JP2007233669A - Method for managing license of software in thin client system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a mechanism capable of introducing a thin client system that uses a platform different from that of an existing system, and of easily performing appropriate license management for software without constructing any particular license management system. <P>SOLUTION: A thin client system based on a screen transfer method is constructed. In order to provide the mechanism for easily preventing illegal use of particular software without constructing any special license management system, the connection limiting function of a directory service for authenticating users is used to limit the software used by users. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention provides a license management method that enables the use of software across different platforms in a thin client system and can easily prevent unauthorized use of the license of the software.

  In recent years, thin client systems are attracting attention as means for solving problems such as an increase in maintenance costs on the client terminal side and the risk of leakage of personal information in corporate information systems.

  The thin client system is a form in which only an input / output function represented by a display and a keyboard is provided on the client terminal side, and hardware and software resources are provided on the server side to manage them.

  For example, Patent Document 1 discloses provision of a technique for realizing a thin client system by an appropriate network boot method and a software license management technique.

Here, the network boot method is a method in which an OS and software are stored on the server side, and these are read into the terminal memory in response to a request from the client terminal side and executed.
In addition to the network boot method, a blade PC method and a screen transfer method are known as thin client system implementation methods.

  The blade PC method stores the hardware resources represented by the CPU, memory, and hard disk installed in the client terminal in one platform (hereinafter referred to as the blade) and manages it in the rack in the server room. This is a method of installing a display and communication terminal on the side. The manufacturer's original communication method is adopted between the blade and the client terminal, and it is common not to use TCP / IP communication.

  The screen transfer method is a method of executing an application on the server side and transmitting the screen image to a client terminal via a device having an emulator function. Information is exchanged between the server and client terminals using only screen information and keyboard / mouse input / output information.

  On the other hand, applications and software used on a network (hereinafter simply referred to as software) can be easily used in excess of the number of license agreements with software vendors. .

For example, Patent Document 2 discloses a software registration / activation method that can prevent unauthorized use of software, and can notify a software supplier when the number of licenses exceeds a predetermined number.
Patent Publication No. 2004-295270 JP-A-7-219763

However, when a company adopting a conventional system tries to introduce a thin client system, the difference between the newly introduced thin client system and the conventional system, such as an OS platform, and software and hardware specifications. Due to the limitations, there is a problem that it cannot be easily introduced.

  For example, in Patent Document 1, it is assumed that the software and OS to be used are started as a set, and after investigating the hardware compatibility of the thin client terminal, the OS is started and then the software is used. It is out. In such a method, software having different execution environments cannot be used simultaneously. In addition, there is a possibility that the OS and software cannot be started due to the hardware specifications on the client terminal side, and the compatibility of the OS and software already used with the thin client terminal is determined beforehand. There is a need for human research and implementation.

  As for software license management, most software is premised on use on the same platform. If a thin client system that spans different platforms in the screen transfer method is realized, the conventional license management method is appropriate. There is a problem that it cannot be managed.

  For example, in Patent Document 2, the presence or absence of a license is determined for each device that uses software. In this regard, in the thin client system using the screen transfer method, the device that uses the software, that is, the device that executes the software, is formally a thin client terminal management server. Therefore, by purchasing and installing one license of the software on the thin client terminal management server, it becomes possible for many people to use it at the thin client terminals under the thin client terminal management server. Such a situation is not appropriate because it can be used substantially more than the number of license agreements.

  Therefore, in view of the above problems, the present invention makes it easy to introduce a thin client system that uses a platform different from the existing system, and appropriate software license management without constructing a special license management system. The purpose is to provide technology that can be used.

In a preferred embodiment of the present invention, a thin client system based on a screen transfer method is constructed in order to eliminate differences in hardware and software specifications. Software used by the user by using the directory service function to authenticate the user in order to provide a mechanism to easily prevent unauthorized use of specific software without constructing a special license management system By limiting the above, the above-mentioned problems are solved.

