JP2009187475A - Security management system, security device and security management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security management system that can be installed within the range of a determined number, and to provide a security device and a security management method. <P>SOLUTION: A computer has a computer identification information storing part for storing identification information for identifying the computer, and the security device comprises a storing part provided with write-in areas corresponding to an installable number, a determining part for determining whether to have an empty write-in area of the storing part upon receiving a request for installation, and an installation managing part for reading the identification information from the computer identification information storing part when the determining part determines that there is an empty write-in area of the storing part, writing the identification information in the empty write-in area, allowing installation, and preventing installation from being allowed when the determining part determines that there is no empty write-in area of the storing part. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a security management system, a security device, and a security management method for restricting unauthorized installation of software on a computer.

Conventionally, when installing a paid application on a personal computer, the application is purchased and installed.
In this installation, for example, the serial number is set on the media. When installing, the serial number input from the keyboard etc. is compared with the serial number set on the media, and if they match, Installation is possible. This confirms that the product has been purchased properly.
As described above, for example, a technique described in Patent Document 1 described below is known as a technique for performing restriction or confirmation when an application is installed in a personal computer.
JP 2000-66890 A

However, at present, it is permitted to install on a personal computer within a range according to the number of copies and contracts by contracting the number of applications to be installed when purchasing the application. Therefore, when limiting and managing the number of installations in such a case, in the method of permitting installation by inputting the serial number described above, the serial number is known to those who have purchased the application, If you enter this serial number, you can install more than the number of contracts. It is desirable to prevent unauthorized installation on a personal computer exceeding the number of contracts.
Further, in the above-described prior art document 1, since installation is managed for one PC, it is not possible to manage the number that can be installed when installing on a plurality of personal computers.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a security management system, a security apparatus, and a security management method that can be installed within a predetermined number of ranges.

  In order to solve the above-described problems, the present invention provides a security management system in which a security device and a computer are communicatively connected to manage the installation of software on the computer, and the computer identifies the computer A computer identification information storage unit for storing information, wherein the security device is provided with a write area corresponding to the number of installable units, and when a request for installation is received, the write area of the storage unit is free. A determination unit for determining whether or not there is a read area, and when the determination unit determines that there is a free write area in the storage unit, the identification information is read from the computer identification information storage unit, and the free write area Write identification information on the It characterized by having a a installation management portion that does not allow the installation if it is determined that there is no vacancy in the write area of the storage unit by the tough.

  Further, the present invention is the above-described security management system, wherein the security management system is provided so that a server device can communicate, and the security device includes a serial information storage unit that stores serial information for identifying the security device; A serial information notification unit that notifies the server device of the serial information; and a key generation unit that generates product key information from the identification information and the serial information. When it is determined that there is a vacancy in the writing area of the storage unit, the serial information notification unit notifies the server device of the serial information to request whether the serial information is correct or not. When information indicating correctness is obtained, a product key is generated by the key generation unit. The server device is notified from the serial information storage unit for storing serial information and the installation management unit. A serial information determination unit that compares serial information stored in the serial information storage unit and determines whether the serial information notified from the installation management unit is correct; and And a determination result notification unit that notifies the installation management unit of the determination result.

  According to the present invention, in the security management system described above, when the security device receives a request for uninstalling the installed software, the security device reads and reads the identification information from the computer identification information storage unit of the computer to be uninstalled. Whether the identification information that matches the identification information is stored in the storage unit, or the product key information generated by the product key information from the identification information and the serial information stored in the serial information storage unit An installation determination unit that determines whether or not matching product key information is stored in the storage unit, and based on a determination result of the installation determination unit, matching identification information or product key information is stored in the storage unit. The matching identification information. It removes the product key information from the storage unit, and having a uninstall management unit to allow uninstallation, the.

