Application usage policy enforcement

Abstract

Disclosed herein are systems, methods, and non-transitory computer-readable media for enforcing application usage policies. As part of an application purchase transaction, the application distributor creates a unique proof of purchase receipt. This receipt can be bundled with the application and delivered to the purchaser. Each machine can maintain an authorization file that lists the users authorized to use applications on that machine. A system configured to practice the method verifies that a user is authorized to use an application on a machine based on an application proof of purchase receipt and the authorization file. If the application proof of purchase receipt and the authorization file are both valid, the system checks if the user account identifier in the receipt is contained in the authorization file. If so, the user can be considered authorized to use the application on the machine.

1 . A method for providing a proof of purchase of an application, the method comprising:
 receiving, at a server, a purchase request from a user to purchase the application;   constructing an application purchase receipt;   creating an application bundle based on the application purchase receipt and the application, wherein the application purchase receipt is unique to the purchase request; and   sending the application bundle to the user.   
     
     
         2 . The method of  claim 1 , wherein constructing the application purchase receipt further comprises:
 adding a signature to the application purchase receipt.   
     
     
         3 . The method of  claim 1 , wherein the application purchase receipt comprises at least one of a user identifier, a user account identifier, an application identifier, a version number of the application, a purchase date, a purchase timestamp, a parental control rating, and a de-authorization count. 
     
     
         4 . The method of  claim 3 , wherein the user account identifier is a one-way representation of the user account identifier. 
     
     
         5 . The method of  claim 3 , wherein the de-authorization count is a tally of received de-authorization requests associated with the user account identifier. 
     
     
         6 . A system for enforcing an application usage policy, the system comprising:
 a processor;   a first module configured to control the processor to receive a request from a user to purchase a first application;   a second module configured to control the processor to construct an application purchase receipt for the first application;   a third module configured to control the processor to send an application bundle including the first application and the application purchase receipt to the user;   a fourth module configured to control the processor to receive a request to verify a second application on a client device based on an application purchase receipt and an authorization file; and   a fifth module configured to control the processor to verify the second application based on the application purchase receipt and the authorization file.   
     
     
         7 . The system of  claim 6 , wherein the fifth module comprises:
 a sixth module configured to control the processor to verify that the application purchase receipt is valid;   a seventh module configured to control the processor to verify that the authorization file is valid; and   an eighth module configured to control the processor to verify that a purchasing user specified in the application purchase receipt is in the authorization file.   
     
     
         8 . The system of  claim 7 , further comprising:
 a ninth module configured to control the processor to authorize the purchasing user when the purchasing user is not in the authorization file.   
     
     
         9 . A server for enforcing an application usage policy on a client device, the server comprising:
 a processor;   a network interface;   a first module configured to control the processor to receive, via the network interface, a request from the client device to purchase a first application;   a second module configured to control the processor to construct an application purchase receipt for the first application; and   a third module configured to control the processor to send to the client device an application bundle based on the first application and the application purchase receipt,   wherein the client device receives a request to verify a second application on the client device based on the application purchase receipt and an authorization file, and verifies the second application based on the application purchase receipt and the authorization file.   
     
     
         10 . The server of  claim 9 , further comprising:
 a fourth module configured to control the processor to maintain authorization records, wherein an entry in the authorization records includes at least one of an account identifier, a list of authorized client devices on which the account identifier is authorized to execute applications, a total number of authorized client devices, and a de-authorization count.   
     
     
         11 . The server of  claim 10 , further comprising:
 a fifth module configured to control the processor to receive, via the network interface, a de-authorization request from a second client device, wherein the de-authorization request includes an account identifier and an authorization file;   a sixth module configured to control the processor to identify an entry in the authorization records associated with the account identifier;   a seventh module configured to control the processor to remove the client device specified in the authorization file from the list of authorized client devices in the entry;   an eighth module configured to control the processor to create an updated authorization file; and   a nineth module configured to control the processor to send the updated authorization file to the second client device.   
     
