Apparatus and method for controlling access to software

• US 5,933,497 A
• Filed: 01/29/1993
• Issued: 08/03/1999
• Est. Priority Date: 12/14/1990
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Moran, James William, Reardon, Francis Joseph Jr., Beetcher, Robert Carl, Corrigan, Michael Joseph
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/011,042
• Time in Patent Office: 2,377 Days
• Field of Search: 380/4, 380/9, 380/20, 380/21, 380/23, 380/25, 380/43, 380/44, 380/49, 380/50
• US Class Current: 705/59
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs

Abstract

Software is distributed without entitlement to run, while a separately distributed encrypted entitlement key enables execution of the software. The key includes the serial number of the computer for which the software is licensed, together with a plurality of entitlement bits indicating which software modules are entitled to run on the machine. A secure decryption mechanism contained on the computer fetches its serial number and uses it as a key to decrypt the entitlement information, which is then stored in a product lock table in memory. The distributed software contains a plurality of entitlement verification triggers. Each trigger is a single machine instruction in the object code, identifying a product number of the software module. When a trigger is encountered during execution, the computer checks the product lock table entry corresponding to the product number of the software. If the product is entitled to run, execution continues normally; otherwise execution is aborted. Because this verification involves only a single machine instruction, it can be done with virtually no impact to overall system performance. As a result, it is possible to place a substantial number of such entitlement verification triggers in the object code, making it virtually impossible for someone to alter the code by "patching" the triggers. The triggering instruction may alternatively perform some useful work in parallel with entitlement verification.

Claims

1. An apparatus for controlling the use of a software module executing on a computer system, said computer system comprising:

means for granting entitlement for said computer system to execute said software module, said software module being a program unit that is discrete and identifiable with respect to compiling, combining with other units, and loading;

a plurality of independent triggering means in said software module for triggering entitlement verification;

entitlement verification means, responsive to each of said plurality of independent triggering means, for verifying that said computer system has entitlement to execute said software module; and

means, responsive to said entitlement verification means, for aborting execution of said software module if said entitlement verification means determines that said computer system lacks entitlement to execute said software module.

2. The apparatus for controlling the use of a software module of claim 1, wherein each of said plurality of independent triggering means is a single object code instruction which triggers said entitlement verification means.

3. The apparatus for controlling the use of a software module of claim 2, wherein said object code instruction which triggers said entitlement verification means also causes said computer system to perform an additional function required for proper execution of said software module concurrently with verifying that said computer system has entitlement to execute said software module, whereby if said software module is modified by removing said object code instruction, said additional function required for proper execution of said software module will not be performed.

4. The apparatus for controlling the use of a software module of claim 2, wherein said object code instruction which triggers said entitlement verification means contains a product number for said software module.

5. The apparatus for controlling the use of a software module of claim 4, wherein said entitlement verification means comprises:

a product lock table in said computer system, said product lock table comprising a plurality of entries containing entitlement information, wherein each of said plurality of entries is associated with a product number; and

means, responsive to said object code instruction, for accessing entitlement information contained in an entry in said product lock table associated with said product number contained in said object code instruction.

6. The apparatus for controlling the use of a software module of claim 1, wherein said means for granting entitlement for said computer system to run said software module comprises:

means for generating an entitlement key consisting of data; and

means for inputting said entitlement key into said computer system.

7. The apparatus for controlling the use of a software module of claim 6, wherein said computer system contains a unique identifier, wherein said means for generating an entitlement key uses said unique identifier to generate said entitlement key, and wherein said entitlement key grants entitlement to run software only on a computer system containing the same unique identifier.

8. The apparatus for controlling the use of a software module of claim 7, further comprising:

means for encrypting said entitlement key using said unique identifier, wherein the resultant encrypted entitlement key may be decrypted only on a computer system having the same unique identifier;

means in said computer system for accessing the unique identifier of said computer system; and

means in said computer system, responsive to said means for accessing said unique identifier, for decrypting said encrypted entitlement key.

9. A method for controlling the use of a software module executing on a computer system, said software module comprising a plurality of object code instructions, said method comprising the steps of:

granting entitlement for said computer system to execute said software module, said software module being a program unit that is discrete and identifiable with respect to compiling, combining with other units, and loading;

placing in said software module a plurality of independent triggering means for triggering entitlement verification;

executing object code instructions contained in said software module;

triggering an entitlement verification in said computer system to verify that said computer system has entitlement to execute said software module whenever one of said plurality of independent triggering means is encountered during execution of said object code instructions contained in said software module;

aborting execution of said software module if said entitlement verification determines that said computer system lacks entitlement to execute said software module.

10. The method for controlling the use of a software module of claim 9, wherein said step of placing in said software module a plurality of independent triggering means comprising placing, at each of a plurality of separate locations in said software module, a single object code instruction which triggers said entitlement verification.

11. The method for controlling the use of a software module of claim 10, wherein said object code instruction which triggers said entitlement verification also causes said computer system to perform an additional function required for proper execution of said software module concurrently with verifying that said computer system has entitlement to execute said software module, whereby if said software module is modified by removing said object code instruction, said additional function required for proper execution of said software module will not be performed.

