Methods and apparatus for secure distribution of software

• US 6,966,002 B1
• Filed: 06/09/1999
• Issued: 11/15/2005
• Est. Priority Date: 04/30/1999
• Status: Expired due to Term

• Current Assignee: Flexera Software LLC
• Original Assignee: Trymedia Systems, Inc. (RealNetworks, Inc.)
• Inventors: Torrubia-Saez, Andres
• Primary Examiner(s): Barrón, Jr., Gilberto
• Assistant Examiner(s): Lanier, Benjamin E.
• Application Number:
  US09/328,737
• Time in Patent Office: 2,351 Days
• Field of Search: 717/172, 705/51, 705/52, 713/201, 713/191
• US Class Current: 726/29
• CPC Class Codes: G06F 21/1011 to devices

Abstract

Software is securely distributed with limited usage rights. The software may be an executable program and/or one or more data files such as image or multimedia data files. The software includes an access control object which prevents at least some usage of the software without use of a first access control code. The first access control code is produced based on selected information characteristic of the user'"'"'s computer system. The access control code is produced in a server computer to which the user directs a request for the access control code. The user makes a payment to receive the access control code, which is then downloaded to the user'"'"'s computer system.

Claims

1. A method of securely distributing software with limited usage rights, comprising:

supplying a software package, containing software therein, for distribution to a user, the software including an access control object for preventing at least some usage of the software on a computer system without the use of a first access control code, wherein the software includes data defining a notifier which the software causes to be displayed by means of the computer system, the notifier conveying information required by the user for ordering rights to predetermined usage of the software and enabling entry of first transaction information required for the purchase of the rights;

receiving at a server a request from the user to purchase the rights to predetermined usage of the supplied software;

receiving at the server selected information characteristic of the computer system;

obtaining payment information from the user assuring payment for the rights;

producing the first access control code based on the selected information, wherein the first access code comprises decryption means produced from the selected information; and

supplying the first access control code from the server to the predetermined computer system in response to receipt of the payment information to enable the at least some usage of the supplied software;

wherein the access control object comprises an access control executable controlling access to the software by referencing the first access control code and the selected information in the computer system.

2. The method of claim 1, wherein the step of supplying a software package comprises supplying the software package to the computer system, the software therein having a first object and a second object, the access control object comprising an access control executable controlling access to the first and second objects by referencing the first access control code and the selected information in the computer system.

3. The method of claim 2, wherein the step of supplying the first access control code comprises supplying a usage authorization package including the first access control code and information identifying authorized usages of the software, the access control executable being operative to reference the usage authorization package in controlling access to the first and second objects, the software being operative to store the usage authorization package apart from the first and second objects.

4. The method of claim 2, wherein the first object provides a first set of a plurality of features, the second object provides a second set of a plurality of features including some, but less than all, of the features included in the first set and the access control executable is operative to prevent access to the first object in the absence of the first access control code and the selected information but to enable access to the second object without reference to the first access control code or the selected information.

5. The method of claim 4, wherein the software includes a third object providing the first set of a plurality of features together with a third set including at least one feature not included in the first set, the executable being operative to prevent access to the third object in the absence of a second access control code different from the first access control code and further selected information characteristic of the computer system, the second access control code being produced based on the further selected information, the method further comprising:

supplying the second access control code to the computer system.

6. The method of claim 2, wherein the access control executable comprises a wrapper for the first and second objects.

7. The method of claim 1, wherein the decryption means comprises a decryption key.

8. The method of claim 1, wherein the decryption means comprises a decryption executable.

9. The method of claim 1, wherein the first access control code further comprises a watermark in an object supplied to the computer system.

10. The method of claim 1, wherein the software includes transaction information relating to a transaction by which the software is supplied to the user, and the access control object is operative to prevent the at least some usage of the software in the absence of the transaction information.

11. The method of claim 10, wherein the transaction information is supplied as a watermark in the software.

12. The method of claim 1, further comprising the steps of storing the first access control code at a location in the computer system apart from a location at which the software is stored.

13. The method of claim 1, further comprising supplying a system information collection code from the server to the computer system, the system information collection code being operative to obtain the selected information characteristic of the predetermined computer system.

14. The method of claim 1, wherein the software is operative to obtain the selected information from the predetermined computer system in response to entry of the payment information and to cause the computer system to transmit the selected information and the first transaction information to the server.