  According to a preferred embodiment of the present invention, one or more thin client terminals, a thin client terminal management server that manages the one or more thin client terminals, an authentication server that authenticates a user who uses the thin client terminal, A file server for storing individual areas and software, a user management server built on a platform different from the thin client terminal management server, a user server on the user management server and a file server for storing software, and a user An authentication server for authenticating a user on the management server, a linkage server for linking the thin client terminal management server and the user management server, and resolving a difference in specifications on the platform; and the thin client terminal management server; For linkage between linked servers In a screen transfer type thin client system that is connected to each other via a computer network with a load balancer that realizes application-level communication load distribution, use the right to use specific software using the connection restriction means in the directory service Thus, the software license management method is characterized in that it can be used only by a specific user (claim 1).

  The authentication server for authenticating the user on the user management server has a usage authority function unit capable of setting usage authority for each software, and the usage authority function unit is a directory service. The connection with the software seller is permitted by connection restriction means for permitting or denying connection to the folder by determining whether or not the user is registered in advance with respect to the program folder storing the software. A software license management method (claim 2) characterized in that the use of software exceeding a prescribed number of contracts is prevented.

  Further, the cooperation server has a session management function unit that manages a session between the thin client terminal management server and the user management server, and the session management function unit is configured even when the user does not explicitly log out. If the session between either the thin client terminal management server and the linked server or between the linked server and the user management server is disconnected, the contract restriction with the software seller is established by connection restriction means for terminating both sessions. A software license management method (claim 3) characterized by preventing the use of more than a few pieces of software.

Preferred embodiments of the present invention will be described with reference to the drawings.
This embodiment can be broadly divided into a thin client system introduction part using a thin client terminal management server and an existing corporate information system part using a user management server.

  In this embodiment, the thin client system part by the thin client terminal management server or the like is constructed in the UNIX (registered trademark) environment, and the existing corporate information system part by the user management server or the like is constructed in the WINDOWS (registered trademark) environment. Assume the case.

  In addition, the configuration in the present embodiment is in consideration of decentralization and redundancy. If each component can function optimally, it is not necessary to physically configure each component.

  It is assumed that each server has a control function unit such as an OS, a storage function unit such as a hard disk, and an input / output function unit such as a display, a keyboard, and a network interface.

  Further, portions not directly related to the present invention, such as name resolution by DNS and IP address assignment by DHCP, are not described or illustrated, and are omitted.

FIG. 1 is a configuration diagram of a thin client system 10 in a preferred embodiment of the present invention.
The thin client system 10 includes one or more thin client terminals 11, a thin client terminal management server 12 that manages the one or more thin client terminals 11, an authentication server_U13 that authenticates a user who uses the thin client terminal 11, File server_U14 for storing user individual areas and software, user management server 15 constructed on a platform different from the thin client terminal management server 12, and user individual areas and software storage on the user management server 15 File server 16, authentication server 17 for authenticating a user on user management server 15, thin client terminal management server 12 and user management server 15 are linked to eliminate differences in specifications on the platform Cooperation server 18, thin client terminal management server 12 and cooperation server 18 And a load balancer 19 for implementing the application-level communication load distribution in cooperation portion.

  The thin client terminal 11 is a thin client terminal including at least a control function unit 11a and an input / output function unit 11b.

The control function unit 11a includes software for transmitting and receiving data to and from the thin client terminal management server 12. In the present embodiment, the input / output function unit 11b also includes a smart card reader so as to enable login using a smart card.
The thin client terminal management server 12 is a server including at least an authentication management function unit 12a, a storage management function unit 12b, and a software management function unit 12c.

  The thin client terminal management server 12 may be prepared in each office depending on the size of the company and may be constructed as a thin client terminal management server group consisting of a plurality of units. In addition, as a redundant configuration, a configuration in which a primary server and two secondary servers are provided for each office may be used, and the secondary server may be operated in a system such as hot standby / cold standby.

  The authentication management function unit 12a is a function for performing authentication when a user logs in to the thin client system 10. The authentication management function unit 12a has a function of authenticating a thin client terminal and a smart card, and a function of authenticating a user account on the thin client system 10 and a password corresponding to the account. In the present embodiment, it is assumed that a plurality of thin client terminal management servers 12 are constructed. This function uses an authentication function unit 13a of an authentication server described later, and is received when the user is a valid user. The specific thin client terminal 11 can be used based on the account information.

