JP2005293270A - Portable storage medium, application distribution method, and application activating method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent the unauthorized copying and illegal use of an application, and to allow easy production even in a small amount. <P>SOLUTION: Only an end user authentication application storing part 2 of a portable memory 1 can be accessed from a personal computer of an end user. The personal computer of the end user activates the end user authentication application of the end user authentication application storing part 2. The end user authentication application authenticates the developer authentication ID of a developer authentication ID storing part 5, and the product authentication ID of a product authentication ID storing part 4. If authentication is right, an application of an application storing part 3 is read and executed by the end user authentication application. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a portable storage medium, an application distribution method, and an application activation method.

  In recent years, problems such as illegal copying of CD-ROMs and illegal use of personal computer applications have been increasing. As means for solving this, there is a technique for preventing illegal copying of a CD-ROM by creating a ring-shaped no-signal (unformatted) portion in advance on the recording surface of the CD-ROM.

  In addition, in order to prevent illegal use of an application, an authentication function is provided to a USB device that can be attached to a USB port, and authentication is performed between the application and the USB device when the application is activated. There is a technique for starting the application.

In recent years, a USB device that can be mounted on a USB port that comes standard with a personal computer, has a security function, and can store applications that can be executed by the personal computer has been proposed (for example, a patent). Reference 1). In the related art, security is improved by storing a setting file necessary for the operation of the application and a file created by the operation in the USB device.
JP 2003-178017 A

  However, the conventional technology for preventing unauthorized copying by creating a ring-shaped no-signal (unformatted) portion in advance on the recording surface of a CD-ROM produces an original CD-ROM, and thus it is difficult to produce in a small amount. There was a problem.

  In addition, in the conventional technology in which an application and a USB device have an authentication function, there is a problem that a modification such as adding an authentication function to the application itself is necessary.

  Furthermore, in the conventional technology for improving security by storing a setting file necessary for the operation of the application and a file created in accordance with the operation in the USB device, the setting file and the created file are simply stored in the USB device. Since it is only stored in the device, there is a problem that illegal copying and illegal use cannot be sufficiently prevented.

  The present invention has been made in view of such circumstances, and its purpose is to prevent unauthorized copying and illegal use without requiring modifications to the application itself, and it can be easily performed even in a small amount. Another object of the present invention is to provide a portable storage medium, an application distribution method, and an application activation method that can be produced.

  The present invention has been made to solve the above-mentioned problems, and is a portable storage medium for distributing an application executable on a computer, provided with connection means connectable to the computer and access restrictions. A first storage means for storing an authentication application executable by the computer, and a second storage means for storing an application executable on the computer with access restriction provided to the computer; Although access restrictions are provided for the computer, access restrictions are not provided for the authentication application, and product authentication information for authenticating use validity of the application is stored. 3 storage means and the authentication executed by the computer Control means for starting the application stored in the second storage means from the computer when the product authentication information stored in the third storage means is authenticated by the application. Features.

  According to the present invention, in the portable storage medium according to claim 1, access restriction is provided, and fourth storage means for storing developer authentication information for authenticating use validity of the portable storage medium is provided. The control unit is separately prepared for writing the authentication application, the application, and the product authentication information in the first storage unit, the second storage unit, and the third storage unit, respectively. If the developer authentication information stored in the fourth storage means is authenticated by the writing application, writing by the writing application is permitted.

  The present invention has been made to solve the above-described problem, and is an application distribution method for distributing an application executable by a computer, wherein an authentication application can be accessed by the computer, and the use justification of the application is achieved. So that the product authentication information for authenticating the product cannot be directly accessed from the computer, and can be activated when the product authentication information is authenticated by the authentication application executed on the computer. Access restrictions are provided so that the application cannot be directly accessed from the computer, and the application is stored and distributed in a storage medium connectable to the computer.

  Further, the present invention provides the application distribution method according to claim 3, wherein developer authentication information for authenticating use validity of the storage medium used for authentication together with the product authentication information by the authentication application is used for the computer. And storing in the storage medium with an access restriction so that direct access is not possible.

  Further, the present invention has been made to solve the above-described problem, and is an application activation method for activating an application stored in a storage medium connectable to a computer, and an authentication application executed by the computer When the product authentication information stored in the storage medium is authenticated so that it cannot be accessed directly from the computer, the access restriction is set so that the computer cannot be accessed directly and stored in the storage medium. The application can be started from the computer.

