JP2011138274A - Method for installing software, installation system and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To simultaneously materialize both reduction of a burden of installation work on a manager and avoidance of security risk when installing software to each of a plurality of computers. <P>SOLUTION: A computer 10 allocates a serial number to management data wherein identification information of each computer, a user name of manager authority, and a password are associated and recorded about each of the plurality of computers 20, encrypts at least the user name of the manager authority and the password with the serial number as an encryption key, and creates an attached file 38. The manager distributes the serial number and the attached file 38 to a general user of the computer 20 together with an application 32 or the like. The computer 20 decrypts data included in the attached file 38 with the serial number as a decryption key, and installs the application 32 by the manager authority by use of the user name of the manager authority and the password included in the decrypted data. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a software installation method, an installation system, and a computer program.

  A large number of computers such as personal computers and workstations have been introduced in companies and the like. Various types of application software are installed in these computers, and the application software is used for various tasks.

  This application software is provided and distributed to each computer via a recording medium such as a CD (Compact Disc) or a DVD (Digital Versatile Disc), or a network such as the Internet or a local area network. Conventionally, various techniques for preventing or suppressing unauthorized use of application software have been proposed (see, for example, Patent Documents 1 and 2 below).

JP-A-6-195217 JP 7-182244 A

  By the way, in a computer, application software generally operates under an operating system. Some of these operating systems, such as Windows XP (registered trademark), have application software installation restricted under administrator authority. Then, a general user of each computer starts up the operating system with non-administrator authority and uses application software.

When such an operating system is installed in a computer, when installing application software on the computer, an administrator authority, that is, a user name and a password with an administrator authority, for example, are required. For this reason, the following method is generally employed as a method of installing application software on each computer.
(1) A specific person (administrator) who knows the user name and password of the administrator authority for each computer gives the user name and password of the administrator authority to each general user (non-administrator) of each computer. And have them install the application software on their computers.
(2) An administrator installs application software on each of a plurality of computers using a user name and password with administrator authority.

  However, in the method (1), although the burden of the administrator's installation work is small, the user name and password of the administrator authority are known to the non-administrator, and the security risk is high. In the method (2), since the user name and password of the administrator authority are not known to the non-administrator, the security is ensured, but the burden of the administrator installation work is large. In other words, it has been difficult to reduce both the burden of the administrator's installation work and the avoidance of security risks when installing application software on each of a plurality of computers.

  The present invention has been made to solve the above-described problems, and achieves both a reduction in the burden of an administrator's installation work and avoiding a security risk when installing software on each of a plurality of computers. For the purpose.

  SUMMARY An advantage of some aspects of the invention is to solve at least a part of the problems described above, and the invention can be implemented as the following forms or application examples.

[Application Example 1]
An installation method for installing the software on each of a plurality of computers having an operating system in which installation of software is restricted under administrator authority, and the operating system is started with non-administrator authority,
One of the plurality of computers is
For each of the plurality of computers, obtaining management data in which identification information for identifying the computer and predetermined information related to administrator authority are recorded in association with each other;
Assigning different encryption keys to each of the management data;
For each of the management data, a step of encrypting at least the predetermined information by a common key encryption method using the assigned encryption key, and generating the encrypted management data by collecting the encrypted data When,
With
Each of the plurality of computers
Obtaining the encryption management data;
Obtaining a decryption key identical to the encryption key for decrypting the encryption management data;
Decrypting the encrypted data included in the encryption management data by the common key encryption method using the decryption key in a state concealed from a non-administrator who is a user of the plurality of computers; ,
Using the predetermined information included in the decrypted management data, installing the software with the administrator authority;
An installation method comprising:

  In the installation method of Application Example 1, when software is installed on each of a plurality of computers, the predetermined information related to the administrator authority is not known to the non-administrator. Therefore, it is possible to avoid a security risk caused by a non-administrator acquiring predetermined information related to the administrator authority. In addition, in the installation method of Application Example 1, the non-administrator can install software with the administrator authority without knowing the predetermined information related to the administrator authority. Therefore, the burden on the administrator's installation work is reduced as compared to the case where the administrator performs installation of application software on each of a plurality of computers using predetermined information related to the administrator's authority. can do. In other words, the installation method of Application Example 1 can both reduce the burden of the administrator's installation work and avoid security risks when installing software on each of a plurality of computers.

