Secure License Verification for Process Computers

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for licensing software in process computers, particularly those used in critical applications like automotive control systems, face challenges in ensuring secure and efficient license management, often leading to potential misuse and increased latency due to inadequate identification and verification processes.

Innovation Solution

A method that involves a configuration program transferring executable binary code to a process computer with associated license information, which is verified by an authorization program using a unique identifier stored in a secure data container, ensuring only licensed libraries are executed, independent of the computer's identifier, thus preventing license abuse and reducing latency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If license information is bound to a specific computer identifier, then security against license misuse is improved, but adaptability to different computers deteriorates

Engineering Contradiction:
Improvelicense securityVSAvoidcomputer independence
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent introduces a service computer as an intermediary between the process computer and the license verification system. The service computer stores license information in a secure data container and performs verification, while the process computer remains independent and unaware of the licensing mechanism. This mediator enables both security (through centralized license management) and adaptability (through process computer independence).

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The system is divided into two separate components: the process computer that executes binary code and the service computer that manages licenses. The license information is segmented from the binary code and stored separately in a secure data container on the service computer. This segmentation allows the process computer to remain adaptable while license security is maintained through separate verification.

Inventive Principle:
Principle #1Segmentation

2Reliability

If license verification is performed on the process computer, then license control is improved, but system complexity and latency deteriorate

Engineering Contradiction:
Improvelicense verificationVSAvoidprocess computer load
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The license verification function is extracted from the process computer and relocated to the service computer. The process computer no longer carries the burden of license management, reducing its complexity and latency. The service computer assumes responsibility for verification by comparing binary code identifiers with license information in its secure data container.

Inventive Principle:
Principle #2Taking out (Extraction)

3Reliability

If secure license management is implemented, then prevention of license abuse is improved, but ease of operation deteriorates

Engineering Contradiction:
Improvelicense protectionVSAvoidconfiguration simplicity
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The system implements automatic license verification where the authorization program on the service computer autonomously checks whether license information covers the required licenses for the binary code. This self-service mechanism provides strong license protection without requiring manual intervention or complex configuration by the user.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP3309698B1Method for operating a computer system
Publication Date: 2019.09.04 DSPACE DIGITAL SIGNAL PROCESSING & CONTROL ENGINEERING GMBH
  • EP3309698B1 patent drawingFigure 1~2
  • EP3309698B1 patent drawingFigure 3~4
  • EP3309698B1 patent drawingFigure 5~6

AI summary

In a method for operating a process computer that is at least temporarily connected to an operator computer running a configuration program capable of transferring executable binary code to the process computer, a license check is provided. License information specifying the required licenses is associated with the binary code, and the configuration program is configured to receive a unique identifier for the process computer. The configuration program provides this identifier and the license information to an authorization program. To determine eligibility, the authorization program checks whether the available licenses associated with the unique identifier cover the licenses required according to the license information. The configuration program transfers the executable binary code to the process computer only if the authorization program has confirmed eligibility.The invention further relates to an operator computer and a computer program product.