  The storage management function unit 12b is a function for managing the home directory used by the user. A multi-user environment is realized, and the effective environment and storage area of the user are secured without depending on the specific thin client terminal 11. In this embodiment, a storage area of a file server, which will be described later, is used, an area is secured as a home directory for each user, and is managed by the storage management function unit 12b.

  The software management function unit 12c is a function for managing software that can be used by the user. In the present embodiment, a storage area of a file server, which will be described later, is used to store programs in the execution format of each software, and are managed by the software management function unit 12c.

  The authentication server_U13 is a server including at least the authentication function unit 13a. When the user who uses the thin client terminal 11 attempts to log in by inputting an account and a password, the authentication server_U13 determines whether or not the user is valid, and if the user is a valid user, the corresponding thin client terminal management server 12 It has a function to provide the user's account information. The user can execute each person's work environment without depending on the specific thin client terminal 11.

  The authentication function unit 13a is a directory service that manages the thin client terminal 11 and user accounts. For example, LDAP (Lightweight Directory Access Protocol) authentication. Pre-registered information such as the MAC address of the thin client terminal 11 and the token ID of the smart card is stored, and compared with the smart card information read from the smart card reader attached to the thin client terminal 11 It is possible to determine whether or not the client terminal 11 and whether or not the user is a valid user. As a result, when the user is a valid user, the thin client terminal management server 12 is provided with identification information of the user and an absolute path such as a home directory. That is, the authentication function unit 13a can provide the authentication function to the authentication management function unit 12b of each thin client terminal management server.

  The file server_U14 is a server including at least a control function unit 14a and a storage function unit 14b. The file server_U14 holds a storage area used for each user who uses the thin client terminal 11, a program for executing the software used by the user, and the like. Further, it is managed by the storage management function unit 12b of the thin client terminal management server.

  The control function unit 14a includes software that manages the file server. For example, software used when the file server_U14 has a cluster configuration or a RAID1 configuration (mirroring).

  The storage function unit 14b is a hard disk or the like that stores the storage area of each user.

  The user management server 15 is a server including at least an authentication management function unit 15a, a storage management function unit 15b, and a software management function unit 15c. However, it is constructed on a platform different from the thin client terminal management server 12.

  The authentication management function unit 15a is a function for performing authentication when a user logs in by inputting an account and a password corresponding to the account to the user management server 15. In the present embodiment, it is assumed that a plurality of user management servers 15 are constructed, and this function uses an authentication function unit 16a of an authentication server described later. If the user is a valid user, the authentication management function unit 15a provides an execution environment for a specific user based on the received account information.

  The storage management function unit 15b is a function for managing the home directory used by the user. A multi-user environment is realized, and the effective environment and storage area of the user are secured without depending on the specific thin client terminal 11. In the present embodiment, a storage function unit 17b of a file server, which will be described later, is used to secure an area as a home directory for each user and managed by the storage management function unit 15b.

The software management function unit 15c is a function for managing software used by the user. In this embodiment, management is performed using an authentication function unit 16a and a use authority management function unit 16b of an authentication server, which will be described later.
However, it is also possible to store the program of the execution format of the software in the storage function unit 17b of the file server described later and manage it by the software management function unit 15c.

The authentication server_W16 is a server including at least the authentication function unit 16a and the usage authority management function unit 16b.
The authentication function unit 16a is a directory service that manages users and servers registered in advance, and has a domain function. For example, Active Directory (registered trademark) authentication. It is possible to store an account and a server name for each user registered in advance, and determine whether the user is a valid user by comparing them with an account and a password input by the user. The authentication function unit 16a can provide the authentication function to the authentication management function unit 15a of each user management server 15.

The usage authority management function unit 16b defines a group (or policy) that can use specific software, and manages by adding or deleting a user registered in advance on the authentication server 16 to the group. Then, by applying the above-described group to a program folder storing specific software, an access restriction is applied so that only registered users can use the group. Here, by making the number of software licenses equal to or less than the number of purchases, unauthorized use can be prevented in a thin client system using a screen transfer method across different platforms, and software license management can be easily performed.
It is also possible to prepare a license management server for managing the number of software licenses and to construct a system that limits the number of people registered in a group that can use specific software.

  The file server_W17 is a server including at least the control function unit 17a and the storage function unit 17b. The file server_W17 holds a storage area used for each user who uses the thin client terminal 11, a program for executing the software used by the user, and the like. Further, it is managed by the storage management function unit 15b of the user management server.

