JP2008065693A - Information processor, and its method and program for controlling installation - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technique preventing unauthorized program installation. <P>SOLUTION: When a user's authentication information is input, a client PC 10 sends the authentication information to a domain controller 20. The domain controller 20 sends an installation control program to the client PC 10 when authenticating the user based on the authentication information. When executing the installation control program, the client PC 10 obtains installation permission definition information from a file server 30 and determines whether or not a predetermined program can be installed using the installation permission definition information. If the determination result is affirmative, the client PC 10 obtains an installer from the file server 30. The client PC 10 executes the installer to install the predetermined program. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an information processing apparatus that installs a predetermined program on itself when a user logs in, an installation control method thereof, and an installation control program.

  2. Description of the Related Art Conventionally, there is a technology for automatically installing various programs such as a program for upgrading when a user logs in on a client PC (Personal Computer). For example, Patent Document 1 describes a technology for controlling automatic installation of a program on a client PC between the client PC and the management server in an information processing system including a plurality of client PCs and a management server. Yes. Specifically, when the user logs in to the client PC, the client PC downloads an installation control program from the management server and executes the installation control program to obtain an installer for installing a predetermined program. The predetermined program is installed by executing the acquired installer. In this technique, all users who have logged in on the client PC can install a predetermined program.

JP 2005-25477 A

  However, there is a possibility that some users have the right to use a predetermined program, for example, under a license agreement, and some users do not actually have the right (hereinafter referred to as unauthorized users). . Therefore, when all users who have logged in at the client PC can install the predetermined program, the predetermined program may be installed on the client PC by an unauthorized user, and the predetermined program may be used illegally.

  SUMMARY An advantage of some aspects of the invention is that it provides an information processing apparatus, an installation control method, and an installation control program capable of preventing unauthorized installation of a program.

  In order to solve the above-described problems and achieve the object, the invention according to claim 1 is an information processing apparatus, in which authentication of a user is performed using authentication information for identifying the user and the authentication is successful. Transmitting means for transmitting the authentication information via a network to the first information management apparatus permitting login of the user, and the first authenticating the user using the authentication information transmitted by the transmitting means. A first acquisition unit that acquires an installation control program from an information management device; and an execution unit that executes the installation control program acquired by the first acquisition unit, wherein the execution unit is connected to the network. (2) second acquisition means for acquiring installation permission definition information indicating whether or not a predetermined program can be installed from the information management device; A determination unit that determines whether or not the predetermined program can be installed using the installation permission definition information acquired by the unit; and if the determination result of the determination unit is affirmative, And third acquisition means for acquiring the program.

  The invention according to claim 2 is the invention according to claim 1, wherein the third acquisition unit acquires an installer for installing the predetermined program, the third acquisition unit including the predetermined program, The system further comprises installation means for executing the acquired installer and installing the predetermined program.

  The invention according to claim 3 is the invention according to claim 1, wherein the installation permission definition information is encrypted, and the determination unit decrypts the installation permission definition information acquired by the second acquisition unit, Using the decrypted install permission definition information, it is determined whether or not the predetermined program can be installed.

  According to a fourth aspect of the present invention, in the first aspect of the invention, the installation permission definition information includes first identification information that identifies a user who is permitted to install the predetermined program. When the first identification information included in the installation permission definition information matches the authentication information, it is determined that the installation is possible.

  The invention according to claim 5 is the invention according to claim 1, further comprising storage means for storing at least device identification information for identifying itself in the network, wherein the installation permission definition information includes installation of the predetermined program. The apparatus identification information for identifying an information processing apparatus that is permitted is included, and the determination unit matches the apparatus identification information included in the installation permission definition information with the apparatus identification information stored in the storage unit. In this case, it is determined that the installation is possible.

  The invention according to claim 6 is the invention according to claim 1, wherein the device identification information is an IP address that is uniquely identifiable in the network.