     
         12 . The server of  claim 11 , further comprising:
 a tenth module configured to control the processor to increment a de-authorization count in the entry.   
     
     
         13 . The server of  claim 11 , wherein the ninth module further comprises:
 a tenth module configured to control the processor to remove the account identifier from the authorization file and add a signature to the authorization file.   
     
     
         14 . The server of  claim 10 , further comprising:
 a fifth module configured to control the processor to receive, via the network interface, an authorization request from a third client device, wherein the authorization request includes an account identifier and an authorization file;   a sixth module configured to identify an entry in the authorization records associated with the account identifier; and   a seventh module configured to control the processor to process the authorization request.   
     
     
         15 . The server of  claim 14 , wherein the seventh module further comprises:
 an eighth module configured to control the processor to deny the authorization request when a total number of authorized client devices in the entry is equal to a specified maximum number of authorized client devices; and   a ninth module configured to control the processor to send a denial notification to the third client device.   
     
     
         16 . The server of  claim 14 , wherein the seventh module further comprises:
 an eighth module configured to control the processor to allow the authorization request when a total number of authorized client devices in the entry is less than a specified maximum number of authorized client devices;   a ninth module configured to control the processor to add the client device specified in the authorization file to a list of authorized client devices in the entry;   a tenth module configured to control the processor to update the authorization file; and   an eleventh module configured to control the processor to send an allowance notification to the third client, wherein the allowance notification includes the updated authorization file.   
     
     
         17 . The server of  claim 16 , wherein the tenth module further comprises:
 a twelfth module configured to control the processor to add the account identifier to the authorization file; and   a thirteenth module configured to control the processor to add a signature to the authorization file.   
     
     
         18 . The server of  claim 17 , further comprising:
 a fourteenth module configured to control the processor to add a de-authorization count from the entry to the authorization file prior to adding the signature.   
     
     
         19 . A client device for enforcing a server-generated application usage policy, the client device comprising:
 a processor;   a network interface;   a user input interface;   receiving, from a server, an application bundle including a first application and an application purchase receipt, wherein the application bundle is generated at the server by steps comprising:
 receiving a request from a user to purchase a first application; 
 constructing an application purchase receipt for the first application; and 
 generating the application bundle based on the first application and the application purchase receipt; 
   receiving a request, via the user input interface, to verify a second application on the client device based on the application purchase receipt and an authorization file; and   verifying the second application based on the application purchase receipt and the authorization file.   
     
     
         20 . The client device of  claim 19 , wherein verifying the second application further comprises:
 verifying that the application purchase receipt is valid;   verifying that the authorization file is valid; and   verifying that a user specified in the application purchase receipt is in the authorization file.   
     
     
         21 . The client device of  claim 20 , further comprising:
 verifying that a de-authorization count in the application purchase receipt is less than or equal to a de-authorization count associated with the user in the authorization file.   
     
     
         22 . The client device of  claim 20 , wherein verifying that the application purchase receipt is valid further comprises:
 verifying that a signature associated with the application purchase receipt is the signature for the application purchase receipt;   checking that an application identifier in the application purchase receipt matches an identifier of the application; and   checking that an application version number in the application purchase receipt matches a version number of the application.   
     
     
         23 . The client device of  claim 20 , wherein verifying that the authorization file is valid further comprises:
 verifying that a signature associated with the application purchase receipt is the signature for the authorization file; and   checking that a unique client device identifier in the authorization file matches a unique identifier for the client device.   
     
     
         24 . The client device of  claim 19 , further comprising:
 allowing use of the application when all verification steps succeed.   
     
     
         25 . The client device of  claim 19 , further comprising:
 denying at least some use of the application when at least one of the verification steps fails.   
     
     
         26 . The client device of  claim 20 , further comprising:
 sending a request, via the network interface, to the server to authorize a user in the application purchase receipt when the user specified in the application purchase receipt is not in the authorization file.   
     
