Patent Application
20050278716
The present invention relates to digital rights management and device management. More particularly, the present invention relates to a digital rights management (DRM) license manager.
Digital Rights Management (“DRM”) is a term used to describe a range of techniques that use information about rights and rightsholders to manage copyright material and the terms and conditions on which the material is made available to users. More specifically, DRM involves the description, layering, analysis, valuation, trading, and monitoring of an owner's property rights to an asset. DRM covers the management of the digital rights to the physical manifestation of a work (e.g., a textbook) or the digital manifestation of a work (e.g., an Internet web page). DRM also covers the management of an asset whether the asset has a tangible or an intangible value. Current DRM technologies include languages for describing the terms and conditions for an asset, tracking asset usage by enforcing controlled environments or encoded asset manifestations, and closed architectures for the overall management of the digital rights.
In general, DRM protection is based on the principle that every end-entity able to consume DRM protected content is equipped with a cryptographic key, which usually is unique for every end-entity. DRM protected content is distributed, possibly together with a set of consumption rights, in encrypted form. Thus, only authorized parties, usually those that have paid for the content, are able to consume the content. This is done, for example, by encrypting the content with the public key matching the recipient's private DRM key (asymmetric key encryption). For practical reasons, usually a hybrid scheme is chosen, wherein DRM protected content is encrypted under a content encryption key (CEK) using symmetric encryption. The CEK in turn is then encrypted with the public DRM key matching the recipient's private DRM key. The CEK may be accompanied by consumption rights (which may also be encrypted) expressing the usage rules for the DRM protected content.
The effect is the same for both approaches, i.e., only authorized parties are able to consume the DRM protected content (if implemented securely and correctly). The two approaches, however, also share a drawback originating from the fact that every end-entity is equipped with a unique DRM key: content (or the CEK) has to be personalized for every device prior to consumption.
Usually, DRM content is protected (using encryption, for example) by the network side for various reasons, e.g., to guarantee payment for the content. Typically, the network infrastructure has a server for personalizing content transported in the wireless network. The network centric nature of current approaches, however, is not very suitable for certain types of content, e.g., free content. One example is content intended for preview purposes.
It is usually the case that the transfer of purchased, digital rights management (DRM)-protected content from one terminal to another cannot be performed by the end user of a terminal. Typically, the rights holders for the content want to enforce certain usage rights over content management, and this includes in most cases control over how content can be copied and which technical and security requirements have to be met.
Challenges in the context of DRM include handling the license data (e.g., distributing it to the user, checking it, managing it on the terminal), using the license data in a meaningful way, and preventing the unauthorized use of the application to be protected (e.g., copying or circumventing the rights checking). Conventional attempts at resolving these challenges do not tie the functioning of the software application to the license. Instead, only a simple check for a license is performed. Such simple checks are easily removed or manipulated.
Thus, there is a need to manage licensed software applications in a digital rights management (DRM) environment. Further, there is a need to combine copy protection mechanisms with rights management for software applications. Even further, there is a need for improved techniques for licensing, using, and preventing unauthorized use of data protected using DRM.
The present invention is directed to the use of a digital rights management (DRM) license manager to protect software applications from unauthorized use. The DRM license manager system binds essential application data to a software license. This binding is achieved by adding an encryption key to a software license and encrypting the application data with that key. The essential application data is any kind of data which is required for proper operation of the program, such as media files, game levels or state tables. The DRM license manager system performs a check and decrypt operation of the essential application data during program run time. It requires that the license is available on the system. It also ensures that the decryption operation can only take place if the conditions defined in the license are met.
Briefly, one exemplary embodiment relates to a method of managing licensed software applications in a digital rights management (DRM) environment. The method includes unpacking a software application package including application code, a control file, and one or more data files; encrypting the one or more data files; installing the application code into a terminal; and at run time for an application associated with the application code, verifying that a license corresponding to the application is present in the terminal and, if so, providing decrypted one or more data files to the installed application code.
Another exemplary embodiment relates to a device that includes a licensed software application subject to digital rights management (DRM) limitations. The device includes installed application code corresponding to a software application and a digital rights management (DRM) license checker. When the software application is run, the DRM license checker verifies that a license associated with the software application is present, and if the license is present, the DRM license checker decrypts an encrypted data file and provides the decrypted data file to the installed application code.
Yet another exemplary embodiment relates to a system for managing licensed applications. The system includes essential application data, a license checker, and a license manager. The essential application data includes data needed by an application for proper operation. When the application is run, the license checker verifies that a license associated with the essential application data is correct. The license manager provides application code for installation and encrypts essential application data that is provided to the application code at application run time if the license checker verifies that the license is valid.
