JP2011164858A - System and method for setting of license - Google Patents

Abstract

Distributing license information with guaranteed validity.
A tool terminal 10 includes a hash calculator 12 that calculates a hash value using license information and USB identification information in a USB memory 20, and encryption that generates an electronic signature by encrypting the hash value with a secret key. A calculation unit 13 and a data writing unit 11 for writing an electronic signature in the USB memory 20, and the management console 30 calculates a hash value using the license information and the USB identification information in the USB memory 20. Unit 31, decryption operation unit 32 that decrypts the digital signature in the USB memory 20 with the public key and restores the hash value, and determines whether the license information is valid using the calculated and restored hash value A validity determination unit 33, and a license setting unit 35 that sets license information in the management server when the license information is valid. To.
[Selection] Figure 1

Description

  The present invention relates to computer technology, and more particularly to a license setting system and a license setting method.

  When purchasing and installing software, one software license is distributed to one user in order to prevent unauthorized use such as unauthorized copying. Patent Document 1 below discloses a method for distributing a software license. In this method, a license count indicating the number of software licenses is stored in an electronic key, and the license count is reduced each time the software is installed on a computer equipped with the electronic key. When the license count reaches zero, the software cannot be installed. .

JP 2008-515060 A

  Patent Document 1 does not disclose logic for writing a license count into an electronic key or logic for reading out from an electronic key. Therefore, it is conceivable that the license count stored in the electronic key is falsified if no means for preventing falsification of the license count is incorporated in this logic. For example, when distributing the license of the number of simultaneous connections to the system as the license information, if the content of the number of simultaneous connections to be distributed is altered, connections exceeding the license range are permitted.

  Accordingly, the present invention has been made to solve the above-described problems caused by the prior art, and provides a license setting system and a license setting method capable of distributing license information with a guaranteed validity. With the goal.

  A license setting system according to the present invention includes a management server that manages a predetermined system, a tool terminal that outputs license information to be given to the predetermined system, and a storage medium that is detachable from the management server and the tool terminal. In the license setting system, the storage medium includes at least a license information storage area for storing license information regarding the number of simultaneous connections to the predetermined system, and authentication information for storing information used for authentication of the license information. A storage area, and an identification information storage area for storing storage medium identification information of the own storage medium, wherein the tool terminal includes at least a license information writing unit that writes the license information in the license information storage area, The license information stored in the license information storage area A signature generation unit that generates an electronic signature using the storage medium identification information stored in the identification information storage area and a secret key; and an authentication information writing unit that writes the electronic signature in the authentication information storage area. The management server includes a decryption unit that decrypts the electronic signature stored in the authentication information storage area with a public key, the decrypted information, the license information stored in the license information storage area, and A determination unit that determines whether the license information stored in the license information storage area is valid using the storage medium identification information stored in the identification information storage area; and When it is determined that the information is valid, it is included in the predetermined system based on the license information stored in the license information storage area. Has a filter that limits the number of clients, the.

  A license setting method according to the present invention includes a management server that manages a predetermined system, a tool terminal that outputs license information to be given to the predetermined system, and a storage medium that is detachable from the management server and the tool terminal. A license setting method executed by a license setting system, wherein the tool terminal writes the license information in a license information storage area of the storage medium for storing license information of the number of simultaneous connections to the predetermined system. And at least a step of generating an electronic signature using the license information stored in the license information storage area, storage medium identification information for identifying the storage medium, and a secret key, and information used for authentication of the license information In the authentication information storage area of the storage medium for storing Writing the electronic signature, wherein the management server decrypts the electronic signature stored in the authentication information storage area with a public key, the decrypted information, and the license information Determining whether the license information stored in the license information storage area is valid using the license information stored in the storage area and the storage medium identification information; and Executing the step of limiting the number of clients included in the predetermined system based on the license information stored in the license information storage area when it is determined that the information is valid.

  By adopting such a configuration, in the tool terminal, the electronic signature generated using the license information regarding the number of simultaneous connections to the predetermined system stored in the storage medium and the storage medium identification information is stored in the storage medium. When the license information is set in the management server, the validity of the license information is determined using the electronic signature, the license information, and the storage medium identification information stored in the storage medium, and the validity is confirmed. Based on the license information, the number of clients can be limited. This can limit the number of clients in the system.

  Further, the management server has a terminal identification information writing unit that writes terminal identification information for identifying the predetermined terminal in the license information storage area when the determination unit determines that the license information is valid, At least authentication information generated using the terminal identification information and the license information stored in the license information storage area, and the storage medium identification information stored in the identification information storage area, is stored in the authentication information storage area And an authentication information writing unit for writing to the authentication information.

