JP2017084251A - License authentication method, license authentication system, and license authentication program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform license authentication even in a situation where data communication cannot be performed between a use device and a management device.SOLUTION: A design support device 2 generates a challenge code for creating a one-time password, and displays a QR code (R) including the challenge code. The design support device 2 creates, as a matching confirmation password, a hash value calculated by processing with a predetermined hash function using the challenge code, and determines whether or not an input one-time password and the hash value match. A portable terminal 4 obtains the displayed challenge code and transmits the challenge code to a server 3. The portable terminal 4 displays the one-time password received from the server 3. The server 3 creates, as a one-time password, a hash value calculated by processing with a hash function identical to the one used by the design support device 2, by using the received challenge code; and transmits it to the portable terminal 4.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a license authentication method, a license authentication system, and a license authentication program for performing license authentication of a program.

  2. Description of the Related Art Conventionally, a technique for granting a license to a program in order to prevent unauthorized use of a program used on a computer is known (see, for example, Patent Document 1). Specifically, when a licensed program (hereinafter referred to as a license grant program) is executed, an information processing device (hereinafter referred to as a “use device”) in which the license grant program is installed is assigned to the license grant program, for example. The license authentication is requested by transmitting the authentication identification information (ie, ID) and the password to the management apparatus that manages the license via the network. Based on the received authentication identification information and password, the management device determines whether it is a license authentication request from the license grant program, and if it is determined that it is a license authentication request from the license grant program, Allows the device to use the program.

Japanese Patent No. 4622354

However, for example, in a situation where data communication cannot be performed between the using device and the management device due to a network abnormality, there is a problem that license authentication cannot be performed.
The present invention has been made in view of such a problem, and an object of the present invention is to provide a technique capable of performing license authentication even in a situation where data communication cannot be performed between a use device and a management device. And

  In order to achieve the above object, a first invention includes a use device in which a license grant program, which is a program to which a license permitting use, is installed, a management device that manages a license of the license grant program, This is a license authentication method for authenticating a license of a license grant program using a mobile terminal that performs data communication with a management apparatus.

  The license authentication method of the first invention includes an information generation procedure, a creation information display procedure, a creation information acquisition procedure, a creation information transmission procedure, an authentication password creation procedure, a password transmission procedure, a password display procedure, A confirmation password creation procedure and a matching confirmation procedure are provided.

  In the information generation procedure, the using device generates password creation information for creating an authentication password, which is a password for authentication. In the creation information display procedure, the using device displays the password creation information generated by the information generation procedure. In the creation information acquisition procedure, the mobile terminal acquires the password creation information displayed by the creation information display procedure. In the creation information transmission procedure, the mobile terminal transmits the password creation information acquired by the creation information acquisition procedure to the management apparatus. In the authentication password creation procedure, the management device creates an authentication password using a password creation method set in advance using the password creation information received from the mobile terminal. In the password transmission procedure, the management device transmits the authentication password created by the password creation procedure to the mobile terminal. In the password display procedure, the mobile terminal displays the authentication password received from the management device. In the confirmation password creation procedure, the using device uses the password creation information to create a matching confirmation password using the same creation method as the password creation method used by the management device. In the match confirmation procedure, the using device determines whether or not the authentication password input to the using device matches the match confirmation password created by the confirmation password creation procedure.

  In the license authentication method of the first invention configured as described above, the portable terminal acquires the password creation information displayed on the use device, and transmits the password creation information to the management device by data communication. The portable terminal receives the authentication password created by using the password creation information in the management device from the management device by data communication, and displays the authentication password. Thereafter, when the authentication password displayed on the portable terminal is input to the use device, the use device can determine whether or not the authentication password matches the match confirmation password. As a result, the using device can permit the use of the license grant program when the authentication password matches the match confirmation password.

Thus, the license authentication method of the first invention can perform license authentication even in a situation where data communication cannot be performed between the using device and the management device.
A second invention made to achieve the above object is a license authentication system that includes a use device, a management device, and a portable terminal, and performs license authentication of a license grant program.

  The use device includes information generation means, creation information display means, confirmation password creation means, and coincidence confirmation means. The portable terminal includes creation information acquisition means, creation information transmission means, and password display means. The management device includes an authentication password creation unit and a password transmission unit.

  The information generating means generates password creation information for creating an authentication password that is a password for authentication. The creation information display means displays the password creation information generated by the information generation means. The confirmation password creating means creates a matching confirmation password by using a password creation method set in advance using the password creation information. The coincidence confirmation unit determines whether or not the authentication password input to the device in use matches the coincidence confirmation password created by the confirmation password creation unit.