  The control function unit 17a includes software that manages the file server_W17. For example, it is software used when the file server_W17 has a cluster configuration and a RAID1 configuration (mirroring).

  The storage function unit 17b is a hard disk or the like that stores the storage area of each user.

  The cooperation server 18 is a server including at least an authentication cooperation management function unit 18a, a session management function unit 18b, a load distribution function unit 18c, and an emulator management function unit 18d. By linking the thin client terminal management server 12 and the user management server 15, the linkage server 18 eliminates differences between platforms, and allows the user to use various software without being aware of the platform.

  When the authentication linkage management function unit 18a links the authentication server_U13 used on the thin client terminal management server 12 side and the authentication server_W16 used on the user management server 15 side, and the user uses software on different platforms It is a function for linking account authentication. Note that it is necessary to set the thin client terminal management server 12 as a client of the cooperation server 18 in order to realize this function.

The session management function unit 18b is a resume function that can be resumed after the user stops using specific software. However, in this embodiment, the establishment of multiple sessions with one user account is prohibited. For example, if the user does not explicitly log out and one of the sessions between the thin client terminal management server 12 and the collaboration server 18 or between the collaboration server 18 and the user management server 15 is disconnected, whichever The session is also set to end.
This is to prevent unauthorized use of software by multiple sessions of the same user.

The load distribution function unit 18c has a function of distributing the load in the cooperation server 18 group and a function of distributing the load to the user management server 15.
The function to distribute load in 18 linked servers is the load that the thin client terminal management server 12 receives from the thin linked client terminal 11 at the primary linked server first and then allocates it to multiple secondary linked servers. This is a function for performing distribution. In this case, it is necessary to set in advance so that one unit operates as a primary linkage server. However, in this embodiment, the load balancer 19 is used to distribute the load, so this function is not used between the cooperation servers 18, but may be used in the case of an embodiment that does not use the load balancer 19.

  Load distribution with respect to the user management server 15 is a function in which the linkage server 18 performs load distribution by selecting and connecting the user management server 15 having a low load.

  The emulator management function unit 18d has an execution environment that can be used by software on different platforms using a Web browser. In addition, a client program is installed on all the thin client terminal management servers 12, and is set so that the client program is automatically started at the same time when the user logs in or when moving to the effective environment on the user management server. As a result, the emulator management function 18d operates, and the software on the user management server can be executed in response to a user activation request.

The load balancer 19 is a device including at least the load distribution function unit 19a.
The load distribution function unit 19a is a device that performs communication load distribution in the session layer of the thin client terminal management server 12 groups and the linked server 18 groups. Specifically, when a session connection request occurs from the thin client terminal management server 12 to the linkage server 18, the load balancer 19 selects a device to be used in consideration of network traffic and the load status of the linkage server 18. Is possible.
In the present embodiment, the load balancer 19 is used, but the load distribution function is not necessarily required.

Next, a specific data flow in a preferred embodiment of the present invention will be described.
2 and 3 are sequence diagrams in a preferred embodiment of the present invention.
First, the user inserts a smart card into the smart card reader of the thin client terminal in order to log in to the thin client system (1000).

  The smart card has a token ID registered in advance, and the identification information is transmitted to the authentication management function unit 12a of the thin client terminal management server.

Then, whether or not the transmitted identification information can be authenticated is determined by the authentication management function unit 12a (1001). When logging in to the thin client system 10, it is necessary to register the token ID of the smart card in the thin client terminal management server 12 in advance. After the authentication, the authentication management function unit 12a displays a screen requesting the user to input an account and password (1002).
The user inputs an account and password according to the screen display (1003).

The authentication management function unit 12a of the thin client terminal management server transmits the account and password input by the user to the authentication function unit 16a of the authentication server, and inquires whether the account and password are valid. In the case of a valid account and password, the authentication function unit 16a provides the user's UID (user ID), GID (group ID), an absolute path such as a shell used for login and a home directory (1004). .

  The thin client terminal management server 12 displays the initial interface on the thin client terminal 11 on the screen according to the absolute path.