  Further, the present invention is the application activation method according to claim 5, wherein the authentication application is stored in the storage medium so as to be accessible by the computer.

  Further, the present invention provides the application activation method according to claim 5 or 6, wherein developer authentication information for authenticating the validity of use of the storage medium is provided with an access restriction so that the computer cannot be directly accessed. The authentication application is activated, and activates the application when the product authentication information and the developer authentication information are authenticated.

As described above, according to the present invention, the connection means connects to the computer, the access restriction is not provided, and the authentication application executable by the computer is stored in the first storage means. An access restriction is provided for the computer, and an application executable by the computer is stored in the second storage means. Although an access restriction is provided for the computer, the authentication application No access restriction is provided, product authentication information for authenticating use validity of the application is stored in a third storage means, and the control application causes the authentication application executed by the computer to Product authentication information stored in the third storage means is authenticated If it is, starts the application stored in the second storage means from the computer.
Therefore, it is possible to prevent unauthorized copying and illegal use without requiring modification of the application itself, and it is possible to easily produce even a small amount.

Further, according to the present invention, access restriction is provided, developer authentication information for authenticating the validity of use of the portable storage medium is stored in the fourth storage means, and the control application stores the authentication application. The fourth storage means is provided by a writing application separately prepared for writing the application and the product authentication information to the first storage means, the second storage means, and the third storage means, respectively. When the developer authentication information stored in is authenticated, writing by the writing application is permitted.
Therefore, it is possible to prevent unauthorized copying and illegal use without requiring modification of the application itself, and it is possible to easily produce even a small amount.

Further, according to the present invention, an access restriction is provided so that an authentication application can be accessed by the computer, and product authentication information for authenticating use validity of the application cannot be directly accessed from the computer. An access restriction is provided so that the application cannot be directly accessed from the computer so that it can be activated when the product authentication information is authenticated by the executed authentication application. Remember and distribute.
Therefore, it is possible to prevent unauthorized copying and illegal use without requiring modification of the application itself, and it is possible to easily produce even a small amount.

Further, according to the present invention, the authentication application uses the authentication application together with the product authentication information to restrict the developer authentication information for authenticating the use validity of the storage medium so that the computer cannot be directly accessed. It is provided and stored in the storage medium.
Therefore, it is possible to prevent unauthorized copying and illegal use without requiring modification of the application itself, and it is possible to easily produce even a small amount.

Further, according to the present invention, when the authentication application executed by the computer authenticates the product authentication information stored in the storage medium by providing an access restriction so that it cannot be directly accessed from the computer, An access restriction is provided so that the computer cannot be directly accessed, and the application stored in the storage medium can be started from the computer.
Therefore, it is possible to prevent unauthorized copying and illegal use without requiring modification of the application itself, and it is possible to easily produce even a small amount.

According to the present invention, the authentication application is stored in the storage medium so as to be accessible by the computer.
Therefore, it is possible to prevent unauthorized copying and illegal use without requiring modification of the application itself, and it is possible to easily produce even a small amount.

According to the present invention, developer authentication information for authenticating the validity of use of the storage medium is stored in the storage medium with access restrictions so that the computer cannot be directly accessed, and the authentication application is stored in the storage medium. When the product authentication information and the developer authentication information are authenticated, the application is activated.
Therefore, it is possible to prevent unauthorized copying and illegal use without requiring modification of the application itself, and it is possible to easily produce even a small amount.

  Hereinafter, the best mode for carrying out the present invention will be described.

A. Configuration of Embodiment FIG. 1 is a block diagram showing a schematic configuration of a portable memory according to the present embodiment. In the figure, the portable memory 1 includes an end user authentication application storage unit 2, an application storage unit 3, a product authentication ID storage unit 4, a hardware authentication ID storage unit 5, a connection unit 6, and a control unit 7. .

  The end user authentication application storage unit 2 stores an end user authentication application (program) for authenticating whether the end user can use the portable memory 1, that is, whether the end user is a legitimate end user. Therefore, when the portable memory 1 is connected to a personal computer, the end user authentication application storage unit 2 is not authenticated or authorized by a general file management application of the personal computer or an OS for performing file management. It is possible to access an end-user authentication application stored inside. Note that the storage area is open to the user of the portable memory 1, and access restrictions are set so that data can be freely read and written in addition to the end user authentication application.