  Further, the present invention is a security device in a security management system in which the security device and the computer are communicably connected in the above-described security management system and manages the installation of software on the computer, and the security device corresponds to the number that can be installed. A storage unit provided with a write area, a determination unit that determines whether or not there is a free space in the write area of the storage unit upon receiving a request for installation, and a free space in the write area of the storage unit by the determination unit When it is determined that, the identification information stored in the computer identification information storage unit provided in the computer is read, the identification information is written in the vacant writing area, the installation management unit to permit installation, It is characterized by having.

  The present invention also relates to a security management method in a security management system in which the security device and the computer are communicably connected in the above-described security management system and manages the installation of software on the computer. However, upon receiving a request for installation, it is determined whether or not there is a vacancy in the writing unit of the storage unit provided in the own security device, the writing unit corresponding to the number of installable, The installation management unit of the security device reads the identification information stored in the computer identification information storage unit provided in the computer when the determination unit determines that the writing area of the storage unit is empty. The vacant writing Rear to write the identification information, characterized in that the authorization of the installation.

  In this way, when performing uninstallation, the product key information generated from the identification information of the computer to be uninstalled or the identification information of the computer to be uninstalled is deleted from the storage unit and the uninstallation is permitted. As a result, the number of write areas in the storage unit increases according to the number of uninstalls, so installation can be performed according to the number of uninstalls, and installation and uninstallation can be performed within the range of possible installations. And can be done.

  As described above, according to the present invention, when an installation request is received, it is determined whether or not there is a vacancy in the writing area of the storage unit. If there is a vacancy, the identification information is obtained from the computer identification information storage unit. Reading and writing identification information in an empty writing area to permit installation, while if it is determined that there is no space in the writing area, installation is not permitted. As a result, application software can be installed in a number that can be written to the writing area of the storage unit, and the number that can be installed in the computer can be limited within a predetermined range.

  Further, according to the above-described embodiment, when it is determined that the writing area of the storage unit is empty, the security device notifies the server device of the serial information by the serial information notification unit and determines whether the serial information is correct or not. When the information indicating that the serial information is correct is obtained from the server device, the product key information is generated by the key generation unit, and the product key information is written in an empty writing area of the storage unit. Since the permission is given, it is possible to permit the installation after confirming from the issuer side of the application software whether or not the security device has been correctly contracted and issued. Further, since the protect key generated in the security device does not go out of the casing from the security device, it is possible to ensure high security.

  Further, according to the present invention, when an uninstall request is received for the installed software, the identification information is read from the computer identification information storage unit of the computer to be uninstalled, and the identification information matching the read identification information is present. Whether or not product key information that matches product key information generated from the identification information and the serial information stored in the serial information storage unit is stored in the storage unit. If the matching identification information or product key information is stored, the matching identification information or product key information is deleted from the storage unit and the uninstallation is permitted. It is possible to perform a new installation for the number of minutes.

  A security management system according to an embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a schematic block diagram showing a configuration of a security management system according to an embodiment of the present invention. In the security management system 1, the computer 10, the security device 20, and the server device 30 are connected to be communicable and manage the installation of software on the computer 10. The security device 20 and the computer 10 are connected by, for example, USB (universal serial bus), and the computer 10 and the server device 30 are connected through a network such as the Internet.

In the computer 10, a computer identification information storage unit 11 stores computer identification information for identifying a computer. The computer identification information storage unit 11 is composed of, for example, an IC chip (security chip), and the computer identification information is stored in an area where it cannot be rewritten. Information stored in the computer identification information storage unit 11 is written in the computer identification information storage unit 11 in advance, and is loaded and shipped before the computer 10 is shipped.
The communication unit 12 communicates with the server device 30 via a network.

  In the security device 20, the storage unit 21 is provided with a writing area corresponding to the number that can be installed. The number of writable areas in the storage unit 21 is set before shipment of the security device 20, and the number of areas cannot be increased on the user side after shipment. The number of areas is set according to the number of contracts for installing software and delivered to the user who has contracted.