  In this specification, the software installation includes not only an aspect of newly installing software, but also an aspect of updating a part of already installed software, for example, software update or repair.

[Application Example 2]
An installation method described in application example 1,
The predetermined information includes a user name and password of the administrator authority,
Installation method.

  In general, a user name and a password with administrator authority are used as predetermined information related to administrator authority. Therefore, with the installation method of this application example, it is possible to reduce both the burden on the administrator's installation work and avoid the security risk when installing software on each of the plurality of computers described above.

[Application Example 3]
An installation method described in application example 1 or 2,
In each of the plurality of computers obtaining the decryption key, each of the plurality of computers acquires the decryption key in a state where the non-administrator conceals that the decryption key is a decryption key. get,
Installation method.

  By the installation method of the application example 3, it is possible to prevent the non-administrator from trying to decrypt predetermined information related to the administrator authority such as the user name and password of the administrator authority decrypted.

[Application Example 4]
An installation method described in application example 3,
The encryption key and the decryption key are assigned as serial numbers of the management data.
Installation method.

  The installation method of Application Example 4 can suppress at least non-administrators from knowing that encryption and decryption are performed in a series of steps for installing software on a plurality of computers. it can.

[Application Example 5]
An installation system for installing software on each of a plurality of computers having an operating system in which software installation is restricted under administrator rights, and wherein the operating system is booted with non-administrator rights,
Any one of the plurality of computers is
For each of the plurality of computers, a management data acquisition unit that acquires management data in which identification information for identifying the computer and predetermined information related to administrator authority are recorded in association with each other;
For each of the management data, at least the predetermined information is encrypted by a common key encryption method using different encryption keys assigned to the management data, and the encrypted data is collected. An encryption management data generation unit for generating encryption management data,
With
Each of the plurality of computers is
An encryption management data acquisition unit for acquiring the encryption management data;
A decryption key acquisition unit that acquires the same decryption key for decrypting the encryption management data as the encryption key;
A decrypting unit that decrypts the encrypted data included in the encrypted management data by the common key encryption method using the decryption key in a state of being concealed from a non-administrator who is a user of the plurality of computers. When,
Using the predetermined information included in the decrypted management data, an installation execution unit for installing the software with the administrator authority;
An installation system comprising.

  Similar to the installation method of Application Example 1, the installation system of Application Example 5 achieves both a reduction in the burden of the administrator's installation work and the avoidance of security risks when installing software on each of a plurality of computers. be able to.

[Application Example 6]
A computer program executed by a computer,
For each of the plurality of computers, a function of acquiring management data in which identification information for identifying the computer and predetermined information related to the administrator authority are recorded in association with each other;
For each of the management data, at least the predetermined information is encrypted by a common key encryption method using different encryption keys assigned to the management data, and the encrypted data is collected. A function to generate encryption management data,
A computer program for realizing a computer.

  The computer program of the application example 6 can cause the computer to function as “any one of a plurality of computers” in the installation system of the application example 5.

[Application Example 7]
A computer program executed by a computer having an operating system in which installation of software is restricted under administrator rights, said operating system being started with non-administrator rights,
For each of the plurality of computers, at least the predetermined information in the management data recorded by associating the identification information for identifying the computer with the predetermined information related to the administrator authority is stored in the management data. A function of acquiring encryption management data generated by encrypting by using a common key encryption method using different encryption keys assigned to each other and collecting the encrypted data;
A function for obtaining a decryption key for decrypting the encryption management data, the same as the encryption key;
A function of decrypting the encrypted data included in the encryption management data by the common key encryption method using the decryption key in a state of being concealed to a non-administrator who is a user of the computer;
Using the predetermined information included in the decrypted management data, a function of installing the software with administrator authority;
A computer program for realizing a computer.

