Patent Publication Number: US-6223288-B1

Title: System for persistently encrypting critical software file to prevent installation of software program on unauthorized computers

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     Related subject matter is disclosed and claimed in application Ser. No. 09/031,536, filed Feb. 27, 1998, and in application Ser. No. 08/670,846, filed Jun. 28, 1996, now U.S. Pat. No. 5,809,145. The entire subject of both applications is hereby incorporated herein by reference for all purposes. 
    
    
     FIELD OF INVENTION 
     The invention relates to a system for encrypting a selected program file, the decryption of which is critical to the successful installation or execution of a software program. The encryption method involves wrapping the selected program file to permit limited unlocking thereof without complete decryption or unwrapping. 
     BACKGROUND OF THE INVENTION 
     Demand for network-based distribution of protected and unprotected data is increasing dramatically. Yet, many challenges exist that need to be addressed to effectively distribute data via electronic commerce such as: (1) conducting reliable, secure transactions necessary to build confidence with both information providers (e.g., data publishers) and data customers; and (2) ensuring that information providers or publishers can specify access controls to prevent piracy (e.g., installation of a software program on more than the allowable number of machines specified by a software program vendor), among other challenges. 
     A need exists for a data distribution infrastructure which addresses the aforementioned challenges and which overcomes a number of disadvantages associated with existing distributed data commerce systems. Existing methods for preparing software programs for retail sales provide several software programs on a compact disc (CD), for example, since a CD has substantial memory capacity. The unit price of each CD, however, can be excessive, particularly if the consumer only wishes to have access to one of the programs stored thereon. Accordingly, software vendors have been encrypting all but one of the software programs available on a CD and selling the CD for the price of the one program that is not encrypted. If the consumer wishes to access the other encrypted programs on the CD, the consumer can contact the software vendor at a later time to purchase the release codes to decrypt remaining software programs on the CD. The software retailer, however, does not profit from the purchases of release codes after the initial sale of the CD. Thus, problems are presented in the software retail chain. Software retailers are less likely to use retail space to display software programs for which they do not receive compensation from vendors for subsequent release code purchases. Consumers are therefore not presented with all of the available software by retailers, and software vendors are provided with a less effective retail chain. 
     Another problem facing software vendors is piracy of software programs. Piracy can be in a number of forms such as unlocking encrypted software for illegal copying and retail sale, as well as the installation of unlocked software onto more computers than permitted under the software license. A need exists for an encryption/decryption system for software programs which restricts the use of unlocked software to the purposes intended by the software vendor. 
     SUMMARY OF THE INVENTION 
     In accordance with an aspect of the present invention, an encryption/decryption system is provided wherein a software program to be distributed comprises at least one critical program file that is persistently encrypted. The critical program file is selected to be a file without which the software program cannot be successfully installed or executed. The critical program file is encrypted to permit the software program to be installed according to the related software license. 
     In accordance with another aspect of the present invention, an encryption method uses an encryption wrapper with the critical file and permits only restricted unlocking of the critical file. The critical file is not completely unwrapped or visible to the computer user. 
     In accordance with yet another aspect of the present invention, individual programs within a suite of programs provided by the same software distribution means (e.g., a CD, an internet transaction or a satellite signal transmission) can be individually encrypted using a wrapper on respective critical files in each of the individual programs. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     These and other features and advantages of the present invention will be more readily comprehended from the following detailed description when read in connection with the appended drawings, which form a part of this original disclosure, and wherein: 
     FIG. 1 is a schematic block diagram of a data distribution system (DDS) constructed in accordance with an embodiment of the present invention; 
     FIG. 2 is a schematic block diagram illustrating data encryption/decryption system (DES) components constructed in accordance with an embodiment of the present invention for requesting and receiving a license key to unlock encrypted data; 
     FIG. 3 is a flow chart depicting the sequence of operations for requesting and receiving a license key to unlock encrypted data in accordance with an embodiment of the present invention; and 
     FIG. 4 depicts an exemplary computer screen generated on a consumer&#39;s computer to request a license key to decrypt a critical file. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     With reference to FIG. 1, a data distribution system (DDS)  10  is provided in accordance with the present invention to allow information providers (IPs) to prepare digital information for commerce, as well as to perform data retrieval and transmission, and transactional services. The DDS  10  allows customers or end-users to browse or search for data available from a number of IPs and to purchase selected data directly via their respective computers. As shown in FIG. 1, data can be distributed by a number of methods such as by storing data (e.g., software programs) on CDs or other data storage devices (e.g., digital audio tapes or magnetic diskettes) for shipping to retail locations or directly from the software vendor to the consumer. Data can also be distributed to consumer computers electronically via the internet or other communication links such as by satellite communication. FIG. 1 depicts different data distribution paths for illustrative purposes. It is to be understood that other data distribution paths can be used within the scope of the present invention. 
     FIG. 1 depicts three exemplary consumer computers  12   a ,  12   b  and  12   c  which are collectively referred to as consumer computers  12 . The consumer computers  12  are preferably conventional personal computers which comprise a monitor or display device  13 , an optional hard drive  15 , a central processing unit  17  and an input device  19  such as a keyboard or a mouse. The computers can operate using one of a number of operating systems developed for IBM-compatible or Macintosh computers or the UNIX operating system, for example. 
