Activation system architecture

• US 8,620,818 B2
• Filed: 06/25/2007
• Issued: 12/31/2013
• Est. Priority Date: 06/25/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hughes, Aidan T., Baxter, Alexander V., Kenworthy, Mark, Frank, Alexander, Szimmetat, Oliver
• Primary Examiner(s): CHEUNG, CALVIN K
• Application Number:
  US11/821,777
• Publication Number:
  US 20080319779A1
• Time in Patent Office: 2,381 Days
• Field of Search: 705/51, 705/59, 726/32, 726/33, 726/34
• US Class Current: 705/59
• CPC Class Codes: G06Q 2220/18 Licensing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 50/184 Intellectual property management
• CPC Class Codes: G06Q 99/00 Subject matter not provided for in other groups of this subclass

Abstract

Techniques are described for generating a license for software installed on a device. An entitlement certificate is generated including one or more entitlements describing license characteristics of the software. The one or more entitlements are determined in accordance with first information about the software. The first information includes at least one of a purchase token and package information. A binding certificate in accordance with a binding type for the software is generated. A license in accordance with said binding certificate and said entitlement certificate is generated. The binding certificate identifies an entity to which the license is bound.

Claims

1. A method performed by at least one computer processing unit, the method comprising:

accessing an entitlement certificate, wherein the entitlement certificate includes;

one or more entitlements describing license characteristics of software, said one or more entitlements being determined based on a purchase token for the software or package information comprising an identifier of said software; and

a binding type identifying a particular device type to which the license may be bound;

accessing a binding certificate identifying a device, the binding certificate and the entitlement certificate comprising separate digital signatures;

determining whether the device identified by the binding certificate is an instance of the binding type;

when the device identified by the binding certificate is an instance of the binding type, generating a first license for the device identified by the binding certificate to use a first copy of the software, the first license being generated based on said binding certificate and said entitlement certificate;

storing the license in a license database; and

querying the license database to generate a second license for a second copy of the software.

2. The method of claim 1, wherein the method is performed by a licensing server having the at least one computer processing unit.

3. The method of claim 1, further comprising:

receiving the purchase token and the package information from the device;

determining said one or more entitlements using an entitlements database; and

generating the entitlement certificate.

4. The method of claim 3, wherein said purchase token and said package information are obtained from the device during installation of the software on the device.

5. The method of claim 1, wherein said binding type is one of:

a hardware identifier binding, a trusted platform module binding, or a portable secure identification device identifier binding.

6. The method of claim 5, wherein the binding type is the hardware identifier binding, the binding certificate is generated by the device, and the accessing the binding certificate comprises receiving the binding certificate from the device.

7. The method of claim 5, further comprising:

when the binding type is a type other than the hardware identifier binding;

sending binding data from the device to a binding service; and

receiving said binding certificate from said binding service.

8. The method of claim 1, further comprising:

transmitting said first license to said device for use in connection with subsequent launches of the first copy of said software.

9. The method of claim 1, wherein the second license entitles a second device to use the second copy of the software.

10. The method of claim 1, further comprising:

generating additional licenses for additional devices based on a plurality of additional entitlement certificates and a plurality of additional binding certificates, the plurality of additional entitlement certificates including binding types for the additional licenses for the software, the binding types comprising;

a hardware identifier binding type reflecting hardware of a computer to which the additional licenses may be bound;

a secure identification device binding type reflecting a dongle, USB device, or smart card to which the additional licenses may be bound; and

a trusted platform module binding type reflecting a trusted platform module to which the additional licenses may be bound.

11. A method performed by at least one computer processing unit of a licensing service, the method comprising:

accessing an entitlement certificate, wherein the entitlement certificate includes;

one or more entitlements describing characteristics of a license for software; and

a binding type identifying a particular device type to which the license may be bound;

accessing a binding certificate identifying a device, the binding certificate and the entitlement certificate comprising separate digital signatures;

determining whether the device identified by the binding certificate is an instance of the binding type; and

when the device identified by the binding certificate is an instance of the binding type, generating the license for the device identified by the binding certificate to use the software, the license being generated based on said binding certificate and said entitlement certificate, and

wherein the entitlement certificate is digitally signed using a first encryption key that is particular to an entitlement service that generates the entitlement certificate, and

wherein the binding certificate is digitally signed using a second encryption key that is particular to a binding service that generates the binding certificate.

12. The method of claim 11, wherein the binding service and the entitlement service are remote from the device and the licensing service.

13. The method of claim 11, further comprising verifying the entitlement certificate using a first public key counterpart of the first encryption key that is particular to the entitlement service.

14. The method of claim 13, further comprising verifying the binding certificate using a second public key counterpart of the second encryption key that is particular to the binding service.

15. A method performed by at least one computer processing unit of a licensing service, the method comprising:

accessing an entitlement certificate generated by an entitlement service, wherein the entitlement certificate includes;

one or more entitlements describing characteristics of a license for software;

a binding type identifying a particular device type to which the license may be bound; and

a first digital signature generated using a first private key of the entitlement service;

accessing a binding certificate identifying a device, the binding certificate comprising a second digital signature generated using a second private key;

verifying the entitlement certificate using a first public key corresponding to the first private key;

verifying the binding certificate using a second public key corresponding to the second private key; and

provided the entitlement certificate and the binding certificate are verified and the device is an instance of the binding type, generating the license for the device identified by the binding certificate to use the software.

16. The method of claim 15, wherein the entitlement certificate identifies a hardware identifier binding type and the device is a computer.

17. The method of claim 16, wherein:

the accessing the binding certificate comprises receiving the binding certificate from the computer, and

the second private key and the second public key are associated with the computer.

18. The method of claim 15, wherein the entitlement certificate identifies a trusted platform module binding type and the device is a trusted platform module.

19. The method of claim 18, wherein:

the accessing the binding certificate comprises receiving the binding certificate from a binding service, and

the second private key and the second public key are associated with the binding service.

20. The method of claim 15, wherein:

the entitlement certificate identifies a portable secure identification device binding type,

the device is a portable secure identification device,

the accessing the binding certificate comprises receiving the binding certificate from a binding service, and

the second private key and the second public key are associated with the binding service.