  The computer program of the application example 7 can cause the computer to function as “a plurality of computers” in the installation system of the application example 5.

  The present invention can be realized in various modes such as a recording medium that records the computer program according to Application Examples 6 and 7, and a data signal that includes the program and is embodied in a carrier wave.

It is explanatory drawing which shows schematic structure of the software installation system 100 as one Example of this invention. It is explanatory drawing which shows schematic structure of the computer 10 of an information system department. It is explanatory drawing which shows typically a mode that the encryption management data generation part 11b produces the attachment file 38. FIG. It is a flowchart which shows the flow of an attachment file production | generation process in the computer 10 of an information system department. It is explanatory drawing which shows schematic structure of the computer 20 of a user department. It is a flowchart which shows the flow of the installation process in the some computer 20 of a user department. It is explanatory drawing which shows an example of the installation menu screen GUI1. It is explanatory drawing which shows an example of the serial number input screen GUI2.

Hereinafter, embodiments of the present invention will be described based on examples.
A. Installation system configuration:
FIG. 1 is an explanatory diagram showing a schematic configuration of a software installation system 100 as an embodiment of the present invention. In the present embodiment, it is assumed that the installation system 100 is installed in a company. It is assumed that this company has an information system department that manages computers in the company and a user department that performs various operations using the computers.

  The installation system 100 includes a computer 10 installed in the information system department and a plurality of computers 20a, 20b, 20c,..., 20i installed in the user department (hereinafter collectively referred to as the computer 20). And. In FIG. 1, nine computers 20 are illustrated as the plurality of computers 20 for convenience of illustration, but the number of computers 20 may be any number. Although illustration is omitted, the computer 10 in the information system department and the plurality of computers 20 in the user department are connected to each other via a local area network. The computer 10 in the information system department and the plurality of computers 20 in the user department are also connected to the Internet.

  An operating system and various application software operating under the operating system are installed on the computer 10 in the information system department and the plurality of computers 20 in the user department. Used for. The operating system is an operating system such as Windows XP (registered trademark) in which installation of application software is restricted under the authority of an administrator. As shown in the drawing, each computer 20 is set with identification information (for example, a computer name) for identifying the computer, a user name with administrator authority (AdminID), and a password with administrator authority (AdminPW). Yes. In this embodiment, each computer 20 is set with a different administrator authority user name (AdminID) and password (AdminPW), but the plurality of computers 20 have the same administrator authority user names ( (AdminID) and password (AdminPW) may be set.

  In order to ensure security, the user name and password of the administrator authority set in each computer 20 are managed as management data by the computer 10 in the information system department, and the general user (non-user) of each computer 20 It is kept secret from the administrator. A general user of each computer 20 activates the operating system with a user name and password of general user authority (non-administrator authority) and uses application software.

  The outline of the procedure for installing the application software 32 in the plurality of computers 20 in the installation system 100 of the present embodiment is as follows.

  That is, an administrator who manages a plurality of computers 20 in the information system department generates an attachment file 38 to be described later using an attachment file creation tool (computer program) installed on the computer 10. The attached file creation tool is provided / distributed by the provider of the application software 32, for example. Then, the administrator of the information system department records the attached file 38 created by the attached file creation tool on the compact disc 30 together with the application software 32, the installer 34, the kicker 36, and the like. The kicker 36 is an activation program for activating the installer 34, and operates with general user authority and administrator authority under the operating system. On the other hand, the installer 34 is a computer program for installing the application software 32 in the computer, and operates only with administrator authority under the operating system.

  The administrator of the information system department distributes one or a plurality of compact discs 30 to the user department. The administrator of the information system department distributes the serial number used for installing the application software 32 to general users of the computer 20 of the user department. The serial number is distributed by, for example, a sheet on which the serial number is written, an e-mail, a download from a server (not shown), or the like. A general user of the computer 20 that has obtained the compact disk 30 and the serial number uses these to install the application software 32 on the computer 20. Hereinafter, the configuration of each of the computers 10 and 20 and the processing executed by them will be described.

