GB2481133A

GB2481133A - Uniquely identifying a computing device in trial period abuse prevention

Info

Publication number: GB2481133A
Application number: GB1109666.6A
Authority: GB
Inventors: Philip Anthony Sant; Matt Tighe; Neal Hart
Original assignee: Omnifone Ltd
Current assignee: Omnifone Ltd
Priority date: 2010-06-09
Filing date: 2011-06-09
Publication date: 2011-12-14
Also published as: WO2011154742A1; GB201109666D0

Abstract

A web browser plug-in tool is used to read or construct a unique identifier for a computing device. The tool is programmed to read or construct the identifier from one or more Microsoft ® Windows ® Management Instrumentation (WMI) sources for example: ComputerSystemProduct.UUID, ComputerSystemProduct.IdentifyingNumber and BaseBoard.Product and to provide the identifier to a remote digital media service. Preferably, the identifier is stored both in the device and on a server for the service against a record associated with the device. A further unique identifier, generated by the service, may also be stored in the browser or browser plug-in; preferably as a Flash Â® Shared Object but perhaps as a cookie or in browser local storage. The unique identifier is typically used to determine whether or not a trial period for the service has been utilised on the computing device. Also disclosed is a method in which only a unique identifier, generated by a remote digital media service, is stored in the web browser or browser plug-in.

Description

*::r: INTELLECTUAL . .... PROPERTY OFFICE Application No. GB1 109666.6 RTM Date:5 October 2011 The following terms are registered trademarks and should be read as such wherever they occur in this document: "Microsoft", Windows", "Flash", "Internet Explorer", "Firefox" and "Safari".

Intellectual Property Office is an operating name of the Patent Office www.ipo.gov.uk

I

A METHOD FOR UNIQUELY IDENTIFYING A PERSONAL COMPUTING

DEVICE TO PREVENT THE ABUSE OF TRIAL PERIODS IN A DIGITAL

MEDIA CONTENT SERVICE.

BACKGROUND OF THE INVENTION

I. Field of the Invention

This invention relates to a method for uniquely identifying a personal computing device to prevent the abuse of trial periods in a digital media content service.

2. Description of the Prior Art

Historically, digital media content services have been reluctant to offer trial periods -periods during which access to the digital media content is free or is provided at a reduced rate -to users because of the great potential for abuse of such periods.

For example, suppose that a given digital content service wishes to deliver either a free 30 day or ultra-discounted three month period (trial period') service proposition to the service's users. Such trial periods are used as a method of encouraging users to experience the service at low or no cost for a short to medium term period followed by a transitioning of such consumer into a paying and satisfied long term subscriber.

Such free and ultra-discounted periods are perceived by the rights owners as an effective way to encourage up-sell to a paid-for service and therefore a source of recurring digital music revenues. Understandably, however, the rights holders require parties utilizing such trial periods to have reasonable mechanisms in place that effectively stop trial periods being easily abused, e.g. a consumer using 30 day free trials every month, and so receiving a fully paid-for service at no cost on an ongoing basis.

This has historically been achieved using the unique embedded device identifier information (DevicelD) built into the device at manufacture time. These DevicelDs are unique and can be presented up to the service in exchange for a trial period entitlement and the back-end' can record the fact that this DevicelD has received it's one-time trial period and therefore that same device will not be offered a trial period again as the entitlement has been consumed. This mechanism restricts a consumer to be able to take up a trial period only once on each device.

However, such capabihty is not necessarily available for valid technical reasons. For example, while gaming consoles may have such a fixed devicelD embedded into them, the far more commonplace personal computer often does not.

The present invention provides a method to overcome this deficiency by disclosing a mechanism for uniquely identifying a personal computing device in order to determine whether that device is entitled to a trial period in a digital media content service.

SUMMARY OF THE INVENTION

The present invention provides a method for uniquely identifying a personal computing device in order to determine whether that device is, for example, entitled to a trial period in a digital media content service. The invention is a method for uniquely identifying a computing device, comprising the steps of: using a tool to read or construct a unique identifier for the device, the tool being a browser plug-in that is programmed to read or construct the unique identifier from one or more Microsoft WindowsTM management instrumentation sources and is programmed to provide that unique identifier to a remote digital media service.