When the storage area determination unit 22 receives a request for installation, the storage area determination unit 22 determines whether or not there is a free space in the writing area of the storage unit 21.
Here, free means that the data in the write area of the memory has a predetermined value such as an initial value. If this is the initial value, there is a writable area, that is, a free area. The protect key (or serial information) described below can be written.
The serial information storage unit 23 stores serial information for identifying the security device 20. This serial information is written in advance in an IC chip (security chip) before shipment of the security device 20, and this IC chip is mounted on the security device 20 and shipped.
The serial information notification unit 24 notifies the server device 30 of serial information. This notification may be performed via the communication unit 12 of the computer 10.
The key generation unit 25 generates product key information from computer identification information and serial information.

The installation management unit 26 reads the computer identification information from the computer identification information storage unit 11 when the storage area determination unit 22 determines that the writing area of the storage unit 21 is free, and the computer is stored in the free writing area. The identification information is written, installation is permitted, and installation is not permitted when the storage area determination unit 22 determines that the writing area of the storage unit 21 is not empty.
In addition, when the storage area determination unit 22 determines that the writing area of the storage unit 21 is empty, the installation management unit 26 notifies the serial information to the server device by the serial information notification unit 24 to check whether the serial information is correct or not. When the information indicating that the serial information is correct is obtained from the server device, product key information is generated by the key generation unit 25, and the product key information is stored in an empty writing area of the storage unit 21. Allow writing and installation.

  When receiving an uninstallation request from the computer 10 for the installed software, the installation status determination unit 27 reads out the computer identification information from the computer identification information storage unit 11 of the computer to be uninstalled, and the read computer identification information and Whether the matching computer identification information is stored in the storage unit 21, or the product that matches the product key information generated by the product key information from the computer identification information and the serial information stored in the serial information storage unit 11 It is determined whether or not key information is stored in the storage unit 21.

  When the matching computer identification information or product key information is stored in the storage unit 21 based on the determination result of the installation status determination unit 27, the uninstallation management unit 28 displays the matching computer identification information or product key information. It deletes from the memory | storage part 21 and permits uninstallation.

In the server device 30, the serial information storage unit 31 stores serial information. The serial information determination unit 32 compares the serial information notified from the installation management unit 26 with the serial information stored in the serial information storage unit 31, and determines whether the serial information notified from the installation management unit 26 is correct. judge.
The determination result notification unit 33 notifies the installation management unit 26 of the determination result of the serial information determination unit 32.

FIG. 2 is a diagram for explaining a case where an application of the security management system according to the embodiment of the present invention is installed.
For example, an IC chip is applied to the computer 10 as the computer identification information storage unit 11 and is mounted on the computer 10. This computer identification information is, for example, the serial number of the computer 10 and is stored in an area where the IC chip cannot be rewritten.
For example, an IC chip is applied to the security device 20 as the serial information storage unit 23 and is mounted on the security device 20. This serial information is, for example, a product serial number, and is stored in a non-rewritable area of the IC chip mounted on the security device 20.

  The key generation unit 25 of the security device 20 generates a protect key from the computer identification information and the serial information by performing a key generation process according to the key generation process. Then, the installation management unit 26 stores the same one as the protect key in the storage unit 21, and if there is no same one as the protect key, whether or not there is a writable memory area in the storage unit 21. If there is a writable memory area, write is executed and installation is permitted.

  Here, the number of writable memory areas in the storage unit 21 corresponds to the number of installable software to be managed, and the remaining number of writable memory areas is the remaining installable remaining area. Corresponds to a number. Therefore, if there is no free space in the memory area, it can be assumed that the number of contracts has been reached and no further installation is allowed.

Next, the operation of the above-described security management system will be described.
FIG. 3 is a flowchart for explaining the installation process of the security management system in this embodiment.
In this figure, first, the user applies to the application software supplier for the number of licenses of the application software to be installed, and makes a license agreement for installation (step S10). The supplier of the application software sets a writing area corresponding to the number of application licenses in the storage unit 21 of the IC chip, and writes serial information as a product serial number in the serial information storage unit 23 (step S11).
Next, the application software supplier sends the security device 20 in which the product serial number is registered to the user who is the applicant (step S12). Further, the serial information of the security device 20 sent is stored in the serial information storage unit 31 of the server device 30.