B. Information system department:
B1. Configuration of the computer 10 in the information system department:
FIG. 2 is an explanatory diagram showing a schematic configuration of the computer 10 in the information system department. As illustrated, the computer 10 includes a CPU 11, a RAM 12, a ROM 13, a hard disk drive (HDD) 14, and a compact disk drive (CDD) 15. The computer 10 includes an input device such as a keyboard and a mouse (not shown) and a display device.

  The hard disk drive 14 stores a management data file 14a in which a plurality of management data 14d for each computer 20 is recorded. The structure of the management data 14d is schematically shown in the figure. As shown in the figure, the management data 14d is data in which identification information for identifying a computer, a user name “AdminID” of administrator authority, and a password “AdminPW” are recorded in association with each other for a plurality of computers 20 in the user department. It is.

  The CPU 11 functions as the management data acquisition unit 11a and the encrypted management data generation unit 11b by executing the attached file creation tool. The management data acquisition unit 11 a acquires management data 14 d stored in the hard disk drive 14. As will be described later, the encrypted management data generation unit 11b encrypts data including a plurality of management data 14d, and generates the attached file 38 by collecting the encrypted data.

  FIG. 3 is an explanatory diagram schematically showing how the encryption management data generation unit 11b creates the attached file 38. As shown in FIG. As shown in the upper part of FIG. 3, the encryption management data generation unit 11b attaches a serial number assigned by the administrator of the information system department to the head of each management data 14d. In the upper and lower stages of FIG. 3, for example, “<1>” corresponds to the management data 14d in the first line in the upper part of FIG. 3 and the encryption management data 14e in the first line in the lower part of FIG. It represents that. For each management data 14d, the encrypted management data generation unit 11b includes a serial number, identification information for identifying the computer, a user name (AdminID) with administrator authority, and a password (AdminPW) with administrator authority. Then, encryption is performed using the serial number as an encryption key, and the encrypted data is collected to generate encryption management data 14e. Then, the encryption management data generation unit 11b creates the attached file 38 that stores the encryption management data 14e. In this embodiment, a common key cryptosystem is employed as the encryption scheme, and the serial number is later used as a decryption key for decrypting the encryption management data 14e in the computer 20. However, the general user of the computer 20 does not know that this serial number is a decryption key.

B2. Attached file generation processing:
FIG. 4 is a flowchart showing the flow of attachment file generation processing in the computer 10 of the information system department. This process is a process executed by the CPU 11 when the attached file creation tool is activated.

  First, the CPU 11 acquires the management data 14d from the management data file 14a stored in the hard disk drive 14 by the management data acquisition unit 11a (step S100). Next, as shown in the upper part of FIG. 3, the CPU 11 sets the serial number assigned by the administrator of the information system department to each management data 14d by the encryption management data generation unit 11b (Step S11). S110). Then, as shown in FIG. 3, the CPU 11 sequentially encrypts each serial number and each management data 14d corresponding to each serial number by using the encryption number as an encryption key, as shown in FIG. (Step S120). Then, the CPU 11 uses the encryption management data generation unit 11b to create the encryption management data 14e by combining the data encrypted in step S120 (step S130). The encryption management data 14 e is stored in the attached file 38 and saved on the compact disk 30. The compact disc 30 is distributed to the user department.

C. User department:
C1. Configuration of the user department computer 20:
FIG. 5 is an explanatory diagram showing a schematic configuration of the computer 20 in the user department. As illustrated, the computer 20 includes a CPU 21, a RAM 22, a ROM 23, a hard disk drive (HDD) 24, and a compact disk drive (CDD) 25. The computer 20 includes an input device such as a keyboard and a mouse (not shown) and a display device.