  The creation information acquisition means acquires the password creation information displayed by the creation information display means. The creation information transmission means transmits the password creation information acquired by the creation information acquisition means to the management apparatus. The password display means displays the authentication password received from the management device.

  The authentication password creating means creates an authentication password by the same creation method as the password creation method used by the using device, using the password creation information received from the mobile terminal. The password transmission unit transmits the authentication password created by the password creation unit to the portable terminal.

  The license authentication system of the second invention configured as described above is a system for executing the license authentication method of the first invention, and can obtain the same effects as the license authentication method of the first invention.

  According to a third aspect of the present invention, there is provided a computer mounted on a use device for authenticating the license of the license grant program using a use device, a management device, and a portable terminal. Is a license authentication program that functions as information generation means, creation information display means, confirmation password creation means, and coincidence confirmation means.

  The license authentication program of the third invention configured as described above is a program for executing the license authentication method of the first invention, and is a program executed by the license authentication system of the second invention. The same effects as those of the license authentication method and the license authentication system of the second invention can be obtained.

1 is a block diagram illustrating a configuration of an authentication system 1. FIG. It is a flowchart which shows a design support program execution process and an information acquisition process. It is a flowchart which shows an authentication process. It is a flowchart which shows an apparatus side return process and an online authentication process. It is a flowchart which shows an offline authentication process and a server side return process. It is a figure which shows window W1, W2, W3, W4.

Embodiments of the present invention will be described below with reference to the drawings.
As shown in FIG. 1, the authentication system 1 of this embodiment includes a design support apparatus 2, a server 3, and a mobile terminal 4.

  The design support apparatus 2 includes a personal computer (hereinafter referred to as a personal computer), and includes a CPU 11, a ROM 12, a RAM 13, a data storage device 14, an input device 15, a display device 16, and a communication device 17.

  The ROM 12 is a non-volatile memory in which data cannot be rewritten. The ROM 12 stores a boot program and the like. The RAM 13 is a volatile memory, and temporarily stores calculation results of the CPU 11 and the like. The data storage device 14 is a nonvolatile memory capable of rewriting stored contents, and is, for example, a hard disk drive in the present embodiment. The data storage device 14 stores an operating system, various application programs, and the like.

  The input device 15 includes a keyboard and a pointing device, for example. Then, the input device 15 outputs to the CPU 11 input operation information for specifying an input operation performed by the user through the keyboard and the pointing device. The display device 16 displays various images on the display screen based on instructions from the CPU 11. The communication device 17 performs data communication with the server 3 via the Internet. The CPU 11 executes various processes based on programs stored in the ROM 12 and the data storage device 14.

  When the design support apparatus 2 is turned on and started up, the design support apparatus 2 operates according to the operating system installed in the design support apparatus 2 and executes various application programs according to the input operation information input from the input apparatus 15. Run.

  A design support program 21 and an authentication program 22 are installed in the design support apparatus 2. The design support program 21 is an application program used when creating a design drawing for constructing buildings such as buildings and houses. The design support program 21 is licensed. The license according to the present embodiment is a right to use the program under a predetermined use condition. The authentication program 22 is an application program for performing license authentication when the design support program 21 is used. The design support program 21 and the authentication program 22 may be installed in advance on a personal computer that constitutes the design support apparatus 2, or may be installed via a recording medium or a network. Examples of the recording medium include an optical disk, a magnetic disk, and a semiconductor memory.

Then, when input operation information for executing the design support program 21 is input from the input device 15, the CPU 11 starts executing the design support program 21.
The server 3 includes a CPU 31, a ROM 32, a RAM 33, a data storage device 34 and a communication device 35. The ROM 32 is a non-volatile memory in which data cannot be rewritten. The RAM 33 is a volatile memory, and temporarily stores calculation results of the CPU 31 and the like. The data storage device 34 is a nonvolatile memory capable of rewriting stored contents, and is, for example, a hard disk drive in the present embodiment. The communication device 35 performs data communication with the design support device 2 via the Internet, and performs data communication with the mobile terminal 4 via a mobile phone communication network. The CPU 31 executes various processes based on programs stored in the ROM 32 and the data storage device 34.