  By adopting such a configuration, the contents of the storage medium in which the license information is set in one system can be rewritten after authentication by the management server, thereby preventing an illegal act such as setting the license information in another terminal. it can.

  In addition, when the authentication information is stored in the authentication information storage area, the determination unit of the management server uses setting terminal identification information for identifying a setting target terminal of the license information and the authentication information. Determining whether the license information stored in the license information storage area and the setting target terminal are valid, and the limiting unit of the management server determines whether the license information and the setting target are determined by the determination unit. When it is determined that the terminal is valid, the number of clients is limited based on the license information stored in the license information storage area.

  By adopting such a configuration, it is possible to reset the license information only for the same predetermined server using the storage medium in which the license information is set for the predetermined server.

  The management server further includes a setting unit that sets the license information stored in the license information storage area in the predetermined system when the determination unit determines that the license information is valid. And the limiting unit limits the number of clients based on the license information set by the setting unit.

  According to the present invention, it is possible to provide a license setting system and a license setting method capable of distributing license information with a guaranteed validity.

It is a figure which illustrates typically the composition of the license setting system in an embodiment. It is a flowchart which illustrates the process sequence at the time of writing license information to a USB memory from a tool terminal. It is a flowchart which illustrates the process sequence at the time of reading license information from a USB memory, and setting to a management server. It is a flowchart which shows the process sequence at the time of reading the license information already set from USB memory, and resetting to a management server.

  Embodiments of the present invention will be described below with reference to the drawings. However, the embodiment described below is merely an example, and does not exclude application of various modifications and techniques not explicitly described below. That is, the present invention can be implemented with various modifications without departing from the spirit of the present invention.

  First, the configuration of the license setting system in the embodiment will be described with reference to FIG. As illustrated in FIG. 1, the license setting system 1 includes a tool terminal 10, a USB memory 20, and a management console 30.

  The tool terminal 10 is a terminal that outputs license information to be given to a predetermined system. The license information in the present embodiment is information related to the license of the number of simultaneous connections indicating the number of terminals or users who can log in to a predetermined system at the same time.

  The management console 30 is a console of a management server (not shown) that manages a predetermined system. The management server is composed of the management server body and the management console. In the present embodiment, a case where license information is given to the management server via the management console 30 will be described.

  The USB memory 20 is an example of a storage medium that can be attached to and detached from the USB ports of the tool terminal 10 and the management console 30. The USB memory 20 has a storage unit 21. The storage unit 21 uniquely identifies the license information file 22 for storing license information, the authentication information file 23 for storing information used for authenticating the validity of the license information, and the own USB memory. Storage area for storing the USB identification information 24. The USB identification information 24 corresponds to, for example, information obtained by combining a serial number, a vendor ID, and a product ID.

  As the license information file 22 and the authentication information file 23, for example, an XML format file can be adopted. In this case, for example, the license information file 22 is provided with a license information entry for storing license information and a terminal identification information entry for storing terminal identification information for uniquely specifying the management server for which license information has already been set. As the terminal identification information, for example, the volume serial NO of the hard disk assigned to the C drive of the management server can be used. By using the volume serial NO, for example, even when the OS of the management server is reinstalled, the management server can be specified with the same volume serial NO. The authentication information file 23 includes, for example, an electronic signature entry that stores an electronic signature and a hash value entry that stores a hash value.

  The tool terminal 10 includes a data writing unit 11, a hash calculation unit 12, an encryption calculation unit 13, and a storage unit 14.

  The data writing unit 11 writes various information in the storage unit 21 of the USB memory 20. Examples of the various information include license information and electronic signature. When the various information is license information, the data writing unit 11 writes the license information in the license information entry of the license information file 22 of the USB memory 20. This license information is input by an operator of the tool terminal 10 from an input device of the tool terminal 10, for example. When the various types of information are electronic signatures, the data writing unit 11 writes the electronic signature in the electronic signature entry of the authentication information file 23 of the USB memory 20. This electronic signature is generated by an encryption operation unit 13 described later.

  For example, the hash calculator 12 uses the license information stored in the license information file 22 of the USB memory 20, the update date of the license information file 22, and the USB identification information 24 as input information, and uses the input information as a hash function. To convert it to a hash value.

  The encryption operation unit 13 encrypts the hash value calculated by the hash operation unit 12 with a secret key stored in advance in the storage unit 14 to generate an electronic signature. Instead of using the hash value, for example, the license information, the update date of the license information file 22, and the USB identification information 24 may be encrypted with a secret key to generate an electronic signature.