  The CPU 21 sequentially executes the computer program read from the compact disk 30 by the compact disk drive 25, whereby the serial number acquisition unit 21a, the encryption management data acquisition unit 21b, the decryption unit 21c, the user authority change unit 21d, It functions as an installation execution unit 21e. Specifically, by executing the kicker 36, the CPU 21 functions as a serial number acquisition unit 21a, an encryption management data acquisition unit 21b, a decryption unit 21c, and a user authority change unit 21d. Further, the CPU 21 functions as an installation execution unit 21e by executing the installer 34.

  The serial number acquisition unit 21 a acquires a serial number input by a general user of the computer 20. As described above, this serial number is distributed from the administrator of the information system department. The encryption management data acquisition unit 21b acquires the encryption management data 14e from the attached file 38 recorded on the compact disc 30. Using the serial number acquired by the serial number acquisition unit 21a as a decryption key, the decryption unit 21c sequentially decrypts each encryption management data 14e and searches for decryptable encryption management data 14e. For example, the encryption management data 14e on the second line in the attached file 38 shown in FIG. 3 can be decrypted only when the serial number “zdcbxy002” is used as the decryption key. The user authority changing unit 21d temporarily enters the administrator authority user name (AdminID) included in the data decrypted by the decryption unit 21c without ending the operating system while the operating system is activated with the general user authority. Then, the user authority of the operating system is changed from the general user authority to the administrator authority using the password (AdminPW), and the installation execution unit 21e is caused to function. The installation execution unit 21e installs the application software 32.

C2. Installation process:
FIG. 6 is a flowchart showing the flow of installation processing in a plurality of computers 20 in the user department. This process is a process executed by the CPU 21 when the compact disk 30 is inserted into the compact disk drive 25.

  First, the CPU 21 reads and executes the computer program stored in the compact disc 30 by the auto-run function of the operating system, and displays a menu screen for installation processing on the display device (step S200).

  FIG. 7 is an explanatory diagram showing an example of the installation menu screen GUI1. As shown in the figure, in this embodiment, standard installation, silent installation, and custom installation are prepared as installation menus. The standard installation is an installation form in which an installation operator can specify a change of the installation destination directory at any time. Silent installation is an installation form in which installation is automatically performed without an instruction from an installation operator. The custom installation is an installation form in which a required function of the application software 32 can be selected by an installation operator. The installation operator selects and inputs a number corresponding to a desired installation form on the installation menu screen GUI1. Here, it is assumed that silent installation is selected, and the description of the subsequent installation processing will be continued (see FIG. 6).

  When silent installation is selected by the installation operator on the installation menu screen GUI1 shown in FIG. 7, the CPU 21 starts the kicker 36 stored in the compact disc 30 with general user authority (step S210). At this time, the CPU 21 displays on the display device a serial number input screen for allowing the installer to input the serial number.

  FIG. 8 is an explanatory diagram showing an example of the serial number input screen GUI2. The serial number input screen GUI2 includes a text box TB for inputting the serial number, an “OK” button BT1 for confirming the serial number input in the text box TB, and a canceling of the input of the serial number. "Cancel" button BT2 is displayed. When the installation operator inputs the serial number in the text box TB and presses the “OK” button BT1, the CPU 21 acquires the serial number by the serial number acquisition unit 21a (step S210 in FIG. 6).

  Next, the CPU 21 sequentially acquires the encryption management data 14e from the attached file 38 by the encryption management data acquisition unit 21b, and the decryption unit 21c uses the serial number acquired by the serial number acquisition unit 21a as a decryption key. Sequentially, the encryption management data 14e is tried to be decrypted, and the decryptable encryption management data 14e is searched (step S230). When the CPU 21 finds the encryption management data 14e that can be decrypted, the CPU 21 acquires the user name (AdminID) and the password (AdminPW) of the administrator authority included in the decrypted data (step S240). Note that the general user of the computer 20 cannot know the user name and password of the administrator authority.