  The mobile terminal 4 has a function of performing a voice call and data communication via a mobile phone communication network. The portable terminal 4 includes a CPU 41, a ROM 42, a RAM 43, a data storage device 44, a display device 45, an input device 46, a photographing device 47 and a communication device 48. The ROM 42 is a nonvolatile memory that cannot rewrite data. The RAM 43 is a volatile memory, and temporarily stores calculation results of the CPU 41 and the like. The data storage device 44 is a nonvolatile memory capable of rewriting stored contents, and is, for example, a flash memory in the present embodiment. The display device 45 displays various images on a display screen installed on the front surface of the casing of the mobile terminal 4 based on an instruction from the CPU 41. The input device 46 includes a touch panel installed on the display screen of the display device 45 and a switch installed around the display screen of the display device 45. The input device 46 outputs input operation information for specifying an input operation performed by the user via the touch panel and the switch to the CPU 41. The photographing device 47 includes a front camera installed on the front surface of the casing of the mobile terminal 4 and a rear camera installed on the rear surface of the casing. The communication device 48 performs data communication with the server 3 via a mobile phone communication network. The CPU 41 executes various processes based on programs stored in the ROM 42 and the data storage device 44.

  Next, the procedure of the design support program execution process executed by the CPU 11 of the design support apparatus 2 will be described. The design support program execution process is a part of the process executed by the CPU 11 based on the design support program 21, and is a process executed after the execution of the design support program 21 is started.

  When the design support program execution process is executed, as shown in FIG. 2A, the CPU 11 first determines whether or not the authentication process is activated in S10. The authentication process is an authentication program 22 being executed by the CPU 11. If the authentication process is activated, the process proceeds to S30. On the other hand, if the authentication process is not activated, the authentication process is activated (that is, the execution of the authentication program 22 is started) in S20, and the process proceeds to S30. Then, when the process proceeds to S30, an inquiry is made to the authentication process as to whether or not activation is possible.

  Thereafter, in S40, it is determined whether or not activation permission information has been acquired from the authentication process. If it is determined that the activation availability information has not been acquired, the process proceeds to S30. On the other hand, if it is determined that the activation availability information has been acquired, it is determined in S50 whether or not the design support program 21 can be used based on the acquired activation availability information (hereinafter referred to as an availability state). Determine whether. Specifically, when the availability information indicates that it can be activated, it is determined to be in an available state, and when the availability information indicates that it cannot be activated, It is determined that it is not usable.

  If it is not in the usable state, the design support program execution process is terminated. On the other hand, if it is in a usable state, in S60, a portion (hereinafter referred to as a design support application) used to create a design drawing for constructing a building is started in the design support program 21. Then, the design support program execution process is terminated.

  Next, a procedure of authentication processing executed by the CPU 11 of the design support apparatus 2 will be described. The authentication process is a part of the process executed by the CPU 11 based on the authentication program 22, and is a process repeatedly executed after the execution of the authentication program 22 is started.

  When the authentication process is executed, as shown in FIG. 3, the CPU 11 first determines in S110 whether or not there is an inquiry as to whether or not the design support program can be activated. If it is determined that there is no inquiry about whether or not activation is possible, the process of S110 is repeated to wait until there is an inquiry about whether or not activation is possible. If there is an inquiry as to whether or not activation is possible, in S120, it is determined whether or not it is within the authentication designation time for offline authentication. The authentication designation time in offline authentication is the time designated in the process of S200 described later. In S120, when the authentication designation time has not elapsed since the time when the authentication designation time was designated in the process of S200, it is determined that it is within the authentication designation time, and if the authentication designation time has elapsed, Judge that it is not within the specified time. If it is determined that it is within the authentication designation time, the process proceeds to S270.

  On the other hand, if it is determined that it is not within the designated authentication time, an authentication information input window W1 (see FIG. 6A) is displayed on the display screen of the display device 16 at S130. The authentication information input window W1 includes an ID input text box, a password input text box, an OK button, and an offline authentication button. In step S140, it is determined whether authentication information has been input. The authentication information in this embodiment is an ID and a password. If it is determined that authentication information has not been input, the process of S140 is repeated to wait until authentication information is input. When the authentication information is input, it is determined in S150 whether online authentication is performed. Specifically, it is determined that online authentication is performed when the OK button of the authentication information input window W1 is operated, and it is determined that online authentication is not performed when the offline authentication button is operated.

  If it is determined that the authentication is online authentication, a communication message including the input authentication information and identification information of the application to be used (that is, the design support program 21) is created and created in S160. A communication message is transmitted to the server 3. In S170, it is determined whether license validity information is received from server 3. The license validity information is information relating to the validity of the license (that is, whether or not the design support application can be used). If it is determined that the license validity information has not been received, the process of S170 is repeated to wait until the license validity information is received. When the license validity information is received, in S180, it is determined whether or not it is in a usable state based on the license validity information, and the usability information indicating whether or not it is in a usable state is stored in the RAM 13. Then, the process proceeds to S270.