Other principle features and advantages of the invention will become apparent to those skilled in the art upon review of the following drawings, the detailed description, and the appended claims.
Exemplary embodiments will hereafter be described with reference to the accompanying drawings.
The software application package may or may not have an associated software license available on the terminal or system on which the software application is loaded. The license checker 40 determines if the correct license is present in the terminal or system. If the software license is available, the software application can be executed. Otherwise, it cannot.
A software license 34 with an encryption key 36 is generated and used to encrypt the encrypted application package 12. The software license 34 can include various types of information relevant for implementing the license. For example, in one embodiment the software license 34 can include an actual encryption key, as well as a list of license constraints or conditions for setting establishing the license conditions, and user identification information for identifying the licensee. The encrypted application package 12 is provided to a digital rights management (DRM) license manager 22. The DRM license manager 22 decrypts and unpacks the application package, identifies the definition file 16 and data files 18 and 20, and encrypts the data files 18 and 20 using the encryption key 36 from the software license 34 to form encrypted data files 24 and 26. The DRM license manager 22 provides the original application code 14 to an application installer 30 which installs the code as installed application code 32.
In an operation 42, an original software application code is decrypted and unpacked from an encrypted software application package. In addition to the original software application code, the encrypted software application package contains a control file and data files. In an operation 44, the data files are encrypted using the encryption key that is generated to encrypt the software application package. In an operation 46, the original software application code is installed for execution in a terminal or device.
Before the installed code can be executed, in an operation 48, a license checker verifies that a correct license is present in the terminal or device. Once verification of the license is performed, the encrypted data file that was unpacked from the software application package and encrypted is decrypted and provided to the installed application code, in an operation 50, such that the code can execute.
A license can be configured to control content in a variety of ways. For example, the license can be time-based allowing the end user to use the software application for a predetermined period of time (i.e. 30 days, 60 day, etc.). The period of time can begin upon any number of events, such as installation of the software application code or first use of the software application. Upon expiration of the predetermined time period, the license will expire and the decrypted data file will no longer be supplied to the software application effectively disabling use of the software application. The DRM license checker can be configured to check a timer to determine if the time period has expired or a separate application can be included for checking the timer and removing the license when the timer expires.
Another possible license scheme can be count-based. In other words, the end user can be granted a license to use the software application a predetermined number of time (i.e. 5, 10, etc.). A counter can be included to track each usage and after the end user has used the software application the predetermined number of times the decrypted data file will no longer be supplied to the software application disabling use of the software application. As with the time-based scheme discussed above, the DRM license checker or a separate application can be used to check the timer to determine when the license has expired.
A location or event-based scheme can also be used. In this scheme, the license can be tied to a location or event such as a conference or seminar. In this situation, the license can be tied to usage within a specific, predetermined geographical location, such as a conference hall or the city in which the conference is being held. The terminal on which the software application runs may be configured to include a position tracking device, such as GPS, and the DRM license checker (or a separate application) can be configured to check the location of the terminal, as provided by the position tracking device, to determine if the terminal is currently present in the predetermined geographical location. If it is, the decrypted application data can be supplied and the software application can be used. If not, the decrypted application data is not supplied disabling the software application.
In addition to the individual schemes described above, a combination of these schemes can be used. For example, in an event-based scheme allowing access to a software application during a conference, the DRM license checker (or another application) can check location, to determine whether the user is in the conference hall, and time, to determine that the conference is still in session. Other combinations can also be used. Furthermore, the license constraints (schemes) can be tied to individual users instead of terminals. In this situation, the DRM license checker (or another application) can first check the user login ID or the device SIM card to determine which license constraints (scheme) to use and then can determine if the license meets the constraints before providing the decrypted data files. Other constraints, such as a prohibition on copying, can be included along with the constraints specifically described herein.
Previous attempts at managing digital rights management licenses have not tied the functioning of the application to the license. Instead, a simple check if the license is available was performed. These simple checks can be easily removed or manipulated by an attacker. One advantage in the systems and methods described with reference to the FIGURES is the use of essential data which in turn is tied by encryption to the license.
This detailed description outlines exemplary embodiments of a method, device, and system for a managing licensed applications within a digital rights management (DRM) environment. In the foregoing description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It is evident, however, to one skilled in the art that the exemplary embodiments may be practiced without these specific details. In other instances, structures and devices are shown in block diagram form in order to facilitate description of the exemplary embodiments.
While the exemplary embodiments illustrated in the FIGURES and described above are presently preferred, it should be understood that these embodiments are offered by way of example only. Other embodiments may include, for example, different techniques for performing the same operations. The invention is not limited to a particular embodiment, but extends to various modifications, combinations, and permutations that nevertheless fall within the scope and spirit of the appended claims.