Other aspects of the invention are a computing device uniquely identified using the above method and a system comprising a digital media service and multiple computing devices, each uniquely identified using the above method a.

The method comprises steps which -taken in combination -result in a robust unique identifier for the computing device on which those steps are performed.

The Rights Holders of digital media content -such as the four major music labels, who are the key parties that must sign-off such abuse prevention measures -tend to take a pragmatic approach to these free trial abuse situations.

That is, they are well aware that in many such instances total prevention of abuse is not realistic and demanding such would deny them a revenue stream. In this particular situation the labels share an opinion that solution providers should take reasonable steps to make abuse difficult. They are firmly of the belief that those users who would invest the time to take multiple steps so as to benefit from an additional trial period are likely to be the same users who currently easily steal all their music already -i.e. no net loss, but potential significant gain from users who are currently not engaged in digital music at all.

BRIEF DESCRIPTION OF THE DRAWING

Figure 1 is a flowchart illustrating the operation of the invention.; Figure 2 is a screen shot that shows that multiple attempts to enable a trial period are denied.

DETAILED DESCRIPTION

Definitions For convenience, and to avoid needless repetition, the terms "music" and "media content" in this document are to be taken to encompass all "media content" which is in digital form or which it is possible to convert to digital form -including but not limited to books, maga2ines, newspapers and other periodicals, video in the form of digital video, motion pictures, television shows (as series, as seasons and as individual episodes), computer games and other interactive media, images (photographic or otherwise) and music.

Similarly, the term "track" indicates a specific item of media content, whether that be a song, a television show, an eBook or portion thereof, a computer game or any other discreet item of media content.

The terms "playlist" and "album" are used interchangeably to indicate collections of "tracks" which have been conjoined together such that they may be treated as a single entity for the purposes of analysis or recommendation.

The terms "digital media catalogue", "digital music catalogue", "media catalogue" and "catalogue" are used interchangeably to indicate a collection of tracks and/or albums to which a user may be allowed access for listening purposes. The digital media catalogue may aggregate both digital media files and their associated metadata or, in another example embodiment, the digital media and metadata may be delivered from multiple such catalogues. There is no implication that only one such catalogue exists, and the term encompasses access to multiple separate catalogues simultaneously, whether consecutively, concurrently or by aggregation. The actual catalogue utilised by any given operation may be fixed or may vary over time and/or according to the location or access rights of a particular device or end-user.

The abbreviation "DRM" is used to refer to a "Digital Rights Management" system or mechanism used to grant access rights to a digital media file.

The verbs "to listen", "to view" and "to play" are to be taken as encompassing any interaction between a human and media content, whether that be listening to audio content, watching video or image content, reading books or other textual content, playing a computer game, interacting with interactive media content or some combination of such activities.

The terms "user", "consumer", "end user" and "individual" are used interchangeably to refer to the person, or group of people making use of the facilities provided by the CloudStick. In all cases, the masculine includes the feminine and vice versa.

The terms "device" and "media player" are used interchangeably to refer to any computational device which is capable of playing digital media content, including but not limited to MP3 players, television sets, home entertainment system, home computer systems, mobile computing devices, games consoles, handheld games consoles, IVEs or other vehicular-based media players or any other applicable device or software media player on such a device. Something essentially capable of playback of media. Where applicable, "device" may refer to the device alone or to the combination of the device and the CloudStick.

Anti Abuse Solution The intention of the present invention is to produce a unique identifier for a computing device which does not have such an identifier built into it at the manufacturing stage.

Thus, it is intended for application on personal computers rather than on devices, such as games consoles, which provide a unique and unchangeably identifier which can be readily checked.

Once the identifier is obtained, it may then be used, in the preferred embodiment, to verify whether or not that device has previously taken part in a trial period for a digital media subscription service, and therefore used to determine whether or not such a trial period may be granted. Figure 1 is a flowchart illustrating the operation of an implementation of the invention.