  If it is determined in S150 that the online authentication is not performed, a usage time input window W2 (see FIG. 6B) is displayed on the display screen of the display device 16 in S190. The usage time input window W2 includes a usage time input button and an OK button. In S200, it is determined whether or not a usage time has been input. If it is determined that the usage time has not been input, the process of S200 is repeated until the usage time is input. When the usage time is input, in S210, a random number (hereinafter, challenge code) to be placed on the communication message is generated. Further, in S220, the authentication information, the usage time information indicating the input usage time, the identification information of the program to be used, the challenge code, and the like are synthesized, and the synthesized information is encrypted to create a communication message.

  Next, in S230, a one-time pass input window W3 (see FIG. 6C) is displayed on the display screen of the display device 16. The one-time pass input window W3 includes a QR code (registered trademark), a one-time password input text box, and an OK button. The QR code of the one-time path input window W3 is an image created based on the URL for accessing the server 3 and the URL parameter composed of the communication message created in S220. In S240, it is determined whether or not a one-time password has been input (see FIG. 6D). If it is determined that the one-time password has not been input, the process of S240 is repeated to wait until the one-time password is input. When the one-time password is input, the consistency of the one-time password is confirmed in S250. Specifically, first, the challenge code generated in S210 is processed with a preset hash function to obtain a hash value. When the hash value and the one-time password match, it is determined that there is consistency, and when it does not match, it is determined that there is no consistency.

  Further, in S260, based on the confirmation result in S250, it is determined whether or not it is in a usable state, the usable / unusable information indicating whether or not it is in a usable state is stored in the RAM 13, and the process proceeds to S270. . When the process proceeds to S270, the activation support information is notified to the design support program execution process based on the availability information stored in the RAM 13. Specifically, when the availability information indicates that it is in an available state, the availability information indicating that it can be activated is notified, and the availability information indicates that it is not in an available state. In this case, the activation availability information indicating that activation is not possible is notified. When the process of S270 ends, the authentication process is temporarily ended.

Next, a procedure of information acquisition processing executed by the CPU 41 of the mobile terminal 4 will be described. The information acquisition process is a process that is repeatedly executed during the operation of the mobile terminal 4.
When the information acquisition process is executed, as shown in FIG. 2B, the CPU 41 first determines whether or not input operation information for performing shooting by the shooting device 47 is input from the input device 46 in S310. Judging. When the input operation information for executing the shooting is not input, the process proceeds to S370. On the other hand, if input operation information for performing shooting is input, the shooting device 47 is caused to perform shooting in S320.

  In S330, it is determined whether or not a QR code is included in the captured image captured by the imaging device 47. If no QR code is included, the process proceeds to S370. On the other hand, if the QR code is included, in S340, the information included in the QR code is read. Then, in S350, it is determined whether or not the URL and the URL parameter are included in the information read in S340. If the URL and the URL parameter are not included, the process proceeds to S370. On the other hand, if the URL and the URL parameter are included, a communication message including the URL and the URL parameter is created in S360, the communication message is transmitted to the server 3, and the process proceeds to S370.

  In S370, it is determined whether a one-time password is received from the server 3. Here, when the one-time password has not been received, the information acquisition process is temporarily terminated. On the other hand, when the one-time password is received, the received one-time password is displayed on the display screen of the display device 45 in S380, and the information acquisition process is temporarily terminated.

  Next, the procedure of the apparatus side return process executed by the CPU 11 of the design support apparatus 2 will be described. The apparatus-side return process is a part of the process that the CPU 11 executes based on the authentication program 22, and is a process that is repeatedly executed after the execution of the authentication program 22 is started.

  When the apparatus-side return process is executed, the CPU 11 first determines in S410 whether there is a license return request from the design support application, as shown in FIG. If it is determined that there is no license return request, the process of S410 is repeated to wait for a license return request. If a license return request is received, a return confirmation window is displayed on the display screen of the display device 16 in S420. The return confirmation window includes, for example, an image indicating “Do you want to return the license?”, An OK button, and a cancel button.

  In S430, it is determined whether or not to return the license. Specifically, it is determined that the license is returned when the OK button is operated, and it is determined that the license is not returned when the cancel button is operated.

  If it is determined that the license is not to be returned, the apparatus-side return process is temporarily terminated. On the other hand, if it is determined that the license is to be returned, a communication message is created from the challenge code generated at the start of authentication in S440. In S450, the license held in the design support apparatus 2 is invalidated. In step S460, it is determined whether the license return request is online. Here, if it is determined to be online, the apparatus-side return process is temporarily terminated. On the other hand, if it is determined that the user is offline, a return window W4 (see FIG. 6E) is displayed on the display screen of the display device 16 in S470. The return window W4 includes a QR code, an image in which, for example, “License is returned. Please access the URL indicated by the QR code”, and an OK button. The QR code of the return window W4 is an image created based on the URL for accessing the server 3 and the URL parameter composed of the communication message created in S440.