  The invention according to claim 7 is an installation control method for authenticating a user by using authentication information for identifying the user and permitting the user to log in when the authentication is successful. A transmission step of transmitting the authentication information via a network, and a first acquisition of acquiring an installation control program from the first information management apparatus that has authenticated the user using the authentication information transmitted in the transmission step And an execution step of executing the installation control program acquired in the first acquisition step, wherein the execution step determines whether or not a predetermined program can be installed from the second information management device connected to the network. A second acquisition step of acquiring the installation permission definition information shown, and the second acquisition step. A determination step for determining whether or not the predetermined program can be installed using the installation permission definition information acquired in step (2), and if the determination result in the determination step is affirmative, And a third acquisition step of acquiring a program.

  The invention according to claim 8 is an installation control program, wherein the installation control method according to claim 7 is executed by a computer.

  According to the present invention, it is possible to install the predetermined program only when installation of the predetermined program is permitted by determining whether or not the installation can be performed using the installation permission definition information. Therefore, it is possible to prevent the predetermined program from being illegally installed when installation of the predetermined program is not permitted.

  Further, according to the present invention, the installation permission definition information can be prevented from being falsified by encrypting the installation permission definition information. As a result, it is possible to prevent a predetermined program from being illegally installed by falsifying the installation permission definition information.

  Further, according to the present invention, only the user who has the right to install a predetermined program by using user identification information that can uniquely identify the user included in the installation permission definition information can install the predetermined program. It becomes possible. Therefore, it is possible to prevent a predetermined program from being installed by an unauthorized user who does not have the above right.

  Further, according to the present invention, when the right to install a predetermined program is granted to each information processing device by using the device identification information that can uniquely identify the information processing device included in the installation permission definition information. In addition, unauthorized installation of a predetermined program can be prevented.

  Exemplary embodiments of an information processing apparatus, an installation control method, and an installation control program according to the present invention will be explained below in detail with reference to the accompanying drawings.

(1) Configuration <Configuration of information processing system>
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram illustrating the configuration of the information processing system in this embodiment. The information processing system 1 includes a client PC 10, a domain controller 20, and a file server 30. These are connected by a network 40 such as a LAN, an intranet, or the Internet. Although there may be a plurality of client PCs 10 constituting the information processing system 1, only one client PC 10 will be described here for convenience. In addition, the network environment here is assumed to be constructed using a Microsoft Windows (registered trademark) OS (Operation System).

<Configuration of client PC>
Each of the client PCs 10 is a computer including a CPU (Central Processing Unit) and a storage device (not shown) of ROM (Read Only Memory) and RAM (Random Access Memory). The client PC 10 is connected to an external storage device such as an HDD (Hard Disk Drive), a display device such as a display device, and an input device such as a keyboard and a mouse (none of which are shown). The ROM stores various programs such as an operation system for the CPU to control the client PC 10. Various application programs can be stored in the HDD.

  When the CPU of the client PC 10 reads a program stored in the ROM or HDD into the RAM and executes it, the client PC 10 realizes various functions. In particular, the following functions are realized in the present embodiment. When a user inputs a user name and password as authentication information in an input device connected to the client PC 10, the client PC 10 transmits the authentication information to the domain controller 20 and requests the domain controller 20 for authentication of the user. When the user is authenticated by the domain controller 20 using the authentication information and the installation control program is transmitted from the domain controller 20, the client PC 10 executes the installation control program. The installation control program is a program in which a function for controlling the entire process of installing a predetermined program on the client PC 10 is installed. Then, the client PC 10 acquires installation permission definition information from the file server 30 and determines whether or not a predetermined program can be installed using the installation permission definition information. The installation permission definition information includes the user name of a user who is permitted to install a predetermined program. The user who is permitted to install the predetermined program is a user who is permitted to use the predetermined program by, for example, concluding a license agreement for the predetermined program. A detailed determination method using the installation permission definition information will be described later. When the determination result is affirmative, the client PC 10 acquires an installer for installing the predetermined program from the file server 30 including the predetermined program. The client PC 10 installs a predetermined program by executing the installer.

