Activation system architecture

A method performed by at least one computer processing unit of a licensing service, the method comprising:

• accessing an entitlement certificate, wherein the entitlement certificate includes:
• one or more entitlements describing characteristics of a license for software;
• and
• a binding type identifying a particular device type to which the license may be bound;
• accessing a binding certificate identifying a device, the binding certificate and the entitlement certificate comprising separate digital signatures;
• determining whether the device identified by the binding certificate is an instance of the binding type;
• and
• when the device identified by the binding certificate is an instance of the binding type, generating the license for the device identified by the binding certificate to use the software, the license being generated based on said binding certificate and said entitlement certificate, and
• wherein the entitlement certificate is digitally signed using a first encryption key that is particular to an entitlement service that generates the entitlement certificate, and
• wherein the binding certificate is digitally signed using a second encryption key that is particular to a binding service that generates the binding certificate.

A method performed by at least one computer processing unit of a licensing service, the method comprising:

• accessing an entitlement certificate generated by an entitlement service, wherein the entitlement certificate includes:
• one or more entitlements describing characteristics of a license for software;
• a binding type identifying a particular device type to which the license may be bound;
• and
• a first digital signature generated using a first private key of the entitlement service;
• accessing a binding certificate identifying a device, the binding certificate comprising a second digital signature generated using a second private key;
• verifying the entitlement certificate using a first public key corresponding to the first private key;
• verifying the binding certificate using a second public key corresponding to the second private key;
• and
• provided the entitlement certificate and the binding certificate are verified and the device is an instance of the binding type, generating the license for the device identified by the binding certificate to use the software.