  In S480, it is determined whether or not the OK button has been operated. If it is determined that the OK button has not been operated, the process of S480 is repeated to wait until the OK button is operated. When the OK button is operated, the apparatus-side return process is temporarily terminated.

Next, a procedure of online authentication processing executed by the CPU 31 of the server 3 will be described. The online authentication process is a process that is repeatedly executed during the operation of the server 3.
When the online authentication process is executed, as shown in FIG. 4B, the CPU 31 first determines whether or not a communication message has been received from the design support apparatus 2 via the Internet in S610. Here, if it is determined that a communication message has not been received, the online authentication process is temporarily terminated. On the other hand, if it is determined that a communication message has been received, it is determined in S620 whether or not to permit use of the application. Specifically, first, authentication information and identification information of an application to be used are extracted from the received communication message. Then, it is determined whether the authentication information is correct. If it is determined that the authentication information is correct, it is determined that the use of the application corresponding to the extracted identification information is permitted. On the other hand, if it is determined that the authentication information is not correct, it is determined that use of the application corresponding to the extracted identification information is not permitted.

  If it is determined in S620 that the use of the application is not permitted, the license validity information indicating that the use of the application is not permitted is transmitted to the design support apparatus 2 in S630, and the online authentication process is temporarily terminated. On the other hand, if it is determined that the use of the application is permitted, it is determined in S640 whether or not the application corresponding to the extracted identification information is being used. Note that “in use” refers to any one of the following first use state and second use state. The first in-use state refers to a state where the use of the license authenticated online is not completed. The second in-use state refers to a state within the designated time for the license authenticated offline.

  If it is determined that the application is in use, the process proceeds to S630. On the other hand, if it is determined that the application is not in use, in S650, it is assumed that the application corresponding to the extracted identification information has started, and the application corresponding to the extracted identification information is “in use”. Is recorded in the data storage device 34. In step S660, license validity information indicating permission to use the application is transmitted to the design support apparatus 2, and the online authentication process is temporarily terminated.

Next, the procedure of offline authentication processing executed by the CPU 31 of the server 3 will be described. The offline authentication process is a process that is repeatedly executed during the operation of the server 3.
When the offline authentication process is executed, as shown in FIG. 5 (A), the CPU 31 first determines whether or not a communication message has been received from the mobile terminal 4 via the mobile phone communication network in S710. . A communication message transmitted from the portable terminal 4 includes the URL and the URL parameter. If it is determined that a communication message has not been received, the offline authentication process is temporarily terminated. On the other hand, if it is determined that a communication message has been received, in S720, the received communication message is decrypted, and authentication information, usage time information, identification information of the program to be used, a challenge code, and the like are extracted. .

  In step S730, it is determined whether to permit use of the application. Specifically, it is determined whether or not the authentication information extracted in S720 is correct. If it is determined that the authentication information is correct, it is determined that the use of the application corresponding to the extracted identification information is permitted. On the other hand, if it is determined that the authentication information is not correct, it is determined that use of the application corresponding to the extracted identification information is not permitted.

  If it is determined in S730 that the use of the application is not permitted, the license validity information indicating that the use of the application is not permitted is transmitted to the portable terminal 4 in S740, and the offline authentication process is temporarily terminated. On the other hand, if it is determined that the use of the application is permitted, it is determined in S750 whether or not the application corresponding to the extracted identification information is being used in the same manner as in S640. If it is determined that the application is in use, the process proceeds to S740. On the other hand, if it is determined that the application is not in use, in S760, the application corresponding to the extracted identification information is recorded in the data storage device 34 as in S650.

  In step S770, a one-time password is created. Specifically, a hash value is calculated by processing the challenge code extracted in S720 with the same hash function as that set in the design support apparatus 2, and this hash value is used as a one-time password. In S780, the one-time password created in S770 is transmitted to the portable terminal 4, and the offline authentication process is temporarily terminated.

Next, a procedure of server side return processing executed by the CPU 31 of the server 3 will be described. The server-side return process is a process that is repeatedly executed during the operation of the server 3.
When the server-side return process is executed, the CPU 31 first determines in S810 whether or not a communication message has been received, as shown in FIG. Here, if it is determined that a communication message has not been received, the server-side return process is temporarily terminated. On the other hand, if it is determined that the communication message has been received, it is determined in S820 whether or not it is online. Specifically, when a communication message is received from the design support device 2 via the Internet, it is determined that the communication message is online, and when a communication message is received from the portable terminal 4 via the communication network of the mobile phone. Judge that it is not online.