  The application storage unit 3 stores an application (program) sold by an application development company. The application is encrypted and protected from unauthorized access such as external cracking. Therefore, the application storage unit 3 cannot be accessed from a general file management application of a personal computer connected to the portable recording medium 1 or an OS that performs file management. On the other hand, it is accessible from the end user authentication application described above.

  The product authentication ID storage unit 4 stores an ID or password for protecting an application sold by an application development company. These IDs and passwords are encrypted and protected from unauthorized access such as external cracking. Therefore, the product authentication ID storage unit 4 cannot be accessed from a general file management application of a personal computer connected to the portable recording medium 1 or an OS that performs file management. On the other hand, it is accessible from the end user authentication application described above.

  The hardware authentication ID storage unit 5 identifies a developer application (described later) that can use the portable memory 1, the end user authentication application storage unit 2, the application storage unit 3, and the product authentication ID storage unit 4. In addition, the developer ID set by the manufacturer of the portable memory 1 is stored. The developer ID is encrypted and protected from unauthorized access such as external cracking. That is, the developer ID can be read only by a developer application permitted by the manufacturer.

  The connection unit 6 is an interface for connecting to a personal computer in an application development company that sells applications and an end user that executes the applications. For example, an interface conforming to the USB standard is used for the connection unit 6. The control unit 7 controls access from the outside (personal computer) to the end user authentication application storage unit 2, application storage unit 3, product authentication ID storage unit 4, and hardware authentication ID storage unit 5.

  Next, FIG. 2 is a block diagram showing a state in which the portable memory 1 described above is connected to a personal computer. The personal computer 10 has a general configuration, and includes a calculation control unit (CPU) 11, a RAM 12, a memory such as a ROM 13, and a connection unit 14 such as a USB port. In the personal computer 10, a general OS and a file management application are activated, and the portable memory 1 is accessed via the OS and the file management application. In the present embodiment, an example in which a personal computer 10 is used as an example of a computer will be described. However, the present invention is not limited to this, and a connection unit with a portable memory is provided, and a program is stored. Any device (information home appliance, game machine, etc.) having an arithmetic control unit to be executed is applicable.

  Next, FIG. 3 is a conceptual diagram showing what data is written in the portable memory 1 described above. First, the manufacturer 30 of the portable memory 1 writes a developer authentication ID 35 for authenticating a developer selling an application (that is, an application development manufacturer) in the portable memory 1. Then, the portable memory 1 and the developers necessary for writing the application (program) and the like in the portable memory 1 to the application development manufacturer 50 that has signed an application sales contract with the manufacturer 30. Application 40 is provided. The application development maker 50 is provided with the number of portable memories 1 corresponding to the number of applications sold.

  The developer application 40 (1) writes an application to be sold to the application storage unit 3, (2) writes a product authentication ID set by the development company to the product authentication ID storage unit 4, and (3) an application storage unit 3 An end-user authentication application used by the end user to browse and execute the application stored in is generated and written.

  Next, the application development maker 50 connects the portable memory 1 to the personal computer 10 of the company, and starts the developer application 40 on the personal computer 10. When the developer authentication ID is authenticated by the developer application 40, a product authentication ID 52 for authenticating whether or not the application to be sold can be used (that is, authenticating that the application is a legitimate end user), An application (program) 54 to be sold and an end user authentication application 56 for authenticating the end user are written in the portable memory 1.

  Next, the end user 60 connects the portable memory 1 to its own personal computer 10 and starts the end user authentication application 56 on the personal computer 10. When the developer authentication ID 35 and the product authentication ID 52 are authenticated by the end user authentication application 56, the application 60 stored in the portable memory 1 can be used.

  Next, FIG. 4 shows access control to the end user authentication application storage unit 2, the application storage unit 3, the product authentication ID storage unit 4, and the hardware authentication ID storage unit 5 by the control unit 7 of the portable memory 1 described above. It is the conceptual diagram put together. As shown in the figure, from a general file management application on the personal computer 10 or an OS that performs file management, only the end user authentication application storage unit 2 has a view execution authority, a new write authority, a change authority, and a delete authority. , And a duplication authority, and access to other storage units is completely restricted. Therefore, in this case, as shown in FIG. 5, only the end user authentication application storage unit 2 can be seen from a general file management application or an OS that performs file management.

