said computer application if said validating step fails.

23. A method as in claim 22, wherein said usage data further comprises a maximum number of accesses by said computer application to said computing resource.

24. A method as in claim 22, wherein said usage data further comprises a maximum number of cryptographic operations to be performed by said computing resource.

25. A method as in claim 24 wherein said trusted computing base comprises a cryptographic token.

26. A method as in claim 25, wherein said cryptographic token comprises a PCMCIA card.

27. A method as in claim 25, wherein said cryptographic token comprises a smart card.

28. A system for enforcing access by a computer application to a computing resource controlled by a trusted computing base, comprising:

means for generating enforcement data identifying usage of said computing resource by said computer application;

means for embedding said enforcement data in a licensing attribute certificate;

means for cryptographically binding said licensing attribute certificate to said computing resource using a private key;

means for associating said licensing attribute certificate with said computer application; and

a trusted computing base for authenticating the use of said computing resource by said computer application using a public key corresponding to said private key.

29. A system as in claim 28, wherein said computing resource comprises a cryptographic operation on a cryptographic token.

30. A system as in claim 29 wherein said cryptographic token comprises a PCMCIA card.

31. A system as in claim 29 wherein said cryptographic token comprises a smart card.

32. A system as in claim 28 wherein said trusted computing base comprises a PCMCIA card.

33. A system as in claim 28 wherein said trusted computing base comprises a smart card.

34. A method for creating a licensing attribute certificate for enforcing access by a computer application to a computing resource controlled by a trusted computing base, comprising the steps of:

generating enforcement data identifying usage of said computing resource by said computer application;

embedding said enforcement data in said licensing attribute certificate;

cryptographically binding said licensing attribute certificate to said computing resource using a private key; and

associating said licensing attribute certificate with said computer application.

35. A method as in claim 34 wherein said generating step further comprises generating enforcement data in response to a request message for a licensing attribute certificate received from a user.

36. A method as in claim 35 wherein said generating step is performed by a vendor.

37. A method as in claim 34 wherein said generating step further comprises generating library attribute data.

38. A method as in claim 37 wherein said generating step further comprises generating token attribute data.

39. A method as in claim 38 wherein said library attribute data further comprises accessible tokens data and sub-functionality data.

40. A method as in claim 39 wherein said generating step further comprises generating enforcement data corresponding to a particular set of access rights, comprising the steps of:

determining appropriate content of token attribute data; and

determining appropriate content of library attribute data.

41. A system for creating a licensing attribute certificate for enforcing access by a computer application to a computing resource controlled by a trusted computing base, comprising:

means for generating enforcement data identifying usage of said computing resource by said computer application;

means for embedding said enforcement data in said licensing attribute certificate;

means for cryptographically binding said licensing attribute certificate to said computing resource using a private key; and

means for associating said licensing attribute certificate with said computer application.

42. A system as in claim 41 wherein said means for generating said enforcement data further comprises means for responding to a request message for a licensing attribute certificate received from a user.

43. A system as in claim 42 wherein a vendor operates said means for generating said enforcement data.

44. A system as in claim 41 wherein said means for generating said enforcement data further comprises means for generating library attribute data.

45. A method as in claim 44 wherein said means for generating said enforcement data further comprises means for generating token attribute data.

46. A system as in claim 45 wherein said means for generating library attribute data further comprises means for generating accessible tokens data and sub-functionality data.

47. A system as in claim 46 wherein said means for generating said enforcement data further comprises means for generating enforcement data corresponding to a particular set of access rights, comprising:

means for determining appropriate content of token attribute data; and

means for determining appropriate content of library attribute data.