JP2012123653A - Id management system having license end batch allocation function and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technology for, when the license of an application is allocated to a user, preventing a plurality of licenses with different use authorities of the same application from being allocated to the same user in an ID management system or the like.SOLUTION: This ID management system includes: a registration processing part 20 for registering a user, an application, a license, allocation conditions, allocation information, or the like in a management DB3 based on the operation of a manager; and a license end batch allocation processing part 40 for, when a plurality of licenses with different use authorities exist with respect to an application available by the user, automatically performing end batch allocation processing so that one license can be allocated to one user. When a plurality of license types exist for one user with one application in the case of end batch allocation, one license type whose priority order is high is adopted and allocated.

Description

  The present invention relates to technologies such as authentication, license management, and ID management, and more particularly to ID management for assigning an application license to a user so that a plurality of licenses of the same application are not assigned to the user. .

  In an authentication system such as single sign-on (SSO) for using a cloud computing environment, it is necessary to perform user registration and assignment of application licenses to the user as a batch process as part of ID management. .

  As a prior art example related to license management, there is JP-A-2006-18815 (Patent Document 1). Patent Document 1 describes a means for collecting license revenue for an OS or application that resides in a virtualized computer system. Japanese Patent Application Laid-Open No. 2004-228561 describes that a software product is licensed in units of virtual machines in a method of licensing a software product for use by a plurality of virtual machines in a virtual machine environment.

JP 2006-18815 A

  As a problem, when a plurality of licenses exist for an application that can be accessed by the user and the usage authority is different, it is necessary to avoid assigning a plurality of licenses to the same user. .

  Corresponding to the above-mentioned problem, as a main object of the present invention, in a system having an ID management processing function in an authentication system or the like, an available application license is allocated to a registered user (customer or the like). Provided is a technique capable of preventing licenses having different usage rights for the same application from being assigned to the same user when performing (giving) processing.

  A typical embodiment of the present invention is an ID management system having an ID management function in an authentication system or the like, and has the following configuration.

  In this ID management function, when performing processing for assigning a license for an application that can be used to a registered user, even if there are multiple licenses with different usage rights for the same application, A function (license batch assignment function) that can perform appropriate assignment in a batch so that no license is assigned. Batch processing of the license allocation is performed according to the validity (priority) of the license and the setting (registration) of the allocation condition (rule) of the license (use authority) uniquely set for each user / license type.

  This system includes a first means (registration processing unit) for registering (setting) an application that can be used by a user and a license type of the application. The first means enables setting (registration) of license allocation condition information including priority order for the license type of the application. It is also possible to set the number of licenses for each license type. The system includes second means (license batch assignment processing unit) that performs batch assignment processing. In the second means, a user included in the above allocation condition information is determined for registered users, and only one license of an available application is allocated to each of the users (for each user). The license batch allocation process is performed so as to hit. At the time of the license batch assignment process in the second means, the one with the higher priority set for each license type is assigned.

  The ID management system includes, for example, a registration processing unit that performs processing for registering management information including user information, application information, license information, allocation condition information, and user license allocation information in a database based on an operation of the administrator. When there are a plurality of licenses having different usage rights for an application that can be used by the user, the licenses are not assigned to the user, that is, one license for one user in one application. And a license batch allocation processing unit that automatically performs batch allocation processing. The registration processing unit includes a license type for each license type including license type for each license for each application and priority order information for each license type with respect to the management information in the database based on an operation of the administrator. Processing to set information and allocation condition information. The license batch allocation processing unit acquires information on a user, an application, a license type, and an allocation condition by using database management information when executing the batch allocation processing, and a plurality of licenses are allocated to one user in one application. If there is a license type, a license type having a higher priority is adopted and assigned, and the result is stored as user license assignment information.

  According to a typical embodiment of the present invention, in a system or the like having an ID management processing function in an authentication system or the like, when performing a process of assigning a license for an application that can be used to a registered user, On the other hand, it is possible to prevent assignment of licenses having different usage rights for the same application. In particular, it is possible to perform allocation all at once according to the priority order of licenses and the setting (registration) of allocation conditions for each user. This is effective and useful as an ID management processing function in an authentication system such as SSO.