  Further, from the end user authentication application for authenticating the end user, only the end user authentication application storage unit 2 is given viewing execution authority, new write authority, change authority, deletion authority, and duplication authority. Only the browsing execution authority is given to the storage unit 3. That is, when the end-user authentication application browses and executes the application stored in the application storage unit 3, the copy authority is not given, so that the copy to other storage areas inside and outside the portable memory 1 is restricted. Thus, access to the application storage unit 3 and the product authentication ID storage unit 4 is completely restricted. In this case, the end user authentication application storage unit 2 and the application storage unit 3 can be seen from the end user authentication application as shown in FIG.

  Further, from the developer application for authenticating the application developer, that is, the developer, and writing the application in the portable memory 1, viewing execution authority and new writing authority for the end user authentication application storage unit 2 and the application storage unit 3. A change authority, a delete authority, and a copy authority are given, and a browsing execution authority, a new write authority, a change authority, and a delete authority are given to the product authentication ID storage unit 4. Therefore, access to the developer authentication ID storage unit 5 is restricted at all. In this case, the end user authentication application storage unit 2, the application storage unit 3, and the product authentication ID storage unit 4 can be seen from the developer application as shown in FIG.

  Therefore, the control unit 7 of the portable memory 1 copies the data and programs stored in the application storage unit 3, the product authentication ID storage unit 4, and the hardware authentication ID storage unit 5 to another storage unit, It cannot be tampered with.

B. Operation of Embodiment Next, the operation of the above-described embodiment will be described. Here, FIG. 8 is a flowchart for explaining the operation in the application development company 40. FIG. 9 is a flowchart for explaining the operation of the end user 50.

  First, the manufacturer 30 writes the developer authentication ID 35 for authenticating the application development manufacturer 50 that has signed an application sales contract with the manufacturer 30 in the developer authentication ID storage unit 5 of the portable memory 1. The application development maker 50 is provided with the portable memory 1 and a developer application 40 necessary for writing an application (program) or the like in the portable memory 1.

  Next, the application development maker 50 connects the personal computer 10 of the company and the provided portable memory 1 (Sa1), and activates the separately distributed developer application 40 (Sa2). The developer application 40 reads the developer authentication ID 35 stored in the developer authentication ID storage unit 5 of the portable memory 1 and authenticates whether or not the developer is an authorized developer (Sa3). If the authentication is not OK (No in Sa4), the process, that is, the developer application 40 is terminated.

  On the other hand, if the authentication is OK (YES in Sa4), the application 54 to be sold is selected on the personal computer 10 (Sa5), and the application 54 is encrypted and written in the application storage unit 3 of the portable memory 1 ( Sa6). Next, it is determined whether there is an application to be further written (Sa7). If there is an application to be added, the process returns to step S4, and the encryption of the application and the writing to the application storage unit 3 are repeated. .

  On the other hand, if there is no application to be written, the product authentication ID 52 set by the application development maker 50 is input from the personal computer 10 (Sa8). Next, the product authentication ID 52 is encrypted and written in the product authentication ID storage unit 4 of the portable memory 1 (Sa9).

  Next, the end user authentication application 56 in which the developer authentication ID 35 and the product authentication ID 52 are set is generated (Sa10), and the end user authentication application 56 is written in the end user authentication application storage unit 2 of the portable memory 1 ( Sa11). Then, the processing, that is, the developer application 40 is terminated.

  The portable memory 1 is sold to end users as a recording medium in which an application 54 is recorded at a store or the like.

  Next, in the end user 60 who purchased the portable memory 1 sold above, the personal computer 10 and the provided portable memory 1 are connected (Sb1), a general file management application on the personal computer 10, Alternatively, the end user authentication application 56 stored in the end user authentication application storage unit 2 of the portable memory 1 is read from the OS that performs file management and activated (Sb2).

  The end user authentication application 56 reads the developer authentication ID 35 stored in the developer authentication ID storage unit 5 of the portable memory 1 and the product authentication ID 52 stored in the product authentication ID storage unit 4 to obtain a regular mobile phone. It is authenticated whether it is a type memory 1 or a regular (regularly purchased) end user (Sb3). If the authentication is not OK (NO in Sb4), the process, that is, the end user authentication application 56 is terminated.

  On the other hand, if the authentication is OK (YES in Sb4), the application 54 stored in the application storage unit 3 of the portable memory 1 is read and executed (or installed) (Sb5).