<Functional configuration of installation control program>
Here, functions realized in the client PC 10 by the CPU of the client PC 10 executing the installation control program will be described. FIG. 2 is a block diagram illustrating functions implemented in the client PC 10. The functions realized in the client PC 10 include an installation control unit K1 (execution unit), an installability determination unit K2 (determination unit), and a data input / output unit K3 (second acquisition unit, third acquisition unit). The installation control unit K1 activates an installer for installing a predetermined program and monitors installation. The installability determination unit K2 determines whether or not to install based on the install permission definition information. The data input / output unit K3 accesses the file server 30 to acquire installation permission definition information and an installer for installing a predetermined program.

<Domain controller configuration>
The domain controller 20 is a computer including a CPU, a ROM, a RAM, an HDD (all not shown), and the like. The ROM stores various programs such as an operation system for the CPU to control the domain controller 20 and a login script that is a shell script of the operation system. The login script is a simple program executed when the user logs in to the client PC 10, and performs various settings necessary for the user to use the information processing system 1 or performs various customizations for each user. Is for. The HDD stores the above-described installation control program. The HDD also stores an authentication database (not shown) that stores user names and passwords of users who are permitted to use the information processing system 1.

  When the CPU of the domain controller 20 reads a program stored in the ROM or HDD into the RAM and executes the program, the domain controller 20 manages information about users and security. In particular, in the present embodiment, when the CPU executes a login script, the domain controller 20 refers to the authentication database in accordance with a request from the client PC 10, and installs when the authentication is successful. The control program is transmitted to the client PC 10.

<File server configuration>
The file server 30 is a computer including a CPU, a ROM, a RAM, an HDD (all not shown), and the like. Various programs such as an operation system for the CPU to control the domain controller 20 are stored in the ROM. The HDD stores an installer for installing a predetermined program in the client PC 10, installation permission definition information, and the like. When the CPU of the file server 30 reads the program stored in the ROM or HDD into the RAM and executes it, the file server 30 transmits installation permission definition information and an installer in response to a request from the client PC 10. . Details will be described later.

(2) Operation Next, the procedure of the installation permission process performed by the client PC 10, the domain controller 20, and the file server 30 in the information processing system 1 according to the present embodiment will be described. FIG. 3 is a sequence chart showing the procedure of the installation permission process performed by the client PC 10, the domain controller 20, and the file server 30. Hereinafter, the processing procedure will be described with reference to the sequence chart of FIG.

  When the user inputs the user name and password as authentication information in the input device connected to the client PC 10, the client PC 10 receives the authentication information and transmits the authentication information to the domain controller 20 to authenticate the user. A request is made to the domain controller 20 (step S1). When the domain controller 20 receives the authentication information transmitted from the client PC 10 (step S2), the domain controller 20 determines whether the authentication information is stored in the authentication database (step S3). If the determination result is affirmative (step S3: YES), that is, if the authentication is successful, the domain controller 20 transmits an installation control program to the client PC 10 (step S4). When the determination result of step S3 is negative (step S3: NO), that is, when the authentication fails, the domain controller 20 transmits information indicating that the authentication has failed to the client PC 10, for example.

  When the client PC 10 receives the installation control program transmitted from the domain controller 20, the client PC 10 executes the installation control program (step S5). Then, the client PC 10 requests the file server 30 to transmit installation permission definition information according to the installation control program (step S6). When receiving a request from the client PC 10 (step S7), the file server 30 encrypts the installation permission definition information stored in the HDD according to the request and transmits it to the client PC 10 (step S8). As an encryption method, a general key encryption method such as DES (Data Encryption Standard) may be used, and the key may be described as a secret key in the installation control program. When the client PC 10 receives the installation permission definition information transmitted from the file server 30, it decrypts it (step S9). Then, the client PC 10 determines whether installation is possible using the decrypted installation permission definition information (step S10). Specifically, the authentication information included in the installation permission definition information is compared with the authentication information received in step S1, and if they match, it is determined that the installation is possible, and if they do not match. It is determined that the installation is impossible. If the determination result of step S10 is negative (step S10: NO), the client PC 10 ends the execution of the installation control program. When the determination result of step S10 is affirmative (step S10: YES), the file server 30 is requested to transmit an installer of a predetermined program (step S11). When receiving a request from the client PC 10 (step S12), the file server 30 transmits an installer to the client PC 10 according to the request (step S13). When the client PC 10 receives the installer transmitted from the file server 30 (step S14), the client PC 10 executes the installer (step S15) and installs a predetermined program.