The DevicelD Browser Plug-In For new Microsoft WindowsTM PCs, a DevicelD detecting Browser Plug-in, DevicelD BPI', may be pre-installed in all browsers delivered with all new Computers. This solution delivers the maximum DevicelD recognition capabilities and requires no painful user authori7ation process to use.

For legacy PCs, that plug-in may still be utili2ed but users may opt not to install it, in which case other methods -as disclosed below -are to be used.

Similarly, for non-Microsoft \VindowsTM computing devices, the other methods disclosed below are to be used.

Where it can be installed, the DevicelD BPI retrieves unique information from potentially many Windows Management Instrumentation sources, including logic such as: First check availability of: root\CIMV2\Win32_ComputerSystemProduct.UUID If not present (or an empty' UUID) use: root\CIMV2\Win32_ComputerSystemProduct.IdentifyingNumber If not present use: root\CIMV2\Win32BaseBoard.Product PLUS root\CIMV2\Win32BaseBoard.SerialNumher PLUS root\CIMV2\Win32BaseBoard.Version If all three of the above aren't present use: root\CIMV2\Win32DiskDrive.DevicelD where its corresponding DevicelD is contained within an entry in: root\CIMV2\Win32DiskDriveToDiskPardtion which is selected by finding the entry in: root\CIMV2\Win32_LogicalDiskToPartition that contains the root (e.g C:\ or D:\ or K:) of the directory contained in: root\CIMV2\Win32_OperatingSystem.WindowsDirectory In the preferred embodiment, this value is then hashed using 5HA256 to obfuscate it.

It is important to note that the DevicelD BPI is not itself trying to determine if this device is entitled to a trial period, it is merely a device identification mechanism. It is the digital media service back-end (with the assistance of the client's own network platform, where applicable) which is determining if a trial period can be delivered to the device.

It should also be noted that if BPIs are not acceptable for reasons other than those related to their install process, then the Web DevicelD mechanism can be used for new PCs.

How to abuse the DevicelD BPI Solution The DevicelD BPI is very hard to circumvent and really only would be achievable by experienced hackers. This falls well within the major labels criteria for doesn't easily allow abuse'. In fact the DevicelD BPI route is very hard to abuse.

If the DevicelD BPI is uninstalled then the system will fall back to the Web DevicelD solution (see below) for making trial period abuse not easily achievable.

Where The DevicelD BPI Is Not Available There are many circumstances where the DecidelD BPI approach disclosed above is not applicable. For example, where a company wishes to offer users trial periods to Music on PCs which are not new devices shipped by that client and can therefore not benefit from a preinstalled DevicelD BPI solution, where the user declined to install the browser plug-in or where the service is to operate on a non-Microsoft WindowsTM computing device.

In these situations the Web DevicelD mechanism is used which is a combination of three components available in all target web browsers which allow storage of persistent information. The primary of these mechanisms is achieved using Flash, where it is present on the target device.

To make trial period circumvention difficult the Web DevicelD solution utilizes Flash SharedObjects, in the preferred embodiment, as a primary prevention mechanism and both cookies and browser local storage as secondary prevention mechanisms.

Using a combination of at least the primary mechanism with the addition of all available secondary mechanisms the service CustomerClientGUlD' is stored and persisted on the device. That CustomerClientGUlD' is a non-personal unique user/device identifier which is generated by the service's back-end and stored against the user's user record. In one example embodiment, the user's user record is itself related to an network account ID, where the service is linked with a network account on which user's have uniquely identifiable records.

When the user requests access to a proposition that includes a trial period, the service's web application on the device sends the CustomerClientGUlD to the service platform.

The service platform first checks if the client's network believes that this user (the network account related to this CustomerClientGUlD) is entitled to another trial period.

Additionally the service platform confirms that this CustomerClientGUlD has no record of being given a trial period before. It should be noted that un'ess a user goes through the difficult circumvention mechanism described below then they will not be given another trial period even if they have gone to the trouble of creating another network account.

