JP2008198021A - Computer and computing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a computer and a computing system enabling the acquisition of accurate and reliable operation time information in regard to the operation time information of the computer. <P>SOLUTION: An operation time information acquisition system includes a computer 1 having a security chip 2, and a management server 4 connected via a network 3. The security chip 2 includes a memory area 5, a clock 6 and a data transmitter/receiver 7. A memory 9 stores operation time information 12. The operation time information 12 is information indicative of the operation time of the computer 2, and added from the startup of the computer 2 every second based on the time information of the clock 6. In response to an operation time information acquisition request from the management server 4, encrypted operation time information is transmitted. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a computer and a computing system, and more particularly, to a computer and a computing system that acquire operating time information of a computer.

  In recent years, the Internet has spread rapidly, and software distribution and various services are provided through the Internet. Such services use time-limited software and pay-per-use systems that charge users according to usage time. However, in the time limit system, since time management is performed using the internal time of the computer, illegal use is often performed, which is a problem.

  Therefore, for example, when using or reproducing data with a time limit, a time encryption key module (a clock, a secret key of a public key encryption system, an encryption time generation means, or the like is used to prevent time tampering or unauthorized use. When a software with a time limit is used on the computer (or built-in), the time limit should be managed based on normal time information from the clock built into the computer. However, a time management system that manages time restrictions only based on the encryption time output by the time encryption key module has been proposed (see, for example, Patent Document 1).

Also, with the spread of the Internet in recent years, distributed computing technology that integrates a large number of distributed computers using a wide area network and performs distributed / parallel processing by regarding these as a large virtual high-performance computer. A so-called grid computing system is known. For security concerns, a technique has been proposed in which an access key and a communication address for accessing a shared area of a storage (storage device) are read from a center server and transferred to a network device (for example, Patent Document 2). reference).
JP 2003-280522 A JP 2005-222399 A

  However, in the service using the above-mentioned pay-per-use system, the operation time is often falsified, which is a problem. Since there is no method for obtaining reliable server operating time information, it has been difficult to apply a pay-as-you-go license system. A time management technique using the time encryption key module has also been proposed, but it is necessary to install a time encryption key module only for the use of time-limited software, which increases costs.

  In recent years, provisioning has become important in order to expand and improve the grid computing system. Provisioning refers to quickly providing pre-pooled resources in response to user requests. Therefore, for provisioning, it is necessary to add a server at all times or temporarily. In that case, it was necessary to grant access permission (grid license) to the grid computing system from the viewpoint of security. . However, there has been a problem that it is difficult to consider a grid license if server operating time information cannot be obtained accurately.

  The present invention has been made in view of such a situation, and an object of the present invention is to obtain accurate and reliable operation time information about computer operation time information.

  The invention according to claim 1 is a computer comprising a security chip, wherein the security chip receives time means for calculating time data and time data calculated by the time means while the computer is running. And a first storage means that is stored as operating time information and cannot be read / written from the outside.

  According to a second aspect of the present invention, in the computer according to the first aspect, an encryption unit that encrypts the operation time information, and a transmission unit that transmits the encrypted operation time information in response to a request. It is characterized by providing.

  According to a third aspect of the present invention, in the computer according to the first or second aspect, the first storage means stores time data calculated from the clock means every second.

  According to a fourth aspect of the present invention, in the computer according to the second or third aspect, the encryption means encrypts the information by a public key encryption method using a public key for encrypting information and a secret key for decrypting ciphertext. It is characterized by becoming.

  According to a fifth aspect of the present invention, in the computer according to the fourth aspect, the first storage means stores the public key and the secret key.

  According to a sixth aspect of the present invention, in the computer according to any one of the first to fifth aspects, the security chip is activated even when the computer is stopped.

  According to a seventh aspect of the present invention, in the computer according to any one of the first to sixth aspects, the first storage means stores operating time information until the computer stops even while the computer is stopped. And when the said computer starts again, the time data from the said clock means are added to the operating time information until it stops.

  The invention according to claim 8 is a computing system in which at least one computer and a management server are connected via a network, and the management server transmits an operation time information acquisition request to the computer. Request sending means, the computer comprises a security chip, the security chip calculates time data, and stores the time data calculated by the clock means as operating time information. A computing system comprising: a first storage unit that cannot be read / written; and a transmission unit that transmits the operation time information in response to an operation time information acquisition request transmitted from the management server. It is.

  According to a ninth aspect of the present invention, in the computing system according to the eighth aspect, the security chip included in the computer includes a first encryption unit that encrypts the operating time information, and the transmission unit includes the encryption unit. The converted operating time information is transmitted to the management server.