12. The method for controlling the use of a software module of claim 10, wherein said object code instruction which triggers said entitlement verification contains a product number for said software module.

13. The method for controlling the use of a software module of claim 12, further comprising the step of:

maintaining a product lock table in said computer system, said product lock table comprising a plurality of entries containing entitlement information, wherein each of said plurality of entries is associated with a product number; and

wherein said step of triggering an entitlement verification comprises accessing entitlement information contained in an entry in said product lock table associated with said product number contained in said object code instruction.

14. The method for controlling the use of a software module of claim 9, further comprising the steps of:

generating an entitlement key consisting of a plurality of data bits, said entitlement key providing information enabling said computer system to determine whether or not it has entitlement to execute said software module; and

inputting said entitlement key into said computer system.

15. The method for controlling the use of a software module of claim 14, wherein said computer system contains a unique identifier, wherein said step of generating an entitlement key uses said unique identifier to generate said entitlement key, and wherein said entitlement key grants entitlement to run software only on a computer system containing the same unique identifier.

16. A program product apparatus for controlling entitlement, wherein said program product apparatus executes on a computer system having means for receiving entitlement to execute a software module, and having entitlement verification means responsive to triggering means in said software module for verifying that said computer system has entitlement to execute said software module, said program product apparatus comprising:

at least one software module recorded on recording media, said software module being a program unit that is discrete and identifiable with respect to compiling, combining with other units, and loading; and

a plurality of independent triggering means in said software module for triggering said entitlement verification means on said computer system.

17. The program product apparatus for controlling entitlement of claim 16, wherein each of said plurality of independent triggering means is a single object code instruction which triggers said entitlement verification means.

18. The program product apparatus for controlling entitlement of claim 17, wherein said object code instruction which triggers said entitlement verification means also causes said computer system to perform an additional function required for proper execution of said software module concurrently with verifying that said computer system has entitlement to execute said software module, whereby if said software module is modified by removing said object code instruction, said additional function required for proper execution of said software module will not be performed.

19. The program product apparatus for controlling entitlement of claim 17, wherein:

said object code instruction which triggers said entitlement verification means contains a product number for said software module;

said entitlement verification means on said computer system comprises a product lock table in said computer system, said product lock table comprising a plurality of entries containing entitlement information, wherein each of said plurality of entries is associated with a product number; and

said entitlement verification means on said computer system further comprises means, responsive to said object code instruction, for accessing entitlement information contained in an entry in said product lock table associated with said product number contained in said object code instruction.

20. A method for distributing a software module, wherein said software module is capable of executing on any one of a plurality of computer systems, each of said computer systems having means for receiving entitlement to execute said software module, and having entitlement verification means responsive to triggering means in said software module for verifying that said computer system has entitlement to execute said software module, said method comprising the steps of:

placing in said software module a plurality of independent triggering means for triggering said entitlement verification means, said software module being a program unit that is discrete and identifiable with respect to compiling, combining with other units, and loading;

distributing a copy of said software module to each of said computer systems; and

granting entitlement for at least one of said computer systems to execute said software module.

21. The method for distributing a software module of claim 20, wherein said step of placing in said software module a plurality of independent triggering means comprises placing, at each of a plurality of separate locations in said software module, a single object code instruction which triggers said entitlement verification means.

22. The method for distributing a software module of claim 21, wherein said object code instruction which triggers said entitlement verification also causes said computer system to perform an additional function required for proper execution of said software module concurrently with verifying that said computer system has entitlement to execute said software module, whereby if said software module is modified by removing said object code instruction, said additional function required for proper execution of said software module will not be performed.

23. The method for distributing a software module of claim 21, wherein:

said object code instruction which triggers said entitlement verification means contains a product number for said software module;

said entitlement verification means on said computer system comprises a product lock table in said computer system, said product lock table comprising a plurality of entries containing entitlement information, wherein each of said plurality of entries is associated with a product number; and

said entitlement verification means on said computer system further comprises means, responsive to said object code instruction, for accessing entitlement information contained in an entry in said product lock table associated with said product number contained in said object code instruction.

24. The method for distributing a software module of claim 20, wherein said step of granting entitlement for said computer system to execute said software module comprises the steps of:

generating an entitlement key consisting of a plurality of data bits, said entitlement key providing information enabling said computer system to determine whether or not it has entitlement to execute said software module; and

transmitting said entitlement key to said computer system.

25. The method for controlling the use of a software module of claim 24, wherein said computer system contains a unique identifier, wherein said step of generating an entitlement key uses said unique identifier to generate said entitlement key, and wherein said entitlement key grants entitlement to run software only on a computer system containing the same unique identifier.

26. The method for controlling the use of a software module of claim 20, wherein:

said step of distributing said software module comprises distributing a plurality of software modules, each having a plurality of independent triggering means for triggering entitlement verification, on a single recording medium; and

said step of granting entitlement for said computer system to execute said software module comprises granting separate entitlement to at least two of said plurality of software modules on said single recording medium.