It is a figure which shows schematic structure of the system of one embodiment of this invention. It is a figure which shows the specific structural example of the hardware software of the system of FIG. It is a figure which shows the example of a license information table. It is a figure which shows the example of a user license allocation information table, (a) shows at the time of manual registration, (b) shows the time at the time of collective allocation implementation (at the time of automatic registration). FIG. 5 is an explanatory diagram illustrating an example of an allocation relationship corresponding to FIGS. 3 and 4. It is a flowchart of the registration process of the management information to management DB using a registration process part. It is a flowchart of a license batch allocation process using a license batch allocation processing unit.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

  The system according to the present embodiment is an information processing system (ID management system) having an ID management function related to users (customers, etc.), applications, licenses, and the like. The system according to the present embodiment can be an authentication system such as SSO or a component thereof. The ID management function of this system has a processing function (“license batch allocation function”) of batch allocation of application licenses to users, which is characteristic of the present invention. This license batch allocation function mainly corresponds to the license batch allocation processing unit 40 of the ID management function unit 2 of FIG. With this license batch assignment function, batch processing related to assignment and management of licenses (usage authority) of each application to each user is possible. When executing the assignment, the license batch assignment processing unit 40 assigns only one appropriate license type to the target user and application based on the ID management information (assignment conditions, etc.) in the management DB 3. The collective assignment process is performed so that the license types are assigned (that is, a plurality of license types having different usage rights are not assigned). Information such as allocation conditions (rules) used in the batch allocation is registered (set) by an administrator (terminal 1) or the like using a function for registering various information in the management DB 3 (registration processing unit 20). It is possible. Information that can be registered (set) in the management DB 3 includes management of license management information (license information table 70) and license allocation conditions (rules), including priorities in a plurality of license types (with different usage rights). (Allocation condition information table 80).

[System configuration]
FIG. 1 shows an overall schematic configuration of a system (an ID management system having a license batch assignment function) according to an embodiment of the present invention. The entire system includes an administrator terminal 1, an ID management function unit 2, and a management DB 3. Although not shown, the elements are connected for communication via a network or the like. In addition, there is an information processing system (management target system) such as a corporate LAN including users who are ID management targets. On this system, based on the operation of the terminal 1 by the administrator, it is possible to perform batch allocation processing of application licenses to users (each user of the managed system) using the license batch allocation function.

  The terminal 1 is a PC or the like used by an administrator. The manager is, for example, a person in charge of the managed system. For example, by accessing the ID management function unit 2 from the terminal 1 and displaying a screen of a predetermined user interface related to ID management and inputting information by the administrator on the screen, ID management operations including license allocation can be performed. It is. In the terminal 1, processing and operations such as management information registration 10 (registration (setting) of various information) and collective assignment 30 (request for license collective assignment and response display, etc.) are performed based on the operation of the administrator. 2 is performed.

  The ID management function unit 2 includes a registration processing unit 20 and a license batch allocation processing unit 40. The ID management function unit 2 includes, for example, a server (including a processor, a memory, a communication interface, and the like). Each processing unit (20, 40) is realized by, for example, processing by a server program. The ID management function unit 2 accesses the management DB 3 to read / write various information. The registration processing unit 20 performs processing for registering (setting) various information in the management DB 3. The license batch allocation processing unit 40 performs batch allocation processing of licenses of each application to each user while reading and writing information in the management DB 3.

  The management DB 3 is a DB (database) that stores various data information tables (other information storage means may be used). The management DB 3 may be configured by a DB server or the like, or may be configured in one computer together with the ID management function unit 2 (FIG. 2). The management DB 3 includes a user information table 50, an application information table 60, a license information table 70, an allocation condition information table 80, a user license allocation information table 90, and the like.

  The user information table 50 includes management information (including at least user identification information) of each user (customer or the like) of the management target system. The application information table 60 includes management information (including at least application identification information) of a management target application (software program or the like) used by the user. The license information table 70 (license type information table) includes license management information (including at least license (license type) identification information) of the application. FIG. 3 described later shows a specific example of the license information table 70. The allocation condition information table 80 includes setting information (rule) setting information, which will be described later, used in batch allocation. In this information, allocation conditions (rules) are managed for each user, application, and license (license type). The user license allocation information table 90 includes management information on the status of license allocation to each user. This information includes information by individual registration (manual registration) and information by batch allocation processing (automatic registration). FIG. 4 to be described later shows a specific example of the user license assignment information table 90.

