LTTP Protection — A Pragmatic Approach to Licensing

Abstract

Licensing is a topic of increasing importance for software publishers and users. More and more, software licensing is performed electronically by mechanisms running on the system on which the licensed software operates. In order to facilitate the use and management of such licensing systems and to enable economic software usage in enterprise-wide computer systems, various organizations are formulating requirements and defining architectures and standard interfaces for license systems. The trustworthiness of these systems is essential because large amounts of revenue can depend on them. A long term solution called Stateful Access Control (SAC) has been proposed, which aims for maximal flexibility in the definition of the license policy and still minimizes the restrictions inferred by the system. To achieve a satisfactory long-term solution like SAC requires a perfectly orchestrated effort by all partners reaching from the hardware and operating system provider to the application developer. Because this cannot be expected to happen all at once, migration strategies must be developed with modes of operation pursuing an optimum for not yet totally satisfactory intermediary states. Tamper Evidence is the ``weak'' security level addressed by this paper. A Licensing Trusted Third Party (LTTP) employing a minimum of dedicated security hardware is proposed as such an intermediate solution. It is an ``add-on'' to currently existing systems without the security pitfalls of today' s licensing mechanisms and which assumes less trust in the license administrators.