  According to the above configuration, only a user who is permitted to install a predetermined program can install the predetermined program. For this reason, unauthorized installation of a predetermined program can be prevented.

  Further, by encrypting the installation permission definition information, for example, the possibility that the installation permission definition information is falsified can be reduced. Therefore, it is possible to prevent a predetermined program from being illegally installed by falsifying the installation permission definition information.

(3) Modifications The present invention is not limited to the above-described embodiments, and various modifications as exemplified below are possible.

<Modification 1>
The information included in the installation permission definition information in the embodiment described above is not limited to information specifying a user permitted to install, but may be information specifying a client PC 10 permitted to install. For example, an identification ID such as a MAC address that can uniquely identify the client PC 10 permitted to be installed, or the IP address of the client PC 10 may be used. In such a configuration, for example, an identification ID such as a MAC address is stored in the ROM of the client PC 10, and an IP address is stored in the HDD or the like. In step S10, the client PC 10 collates the identification ID included in the installation permission definition information with the identification ID stored in the ROM, or the IP address included in the installation permission definition information and the IP address stored in the HDD. May be configured to perform the above-described determination. According to such a configuration, it is possible to prevent unauthorized installation of a predetermined program even when the right to use a predetermined program is granted not for each user but for each client PC.

  Further, the information specifying the client PC 10 permitted to install and the information specifying the user permitted to install may be combined to determine whether or not a predetermined program can be installed.

  Further, the information for identifying the user permitted to install is not limited to the user name and password used in the above-described embodiment as long as the information can uniquely identify the user.

<Modification 2>
In the above-described embodiment, in step S10, it is determined whether or not the authentication information included in the installation permission definition information transmitted from the domain controller 20 matches the authentication information stored in the client PC 10. However, the authentication information included in the installation permission definition information and the authentication information stored in the client PC 10 are determined to match to determine whether or not they match. You may do it. Specifically, for example, when an IP address assigned to the client PC 10 is used as authentication information, the information processing system 1 includes a DNS (Domain Name System) server, and the client PC 10 stores the IP address assigned to itself. Include the domain name in the installation permission definition information. The client PC 10 acquires the IP address corresponding to the domain name included in the installation permission definition information via the DNS server, and determines whether or not the IP address matches the IP address stored in itself. .

<Modification 3>
In the above-described embodiment, the user permitted to install is, for example, a case where the user has a right to use a predetermined program. However, even when the user has a right to use a predetermined program and installation is permitted, the administrator authority for allowing only the administrator to install the predetermined program on the client PC 10 is provided. Further, it may be configured to set. In this case, for example, the administrator information file described in JP-A-2005-25477 may be used to determine whether to permit installation.

<Modification 4>
The configuration of the file server 30 in the above-described embodiment is not limited to that described above, and may be, for example, a Web server having a function of transmitting data in the WWW system. In the above-described embodiment, the domain controller 20 and the file server 30 are provided separately, but they may be integrally configured.

<Modification 5>
In the client PC 10 in the above-described embodiment, the above-described installation control program and installer may be stored in the RAM or may be stored in the HDD. In the domain controller 20, the installation control program may be stored in the ROM. In the file server 30, the installer and the installation permission definition information may be stored in the ROM.