  According to a tenth aspect of the present invention, in the computing system according to the eighth or ninth aspect, the security chip stores information using a second storage unit that stores a public key of the management server and a public key of the management server. Second encryption means for encrypting, wherein the first storage means stores a public key of the security chip and a secret key of the security chip, and the first encryption means The operating time information is encrypted with a public key of the security chip, and the second encryption means encrypts the encrypted operating time information and the secret key of the security chip with the public key of the management server, The transmission unit transmits the ciphertext encrypted by the second encryption unit to the management server, and the management server transmits the ciphertext transmitted by the transmission unit. Is decrypted with the secret key of the management server, and the second decryption further decrypts the ciphertext of the composited operating time information with the secret key of the composited security chip. And means.

  According to the present invention, it is possible to obtain accurate and reliable operation time information about computer operation time information.

  Hereinafter, a computer and a computing system according to an embodiment of the present invention will be described in detail with reference to the drawings. The embodiments described below are preferred embodiments of the present invention, and thus various technically preferable limitations are given. However, the scope of the present invention is particularly limited in the following description. As long as there is no description which limits, it is not restricted to these aspects. Since the computing system according to the present invention is mainly characterized in that the management server acquires computer operating time information, the computing system according to the present embodiment is hereinafter referred to as an operating time information acquiring system.

  An overall configuration of an operating time information acquisition system according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 is an overall configuration diagram of an operating time information acquisition system according to the present embodiment. A computer 1 having a security chip 2 and a management server 4 are connected via a network 3.

  In general, the security chip prevents data tampering and replacement of the chip itself, thereby creating a hardware-reliable environment that is distinct from the security function performed only by software. The security chip also provides a place to securely store information, provides a safe place to perform cryptographic processing, stores information for checking integrity (that has not been tampered with), and stores the results of the check Report.

  Here, the security chip 2 according to the present embodiment will be described with reference to FIG. As shown in FIG. 2, the security chip 2 includes at least a memory area 5, a clock 6, and a data transmission / reception unit 7. The memory area 5 is a non-volatile memory, and includes a memory 8 that can be written from the outside and a memory 9 that cannot be written / read from the outside.

  The memory 9 stores operating time information 12. The operating time information 12 is information indicating a time during which the computer 2 is operating, and is added every second based on the time data of the clock 6 since the computer 2 is started. The data flow of the operating time information 12 is indicated by a dotted line in FIG. The operation time is written in the memory 9 until the computer 2 is stopped.

  Even when the computer 2 is stopped, the previous operating time information value (referred to as the original value) is not deleted, and when the computer 2 is restarted, it is further added to the original value. Can also be considered.

  Further, the security chip 2 may be activated even when the computer 1 is not activated, and a configuration having the IP address of the security chip 2 may be considered.

  Here, the operation time information 12 is encrypted when transmitted to the management server 4. Encryption is performed by, for example, “public key cryptosystem”. The public key cryptosystem uses two keys: a key for encryption and a key for decryption. A key that is public and can be seen by anyone and that performs encryption is hereinafter referred to as a “public key”. On the other hand, a key for performing decryption is hereinafter referred to as a “secret key”. Data encrypted with the public key can be decrypted only with the paired secret key.

  As shown in FIG. 2, the external writable memory 8 in the memory area stores the public key a (see reference numeral 10) of the management server 4 sent from the management server 4 described later. The external write / unreadable memory 9 stores a public key b and a secret key b (see reference numeral 11) of the computer 1.

  Next, an operation process when the management server 4 acquires the operation time information of the computer 1 according to the present embodiment will be described. The exchange of data between the management server 4 and the computer 1 is shown in FIG.

  The management server 4 makes a computer operating time information acquisition request to each computer 1. It may be possible to make an operation time information acquisition request to the security chips of all computers on the same network.

  Specifically, the operation time information acquisition request transmits “request start information”, “public key of the management server 4 (hereinafter referred to as public key a)”, and “request end information” to the security chip 2 of the computer 1. To do. The security chip 2 stores the information transmitted from the management server 4 in the memory 8 which is a memory area writable from the outside. The security chip 2 uses information (data) from receiving the request start information to receiving the request end information as the public key a of the management server.

  The computer 1 encrypts the operating time information with the public key b of the computer 1. The data encrypted with the public key b cannot be decrypted unless it is the secret key b.

  Further, the operating time information and the private key b encrypted with the public key b are encrypted with the acquired public key a of the management server 4 and transmitted to the management server 4.