15. The method of claim 14, wherein the software is operative to reference information in an operating system of the computer system identifying a language selected for providing outputs to a user and to cause the software to provide such outputs in the selected language.

16. The method of claim 14, wherein the software is supplied as a software copy on a storage medium for distribution to the user, the software including an identification code identifying the software copy, the software is operative to transmit the identification code to the server, the server being operative to produce the first access control code based on the identification code.

17. The method of claim 14, wherein the software is supplied by data communication from a server to the predetermined computer system in response to a request, the request including second transaction information, the server being operative to insert transaction identification information in the software based on the second transaction information.

18. The method of claim 17, wherein the server is operative to insert the transaction identification information in the software as a watermark.

19. The method of claim 17, wherein the server is operative to produce the first access control code based on the second transaction information.

20. The method of claim 19, wherein the server is operative to supply the first access control code with an identifying watermark.

21. The method of claim 1, wherein the software comprises a first data object.

22. The method of claim 21, wherein the first data object includes a first set of features and a second set of features, the first set of features being encrypted and the second set of features being unencrypted, and wherein the step of supplying software comprises supplying a driver executable to the computer system, the driver executable including first code for accessing the first data object and decryption code for controlling decryption of the first data object.

23. The method of claim 21, wherein the first data object is encrypted, the step of supplying software including supplying a driver executable to the computer system, the driver executable including first code for accessing the first data object and decryption code for decrypting the accessed first data object.

24. The method of claim 23, wherein the driver executable is operative to receive a request for the first data object from an operating system of the computer system and to transfer the request to a preexisting driver of the computer system, the driver executable being further operative to receive the first data object from the preexisting driver, to decrypt the first predetermined object and supply the decrypted first predetermined object to the operating system.

25. The method of claim 24, wherein the first data object includes a predetermined identifier therein and the driver executable includes second code for detecting the presence of the predetermined identifier in the first data object, the decryption code being operative to decrypt the first data object in response to the presence of the predetermined identifier therein.

26. The method of claim 25, wherein the driver executable is operative to transfer a file from the preexisting driver to the operating system without modification in the absence of the predetermined identifier in the file as received from the preexisting driver.

27. The method of claim 23, wherein the first data object provides a first set of a plurality of features, the software further comprising a second data object providing a second set of a plurality of features including some, but less than all, of the features included in the first set, and a usage authorization package including information identifying authorized usages of the first and second data objects, the driver executable being operative to selectively enable usage of the first and second data objects based on the usage authorization package.

28. The method of claim 27, wherein the driver executable is operative upon a first request for access to the first or second data object to return a dialog box object for displaying a dialog box to the user, the dialog box providing the user with options for accessing the first and second data objects on a pay and/or no-pay basis.

29. The method of claim 28, wherein the driver executable is operative upon the first request for access to the first or second data object to reference information in the operating system identifying a display language selected for producing displays to a user and to provide the dialog box with text in the display language.

30. The method of claim 21, wherein only a portion of the first data object is encrypted, and wherein the step of supplying software comprises supplying a driver executable and a usage authorization package to the computer system, the usage authorization package including information identifying authorized usages of the first data object, the driver executable being operative to access the first data object and to transfer the first data object to an operating system of the computer system, wherein the driver executable selectively decrypts the portion of the first data object before transferring the first data object to the operating system based on the usage authorization package.

31. The method of claim 21, wherein the step of supplying software comprises supplying a driver executable to the predetermined computer system, the driver executable including first code for accessing the first data object in response to a request from an operating system of the computer system and being operative to determine whether a requested action utilizing the first data object is authorized, the driver executable being operative to block execution of the requested action when the same is not authorized.

32. The method of claim 31, wherein the driver executable is operative to block execution of the requested action by hooking a routine of an external executable required for performing the requested action.

33. The method of claim 21, wherein the software comprises a second data object, wherein the method further comprises producing the second data object from the first data object by reducing the information content of the first data object.

34. The method of claim 33, wherein the second data object is produced by eliminating data from the first data object.

35. The method of claim 33, wherein the second data object is produced by adding noise to the first data object.

36. The method of claim 33, wherein the second data object is produced by filtering the first data object.

37. The method of claim 33, wherein the second data object is produced by encrypting portions of the first data object.

38. The method of claim 21, wherein the software comprises a second data object, and wherein the method further comprises producing the first data object from the second data object by adding data to the second data object.

39. The method of claim 1, wherein the software comprises a first executable object.