  If it is determined that the user is online, authentication information and the like are extracted from the received communication message in S830, and the process proceeds to S850. On the other hand, if it is determined that it is not online, a challenge code or the like is extracted from the received communication message in S840, and the process proceeds to S850. In S850, license information corresponding to the authentication information or challenge code is acquired from the issued license information using the extracted authentication information or challenge code as an identifier.

  Thereafter, in S860, the return of the license indicated by the license information acquired in S850 is recorded in the data storage device 34. Specifically, it is recorded in the data storage device 34 that the application corresponding to the license information acquired in S850 is “end”. Then, when the process of S860 ends, the server-side return process is temporarily ended.

  The authentication system 1 configured as described above includes a design support apparatus 2 in which a design support program 21 to which a license permitting use is installed, a server 3 that manages a license of the design support program 21, and a server 3 and a portable terminal 4 that performs data communication.

  The design support apparatus 2 generates a challenge code for creating a one-time password (S210), and displays a QR code including the generated challenge code (S230). The design support apparatus 2 uses the generated challenge code to create a hash value calculated by processing with a preset hash function as a match confirmation password, and the one-time password input to the design support apparatus 2 Then, it is determined whether or not the created hash value matches (S250).

  The portable terminal 4 acquires the displayed challenge code (S320, S330, S340), and transmits the acquired challenge code to the server 3 (S360). The portable terminal 4 displays the one-time password received from the server 3 (S380).

  The server 3 uses the challenge code received from the mobile terminal 4 to create a hash value calculated by processing with the same hash function used by the design support apparatus 2 as a one-time password (S770) The created one-time password is transmitted to the portable terminal 4 (S780).

  As described above, in the authentication system 1, the mobile terminal 4 acquires the challenge code displayed on the design support apparatus 2 and transmits the challenge code to the server 3 by data communication. The mobile terminal 4 receives the one-time password created by using the challenge code in the server 3 from the server 3 by data communication, and displays the one-time password. Thereafter, the one-time password displayed on the portable terminal 4 is input to the design support apparatus 2, so that the design support apparatus 2 can determine whether or not the one-time password and the match confirmation password match. . Thereby, the design support apparatus 2 can permit the use of the design support program 21 when the one-time password matches the match confirmation password.

As described above, the authentication system 1 can perform license authentication even in a situation where data communication cannot be performed between the design support apparatus 2 and the server 3.
In the authentication system 1, a QR code displayed on the screen is used for information transmission from the design support apparatus 2 to the portable terminal 4, and input is performed for information transmission from the portable terminal 4 to the design support apparatus 2. A multi-digit number is input via the device 15. For example, even if the design support device 2 is a device in which input / output of data is strictly restricted, screen display and key input are not restricted, so that the design support device 2 and the portable terminal 4 are not restricted. It is possible to reliably transmit information.

  For example, as shown in Japanese Patent Application Laid-Open No. 2014-96101, a challenge / response method is known as an authentication method using a one-time password. In the challenge-response method, each time the terminal logs in, the authentication server transmits a one-time password generation parameter called a challenge to the terminal. And a terminal produces | generates the one-time password called a response with the received challenge as an input, and transmits to an authentication server. Further, the authentication server calculates a response to be transmitted by the user based on the challenge, and compares it with the response received from the terminal. And an authentication server transmits a collation result to a terminal. That is, in this challenge / response method, data transmission / reception needs to be performed twice between the terminal and the authentication server.

  On the other hand, in the authentication system 1, as data transmission / reception, the portable terminal 4 transmits a challenge code to the server 3 (S 360), and the server 3 transmits a one-time password to the portable terminal 4 (S 780). Authentication can be performed. That is, in the authentication system 1, data exchange between the design support apparatus 2 and the server 3 via the portable terminal 4 may be performed one round trip for license authentication. For this reason, the authentication system 1 can reduce the amount of communication on the network connecting the portable terminal 4 and the server 3 and can reduce the processing load of the server 3.

  Next, the authentication program 22 causes the computer to function to generate a challenge code for creating a one-time password (S210). The authentication program 22 causes the computer to function to display a QR code including the generated one-time password (S230). The authentication program 22 causes the computer to function so as to create a hash value calculated by processing with a preset hash function as a match confirmation password using the generated challenge code (S250). The authentication program 22 causes the computer to function so as to determine whether or not the one-time password input to the design support apparatus 2 matches the created hash value (S250).

The authentication program 22 is a program executed by the authentication system 1 and can obtain the same effect as the authentication system 1.
Further, the authentication program 22 calculates a hash value by processing the challenge code with the same hash function as that set in the server 3, and causes the computer to function as this hash value as a match confirmation password ( S250).

