SECURE SOFTWARE LICENSING CONTROL MECHANISM

The present invention relates to a control mechanism of licensed software. More particularly, the present invention relates to a system and method for protecting licensed software applications within a computer system from piracy.

BACKGROUND TO THE INVENTION

Piracy of digital content such as software and any content of any kind that is digitally stored and distributed is getting more prevalent nowadays. In order to curb the piracy of software and to sustain the business model of charging customers based on number of software installed, a mechanism for software licensing control is required. The purpose of software licensing control is to make sure that only users that have purchased the software is capable of using the software.

One of the most common license control mechanism is based on license key. Most of the time, the license key is fixed or depending on the combination of username and organization data provided by the end user. U.S. Patent No. 7,200,760 describes a data encryption/decryption system where a user must obtain a license key in order to decrypt the critical data elements before the software program can use them. The data elements can be chosen such that their contents provide a control mechanism for the correct operation of the executable software program. The system allows for the inclusion of different data elements with or within a single version of the software program. However, this method can be easily cracked if the algorithm to derive the license key is known.

Another method is based on having an external hardware or token connected to the computer via parallel port, COM port or USB. U.S Patent No. 7,174,568 describes a product distribution and payment system for limited use or otherwise restricted digital software products which is made available to customers through a detachable local storage medium, such as a DVD or CD-

ROM disc, or over a network connection. The software product may comprise a limited use product that is restricted in the number of plays or duration of use and the end user is allowed to download and purchase the product using his computer or playback console. When the preset time or number of plays has elapsed the software program is frozen and access to the program is not allowed. In one embodiment of the present invention, a two-way, public key/private key encryption system is implemented to transmit the product and usage information between the server providing the software product and the customer computer system. However, this method allows the system to provide a machine dependent control but not a user dependent control.

SUMMARY OF THE INVENTION

The present invention is directed to overcoming one or more of the problems due to the limitations and disadvantages of the related arts.

It is an object of the present invention to provide a secure software licensing control mechanism.

At least one of the above and other objects may be realized by providing a system and method for protecting a licensed software application from piracy within a computer system by using a smart card and license code. The system for protecting a licensed software application comprises a smart card containing a digital certificate and a private key, a licensed software containing a software module for authentication, a registration software running on a registration server and a license code generator which is running on a software vendor server for license code generation and encryption.

Meanwhile, the method comprises the steps of determining the presence of a license code, decrypting the license code using user's private key from the smart card, verifying a digital signature in the license code, and checking the expiry date of the software for execution of the software application. If the license code is not available, the method further requires the user to use certificate-based-login to a website and register using the smart card that is

provided by the software vendor. Subsequently, user's information and certificate is sent through a secure channel to the vendor's server and server side application digitally signs the program license expiry date and encrypt with recipient public key. Then, the license code is sent back to the user and the decryption and verification process of the digital signature repeats.

It is an advantage of the present invention to provide flexibility by allowing software companies to implement user dependent license control.

It is another advantage of the present invention to implement an asymmetric algorithm instead of symmetric algorithm used by a token which makes a license code unique for the user and therefore the software cannot activated by a different user.

These and other aspects, objects, features and advantages of the present invention will be more clearly understood and appreciated from a review of the following detailed description of the preferred embodiment and appended claims, and by reference to the accompanying drawings.

BRIEF DESCRtPTION OF THE DRAWINGS

The specific features, aspects, and advantages of the present invention will become better understood with regard to the following description, appended claims, and accompanying drawings where:

Fig. 1 illustrates a system for protecting licensed software applications from piracy within a computer system using a license code and a smart card according to the present invention; and

Fig. 2 illustrates a diagram flow of a method for protecting licensed software applications from piracy within a computer system according to the present invention.

DETAILED DESCRIPTION OF THE INVENTION

In the following description of the preferred embodiments of the present invention, reference is made to the accompanying drawings which form a part hereof, and in which is shown by way of illustration specific embodiments in which the invention may be practiced. It is understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the present invention.

Referring to Fig. 1, a system for protecting licensed software applications 31 within a computer system from piracy according to the present invention comprises of:

a smart card 32 containing a user digital certificate and a private key to decrypt license code sent by software vendor;

a licensed software 31 installed in a computer 30 wherein the licensed software 31 contains a software module 33 which communicates with the smart card 32 in the authentication process;

a registration software 11 running on a registration server 10 wherein the registration software 11 interacts with. the software module 33 through digital certificate based mutual authentication; and

a license code generator 21 running on a software vendor server 20 for license code generation and encryption.

In Fig. 2, when a user executes the licensed software 31, the software module 33 communicates with the smart card 32 to decrypt the license code and to verify the digital signature in the license code to check the expiry date of the software 31. The license code is decrypted using a private key in the smart card 32. Once the date has been verified, the software 33 is allowed to execute.

If the software module 33 does not find the license code, the user has to use certificate-based-login to a website and register using the smart card 32 that is provided by the software vendor. The registration software 11 interacts with software module 33 via digital certificate based mutual authentication. User's digital certificate is used by the registration software 11 to gather information about the user. For this, the private key within smart card 32 is required in the process of digital certificate based authentication. Upon successful registration, the user's digital certificate is sent to license code generator 21 which further digitally signs the software license expiry date, generates license code for the user and encrypts the license code using public key extracted from the user's digital certificate forwarded by the registration software 11.

The encrypted license code is sent by the license code generator 21 to the software module 33 and is further sent to the smart card 32 for decryption. Once the encrypted license code is available in the computer 30, the software module 33 sends the encrypted license code to smart card 32 directly without communicating with either the registration server 10 or software vendor server 20. Upon successful decryption, the software module 33 allows the software 31 to run.