  Then, the CPU 21 temporarily changes the operating system's user name and password by using the user name and password of the administrator authority without ending the operating system while the operating system is started with the general user authority by the user authority changing unit 21d. The user authority is changed from the general user authority to the administrator authority (step S250). Then, the CPU 21 activates the installer 34 stored on the compact disk 30 to function as the installation execution unit 21e, and installs the application software 32 (step S260).

  When this installation process is completed, the user authority of the system of the operating system in the computer 20 is returned from the temporary administrator authority to the normal general user authority. The general user of the computer 20 can use the application software 32 with general user authority.

  According to the installation system 100 of the present embodiment described above, when installing the application software 32 on each of the plurality of computers 20 in the user department, the general user of the computer 20 knows the user name and password of the administrator authority. It is never done. Therefore, it is possible to avoid a security risk caused by a general user of the computer 20 who knows a user name and password with administrator authority. Further, according to the installation system 100 of the present embodiment, the general user of the computer 20 can install the application software 32 with the administrator authority without knowing the user name and password of the administrator authority. . Therefore, the administrator of the information system department installs the administrator as compared with the case where the administrator software user name and password are used to install the application software 32 on each of the plurality of computers 20. The burden of work can be reduced. That is, the installation system 100 according to the present embodiment can both reduce the burden of the administrator's installation work and avoid security risks when installing the application software 32 on each of the plurality of computers 20.

  In the installation system 100 of this embodiment, the decryption key used in the installation process in the computer 20 in the user department is distributed as a serial number to general users of the computer 20, and the general user of the computer 20 has a serial number. I do not know that it is a decryption key. Therefore, it is possible to prevent a general user of the computer 20 from trying to decrypt the user name and password with administrator authority decrypted during the installation process.

  Further, in the installation system 100 of this embodiment, a common encryption method is adopted for encryption in the computer 10 of the information system department and decryption in the computer 20 of the user department. Therefore, the processing can be reduced as compared with the case where other encryption methods are employed.

D. Variations:
Although the embodiments of the present invention have been described above, the present invention is not limited to such embodiments, and can be implemented in various modes without departing from the scope of the present invention. For example, the following modifications are possible.

D1. Modification 1:
In the above embodiment, the application software 32, the installer 34, the kicker 36, and the attached file 38 are distributed using the compact disc 30, but the present invention is not limited to this. For example, these may be stored in a server provided on a local area network in the company, and each computer 20 may appropriately download from this server. Further, the application software 32, the installer 34, and the kicker 36 are stored in a server managed by the manufacturer of the application software 32 provided on the Internet so that the computers 10 and 20 can download them appropriately from this server. Also good.

D2. Modification 2:
In the above embodiment, when the attached file 38 is created, as shown in FIG. 3, the serial number, the identification information for identifying the computer, the user name (AdminID) of the administrator authority, and the password of the administrator authority (AdminPW) is encrypted, but the present invention is not limited to this. It is only necessary to encrypt at least the administrator-privileged user name (AdminID) and the administrator-privileged password (AdminPW). Also, instead of or in addition to the user name (AdminID) and password (AdminPW) of administrator authority, predetermined information related to administrator authority may be used.

D3. Modification 3:
In the above-described embodiment, the serial number is used as a common key (encryption key, decryption key) for encryption in the computer 10 of the information system department and decryption in the computer 20 of the user department. Although it is assumed that the serial number is a decryption key, the present invention is not limited to this. A general user of the computer 20 may be informed that the serial number is a decryption key.

D4. Modification 4:
In the above embodiment, the attached file generation process is executed in the computer 10 (computer used by the administrator) in the information system department, but the present invention is not limited to this. For example, one of the computers 20 in the user department may have the function of the computer 10 and execute the attached file generation process. Further, a confidentiality agreement may be concluded in advance between the company and the application software vendor in the above-described embodiment, and the application software vendor may generate the attached file 38.