  The hash value has less data than the challenge code. For this reason, the data amount when the server 3 transmits a one-time password to the portable terminal 4 can be reduced. Furthermore, since the number of characters of the one-time password displayed on the portable terminal 4 can be reduced, the work when the user of the design support apparatus 2 inputs the one-time password to the design support apparatus 2 via the input device 15. The amount can be reduced.

  The authentication program 22 causes the computer to function so as to store the availability information in the RAM 13 mounted on the design support apparatus 2 (S260), and operates independently of the design support program 21. Since the usability information is stored in the RAM 13, the usability information is not held as permanent data (for example, a file or registry in the HDD) in the design support apparatus 2. For this reason, it becomes difficult to tamper with the availability information, and unauthorized use of the design support program 21 can be suppressed. Further, the authentication program 22 and the design support program 21 operate independently of each other, so that the availability information can be held in the RAM 13 even if the design support program 21 is terminated regardless of whether it is normally terminated or abnormally terminated. . Even when the design support program 21 is terminated, the next authentication process can be omitted when the design support program 21 is executed next.

  Further, the authentication program 22 causes the computer to function to request license authentication by transmitting the ID and password to the server 3 by data communication (S150, S160). The authentication program 22 causes the computer to function so as to receive license validity information indicating whether or not the design support program 21 can be used from the server 3 (S170). As a result, the design support apparatus 2 can perform online license authentication if data communication with the server 3 can be performed.

  If the design support apparatus 2 can perform data communication with the server 3, the license can be returned both online and offline even if the license is authenticated online or offline. Can be done. For example, after performing online license authentication, if it becomes impossible to perform data communication between the design support apparatus 2 and the server 3 due to network abnormality, the license should be returned offline. Also good. In addition, after the license authentication is performed offline, when the network recovers and the data communication between the design support apparatus 2 and the server 3 can be performed, the license is returned online. It may be.

  In the embodiment described above, the authentication system 1 corresponds to a license authentication system, the authentication program 22 corresponds to a license authentication program, the design support apparatus 2 to a use apparatus, the server 3 to a management apparatus, and the design support program 21 to a license grant program.

  Further, the process of S210 is an information generation means and an information generation procedure, the process of S230 is a creation information display means and a creation information display procedure, the process of S250 is a confirmation password creation means and a confirmation password creation procedure, and the process of S250 is a match confirmation means and This corresponds to the match confirmation procedure.

  The processes of S320, S330, and S340 correspond to the creation information acquisition means and the creation information acquisition procedure, the process of S360 corresponds to the creation information transmission means and the creation information transmission procedure, and the process of S380 corresponds to the password display means and the password display procedure.

The process of S770 corresponds to an authentication password creating means and an authentication password creating procedure, and the process of S780 corresponds to a password sending means and a password sending procedure.
The one-time password corresponds to the authentication password, the challenge code corresponds to the password creation information, and the hash value created in S250 corresponds to the match confirmation password.

  The processing of S190 and S200 is a usage time acquisition unit, the processing of S230 is a time information display unit, the processing of S260 is an availability information storage unit, the processing of S150 and S160 is an authentication request unit, and the processing of S170 is a validity information receiving unit. It corresponds to.

The RAM 13 corresponds to a volatile memory, the ID corresponds to authentication identification information, and the password set corresponding to the ID corresponds to an authentication password.
As mentioned above, although one Embodiment of this invention was described, this invention is not limited to the said embodiment, As long as it belongs to the technical scope of this invention, a various form can be taken.

  For example, in the above-described embodiment, the one that creates a one-time password and a matching confirmation password using a challenge code is shown. However, information used to create a password is not limited to a challenge code, and for example, information obtained by combining authentication information, usage time information, program identification information, and a challenge code may be used.

  In the above-described embodiment, the QR code created based on the URL and the URL parameter is displayed on the display screen of the design support apparatus 2. However, any form that allows the mobile terminal 4 to acquire the URL and the URL parameter is acceptable, and the present invention is not limited to the QR code. For example, a character string indicating a URL and a URL parameter may be displayed on the display screen of the design support apparatus 2. In this case, the portable terminal 4 is preferably provided with a function of converting a photographed character string into a character code by OCR.

  In the above-described embodiment, the server-side return process has acquired license information using the challenge code as an identifier when offline. However, the identifier is not limited to the challenge code, and may be any information that can identify the program that requested the license authentication.