The user establishes communication with the server device 30 by connecting the sent security device 20 to the computer 10 on which the application software is to be installed and accessing the website of the supplier, and instructing installation according to the installation process Is input (step S13).
Next, when an installation instruction is input, the storage area determination unit 22 of the security device 20 determines whether there is a writable area in the storage unit 21. If it is determined that there is a free space, the installation management unit 26 reads the serial information from the serial information storage unit 23 and notifies the computer 10 by the serial information notification unit 24. Here, when transmitting serial information, the serial information notification unit 24 encrypts data transmitted by both the security management 20 and the server device 30 using a common secret key, and serial information is transmitted. Send. Other than encryption, a MAC (Message Authentication Code) may be generated and attached. When the encrypted serial information is input, the communication unit 12 of the computer 10 transmits the encrypted serial information to the server device 30 (step S14).
When the server device 30 receives the encrypted serial information, the server device 30 decrypts the received serial information, and determines whether serial information that matches the decrypted serial information is stored in the serial information storage unit 31 (step). S15). Here, if there is no matching serial information, information indicating that installation is not permitted is transmitted to the computer 10, and if there is matching serial information, information indicating that installation is permitted is transmitted to the computer 10 (step S1). S16).

When receiving information indicating installation permission, the computer 10 outputs this information to the security device 20. Upon receiving this installation permission information, the installation management unit 26 uses the key generation unit 25 based on the computer identification information stored in the computer identification information storage unit 11 and the serial information stored in the serial information storage unit 23. Then, a product key is generated, and the generated product key is written in an empty area of the storage unit 21 (step S17). When the writing is performed, the installation management unit 26 determines whether the writing is normally completed. When the writing is normally completed, the server 30 is notified of the completion of the writing via the computer 10. Is performed (step S18).
When notified that the product key has been successfully written, the server device 30 transmits an installation start instruction to the computer 10 (step S19). Upon receiving this installation start instruction, the computer 10 installs application software. The application software may be stored in a recording medium or downloaded from the server device 30.

FIG. 4 is a flowchart for explaining a process when a process for confirming a protect key is added to the installation process of FIG.
First, when the security device 20 is connected to the computer 10 (step S51), the computer 10 automatically detects the security device 20 and starts an installation preparation program (step S52). When the installation preparation program is activated, the security device 20 reads the computer identification information stored in the computer identification information storage unit 11 (step S53), and reads the serial information stored in the serial information storage unit 31 (step S54). Then, the installation management unit 26 of the security device 20 generates a product key by the key generation unit 25 using the read computer identification information and serial information (step S55), and the same protection key as the generated protection key is obtained. It is determined whether it is stored in the storage unit 21 (step S56). If the same protect key is stored (step S57), it is determined that the computer is the same computer that was previously installed (step S58). The installation is executed (step S59). Here, since the same application software is installed in the same computer 10, it may be installed after being uninstalled once.

  On the other hand, if there is no identical protect key in the storage unit 21 of the security device 20, the installation management unit 26 determines whether or not there is an empty area in the storage unit 21 by the storage area determination unit 22 (step S60). . If there is no free area (step S61), the installation management unit 26 determines that the installation process exceeds the number of contracts (step S62), and does not execute the installation and ends the process (step S63).

  On the other hand, when there is the same protect key, the installation management unit 26 notifies the server device 30 that the storage unit 21 has space through the computer 10 by the serial information notification unit 24. Thus, when installation permission is instructed from the server device 30, the installation management unit 26 writes the protect key in the storage unit 21 (step S65), and when the writing is completed, permits installation (step S66). Thereby, installation is executed (step S59).