  The management console 30 includes a hash calculation unit 31, a decryption calculation unit 32, a validity determination unit 33, a data writing unit 34, a license setting unit 35, and a storage unit 36.

  For example, the hash calculator 31 uses the license information stored in the license information file 22 of the USB memory 20, the update date of the license information file 22, and the USB identification information 24 as input information, and uses the input information as a hash function. To convert it to a hash value. If the terminal identification information is stored in the terminal identification information entry of the license information file 22, the hash calculator 31 adds the terminal identification information to the input information and calculates a hash value.

  The decryption operation unit 32 decrypts the electronic signature stored in the authentication information file 23 of the USB memory 20 with the public key stored in advance in the storage unit 36 to restore the hash value.

  The validity determination unit 33 compares the hash value calculated by the hash calculation unit 31 with the hash value restored by the decryption calculation unit 32 when an electronic signature exists in the electronic signature entry of the authentication information file 23. Then, it is determined whether the license information stored in the license information file 22 is valid. Specifically, the validity determination unit 33 determines that the license information stored in the license information file 22 is valid license information when the compared hash values are the same.

  The validity determination unit 33 calculates the hash calculated by the hash calculation unit 31 when there is no digital signature in the digital signature entry of the authentication information file 23 or when a hash value exists in the hash value entry of the authentication information file 23. The license information is compared with the hash value stored in the authentication information file 23, the terminal identification information stored in the license information file 22 is compared with the terminal identification information of the management server to which the license information is set. The validity of the license information stored in the file 22 and the management server that is the setting destination of the license information is determined. Specifically, the validity determination unit 33 sets the license information and the license information stored in the license information file 22 when the compared hash values are the same and the compared terminal identification information is the same. It is determined that the previous management server is valid license information.

  The data writing unit 34 writes various information in the storage unit 21 of the USB memory 20. Examples of the various information include terminal identification information and hash values. When the various types of information are terminal identification information, the data writing unit 34 writes the terminal identification information in the terminal identification information entry of the license information file 22 of the USB memory 20. This terminal identification information is determined, for example, by the management console 30 operator specifying a management server as a license information setting destination. When the various types of information are hash values, the data writing unit 34 writes the hash value in the hash value entry of the authentication information file 23 of the USB memory 20. This hash value is generated by the hash calculator 31. When writing the hash value, the data writing unit 34 deletes the electronic signature from the electronic signature entry in the authentication information file 23 of the USB memory 20.

  The license setting unit 35 sets the license information stored in the license information file 22 in the management server main body when the validity such as the license information is recognized by the validity determination unit 33. Thereby, the restriction unit of the management server main body restricts the number of terminals or the number of users that can log in to the predetermined system simultaneously based on the set license information.

  Next, the operation of the license setting system in this embodiment will be described with reference to the drawings. With reference to FIG. 2, an operation when writing license information from the tool terminal to the USB memory will be described. FIG. 2 is a flowchart showing a processing procedure when writing license information from the tool terminal to the USB memory. In addition, before shifting to this operation | movement, it demonstrates on the assumption that the USB memory 20 is mounted | worn with the USB port of the tool terminal 10. FIG.

  First, the data writing unit 11 of the tool terminal 10 writes the license information in the license information entry of the license information file 22 of the USB memory 20 (step S101).

  Subsequently, the hash calculator 12 of the tool terminal 10 calculates a hash value using the license information file 22 and the USB identification information 24 (step S102).

  Subsequently, the encryption operation unit 13 of the tool terminal 10 encrypts the hash value calculated in step S102 with the private key stored in the storage unit 14 to generate an electronic signature (step S103).

  Subsequently, the data writing unit 11 of the tool terminal 10 writes the electronic signature generated in step S103 in the electronic signature entry of the authentication information file 23 of the USB memory 20 (step S104).

  With reference to FIG. 3, an operation when the license information is read from the USB memory and set in the management server will be described. FIG. 3 is a flowchart showing a processing procedure when the license information is read from the USB memory and set in the management server. In addition, before shifting to this operation | movement, it demonstrates on the assumption that the USB memory 20 is mounted | worn with the USB port of the management console 30. FIG.

  First, the hash calculator 31 of the management console 30 calculates a hash value using the license information file 22 and the USB identification information 24 of the USB memory 20 (step S201).