     IPs can be software publishers which provide raw data such as program code to a fulfillment center  14 . The fulfillment center  14  can arrange raw data into datasets for viewing and purchasing via the aforementioned methods, that is, via physically-distributed storage devices or electronically via communication networks  22  (e.g., the internet). The fulfillment center  14  can be configured to encrypt and store data such as program code on a master copy of a portable data storage device such as a compact disc read-only memory (CD-ROM). The master CD-ROM can then be mass-produced and distributed to consumers. Datasets from more than one IP  11  can be stored on a single CD-ROM  18 . Alternatively, encrypted datasets can be stored at a CD-ROM drive  20  at the fulfillment center for example, or at an IP website server  30 , a database server  28 , an intranet  32 , among other electronic transaction mechanisms. Thus, a customer computer that is not connected to a CD-ROM drive  20  can have on-line access to datasets at the fulfillment center  14  via a modem  26  or other network interface device. The network  22  can be a public switched telephone network, an optical fiber network, a satellite communication network, a microwave or cellular communication network, among other types of networks, or a combination of different types of communication networks. 
     In accordance with an embodiment of the present invention, software vendors&#39; products are encrypted in a manner which requires a consumer to obtain a license key in order to successfully install or execute the software. With reference to FIG. 2, a software vendor&#39;s unprotected software program  34  is depicted for illustrative purposes. The software program  34  comprises at least one application program file indicated at  36 , as well as an installation program file indicated at  38  to install the application program  36  on a consumer computer  12 . The installation software is selected to be encrypted by way of an example. As will be described below, other files which are critical to the successful installation or operation of the software can be selected for encryption. 
     With continued reference to FIG. 2, the installation software is provided to an encryption device  40 . The encryption device  40  is preferably the Desktop Encryption/Decryption System (DES) described in application Ser. No. 09/031,536, filed Feb. 27, 1998. The DES  40  provides the selected program file (e.g., the installation program file) with an embedded executable  42  to provide preview and purchase functions, which are described below, to the customer without having to modify software applications and the operating system (OS) on the computer  12  prior to receiving the license key or other secured content. Once the critical file is encrypted, the encrypted file  38  is stored on a CD-ROM 44, for example, along with the remaining unprotected program files. 
     The process of using a protected software program in accordance with the present invention is described with reference to FIG.  3 . When the CD-ROM 44 is purchased, the consumer loads the CD-ROM onto a computer  12  in a conventional manner (block  70 ). It is to be understood that the protected software program can also be downloaded electronically from a remote source. The installation program  38  generates a screen  50  (block  72 ), as shown in FIG. 4, which provides a “welcome ” dialog instructing the user that a license key is required to install the program, and a button  56  labeled “Download key”. When the button  56  is selected (block  74 ), the embedded executable associated with the installation program  38  programs the computer  12  to send a license key request to the vendor website  30  or other transaction location via a communication network  22  (block  76 ). The website  30  or another transaction computer or a human operator at a fulfillment center  14  transmits a license key to the computer  12 . Once the license key is received at the consumer computer  12  (block  78 ), the installation program  38  is decrypted (block  80 ). The installation program is then invoked by selecting the button  58  in screen  50  which is labeled “Install” (block  82 ). The transaction for the license key can be conducted via telephone, facsimile or internet transmission. The encrypted installation file  38  is not available to the consumer in a raw data format, but rather is stored as a hidden, persistently encrypted file. Thus, the installation program  38  can only be unlocked and used for its intended purpose, that is, to install the software program on the consumer computer  12 . When installation is complete, the decrypted installation program file  38  is deleted (block  84 ). Thus, the installation program  38  does not remain decrypted or unwrapped to permit installation of the software program  36  on other computers. 
     The encryption is preferably in accordance with the encryption method described in the above-referenced application Ser. No. 08/670,846, filed Jun. 28, 1996, which generates machine-dependent release codes. Other encryption algorithms, however, can be used. The special handlers of the DES  40  assign a product code for the protected file  38  and create a code or key to decrypt or unlock the protected file. With reference to FIG. 3, the IP  12  can store the license keys in a license key management database  46 . 
     The file selected for encryption can be another type of file than an installation file or set-up executable. For example, the file can be a communication file or any other critical file that is necessary for the proper functioning of the software program for which protection is desired. 
     Software files which have been encrypted and decrypted in accordance with the present invention are advantageous over software protected in a conventional manner. Software that is protected in its entirety in a conventional manner can be unwrapped completely and then subjected to unauthorized use. By wrapping only a critical file in accordance with the present invention, the decryption process is simplified. Further, the decrypted file can be used in only a restricted manner that is specified by the software vendor for the encryption process. Since the encrypted file is hidden and is unwrapped only temporarily before being deleted, the decrypted file cannot be completely unwrapped to permit unauthorized uses of the protected software. In addition, the encryption/decryption system of the present invention facilitates the encryption of a critical file in each of several protected software programs distributed together. Thus, a user must purchase the license code for each program on a CD-ROM containing several programs, for example, in order to decrypt the corresponding program. This individual encryption and decryption process permits improved monitoring of licenses which is useful in negotiating agreements to compensate software retailers. 
     While certain advantageous embodiments have been chosen to illustrate the invention, it will be understood by those skilled in the art that various changes and modifications can be made therein without departing from the scope of the invention as defined in the appended claims.