  According to the above-described embodiment, the portable memory 1 itself is provided with hierarchical access restrictions, and a specific authentication application, that is, the developer application 40 and the end user authentication application 56 are distributed together with the portable memory 1. Access to restricted areas (data) is possible only when authentication is received by these authentication applications, preventing unauthorized copying and illegal use without requiring modifications to the application itself. And can be easily produced even in small amounts.

  In the above-described embodiment, the series of processes by the control unit 7 is stored in a computer-readable recording medium in the form of a program, and the program is read out and executed by the computer. Is done. That is, each processing means and processing unit in the control unit 7 is such that a central processing unit such as a CPU reads the above program into a main storage device such as a ROM or RAM, and executes information processing / calculation processing. It is realized.

  Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

It is a block diagram which shows the schematic structure of the portable memory | storage memory of this embodiment. It is a block diagram which shows the state in which the portable memory 1 was connected to the personal computer. 3 is a conceptual diagram showing what data is written in the portable memory 1. FIG. 4 is a conceptual diagram summarizing access control for an end user authentication application storage unit 2, an application storage unit 3, a product authentication ID storage unit 4 and a hardware authentication ID storage unit 5 by the control unit 7 of the portable memory 1. FIG. It is a conceptual diagram which shows how it looks when the portable memory 1 is seen from a general file management application or OS which performs file management. It is a conceptual diagram which shows how it looks when the portable memory 1 is seen from an end user authentication application. It is a conceptual diagram which shows how it looks when the portable memory 1 is seen from a developer application. 4 is a flowchart for explaining an operation in an application development company 40. 4 is a flowchart for explaining an operation in an end user 50.

Explanation of symbols

1 ... Portable memory (portable storage medium, storage medium)
2. End user authentication application storage unit (first storage unit)
3 Application storage unit (second storage unit)
4 ... Product authentication ID storage unit (third storage means)
5: Hardware authentication ID storage unit (fourth storage means)
6 ... Connection part (connection means)
7. Control unit (control means)
10 ... Personal computer (computer)
30 ... Portable memory manufacturer 35 ... Developer authentication ID (Developer authentication information)
40 ... Developer application (authentication application)
50 ... Application development manufacturer 52 ... Product authentication ID (Product authentication information)
54 ... Application 56 ... End user authentication application 60 ... End user

Claims (7)

A portable storage medium for distributing computer-executable applications,
Connection means connectable to the computer;
First storage means for storing an authentication application that is not provided with an access restriction and can be executed by the computer;
A second storage means for storing an application executable on the computer, wherein access restriction is provided for the computer;
Although access restrictions are provided for the computer, access restrictions are not provided for the authentication application, and product authentication information for authenticating use validity of the application is stored. Three storage means;
When the product authentication information stored in the third storage unit is authenticated by the authentication application executed by the computer, the application stored in the second storage unit is activated from the computer. A portable storage medium characterized by comprising: Access restriction is provided, and comprises fourth storage means for storing developer authentication information for authenticating the validity of use of the portable storage medium,
The control means is a write separately prepared for writing the authentication application, the application, and the product authentication information in the first storage means, the second storage means, and the third storage means, respectively. 2. The portable storage medium according to claim 1, wherein when the developer authentication information stored in the fourth storage means is authenticated by an application, writing by the writing application is permitted. An application distribution method for distributing an application executable on a computer,
An access restriction is provided so that an authentication application can be accessed by the computer, and product authentication information for authenticating use validity of the application cannot be directly accessed from the computer. An access restriction is provided so that the application cannot be directly accessed from the computer so that the application can be started when the product authentication information is authenticated, and the application is stored and distributed in a storage medium connectable to the computer. Application distribution method. The authentication application stores developer authentication information used for authentication together with the product authentication information for authenticating the validity of use of the storage medium in the storage medium with access restrictions so that the computer cannot be directly accessed. The application distribution method according to claim 3. An application starting method for starting an application stored in a storage medium connectable to a computer,
If the authentication application executed by the computer restricts access to prevent direct access from the computer and the product authentication information stored in the storage medium is authenticated, the access is restricted to prevent direct access from the computer. A method for starting an application, wherein the application stored in the storage medium can be started from the computer. 6. The application activation method according to claim 5, wherein the authentication application is stored in the storage medium so as to be accessible by the computer. Developer authentication information for authenticating the validity of use of the storage medium is stored in the storage medium with an access restriction so that it cannot be directly accessed from the computer,
7. The application activation method according to claim 5, wherein the authentication application activates the application when the product authentication information and the developer authentication information are authenticated.

Images