Digital license migration from first platform to second platform

• US 7,805,375 B2
• Filed: 12/21/2005
• Issued: 09/28/2010
• Est. Priority Date: 08/22/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Siu, Michael Y., Fox, Christopher J., Bordenet, Matthew J., Strom, Clifford P., DiAcetis, Stephen P.
• Primary Examiner(s): Hewitt, II; Calvin L
• Assistant Examiner(s): Nigh; James D
• Application Number:
  US11/316,509
• Publication Number:
  US 20070043680A1
• Time in Patent Office: 1,742 Days
• Field of Search: 705 50- 51, 705/59, 705/56
• US Class Current: 705/59
• CPC Class Codes: G06F 21/1011 to devices
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A digital license is migrated from a source platform to a target platform. At the source platform, a migration image is produced to include the license and corresponding data therein, and the license is deleted from such source platform. At the target platform, permission is requested from a centralized migration service to migrate the license in the migration image to the target platform. The migration service determines whether to permit migration of the license based on predetermined migration policy. Upon receiving the requested permission as a response from the migration service, the migration image is applied to the target platform by un-tying the license from the source platform and re-tying the license to the target platform.

Claims

1. A method for receiving, by a migration engine at a target platform, a digital license from a migration engine associated with a source platform, the method comprising:

receiving, by the target platform, from the migration engine associated with the source platform, a migration image comprising a device identifier of the source platform, a digital license, and license data, said license data further comprising one or more source platform public key encrypted application decryption keys, and a key file comprising a migration service key encrypted private key of the source platform;

sending, by the target platform, a request to the migration service, the request comprising a device identifier of the source platform, a device identifier of the target platform, and the key file;

receiving, by the target platform, a response from the migration service, the response comprising the private key from the migration service key encrypted private key; and

accessing, by the target platform, the one or more application decryption keys by decrypting the license data using the private key of the source platform.

2. The method of claim 1 further comprising:

receiving at the target platform with the migration image, information showing that the digital license and a private key (PR-SP) were deleted from the source platform such that replacing the deleted license at the source platform would not allow rendering of the protected digital content at the source platform inasmuch as the private key (PR-SP) would not be available to access (KD) from such replaced license;

applying the migration image to the target platform based on the response by tying the un-tied license to the target platform by including (KD) therein encrypted and decryptable according to a public key of the target platform (PU-TP) to result in (PU-TP(KD)), only the target platform with a corresponding private key (PR-TP) normally applying same to (PU-TP(KD)) to reveal (KD), and storing the re-tied license at the target platform.

3. The method of claim 1 wherein the migration image comprises information showing that the source platform migration engine had been instantiated at the source platform.

4. The method of claim 1 further comprising instantiating the migration engine at the target platform, the migration engine at the target platform for applying the migration image at the target platform.

5. The method of claim 1 wherein the migration image comprises information showing that a user at the source platform had selected the license to be migrated to the target platform.

6. The method of claim 1 wherein receiving migration image comprises data specific to the license, the data specific to the license including data specific to the source platform, state information relating to the license as maintained in a state store at the source platform, the platform identification of the source platform and platform information regarding the source platform and identifying particular hardware, software and/or operating system features of the source platform.

7. The method of claim 6 comprising requesting permission from the centralized migration service to migrate the license, the request having request data including a platform ID identifying the target platform, the platform identification of the source platform as obtained from the migration image, platform information regarding the target platform and identifying particular hardware, software and/or operating system features of the target platform, and at least a portion of the platform information regarding the source platform as obtained from the migration image, and receiving as a response to the request a determination from the centralized migration service to permit migration of the license based on predetermined migration policy that takes into account such request data.

8. The method of claim 1 wherein the migration image received at the target platform includes at least one of a digital signature and a hash based on at least a portion of the migration image such that the centralized migration service may employ such signature or hash to verify that the migration image has not been altered.

9. The method of claim 1 wherein the migration image comprises information showing that the migration image had been saved to a selected location at the source platform, receiving the migration image from the selected location at the source platform to a selected location at the target platform, and retrieving the migration image from the selected location at the target platform.

10. The method of claim 2 further comprising the target platform resigning the re-tied license.

11. A computer-readable storage medium comprising computer readable instructions that when executed by a processor cause the processor to perform the steps of

receiving, by the target platform, from the migration engine associated with the source platform, a migration image comprising a device identifier of the source platform, a digital license, and license data, said license data further comprising one or more source platform public key encrypted application decryption keys, and a key file comprising a migration service key encrypted private key of the source platform;

sending, by the target platform, a request to the migration service, the request comprising a device identifier of the source platform, a device identifier of the target platform, and the key file;

receiving, by the target platform, a response from the migration service, the response comprising the private key from the migration service key encrypted private key; and

accessing, by the target platform, the one or more application decryption keys by decrypting the license data using the private key of the source platform.

12. The medium of claim 11 further comprising instructions for:

receiving at the target platform with the migration image, information showing that the digital license and a private key (PR-SP) were deleted from the source platform such that replacing the deleted license at the source platform would not allow rendering of the protected digital content at the source platform inasmuch as the private key (PR-SP) would not be available to access (KD) from such replaced license;

applying the migration image to the target platform based on the response by tying the un-tied license to the target platform by including (KD) therein encrypted and decryptable according to a public key of the target platform (PU-TP) to result in (PU-TP(KD)), only the target platform with a corresponding private key (PR-TP) normally applying same to (PU-TP(KD)) to reveal (KD), and storing the re-tied license at the target platform.

13. The medium of claim 11 wherein the migration image comprises information showing that the migration image was produced by the migration engine associated with the source platform to include the license and data specific to the license, the data specific to the license including data specific to the source platform, state information relating to the license as maintained in a state store at the source platform, the platform identification of the source platform and platform information regarding the source platform and identifying particular hardware, software and/or operating system features of the source platform.

14. The medium of claim 11 the request to the migration service comprises request data including a platform ID identifying the target platform, the platform ID of the source platform as obtained from the migration image, platform information regarding the target platform and identifying particular hardware, software and/or operating system features of the target platform, and at least a portion of the platform information regarding the source platform as obtained from the migration image, and receiving as a response to the request a determination from the centralized migration service to permit migration of the license based on predetermined migration policy that takes into account such request data.

15. The medium of claim 11 wherein the migration image received at the target platform includes the license and the cryptographic key of the source platform encrypted and decryptable by the migration service.

16. The medium of claim 15 wherein the to the migration service comprises request data including the encrypted cryptographic key of the source platform, and receiving the requested permission as a response from the centralized migration service, the response including the cryptographic key of the source platform encrypted and decryptable by the target platform.

17. The medium of claim 11 wherein the migration image received at the target platform includes at least one of a digital signature and a hash based on at least a portion of the migration image, such that the centralized migration service may employ such signature or hash to verify that the migration image has not been altered.

18. The medium of claim 11 wherein receiving the migration image further comprises receiving data sufficient to indicate that the migration image had been saved to a selected location at the source platform, and receiving the migration image from the selected location at the source platform to a selected location at the target platform, and retrieving the migration image from the selected location at the target platform.