Next, the uninstall process will be described.
FIG. 5 is a diagram for explaining the case of uninstalling the application of the security management system according to the embodiment of the present invention.
When an uninstall instruction is input by the user via the computer 10, the security device 20 performs key generation processing in accordance with the key generation process, thereby obtaining the computer identification information of the computer 10 and the serial information of the security device 20. Generate a protect key from Then, it is determined whether or not a protection key that matches the generated protection key is stored in the storage unit 21. If there is a matching protection key, it is determined that the computer 10 has the application software installed, and Uninstall application software. Then, it is detected that the erasure of the application software has been completed, and the corresponding protection key stored in the storage unit 21 (the protection key generated when the uninstallation instruction is issued) is deleted from the storage unit 21. This erasing may be performed by writing an initial value. As a result, one of the protect keys stored in the storage unit 21 returns to the initial value, so that application software can be newly installed on the same or another computer 10.

Next, the operation of the above-described security management system will be described.
FIG. 6 is a flowchart for explaining the uninstall process of the security management system in this embodiment.
First, when the security device 20 is connected to the computer 10 from which the application software is to be uninstalled by the user (step S81), the computer 10 detects that the security device 20 has been connected and then instructs the user to uninstall it. Is input, the uninstallation program is activated to prepare for uninstallation (step S82).
When the uninstallation process program is started, the computer 10 outputs an instruction for the uninstallation process to the security device 20. In accordance with this instruction, the security device 20 reads the computer identification information from the computer identification information storage unit 11 of the computer 10 (step S83), and reads the serial information from the serial information storage unit 31 (step S84).

Based on this computer identification information and serial information, the installation status determination unit 27 generates a product key by the key generation unit 25 (step S85), and whether or not the same protection key is stored in the storage unit 21. Is determined (step S86).
If the same protection key exists in the storage unit 21, it is determined that the same computer 10 was previously installed (step S88), and the target application software for which uninstallation has been instructed by the uninstallation management unit 28 is determined. Uninstallation is performed (step S89).
When the uninstallation process is completed, the installation status determination unit 27 sets an initial value of the same protection key generated when the uninstallation process is instructed from among the protection keys stored in the memory area of the storage unit 21. (Step S90).
On the other hand, if the same protect key does not exist in the storage unit 21, it is determined that the computer 10 has not been previously installed (step S91), and the process is terminated without uninstalling (step S92).

  In the embodiment described above, when installing, a protect key is generated and written in the storage unit 21. However, the protect key is not generated, and the computer identification information of the computer 10 to be installed is used as the security device 20. The number of installed computers (the number of computers) and the computer on which the computer is installed can be managed. In this case, when performing the uninstallation process, it is determined whether or not the same computer identification information as the computer identification information of the computer 10 to be uninstalled is stored in the storage unit 21 of the security management 20. If it is, the computer identification information may be deleted from the storage unit 21 and the initial value may be written.

  By generating a protect key and storing it in the storage unit 21, it is possible to determine whether or not the application software is contracted when the security device 20 is issued when uninstalling. That is, since it is a protect key generated from the combination of the serial information of the security device 20 and the computer identification information of the computer 10, which computer 10 is installed under which security device 20 is managed. Can be identified, and the computer identification information and serial information can be prevented from being falsified and stored.

  Further, since the serial information of the security device 20 is transmitted to the server device 30 to determine whether or not it is correct, whether or not the security device 20 has been correctly contracted and issued is issued. It is possible to permit installation after confirmation by the user.

Further, in the above-described embodiment, by causing the application software to be downloaded from the server device 30, unauthorized copying of the application software itself is impossible because the medium in which the application program is written does not exist at the user's hand. In addition, since the security chip is used for the IC medium of the security device 20, it is difficult to duplicate the IC medium, and unauthorized use can be prevented.
Further, since the protect key generated in the security device 20 does not go out of the housing from the security device 20, high security can be ensured.
Furthermore, it is possible to collect charges for the number of regular installations by preventing unauthorized installation.

  1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed to execute installation management and Uninstall management may be performed. Here, the “computer system” includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a portable medium such as a flexible disk, a magneto-optical disk, a ROM, and a CD-ROM, and a storage device such as a hard disk built in the computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes designs and the like that do not depart from the gist of the present invention.

