System for binding secrets to a computer system having tolerance for hardware changes
AssigneeMicrosoft Corporation
InventorAidan T. Hughes
Life of this patent
Estimating the term…
Abstract
Systems and methods for binding a secret to a computer system are disclosed. Systems and methods for generating a strong hardware identification (SHWID) for a given computer system are also disclosed. The strong hardware identification (SHWID) is coupled to a bound secret. The strong hardware identification (SHWID) may be used to control the use of software on the given computer system depending on the degree of hardware changes to the computer system.
Claims7
A method of determining whether a software product can be used on a second computer system having a second hardware configuration, wherein the second computer system is identical to or different from the first computer system, wherein the method comprises:
- identifying the n components classes used to determine the strong hardware identification (SHWID);
- identifying all instances within each component class of the second hardware configuration;
- retrieving an identification string that represents each individual component instance;
- generating instance primes, ip,q, for each component instance, wherein each instance prime is a positive prime number, and wherein p represents a given component class number ranging from 1 to n, and q represents the q-th type of component within the first hardware configuration or the second hardware configuration;
- retrieving possible class partial secrets, Pp,q, wherein:
- Pp,q=[Cp(mod ip,q)];
- extracting possible class primes, pp,q, and possible class remainders, dp,q, from the possible class partial secrets, Pp,q;
- solving a set of congruences provided by a permutation of the possible class primes and the possible class remainders to produce a possible secret;
- and
- testing the possible secret by decoding a given ciphertext using the possible secret as the key for decoding and testing the resultant plaintext obtained by decrypting the given ciphertext with the possible secret against a corresponding known plaintext;
- wherein:
- if the resultant plaintext matches the known plaintext, loading the software product onto the second computer system;
- and
- if the resultant plaintext does not match the known plaintext, preventing the software product from being loaded onto the second computer system.
A computer readable medium having stored thereon computer-executable instructions for performing a method of determining whether a software product can be used on a second computer system having a second hardware configuration, wherein the second computer system is identical to or different from the first computer system, wherein the method comprises:
- identifying the n components classes used to determine the strong hardware identification (SHWID);
- identifying all instances within each component class of the second hardware configuration;
- retrieving an identification string that represents each individual component instance;
- generating instance primes, ip,q, for each component instance, wherein each instance prime is a positive prime number, and wherein p represents a given component class number ranging from 1 to n, and q represents the q-th type of component within the first hardware configuration or the second hardware configuration;
- retrieving possible class partial secrets, Pp,q, wherein:
- Pp,q=[Cp(mod ip,q)];
- extracting possible class primes, Pp,q, and possible class remainders, dp,q, from the possible class partial secrets, Pp,q;
- solving the set of congruences provided by a permutation of possible class primes and possible class remainders to produce a possible secret;
- and
- testing the possible secret by decoding a given ciphertext using the possible secret as the key for decoding and testing the resultant plaintext obtained by decrypting the given ciphertext with the possible secret against a corresponding known plaintext;
- wherein:
- if the resultant plaintext matches the known plaintext, loading the software product onto the second computer system;
- and
- if the resultant plaintext does not match the known plaintext, preventing the software product from being loaded onto the second computer system.
Dependencies are inferred from the claim text.