  The management server 4 combines the operation time information encrypted with the public key b, which is information received from the computer 1, and the secret key b with the secret key a of the management server 4. The encrypted operation time information is further combined with the combined secret key b. Thereby, the management server 4 can acquire the operation time information of the computer 2.

  FIG. 3 is a flowchart showing an operation process of the computer 1 according to the embodiment. After startup (step S1), the computer 1 records operation time information in a memory in the security chip every second (step S2). When there is an operation time information acquisition request from the management server 4 (step S3 / Yes), the computer 1 encrypts the operation time information (step S4), and transmits the encrypted information to the management server 4 (step S5). ). The computer 1 is terminated by stopping (step S6).

  According to the above-mentioned embodiment, it is possible to acquire information held in an area that cannot be tampered by secure communication using a security chip with enhanced security in hardware, and obtain reliable server operating time information I can do it.

  In addition, by starting the security chip even when the computer is stopped, it is possible to obtain the operating time information of the stopped computer on the same network without starting the computer. Therefore, a flexible charging system can be applied in a pay-as-you-go system or a grid license.

  The program for the CPU to execute the processing shown in the flowchart of FIG. 3 constitutes a program according to the present invention. As a recording medium for recording the program, a semiconductor storage unit, an optical and / or magnetic storage unit, or the like can be used. By using such a program and a recording medium in a system having a configuration different from that of each of the above-described embodiments and causing the CPU to execute the program, substantially the same effect as the present invention can be obtained.

  Although the present invention has been specifically described based on the preferred embodiments, it is needless to say that the present invention is not limited to the above-described ones and can be variously modified without departing from the gist thereof.

1 is an overall configuration diagram of an operating time information acquisition system according to an embodiment of the present invention. It is a block diagram of the security chip which concerns on embodiment of this invention. It is a flowchart which shows the operation processing of the computer 1 which concerns on embodiment of this invention. It is a figure for demonstrating the data flow when the working time information 12 which concerns on embodiment of this invention is encrypted, and is transmitted to the management server 4. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Computer 2 Security chip 3 Network 4 Management server 5 Memory area 6 Clock 7 Data transmission / reception part 8 External writable memory 9 External write / unreadable memory 10 Public key a of management server 4
11 Public key b and private key b of computer 1
12 Operating time information

Claims (10)

A computer comprising a security chip,
The security chip is
Clock means for calculating time data;
And a first storage means that stores time data calculated by the clock means as operating time information while the computer is running, and is not readable / writable from the outside. Computer. Encryption means for encrypting the operating time information;
The computer according to claim 1, further comprising: transmission means for transmitting the encrypted operation time information in response to a request.   3. The computer according to claim 1, wherein the first storage unit stores time data calculated from the clock unit every second.   4. The computer according to claim 2, wherein the encryption means encrypts the data by a public key cryptosystem using a public key for encrypting information and a secret key for decrypting ciphertext.   The computer according to claim 4, wherein the first storage unit stores the public key and a secret key.   6. The computer according to claim 1, wherein the security chip is activated while the computer is stopped.   The first storage means stores the operating time information until the computer stops, while the computer is stopped, and when the computer is started again, the operating time information until the computer stops is added to the clock. The computer according to any one of claims 1 to 6, wherein time data from the means is added. A computing system in which at least one computer and a management server are connected via a network,
The management server includes request transmission means for transmitting an operation time information acquisition request to the computer,
The computer includes a security chip,
The security chip is
Clock means for calculating time data;
First storage means for storing time data calculated by the clock means as operating time information, which is not readable / writable from the outside;
A computing system comprising: transmission means for transmitting the operating time information in response to an operating time information acquisition request transmitted from the management server. The security chip included in the computer is:
Comprising first encryption means for encrypting the operating time information;
The computing system according to claim 8, wherein the transmission unit transmits the encrypted operation time information to the management server. The security chip is
Second storage means for storing the public key of the management server;
Second encryption means for encrypting information with the public key of the management server,
The first storage means stores a public key of the security chip and a secret key of the security chip;
The first encryption means encrypts the operating time information with a public key of the security chip,
The second encryption means encrypts the encrypted operating time information and the secret key of the security chip with the public key of the management server,
The transmission means transmits the ciphertext encrypted by the second encryption means to the management server,
The management server
First decryption means for decrypting the ciphertext transmitted by the transmission means with a secret key of the management server;
10. The computing according to claim 8, further comprising: a second decryption unit that further decrypts the ciphertext of the composited operating time information with a secret key of the composited security chip. system.

Images