It is a schematic block diagram which shows the structure of the security management system by one Embodiment of this invention. It is a figure explaining the case where the application of the security management system by one Embodiment of this invention is installed. It is a flowchart explaining the installation process of the security management system in this embodiment. FIG. 4 is a flowchart for explaining a process when a process for confirming a protect key is added to the installation process of FIG. 3. FIG. It is a figure explaining the case where the application of the security management system by one Embodiment of this invention is uninstalled. It is a flowchart explaining the uninstallation process of the security management system in this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Security management system 10 Computer 11 Computer identification information storage part 20 Security apparatus 21 Storage part 22 Storage area determination part 23 Serial information storage part 24 Serial information notification part 25 Key generation part 26 Installation management part 27 Installation status determination part 28 Uninstallation management Part

Claims (5)

A security management system in which a security device and a computer are communicatively connected to manage installation of software on the computer,
The computer
A computer identification information storage unit for storing identification information for identifying the computer;
The security device comprises:
A storage unit provided with a writing area according to the number of installable,
Upon receiving a request for installation, a determination unit that determines whether or not there is an empty writing area of the storage unit;
When the determination unit determines that the writing area of the storage unit is empty, the identification information is read from the computer identification information storage unit, the identification information is written to the empty writing area, and installation is permitted. An installation management unit that does not permit installation when it is determined by the determination unit that there is no space in the writing area of the storage unit;
A security management system comprising: The security management system is provided so that a server device can communicate,
The security device comprises:
A serial information storage unit for storing serial information for identifying the security device;
A serial information notification unit for notifying the server device of the serial information;
A key generation unit that generates product key information from the identification information and the serial information;
Have
When the determination unit determines that the write area of the storage unit is empty, the installation management unit notifies the server device of serial information by the serial information notification unit, and determines whether the serial information is correct or not. When requesting and obtaining information indicating that the serial information is correct from the server device, product key information is generated by the key generation unit, and product key information is written in an available writing area of the storage unit and installed. Permission
The server device
A serial information storage unit for storing serial information;
A serial information determination unit that compares serial information notified from the installation management unit with serial information stored in the serial information storage unit and determines whether the serial information notified from the installation management unit is correct; ,
The security management system according to claim 1, further comprising: a determination result notification unit that notifies the installation management unit of a determination result of the serial information determination unit. The security device comprises:
When a request for uninstalling the installed software is received, the identification information is read from the computer identification information storage unit of the computer to be uninstalled, and identification information that matches the read identification information is stored in the storage unit Whether or not product key information that matches product key information generated by the product key information from the identification information and the serial information stored in the serial information storage unit is stored in the storage unit. An installation determination unit for determining;
If matching identification information or product key information is stored in the storage unit based on the determination result of the installation determination unit, the matching identification information or product key information is deleted from the storage unit, and uninstallation is performed. The uninstall manager to allow,
The security management system according to claim 1 or 2, characterized by comprising: A security device in a security management system in which a security device and a computer are communicably connected to manage installation of software on the computer,
A storage unit provided with a writing area according to the number of installable,
Upon receiving a request for installation, a determination unit that determines whether or not there is an empty writing area of the storage unit;
When the determination unit determines that the writing area of the storage unit is empty, the identification information stored in the computer identification information storage unit provided in the computer is read and identified as the empty writing area. An installation manager that writes information and permits installation;
A security device comprising: A security management method in a security management system in which a security device and a computer are communicably connected to manage installation of software on the computer,
The determination unit of the security device,
Upon receiving a request for installation, it is determined whether or not there is a vacancy in the writing area of the storage unit provided in the own security device, where the writing area corresponding to the number that can be installed is provided,
An installation management unit of the security device;
When the determination unit determines that the writing area of the storage unit is empty, the identification information stored in the computer identification information storage unit provided in the computer is read and identified as the empty writing area. A security management method characterized by writing information and permitting installation.

Images