100 ... Installation system 10 ... Computer 11 ... CPU
11a ... management data acquisition unit 11b ... encryption management data generation unit 12 ... RAM
13 ... ROM
DESCRIPTION OF SYMBOLS 14 ... Hard disk drive 14a ... Management data file 14d ... Management data 14e ... Encryption management data 15 ... Compact disk drive 20 ... Computer 21 ... CPU
21a ... Serial number acquisition unit 21b ... Encryption management data acquisition unit 21c ... Decryption unit 21d ... User authority change unit 21e ... Installation execution unit 22 ... RAM
23 ... ROM
25 ... Compact disc drive 30 ... Compact disc 32 ... Application software 34 ... Installer 36 ... Kicker 38 ... Attached file

Claims (7)

An installation method for installing the software on each of a plurality of computers having an operating system in which installation of software is restricted under administrator authority, and the operating system is started with non-administrator authority,
One of the plurality of computers is
For each of the plurality of computers, obtaining management data in which identification information for identifying the computer and predetermined information related to administrator authority are recorded in association with each other;
Assigning different encryption keys to each of the management data;
For each of the management data, a step of encrypting at least the predetermined information by a common key encryption method using the assigned encryption key, and generating the encrypted management data by collecting the encrypted data When,
With
Each of the plurality of computers
Obtaining the encryption management data;
Obtaining a decryption key identical to the encryption key for decrypting the encryption management data;
Decrypting the encrypted data included in the encryption management data by the common key encryption method using the decryption key in a state concealed from a non-administrator who is a user of the plurality of computers; ,
Using the predetermined information included in the decrypted management data, installing the software with the administrator authority;
An installation method comprising: The installation method according to claim 1,
The predetermined information includes a user name and password of the administrator authority,
Installation method. The installation method according to claim 1, wherein:
In each of the plurality of computers obtaining the decryption key, each of the plurality of computers acquires the decryption key in a state where the non-administrator conceals that the decryption key is a decryption key. get,
Installation method. The installation method according to claim 3, comprising:
The encryption key and the decryption key are assigned as serial numbers of the management data.
Installation method. An installation system for installing software on each of a plurality of computers having an operating system in which software installation is restricted under administrator rights, and wherein the operating system is booted with non-administrator rights,
Any one of the plurality of computers is
For each of the plurality of computers, a management data acquisition unit that acquires management data in which identification information for identifying the computer and predetermined information related to administrator authority are recorded in association with each other;
For each of the management data, at least the predetermined information is encrypted by a common key encryption method using different encryption keys assigned to the management data, and the encrypted data is collected. An encryption management data generation unit for generating encryption management data,
With
Each of the plurality of computers is
An encryption management data acquisition unit for acquiring the encryption management data;
A decryption key acquisition unit that acquires the same decryption key for decrypting the encryption management data as the encryption key;
A decrypting unit that decrypts the encrypted data included in the encrypted management data by the common key encryption method using the decryption key in a state of being concealed from a non-administrator who is a user of the plurality of computers. When,
Using the predetermined information included in the decrypted management data, an installation execution unit for installing the software with the administrator authority;
An installation system comprising. A computer program executed by a computer,
For each of the plurality of computers, a function of acquiring management data in which identification information for identifying the computer and predetermined information related to the administrator authority are recorded in association with each other;
For each of the management data, at least the predetermined information is encrypted by a common key encryption method using different encryption keys assigned to the management data, and the encrypted data is collected. A function to generate encryption management data,
A computer program for realizing a computer. A computer program executed by a computer having an operating system in which installation of software is restricted under administrator rights, said operating system being started with non-administrator rights,
For each of the plurality of computers, at least the predetermined information in the management data recorded by associating the identification information for identifying the computer with the predetermined information related to the administrator authority is stored in the management data. A function of acquiring encryption management data generated by encrypting by using a common key encryption method using different encryption keys assigned to each other and collecting the encrypted data;
A function for obtaining a decryption key for decrypting the encryption management data, the same as the encryption key;
A function of decrypting the encrypted data included in the encryption management data by the common key encryption method using the decryption key in a state of being concealed to a non-administrator who is a user of the computer;
Using the predetermined information included in the decrypted management data, a function of installing the software with administrator authority;
A computer program for realizing a computer.

Images