  As a schematic processing flow in the system of FIG. 1, first, the registration (setting) of various information by the management information registration 10 at the terminal 1 is performed by the administrator to the registration processing unit 20 of the ID management function unit 2. Requested (implemented). Upon receiving the management information registration 10, the registration processing unit 20 registers (sets) information in various tables of the management DB 3 (described later, FIG. 6). This includes setting allocation conditions. Second, the administrator requests the license batch allocation processing unit 40 of the ID management function unit 2 for batch allocation of licenses (usage authority) of each application to each user by batch allocation 30 on the terminal 1 (implementation). Is done. The license batch allocation processing unit 40 receives the batch allocation 30 and performs a license batch allocation process (to be described later) based on acquisition / reference of information from various tables (50, 60, 70, 80) of the management DB 3. 7) is executed, and the result information of the batch allocation is stored in the user license allocation information table 90 or the like.

[Configuration example]
FIG. 2 shows a specific configuration example of hardware and software related to the system of FIG. In this example, the ID management function unit 2 is realized by software program processing in one computer 200 and the management DB 3 is held. The computer 200 is accessed from the terminal 1 via the network, and the processing of the ID management function unit 2 is provided. In the computer 200, a processor 201, a memory 202, an input device 203, an output device 204, a communication interface 205, an HDD (secondary memory) 206, and the like are connected.
The processor 201 loads each program (211 and 212) from the function program 210 (the program of the present embodiment) of the HDD 206 onto the memory 202 and executes it, whereby the registration processing unit 20 and the license batch allocation processing unit 40 are executed. Realize. In addition, the processor 201 reads out the management information from the management DB 220 corresponding to the management DB 3 held in the HDD 206 as appropriate, and references / updates the management information.

[License type table]
FIG. 3 shows a specific example of the license information table 70. The field “id” is identification information of a license (license type), and is a serial number assigned to the license type in this example. The field “appid” is application identification information, and in this example, the same application identification information (application identification number created as a serial number) managed in the application information table 60 is used (example: “A1” etc.). The field “flg” is flag information for identifying and determining whether the license (license type) is valid or invalid (license validity status) (eg, “valid” / “invalid”). etc). The field “ClassificationName” is the name of the license (license type) (eg, “license a11”). The field “Priority” is information indicating the priority (priority) of the license (license type), and which license (license type) is present when there are multiple license types (different usage rights) in the same application. Indicates whether it is a higher one. In this example, the highest priority values are 1, 2, 3,... In addition, it has a field for information necessary for existing license management.

  In the example of the values in FIG. 3, for example, for an application a1, there are licenses a11, a12, a13, etc. (for example, different usage rights) as license type names of a plurality of licenses (license types). The priority order of the three licenses a11, a12, and a13 is set to {3, 2, 1}.

[User License Assignment Information Table]
FIG. 4 shows a specific example of the user license assignment information table 90. (A) shows the time of manual registration, and (b) shows the time of batch allocation processing (automatic registration). The field “id” is a serial number given as identification information of user license allocation information. The field “License” is identification information indicating which license (license type) the allocation is for, and indicates “id” which is license identification information (serial number) in the license information table 70. The field “User” is identification information indicating which user the allocation is for, and indicates user identification information (eg, serial number, “U001”, etc.) in the user information table 50.

  The field “AssignMethod” is information indicating the assignment method of the assignment, and in this example, “manual” / “automatic” can be set. “Manual” indicates manual registration, and “automatic” indicates automatic registration. For example, when information is individually registered from the administrator terminal 1 through the registration processing unit 20 and the allocation information is determined, the information is “manual”, and the allocation information is determined by the batch allocation processing by the license batch allocation processing unit 40. In this case, it is “automatic”. The field “AssignStatus” is information indicating the assignment status, and in this example, “assignment” / “exclusion” can be set. For example, when allocation condition information for a license that is the content of the allocation condition information table 80 is set (when set as “allocation condition”), the value is “allocation”. If it is not set as the “allocation condition” (when the allocation condition is excluded), the value is “exclusion”.