Primary Prevention Mechanism: Flash SharedObject Flash SharedObjects provide the ability for a Flash application (in this example the service web application tTash component) to persist local data. Data stored in Flash SharedObjects is stored independently of particular browsers and so provides a cross-browser solution.

The Web DevicelD mechanism uses a Flash SharedObject to store the ClientCustomerGUlD. This is normally possible without any user interaction or approval because the default setting for Flash is to allow new sites to use Flash SharedObjects.

In the exceptionii condition where the user has disab'ed the use of F'ash SharedObjects this is detected at the point where the user has requested entitlement to a proposition containing a trial period. There are then two UI flows which are available: 1. The user is notified that in order to proceed they need to enable Flash SharedObjects. The UI will display an adequate on screen explanation of how to do this -that said the user should actually only be in this situation because they have previously used this control to change from the default setting and therefore they know what they are doing.

2. The system only offers the user a paid-for proposition, not a trial period. Users in this situation will be a small minority of users so this may be a more acceptable user experience.

The Web DevicelD logic makes it difficult to achieve repeated trial periods even if the user creates a new network account. The majority of users in this situation would see the message in FIGURE 2 with a link to paid-for service; Multiple attempts to enable a trial period are denied.

Second Prevention Mechanisms In addition to the primary prevention mechanism in \Veb DevicelD two other techniques are used: cookies and other browser based local storage mechanisms. In and of themselves these two techniques do not present a huge barrier to abuse given that two cache clear actions or one clear entire cache action can circunwent them. That said they are used in Web DevicelD to include an extra step (or two based on browser type) that the user must take in order to try and circumvent the abuse prevention mechanism.

Browser Cookies Where cookies are available the service web application will store the user's CustomerClientGUlD using this mechanism. If the DevicelD check finds there is no CustomerClientGUlD stored as a Flash SharedObject, then the cookies will be checked for same and the CustomerClientGUlD sent to the service platform if found. In these situations users will be told that they have used their trial period and offered a paid-for proposition.

Browser Local Storage Solutions All target browsers offer (in one way or another -see fig.3) a browser based local storage mechanism which the Music web application, if allowed, will use to store the user's CustomerClientGUlD.

If the DevicelD check finds there is no CustomerClientGUlD stored as a Flash SharedObject and that there is no CustomerClientGUlD stored in a cookie then the service web application will check local browser storage methods (based on browser type).

The CustomerClientGUlD is sent to the digital media services platform if found. Tn these situations users will be told that they have used their trial period and offered a paid-for proposition.

TABLE I provides an overview of the storage location mechanism used in various browsers.

Browser Storage Location Internet Explorer 1E6: userData persistence 1E7: userData persistence 1E8: HTML5 locaiStorage Firefox FF2: Gecko DOM Storage FF3: Gecko DOM Storage FF3.5: HTML5 locaiStorage Safari 3.1: HTML5 DB storage 3.2: HTML5 DB storage 4: HTML5 locaiStorage Chrome Gears DB Opera Opera 10.5: HTMLS locaiStorage TABLE 1: Methods available to provide non-cookie local storage in various web browsers.

How to abuse the Web DevicelD Solution In order to circumvent the Web DevicelD anti trial period abuse solution the user will need to perform the following complicated series of actions (not necessarily in this order): 1. Create or sign-in to a network platform account, where such a network platform account is utilized by the digital media service. This account, in the preferred embodiment, will have had a credit card entered and a confirmed email address.

2. Discover, be offered and consume a trial period.

3. Create a new email address.

4. Create a new network account.

5. Confirm email address.

6. Enter credit card details in the network account.

7. Clear browser cookie and local storage cache or clear entire cache.

8. Locate Flash SharedObject storage manager, identify and delete service Flash SharedObjects.

9. Restart browser and login (with new network account details, where applicable) In the preferred embodiment, Flash SharedObjects must be available to access trial periods.

The Web DevicelD mechanism falls well within the major labels criteria for doesn't easily allow abuse'. This is especially so given that this process needs to be performed on expiry of each trial period (a period likely to be once every month). The major labels believe that people willing to go to these lengths every month will already be determined P2P files sharers.