  Subsequently, the decryption calculation unit 32 of the management console 30 decrypts the electronic signature stored in the authentication information file 23 of the USB memory 20 with the public key stored in the storage unit 36 to restore the hash value ( Step S202).

  Subsequently, the validity determination unit 33 of the management console 30 compares the hash value calculated in step S201 with the hash value restored in step S202 (step S203) and stores it in the license information file 22 of the USB memory 20. It is determined whether the license information thus obtained is valid (step S204). If this determination is NO (step S204; NO), this processing procedure ends.

  On the other hand, if it is determined in step S204 that the license information is valid (step S204; YES), the data writing unit 34 of the management console 30 displays the terminal identification information for identifying the management server as the USB memory 20. Is written in the terminal identification information entry of the license information file 22 (step S205).

  Subsequently, the hash calculator 31 of the management console 30 calculates a hash value using the license information file 22 and the USB identification information 24 of the USB memory 20 (step S206).

  Subsequently, the data writing unit 34 of the management console 30 deletes the electronic signature from the electronic signature entry of the authentication information file 23 of the USB memory 20 (step S207), and uses the hash value calculated in step S206 described above. Is written in the hash value entry of the authentication information file 23 (step S208).

  Subsequently, the license setting unit 35 of the management console 30 sets the number of simultaneous connections included in the license information stored in the license information file 22 of the USB memory 20 in the management server (step S209).

  Thereby, the restriction unit of the management server restricts the number of terminals or users who can log in to the predetermined system at the same time with the number of simultaneous connections included in the license information as an upper limit.

  With reference to FIG. 4, an operation when license information is set again for a management server for which license information has already been set will be described. The situation where the license information is set again corresponds to the case where it is necessary to reset the number of simultaneous connections, for example, by reinstalling the OS on the management server. FIG. 4 is a flowchart showing a processing procedure when the already set license information is read from the USB memory and reset in the management server. In addition, before shifting to this operation | movement, it demonstrates on the assumption that the USB memory 20 is mounted | worn with the USB port of the management console 30. FIG.

  First, the management console 30 determines whether an electronic signature exists in the authentication information file 23 of the USB memory 20 (step S301). If this determination is YES (step S301; YES), this processing procedure ends. In this case, steps S201 to S209 (see FIG. 3) described above may be executed.

  On the other hand, if it is determined in step S301 that the electronic signature does not exist (step S301; NO), the hash calculator 31 of the management console 30 stores the license information file 22 and the USB identification information 24 in the USB memory 20. The hash value is calculated by using (step S302).

  Subsequently, the validity determination unit 33 of the management console 30 compares the hash value calculated in step S <b> 302 with the hash value stored in the authentication information file 23 of the USB memory 20 and the license information of the USB memory 20. The terminal identification information stored in the file 22 is compared with the terminal identification information of the management server that is the setting destination of the license information (step S303), and the license information and license information stored in the license information file 22 of the USB memory 20 are compared. It is determined whether or not the management server that is the setting destination is valid (step S304). If this determination is NO (step S304; NO), this processing procedure ends.

  On the other hand, if it is determined in step S304 that the license information and the management server are valid (step S304; YES), the license setting unit 35 of the management console 30 stores the license information in the license information file 22 of the USB memory 20. The number of simultaneous connections included in the license information thus set is set in the management server (step S305).

  Thus, for example, when it is necessary to reset the number of simultaneous connections by re-installing the OS on the management server, the number of simultaneous connections is read from the USB memory 20 used to set the number of simultaneous connections before. Can be reset.

  As described above, according to the license setting system 1 of the present embodiment, an electronic signature generated using the license information related to the number of simultaneous connections to the predetermined system stored in the USB memory 20 and the USB identification information is stored in the USB memory. When the license information is set, the validity of the license information is determined using the electronic signature, license information, and USB identification information stored in the USB memory 20 and the validity is confirmed. In addition, license information can be set for the management server. As a result, it is possible to set license information in which the validity is guaranteed in the management server, and it is possible to limit the number of terminals or users who can log in to a predetermined system simultaneously based on this license information.

  Further, according to the license setting system 1 in the present embodiment, when license information is set in the management server, the terminal identification information of the management server is added to the license information, and the terminal identification information that matches the terminal identification information is included. It is possible to allow the terminal to reset the license information. As a result, it is possible to prevent an illegal act of setting license information in another management server using the USB memory 20 in which the license information is set in one management server. Further, it is possible to reset the license information only for the same management server using the storage medium in which the license information is set in the management server.