  FIG. 5 shows an example of an allocation relationship corresponding to the example of FIGS. 4 (a) and 4 (b). There are multiple (three) license types “1” (a11), “2” (a12), and “3” (a13) for the application a1, and the license type “4” (a21) for the application a2. There is. As a result of manual registration, the license a11 of a1 and the license a21 of a2 are assigned to the user U001. A license a13 of a1 is assigned to the user U002. As a result of the automatic registration, the a1 license a12 is assigned to each of the users U011 and U012, and the a1 license a11 is assigned to the user U021. Here, for example, when performing batch allocation of the license of the application a1 for the user U001, the a13 having the higher priority according to the allocation condition (rule), priority, etc., among the manually registered a11 and a13. Is determined as the assignment destination.

[registration process]
FIG. 6 shows a process for registering various types of management information in the management DB 3 by the registration processing unit 20 based on the administrator's operation (management information registration 10). S101 and the like represent processing steps. It is assumed that a definition screen (a user interface screen for registering (setting) management information) is provided to the terminal 1 by the ID management function unit 2.

  First, in the terminal 1, the administrator defines and registers user (customer etc.) information that is one of essential information as ID management information from the definition screen (S101). The registration information is stored in the user information table 50 by the registration processing unit 20.

  Next, the administrator registers connection destination application information from the definition screen (S102). This information is stored in the application information table 60 by the registration processing unit 20.

  Next, the administrator registers license information of each application from the definition screen (S103). This information is stored in the license information table 70 by the registration processing unit 20.

  Next, the administrator registers allocation condition (rule) information for each license of each application from the definition screen (S104). This information is stored in the allocation condition information table 80 by the registration processing unit 20.

  In addition, only when registering allocation information to users as fixed information, the administrator manually registers user license allocation information for users who have a status of "Manual" (the "AssignMethod" value) from the definition screen. Correspondingly, the registration information is stored in the user license allocation information table 90 by the registration processing unit 20 (S105).

[License batch assignment processing]
FIG. 7 shows processing for creating user license allocation information (90) including license batch allocation processing by the license batch allocation processing unit 40 at the time of batch allocation 30. FIG. 7 shows an example of processing for a user such as a specific customer. Hereinafter, the processing subject is mainly the license batch assignment processing unit 40.

  First, application information that can be used for the target user is acquired from a table (60, etc.) (S201). It is determined whether there is one or more pieces of information (available applications) acquired in S201 (S202). If there are one or more pieces as a result (Y), the license (license type) information of the target application is displayed in a table. (70 etc.) (S203). Also, allocation condition information for each license (license type) acquired in S203 is acquired from the table (80) (S204). Also, user information that matches the allocation condition information acquired in S204 is acquired from the table (50) as allocation user information (S205).

  Then, it is determined whether or not the user information (allocated user information) in S206 has been acquired for all licenses (license type) for the application acquired in S203 (S206), and for all licenses (license type). If not executed (N), the process returns to S204 to repeat the process.

  When all the licenses have been acquired (S206-Y), it is checked whether the same user is duplicated in the allocated user information acquired for each of a plurality of licenses (license types) of the same application ( S207). If the same user is duplicated in S207 (Y), the one with the higher priority of the license type is adopted based on the above priority information ("priority" in FIG. 3). The information assigned to the higher one is left, and the information assigned to the lower one is deleted (S208).

  Subsequently, license allocation information for existing users is acquired from the table (90), and it is checked whether or not there is a user (corresponding user information) allocated by “manual” (S209). As a result, if there is a user assigned with “manual” (Y), the user information assigned with “manual” in S209 is deleted from the information in S208 (assigned user information) (S210).

  Next, the number of licenses for each license (license type) is acquired (S211). Then, the number of assigned user information for each license created up to S210 is compared with the number of licenses for each license in S211 to check whether the number of licenses is sufficient (S212). As a result, if the number of licenses is sufficient (Y), the allocated user information for each license created up to S210 is registered in the table (90) as user license allocation information (S213), and there is a shortage. In (N), for example, information such as e-mail indicating that the number of licenses is insufficient is transmitted from the administrator to the customer (user) side administrator (S214), and registration of user license allocation information ( S213) is not performed.