In the case of an environment (hereinafter referred to as a user management system environment) in the existing user management server 15 as an initial setting at the time of login (1005), automatic start processing of the client program is performed (1006). If the execution environment on the thin client terminal management server is selected as the initial setting, the interface of the thin client system is displayed (1007). After that, when shifting to the user management system environment, the client program is started at the request of the user (1008).
The client program is a program capable of setting the thin client terminal management server 12 as a client terminal of the linkage server 18.

  Subsequently, a login screen to the user management system environment is displayed by the client program (1009). The user inputs an account and password on the thin client terminal 11 to log in to the user management server 15 (1010).

Then, the server is connected to the cooperation server 18 (1011), and information input by the user is transmitted to the authentication management function unit 15a of the user management server via the session management function unit 18b of the cooperation server 18.
Note that the load balancing function unit 19a of the load balancer selects the optimum linkage server 18 to establish a session before transmitting information input by the user between the thin client terminal management server 12 and the linkage server 18. Further, the load balancing function unit 18c of the cooperation server determines the user management server 15 having the smallest load, and transmits the input information after the session is established.

  The authentication management function 18a of the user management server inquires the received information to the authentication function unit 16a of the authentication server_W, and if the account is a valid account and password, the absolute path of the user is provided. The authentication management function unit 15a of the user management server permits the user to log in to the user management system environment (1012).

  After that, the interface of the user management system is displayed (1013), and the authentication management function unit 15a of the user management server refers to the use authority management function unit 16b of the authentication server_W in response to a user software activation request (1014). In the case of a connection request from a registered user, the connection is permitted, and in the case of a connection request from an unregistered user, the connection is not permitted (1015). As a result, the user can use specific software (1016).

  As described above, the preferred embodiment of the present invention makes it easy to introduce a thin client system that uses a platform different from the existing system, and prevents the illegal use of specific software without constructing a special license management system. It is possible to do.

It is a system configuration diagram in a preferred embodiment of the present invention. It is a sequence diagram in the preferred embodiment of the present invention (first half). It is a sequence diagram (second half) in a preferred embodiment of the present invention.

Explanation of symbols

10 Thin client system
11 Thin client terminal
11a Control function part
11b I / O function block
12 Thin client terminal management server
12a Authentication management function
12b Memory management function
12c Software management function
13 Authentication server_U
13a Authentication function
14 File server_U
14a Control function part
14b Memory function block
15 User management server
15a Authentication management function
15b Memory management function
15c Software management function
16 Authentication server_W
16a Authentication function part
16b Usage authority management function
17 File server_W
17a Control function part
17b Memory function block
18 Linked server
18a Authentication linkage management function
18b Session management function
18c Load balancing function
18d Emulator management function
19 Load balancer
19a Load balancing function

Claims (3)

One or more thin client terminals, a thin client terminal management server for managing the one or more thin client terminals, an authentication server for authenticating a user who uses the thin client terminal, a file for storing a user's individual area and software A server, a user management server constructed on a platform different from the thin client terminal management server, a user server on the user management server, a file server for storing software, and a user on the user management server Authentication server, linkage server for coordinating the thin client terminal management server and user management server to eliminate differences in specifications on the platform, and application level in the linkage portion between the thin client terminal management server and the linkage server Communication And Load Balancer for implementing a load balancing, in the screen transfer type thin client system that are connected to each other through a computer network,
A software license management method characterized in that the right to use specific software can be used only by a specific user by using a connection restriction means in a directory service. An authentication server for authenticating a user on the user management server is:
It has a usage authority function part that can set usage authority for each software,
The usage authority function unit is a directory service, and permits or denies connection to the folder by determining whether or not the user is a registered user for the program folder storing the software, and restricts connection. By connection restriction means to apply,
2. The software license management method according to claim 1, wherein use of software exceeding a prescribed number of contracts with the software seller is prevented in advance. The linkage server
A session management function unit for managing a session between the thin client terminal management server and the user management server;
Even if the user does not explicitly log out, the session management function unit is configured when the session between the thin client terminal management server and the cooperation server or between the cooperation server and the user management server is disconnected. By means of a connection restriction that ends both sessions,
3. The software license management method according to claim 1, wherein the software license is prevented from being used in excess of a prescribed number of contracts with the software seller.

Images