<Modification 6>
In the embodiment described above, the predetermined program to be installed by the client PC 10 using the installer acquired from the file server 30 may be a new program that is not installed in the client PC 10 or has already been installed. The program may be a program for upgrading the existing program, may be a program corresponding to a patch for troubleshooting, or may be a program of various other forms.

<Modification 7>
In the above-described embodiment, the configuration is such that the user inputs the authentication information via the input device. However, user authentication information may be stored in the client PC 10 in advance, and the client PC 10 may be configured to automatically log in (auto login) at a predetermined timing or at an arbitrary timing.

  As described above, the information processing apparatus, the installation control method, and the installation control program according to the present invention are suitable for a technique for installing a predetermined program at the time of user login.

It is a block diagram which illustrates the composition of the information processing system in one embodiment of this invention. It is a block diagram which illustrates the function implement | achieved in client PC10 in the embodiment. 4 is a sequence chart showing a procedure of an installation permission process performed by the client PC 10, the domain controller 20, and the file server 30 in the same embodiment.

Explanation of symbols

1 Information Processing System 10 Client PC (Information Processing Device)
20 Domain controller (first information management device)
30 File server (second information management device)
40 Network K1 Installation control unit (execution means)
K2 installability determination unit (determination means)
K3 data input / output unit (second acquisition means, third acquisition means)

Claims (8)

Transmitting means for transmitting the authentication information via a network to a first information management apparatus that authenticates the user using authentication information for identifying the user and permits the login of the user when the authentication is successful;
First acquisition means for acquiring an installation control program from the first information management apparatus that has authenticated the user using the authentication information transmitted by the transmission means;
Execution means for executing the installation control program acquired by the first acquisition means,
The execution means includes
Second acquisition means for acquiring installation permission definition information indicating whether or not a predetermined program can be installed from a second information management apparatus connected to the network;
Determination means for determining whether the predetermined program can be installed using the installation permission definition information acquired by the second acquisition means;
An information processing apparatus comprising: a third acquisition unit configured to acquire the predetermined program from the second information management apparatus when the determination result of the determination unit is positive. The third acquisition means acquires an installer for installing the predetermined program including the predetermined program,
The information processing apparatus according to claim 1, further comprising an installation unit that executes the installer acquired by the third acquisition unit and installs the predetermined program. The installation permission definition information is encrypted,
The determination means decrypts the installation permission definition information acquired by the second acquisition means, and determines whether or not the predetermined program can be installed using the decrypted installation permission definition information. The information processing apparatus according to 1. The installation permission definition information includes first identification information that identifies a user permitted to install the predetermined program,
The information processing according to claim 1, wherein the determination unit determines that the installation is possible when the first identification information included in the installation permission definition information matches the authentication information. apparatus. Storage means for storing at least device identification information for identifying itself in the network;
The installation permission definition information includes the device identification information that identifies an information processing device that is permitted to install the predetermined program,
The determination unit determines that installation is possible when the device identification information included in the installation permission definition information matches the device identification information stored in the storage unit. The information processing apparatus according to claim 1. The information processing apparatus according to claim 1, wherein the apparatus identification information is an IP address that is uniquely identifiable in the network. A step of transmitting the authentication information via a network to a first information management apparatus that authenticates the user using authentication information for identifying the user and permits the login of the user when the authentication is successful;
A first acquisition step of acquiring an installation control program from the first information management apparatus that has authenticated the user using the authentication information transmitted in the transmission step;
An execution step of executing the installation control program acquired in the first acquisition step,
The execution step includes:
A second acquisition step of acquiring installation permission definition information indicating whether or not a predetermined program can be installed from a second information management apparatus connected to the network;
A determination step of determining whether or not the predetermined program can be installed using the installation permission definition information acquired in the second acquisition step;
And a third acquisition step of acquiring the predetermined program from the second information management device when the determination result of the determination step is affirmative.   An installation control program for causing a computer to execute the installation control method according to claim 7.

Images