  It is checked whether or not the above-described user assignment has been completed for all license information (license type) (S215). If not completed (N), the processing of S211 to S214 is repeated. In S202, if there are no applications available for the target user (N), the process is terminated without performing the subsequent processing.

[Effects]
As described above, according to the present embodiment, when a process of assigning a license of an application that can be used to a registered user is performed, a plurality of licenses having different usage rights for the same application are assigned to the same user. It can be avoided. In particular, license allocation can be performed in a batch according to the validity and priority of licenses and license allocation conditions uniquely set for each user. This is effective and useful as an ID management processing function in an authentication system such as SSO. In particular, even when a large number of users are added or when a user attribute change occurs, user allocation can be effectively performed by using this system.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  The present invention can be used for an authentication system such as SSO on a network, an information processing system that manages user applications, licenses, and the like for a corporate LAN.

  DESCRIPTION OF SYMBOLS 1 ... Terminal, 2 ... ID management function part, 3 ... Management DB, 10 ... Management information registration, 20 ... Registration processing part, 30 ... Batch allocation, 40 ... License batch allocation processing part, 50 ... User information table, 60 ... Application Information table 70 ... License information table 80 ... Assignment condition information table 90 ... User license assignment information table

Claims (4)

An ID management system that performs ID management including assignment and management of application licenses to users,
A registration processing unit that performs processing for registering management information including user information, application information, license information, allocation condition information, and user license allocation information in a database based on an operation of an administrator;
When there are a plurality of licenses having different usage rights for an application that can be used by the user, the plurality of licenses are not assigned to the user, that is, one license for one user in one application. A license batch allocation processing unit that automatically performs batch allocation processing so that
The registration processing unit is configured to set a license type for each license for each application and priority information for each license type for management information in the database based on an operation of the administrator. Done
When executing the batch allocation process, the license batch allocation processing unit uses the management information in the database to acquire information on users, applications, license types, and allocation conditions. When there are a plurality of license types, a license batch assignment function is provided, which performs the processing of adopting and assigning one license type having a higher priority and storing the result as the user license assignment information. ID management system. In the ID management system having the license batch assignment function according to claim 1,
The registration processing unit performs a process of setting the allocation condition information for each user on the management information of the database based on the operation of the administrator,
The license batch allocation processing unit uses the information in the database when executing the batch allocation processing, and uses an application that can be used for each registered user and one or more corresponding license types. , The corresponding allocation condition information is acquired, the user who matches the allocation condition for each license type is acquired as the allocation user, and the same allocation user is duplicated in a plurality of license types of the same application, One license type with a high priority is assigned to one assigned user, and if there is a user assigned manually through the registration processing unit, the assignment of the user is deleted and the above assignment is made. A process for storing the result of the above as the user license allocation information, ID management system to. An ID management program for causing a computer to execute ID management processing including assignment and management of an application license to a user,
A program of a registration processing unit that performs processing for registering management information including user information, application information, license information, allocation condition information, and user license allocation information in a database based on an operation of an administrator;
When there are a plurality of licenses having different usage rights for an application that can be used by the user, the plurality of licenses are not assigned to the user, that is, one license for one user in one application. And a license batch allocation processing unit program that automatically performs batch allocation processing so that
The program of the registration processing unit sets the license type for each license for each application and the priority order information for each license type for the management information in the database based on the operation of the administrator. Process,
When executing the batch allocation process, the program of the license batch allocation processing unit uses the management information of the database to acquire information on users, applications, license types, and allocation conditions, and allows one user to use one application. In the case where there are a plurality of license types, one license type having a higher priority is assigned and assigned, and the result is stored as the user license assignment information. ID management program with functions. In the ID management program having a license batch assignment function according to claim 3,
The program of the registration processing unit performs a process of setting the allocation condition information for each user on the management information of the database based on the operation of the administrator,
The program of the license batch allocation processing unit uses the information of the database when executing the batch allocation processing, and each of the registered users can use an application and corresponding one or more licenses. When the type and corresponding allocation condition information are acquired, the user who matches the allocation condition for each license type is acquired as the allocation user, and the same allocation user exists in multiple license types of the same application. Adopts one license type with a high priority to one assigned user, and if there is a user manually assigned through the program of the registration processing unit, deletes the user assignment , Storing the result of the above allocation as the user license allocation information, License ID management program with a batch allocation function.

Images