Claims

CLAIMS1. A method for uniquely identifying a computing device, comprising the steps of: using a tool to read or construct a unique identifier for the device, the tool being a browser plug-in that is programmed to read or construct the unique identifier from one or morc Microsoft Windows managcmcnt instrumentation sourccs and is programmed to provide that unique identifier to a remote digital media service.
2. The method of claim I where the tool reads or constructs the unique identifier for the device using the values from one or more of the files: root\CIMV2\Win32_ComputerSystemProduct.UUID, root\CIMV2\Win32_ComputerSystemProduct.IdentifyingNumber, root\CIMV2\Win32_BaseBoard.Product PLUS, root\CIMV2\Win32_BaseBoard.SerialNumber PLUS, root\CIMV2\Win32_BaseBoard.Version, root\CIMV2\Win32_DiskDrive.DevicelD, root\CIMV2\Win32_DiskDriveToDiskPartition, root\CIMV2\Win32_LogicalDiskToPartition, root\CIMV2\Win32_OperatingSystem.WindowsDirectory or any other files which contain identifiers for the computing device.
3. The method of Claim I or 2 in which the unique identifier is (i stored in the device and also ii stored in a server for the digital media service against a record associated with the device.
4. The method of any preceding Claim including the step of storing a further unique identifier in a web browser or browser plug-in, that further unique identifier being generated by the remote digital media service.
5. The method of Claim 4 in which the further unique identifier is stored on the device as a Flash SharedObject.
6. The method of Claim 4 or 5 in which a further unique identifier is stored on the device as a web browser cookie.
7. The method of claim 4 -6 in which a further unique identifier is stored on the device in web browser local storage.
8. The method of any preceding Claim 4 -7 in which the further unique identifier is provided to the remote digital media service.
9. The method of any preceding Claim 4 -8 in which the browser plug-in tool is not used to read or construct or send the unique identifier from the Microsoft Windows management instrumentation sources, and instead only the further unique identifier, generated by the remote digital media service, is stored on the device.
10. A method for uniquely identifying a computing device, comprising the steps of storing a further unique identifier in a web browser or browser plug-in, that further unique identifier being generated by a remote digital media service, and the device sending that further unique identifier to a (or the said) remote digital media service, where the further unique identifier is used to determine whether or not a trial period for a service has been utili2ed on the computing device.
11. The method of Claim 10 in which the further unique identifier is stored on the device as a Flash SharedObject.
12. The method of Claim 10 or 11 in which a further unique identifier is stored on the device as a web browser cookie.
13. The method of claim 10 -12 in which a further unique identifier is stored on the device in web browser local storage.
14. The method of any preceding claim where the unique identifier or the further unique identifier for the computing device is not imprinted into that device at the time of manufacture.
15. The method of any preceding claimi -10 where the unique identifier or the further unique identifier for the computing device is imprinted into that device at the time of manufacture.
16. The method of any preceding claim where the unique identifier or the further unique identifier is obfuscated or encrypted using SHA2S6 or any other hashing or encryption mechanism.
17. The method of any preceding claim where the unique identifier or the further unique identifier is assigned by one or more remote servers and retrieved by a chent application running on the device via one or more requests to that/those remote server(s).
18. The method of any preceding claim where the unique identifier or the further unique identifier is linked to the identifying value read or constructed by the tool.
19. The method of any preceding claim where the unique identifier or the further unique identifier is used to determine whether or not a trial period for a service has been utili2ed on the computing device.
20. The method of Claim 19 where a server at the remote digital media service determines whether or not the trial period for a service has been utili2ed on the computing device.
21. The method of Claim I 9or 20 including the further step of granting or denying the trial period for the service.
22. The method of any preceding claim where the service is a digital media content service.
23. The method of any preceding claim where the computing device is a personal computer, games console, mobile phone, smartphone, handset, tablet device, In-Vehicular Entertainment system or any other computing device.
24. A computing device uniquely identified using a method of any preceding daim 1 -fl
25. A system comprising a dWtal media service and multiple computing devices as defined in Claim 24.