     
         27 . A non-transitory computer-readable storage medium storing instructions which, when executed by a computing device, cause the computing device to verify that a user is authorized to execute an application on a machine, the instructions comprising:
 receiving a request to verify an application on a machine based on an application purchase receipt and an authorization file;   verifying that the application purchase receipt is valid;   verifying that the authorization file is valid; and   verifying that a user specified in the application purchase receipt is in the authorization file.   
     
     
         28 . The non-transitory computer-readable storage medium of  claim 27 , wherein verifying that the application purchase receipt is valid further comprises:
 computing a signature for the application purchase receipt;   comparing the computed signature with a signature attached to the application purchase receipt;   verifying that the application purchase receipt is for the application; and   indicating the application purchase receipt is valid when the computed signature matches the signature attached to the application purchase receipt and the application purchase receipt is for the application.   
     
     
         29 . The non-transitory computer-readable storage medium of  claim 27 , wherein verifying that the authorization file is valid further comprises:
 computing a signature for the authorization file;   comparing the computed signature with a signature attached to the authorization file;   verifying that the authorization file is for the machine; and   indicating the authorization file is valid when the computed signature matches the signature attached to the authorization file and the authorization file is for the machine.   
     
     
         30 . The non-transitory computer-readable storage medium of  claim 27 , wherein the authorization file includes a unique machine identifier and at least one user account identifier. 
     
     
         31 . The non-transitory computer-readable storage medium of  claim 30 , wherein one of the at least one user account identifiers is a one-way representation of an account identifier. 
     
     
         32 . The non-transitory computer-readable storage medium of  claim 28 , wherein verifying that the application purchase receipt is for the application further comprises:
 extracting an application identifier from the purchase receipt;   comparing the extracted application identifier to an identifier of the application;   extracting an application version number from the purchase receipt;   comparing the extracted application version number to a version number of the application; and   providing an indication that the application purchase receipt is for the application when the extracted application identifier matches the identifier of the application and the extracted application version number matches the version number of the application.   
     
     
         33 . The non-transitory computer-readable storage medium of  claim 29 , wherein verifying that the authorization file is for the machine further comprises:
 extracting a unique machine identifier from the authorization file;   comparing the extracted unique machine identifier to a unique machine identifier for the machine; and   indicating the authorization file is for the machine when the extracted unique machine identifier matches the unique machine identifier for the machine.   
     
     
         34 . The non-transitory computer-readable storage medium of  claim 30 , wherein a de-authorization count is associated with one of the at least one user account identifiers. 
     
     
         35 . The non-transitory computer-readable storage medium of  claim 27 , further comprising:
 executing the application when each verification step succeeds.   
     
     
         36 . The non-transitory computer-readable storage medium of  claim 27 , further comprising:
 blocking execution of the application when at least one verification step fails.   
     
     
         37 . The non-transitory computer-readable storage medium of  claim 27 , further comprising:
 executing the application with limited functionality when at least one verification step fails.   
     
     
         38 . The non-transitory computer-readable storage medium of  claim 27 , further comprising:
 sending a request to authorize the user when the user specified in the application purchase receipt is not in the authorization file.   
     
     
         39 . A method for verifying that a user is authorized to execute an application on a machine, the method comprising:
 receiving a request to verify an application on a machine based on an application purchase receipt and an authorization file;   verifying, via a processor, that the application purchase receipt is valid;   verifying that the authorization file is valid;   verifying that a user specified in the application purchase receipt is in the authorization file; and   verifying that a de-authorization count in the application purchase receipt is less than or equal to a de-authorization count associated with the user in the authorization file.   
     
     
         40 . The method of  claim 39 , further comprising:
 executing the application when each verification step succeeds.   
     
     
         41 . The method of  claim 39 , further comprising:
 denying execution of the application when at least one verification step fails.   
     
     
         42 . The method of  claim 39 , further comprising:
 allowing limited execution of the application when at least one verification step fails.   
     
     
         43 . The method of  claim 39 , further comprising:
 sending a request to authorize the user when the user specified in the application purchase receipt is not in the authorization file.