  Furthermore, according to the license setting system 1 of the present embodiment, since the license information can be set while the USB memory 20 is being attached and detached, the same management server can be used simultaneously with a plurality of different USB memories 20. It is also possible to set the number of connections. Thereby, the simultaneous connection number in a management server can be increased simply.

  In the embodiment described above, the license information is set in the management server. However, the present invention is not limited to this, and the license information can be set for a predetermined terminal connectable to a predetermined system. The predetermined terminal also includes a client / server type client terminal.

  In addition, when the license information is set in the management server, the data writing unit 34 of the management console 30 in the above-described embodiment writes the hash value generated by the hash calculation unit 31 into the authentication information file 23 as authentication information. However, it is not limited to this. For example, instead of the hash value, the license information and terminal identification information stored in the license information file 22 of the USB memory 20, the update date of the license information file 22, and the USB identification information 24 are directly used as authentication information in the authentication information file 23. It may be written.

  DESCRIPTION OF SYMBOLS 1 ... License setting system, 10 ... Tool terminal, 11 ... Data writing part, 12 ... Hash calculating part, 13 ... Encryption calculating part, 14 ... Memory | storage part, 20 ... USB memory, 21 ... Memory | storage part, 22 ... License information File: 23 ... Authentication information file, 24 ... USB identification information, 30 ... Management console, 31 ... Hash calculation unit, 32 ... Decryption calculation unit, 33 ... Validity determination unit, 34 ... Data writing unit, 35 ... License setting unit , 36... Storage unit.

Claims (5)

A license setting system comprising: a management server that manages a predetermined system; a tool terminal that outputs license information to be given to the predetermined system; and a storage medium that is detachable from the management server and the tool terminal,
The storage medium is
At least a license information storage area for storing license information relating to the number of simultaneous connections to the predetermined system, an authentication information storage area for storing information used for authentication of the license information, and storage medium identification information of the own storage medium An identification information storage area for storing
The tool terminal is
A license information writing unit for writing the license information in the license information storage area;
A signature generation unit that generates an electronic signature using at least the license information stored in the license information storage area, the storage medium identification information stored in the identification information storage area, and a secret key;
An authentication information writing unit for writing the electronic signature in the authentication information storage area,
The management server
A decryption unit that decrypts the electronic signature stored in the authentication information storage area with a public key;
The license information stored in the license information storage area using the decrypted information, the license information stored in the license information storage area, and the storage medium identification information stored in the identification information storage area A determination unit that determines whether or not is valid,
A limiting unit that limits the number of clients included in the predetermined system based on the license information stored in the license information storage area when the determination unit determines that the license information is valid. A license setting system characterized by comprising: The management server
A terminal identification information writing unit that writes terminal identification information for identifying its own management server in the license information storage area when the determination unit determines that the license information is valid;
At least authentication information generated using the terminal identification information and the license information stored in the license information storage area, and the storage medium identification information stored in the identification information storage area, is stored in the authentication information storage area An authentication information writing section for writing to
The license setting system according to claim 1, further comprising: When the authentication information is stored in the authentication information storage area, the determination unit of the management server uses the terminal identification information for identifying the setting target terminal of the license information and the authentication information. Determine whether the license information stored in the license information storage area and the setting target terminal is valid,
The restricting unit of the management server, based on the license information stored in the license information storage area, when the determining unit determines that the license information and the setting target terminal are valid, The license setting system according to claim 2, wherein the number is limited. The management server further includes a setting unit configured to set the license information stored in the license information storage area in the predetermined system when the determination unit determines that the license information is valid. ,
The license setting system according to claim 1, wherein the limit unit limits the number of clients based on the license information set by the setting unit. A license setting method executed by a license setting system comprising: a management server that manages a predetermined system; a tool terminal that outputs license information to be given to the predetermined system; and a storage medium that is detachable from the management server and the tool terminal Because
The tool terminal is
Writing the license information in a license information storage area of the storage medium for storing license information of the number of simultaneous connections to the predetermined system;
Generating an electronic signature using at least the license information stored in the license information storage area, storage medium identification information for identifying the storage medium, and a secret key;
Writing the electronic signature in an authentication information storage area of the storage medium for storing information used for authentication of the license information,
The management server is
Decrypting the electronic signature stored in the authentication information storage area with a public key;
Using the decrypted information, the license information stored in the license information storage area, and the storage medium identification information, whether or not the license information stored in the license information storage area is valid And steps to
Executing the step of limiting the number of clients included in the predetermined system based on the license information stored in the license information storage area when it is determined in the determination that the license information is valid A license setting method characterized by including:

Images