Software signature tracking

• US 8,769,296 B2
• Filed: 10/13/2010
• Issued: 07/01/2014
• Est. Priority Date: 10/19/2009
• Status: Active Grant

• Current Assignee: Atreus Labs LLC
• Original Assignee: Uniloc Luxembourg S.à r.l. (f/k/a Uniloc Luxembourg S.A.) (Uniloc Corporation Pty. Limited)
• Inventors: Etchegoyen, Craig S.
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US12/903,980
• Publication Number:
  US 20110093701A1
• Time in Patent Office: 1,357 Days
• Field of Search: 713/165, 713/176, 713/187, 726/26
• US Class Current: 713/187
• CPC Class Codes: G06F 21/1078 Logging; Metering
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs

Abstract

A method for preventing unauthorized use of software may be achieved by executing computer-readable code with instructions for recording an indication of at least one selected file of a software application in a memory location accessible to a security component of the software application, in which software application the security component is configured to cause a hash signature of the at least one selected file to be generated in response to a signal arising from use of the software application, hashing the at least one selected file to generate a first file signature, transmitting the first file signature to a secure network-accessible computer memory for storage and subsequent comparison to at least one subsequent file signature generated via operation of the security component on a client device, comparing the first file signature to a second file signature generated by the security component in response to a signal arising from use of the software application on the client device, and disabling the software application on the client device, in response to determining that the first file signature does not match the second file signature.

Claims

1. A method for preventing unauthorized use of software, comprising:

recording, using a computer, an indication of at least one selected file of a software application in a memory location accessible to a security component of the software application, in which software application the security component is configured to cause a hash signature of the at least one selected file to be generated in response to a use event for the software application;

hashing the at least one selected file to generate a first file signature;

transmitting the first file signature to a secure network-accessible computer memory for storage and subsequent comparison to at least one subsequent file signature generated via operation of the security component on a client device;

comparing the first file signature to a second file signature generated by the security component in response to a signal arising from use of the software application on the client device;

storing metadata identifying the client device, the software application, and a date that the second file signature is generated, in a database of file signature data;

storing results from comparing the second file signature to the first file signature, in association with an identifier for the client device; and

disabling the software application on the client device, in response to determining that the first file signature does not match the second file signature.

2. The method of claim 1, further comprising transmitting the first file signature to the client device for comparison to the second file signature generated on the client device.

3. The method of claim 1, further comprising comparing the second file signature to the first file signature using the security component of the software application.

4. The method of claim 1, further comprising comparing the first file signature to the second file signature in response to a use event for the software application on the client device.

5. The method of claim 4, wherein the signal is caused by installation of the software application on the client device.

6. The method of claim 4, wherein the signal is caused by execution of the software application on the client device.

7. The method of claim 1, further comprising generating a report tracking instances of generations of second file signatures for the software application across multiple client devices.

14. The method of claim 1 wherein the memory location is on a remote online database.

8. A method for preventing unauthorized use of software, comprising:

generating a file signature of a designated executable file installed on a client device, using a hashing algorithm, in response to use of an application of which the designated executable file is a component;

causing the file signature to be compared to an earlier file signature determined for the designated executable file to obtain comparison results indicating whether the file signature matches the earlier file signature by transmitting the file signature to a remote device with metadata (i) describing the application, (ii) including a date that the file signature is generated, and (iii) indicating an identifier for the client device for comparison to the earlier file signature, and receiving the comparison results in response; and

disabling use of the application on the client device in response to the comparison results.

9. The method of claim 8, wherein disabling use of the application further comprises disabling at least one function of the application in response to comparison results indicating that the file signature does not match the earlier file signature.

10. A non-transitory computer-readable medium encoded with instructions, that when executed by a processor, cause a computer to:

generate a file signature of a designated executable file installed on a client device, using a hashing algorithm, in response to use of an application of which the designated executable file is a component;

transmit the file signature to a remote device with metadata (i) describing the application, (ii) indicating a date that the second file signature is generated, and (iii) indicating an identifier for the client device;

initiate a comparison between the file signature and an earlier file signature determined for the designated executable file to obtain comparison results indicating whether the file signature matches the earlier file signature; and

disable use of the application in response to the comparison results.

11. The non-transitory computer-readable medium of claim 10, wherein the instructions are further configured to cause the computer to disable at least one function of the application in response to comparison results indicating that the file signature does not match the earlier file signature.

12. The non-transitory computer-readable medium of claim 10, wherein the instructions are further configured to cause the file signature to be compared by transmitting the file signature to a remote device for comparison to the earlier file signature, and receiving the comparison results in response.

13. A system for preventing unauthorized use of software, comprising:

a computer having a processor;

memory coupled to the computer and encoded with instructions, that when executed by the processor, cause the computer to;

generate a file signature of a designated executable file installed on the computer, using a hashing algorithm, in response to use of an application of which the designated executable file is a component;

generate an identifier for the computer from a combination of non-user-configurable device identifiers encoded by different manufacturers;

transmit the file signature to a remote device with metadata indicating the identifier for the computer, the application, and a date that the file signature is generated;

initiate a comparison between the file signature and an earlier file signature determined for the designated executable file to obtain comparison results indicating whether the file signature matches the earlier file signature; and

disable use of the application in response to the comparison results.