  In the above embodiment, it is determined whether or not the application is in use, and when it is in use, the license validity information indicating that the application is not permitted is transmitted to the design support apparatus 2. . That is, in the above-described embodiment, a configuration is shown in which duplicate use of applications is not permitted. However, duplicate use of applications may be permitted. That is, even when it is determined that the application is in use, it may be recorded that the application is “in use” and license validity information indicating permission to use the application may be transmitted.

  Moreover, in the said embodiment, what performed the license authentication of the application program used when creating the design drawing for constructing a building was shown. However, the authentication system 1 of the present embodiment can also be applied to license authentication of application programs for other purposes.

  DESCRIPTION OF SYMBOLS 1 ... Authentication system, 2 ... Design support apparatus, 3 ... Server, 4 ... Portable terminal, 11, 31, 41 ... CPU, 12, 32, 42 ... ROM, 13, 33, 43 ... RAM, 14, 34, 44 ... Data storage device 15, 46 ... input device 16, 45 ... display device, 17, 35, 48 ... communication device, 21 ... design support program, 22 ... authentication program, 47 ... photographing device

Claims (6)

A use device in which a license grant program which is a program to which a license permitting use is installed, a management device that manages the license of the license grant program, and a mobile terminal that performs data communication with the management device; A license authentication method for authenticating the license of the license grant program using:
An information generation procedure for generating password creation information for creating an authentication password, which is a password for the authentication, by the use device;
The use device displays a creation information display procedure for displaying the password creation information generated by the information generation procedure;
A creation information acquisition procedure in which the mobile terminal acquires the password creation information displayed by the creation information display procedure;
A creation information transmission procedure in which the portable terminal transmits the password creation information acquired by the creation information acquisition procedure to the management device;
An authentication password creation procedure in which the management device creates the authentication password by a password creation method set in advance using the password creation information received from the mobile terminal;
A password transmission procedure in which the management device transmits the authentication password created by the authentication password creation procedure to the mobile terminal;
A password display procedure in which the mobile terminal displays the authentication password received from the management device;
The use device uses the password creation information to create a confirmation password creation procedure using the same creation method as the password creation method used by the management device;
A license authentication method, comprising: a match confirmation procedure for determining whether or not the authentication password input to the use device matches the match confirmation password created by the confirmation password creation procedure. A use device in which a license grant program which is a program to which a license permitting use is installed, a management device that manages the license of the license grant program, and a mobile terminal that performs data communication with the management device; A license authentication system for authenticating the license of the license grant program,
The device used is
Information generating means for generating password creation information for creating an authentication password which is a password for the authentication;
Creation information display means for displaying the password creation information generated by the information generation means;
Using the password creation information, confirmation password creation means for creating a match confirmation password by a preset password creation method;
A match confirmation unit for determining whether or not the authentication password input to the use device matches the match confirmation password created by the confirmation password creation unit;
The portable terminal is
Creation information acquisition means for acquiring the password creation information displayed by the creation information display means;
Creation information transmission means for transmitting the password creation information acquired by the creation information acquisition means to the management device;
Password display means for displaying the authentication password received from the management device,
The management device
Using the password creation information received from the mobile terminal, an authentication password creating means for creating the authentication password by the same creation method as the password creation method used by the device used;
A license authentication system comprising: a password transmission unit that transmits the authentication password created by the authentication password creation unit to the portable terminal. A use device in which a license grant program which is a program to which a license permitting use is installed, a management device that manages the license of the license grant program, and a mobile terminal that performs data communication with the management device; In order to authenticate the license of the license grant program, a computer mounted on the device used is used.
Information generating means for generating password creation information for creating an authentication password which is a password for the authentication;
Creation information display means for displaying the password creation information generated by the information generation means;
Using the password creation information, a confirmation password creation means for creating a match confirmation password by a preset password creation method, and
A match confirmation means for determining whether or not the authentication password input to the use device matches the match confirmation password created by the confirmation password creation means;
License authentication program to function as. The password creation method is:
The hash value is calculated by processing the password creation information with the same hash function as that set in the management device, and the hash value is used as the match confirmation password. Item 4. The license authentication program according to item 3. Computer
The usability information indicating the determination result by the coincidence confirmation means is made to function as an availability information storage means for storing in a volatile memory mounted on the use device,
The license authentication program according to claim 3 or 4, wherein the license grant program operates independently of each other. Computer
The authentication of the license is performed by transmitting, to the management device, authentication identification information set in advance for the authentication and an authentication password set in association with the authentication identification information by data communication. Requesting authentication request means, and
6. The data processing apparatus according to claim 3, wherein the data management apparatus functions as validity information receiving means for receiving license validity information indicating whether or not the license granting program can be used from the management apparatus. License activation program described in.

Images