JP5049179B2 - Information processing terminal device and application program activation authentication method - Google Patents

Description

  The present invention relates to an information processing terminal device that performs activation authentication of an application program and a method of activation authentication thereof.

  2. Description of the Related Art Conventionally, a management system (such as an operating system) of a computer system prevents an unauthorized terminal device from being connected to the system and starting an unauthorized individual user application program (that is, an unauthorized individual APL). In response to an information processing terminal device requesting connection to the system, a response with a user ID (identifier) and password is requested, and by checking these information, an illegal connection by a terminal device that is illegally connected APL activation is prevented (normal authentication means). In other words, since the individual APL is a dedicated application program determined for each user and system, it is always necessary to prevent unauthorized use by a third party who cannot obtain the user ID and password. There is.

  Therefore, conventionally, a Trusted Platform Module (security chip, hereinafter abbreviated as “TPM”) mounted on a motherboard basically encrypts specific data in an HDD (Hard Disk Device), and the system It monitors the operation of all the devices above.

  For example, a means for collating a hash code created from a program whose validity is to be judged with a hash code obtained by compounding the validity judgment data of the program, and a body of an information processing apparatus on which this program is executed An information processing apparatus is disclosed that includes means for collating unique machine-specific data and machine-specific data obtained by combining legitimacy determination data of the program (see, for example, Patent Document 1). .

  In addition, the user client is provided with a TPM, and the management client is enabled to access the remote TPM enabling module provided in the user client via the communication network, so that the client can be activated at the subsequent booting of the client. A remote security validation system including a client TPM validation module is disclosed (for example, see Patent Document 2).

  Also, the hardware that can verify the validity of the presented value by comparing it with the stored value and can read and decode the data only if the presented value is valid A computer comprising a security module, comprising instructions for executing the verification and data reading, respectively, and an instruction for at least a part of the boot process that cannot complete a normal boot process without the decrypted data A readable medium is disclosed (for example, see Patent Document 3).

Furthermore, an access control system that enables access control on the client side and that can perform access control corresponding to various reliability levels is disclosed (see, for example, Patent Document 4).
JP-A-2005-301968 JP 2006-79617 A JP 2006-323814 A JP 2006-107182 A

  However, in the conventional program activation authentication system (including the resource management system) described in the above background art, when the information processing terminal device is connected to the management device, the management device sends a user to the information processing terminal device. In the case of a method for requesting an ID and a password, as long as the information processing terminal device knows the user ID and password, any model and user can connect to the management device and individually There was a problem that it was possible to start APL.

  In order to solve this problem, conventionally, a code unique to the information processing terminal device is encrypted and stored in the HDD, and compared with the code of the information processing terminal device obtained from the management device and authenticated. A method for monitoring the activation of an individual APL has been known. In this method, when the HDD is taken out illegally or copied, a code unique to the information processing terminal device is decoded. Since the encryption key to be converted is also known, it is not sufficient as a method for suppressing the activation of the individual APL due to unauthorized access.

  As another solution, conventionally, a method for preventing unauthorized connection by authenticating a hardware unique ID such as a MAC address or a serial number of a terminal is also known. However, in this method, it is necessary to list the MAC addresses and serial numbers of all the connected terminals in advance and store them in the management device. If the list is frequently updated due to a failure or expansion of the information processing terminal device, the management cost of the management device is further increased.

  The present invention has been made in view of the above-described conventional problems, and an object thereof is to provide an information processing terminal device that can perform authentication with higher reliability.

  An information processing terminal device of the present invention is an information processing terminal device that is used in a system that performs authentication between a management device and a plurality of information processing terminal devices, and that performs activation authentication of an application program, and is mounted on a motherboard. Encryption / decryption means for performing encryption and decryption, and a third code generated based on the first code and a second code set in common for a plurality of information processing terminal devices Is completed by the third code encrypted by the encryption / decryption means, the storage means for storing the first code on the motherboard, and the management device. A receiving unit that receives the second code transmitted from the management device, the first code stored in the storage unit, and the second code received from the management device. And a third code generated by decrypting the encrypted third code stored in the storage means by the encryption / decryption means And determining means for comparing the fourth code generated by the calculating means to determine whether or not they match, and the third code and the fourth code decoded by the determining means And an activation permitting unit that permits activation of the application program.

According to this information processing terminal device, more reliable authentication can be performed.
In the information processing terminal device, the first code is a model code that is set uniquely for each of the information processing terminal devices or commonly for a plurality of the information processing terminal devices, The second code is a user individual code given to each user who uses the plurality of information processing terminal devices, and the third code is an apparatus generated based on the model code and the user individual code. The fourth code is a device individual code generated based on the model code and the user individual code received from the management device, and the storage means encrypts the model code and A BIOS memory for storing the device individual code, wherein the calculation means includes the model code stored in the BIOS memory, and the management device. The device individual code is generated by performing a predetermined operation on the user individual code received from the device, and the encryption / decryption means encrypts and stores the device individual code in the BIOS memory. The code is decrypted, and the determination means determines whether or not the decrypted device individual code matches the device individual code generated based on the model code and the user individual code received from the management device. judge.

  According to this information processing terminal device, the model code and the encrypted device individual code are stored in the BIOS memory, and the device individual code obtained from the user individual code received from the management device is collated with the decrypted device individual code. By doing so, activation of the application program by an unauthorized third party can be prevented.

  For example, even if a third party knows the user individual code illegally, it is difficult to know the model code stored in the BIOS memory, so the device individual code cannot be generated and the application program is illegal. Can be prevented from being used.

In the information processing terminal device, the encryption / decryption means is a security chip having encryption and decryption functions mounted on the motherboard.
According to the information processing terminal device described above, since the correct code can be decrypted only by the same security chip as the encrypted security chip, the reliability of authentication can be improved.

  According to the present invention, the reliability of activation authentication of an application program can be improved.

  In order to prevent an information processing terminal device from being illegally connected to the network from the outside and starting an individual application, the program activation authentication system according to the present invention embeds device-specific information in the BIOS in advance, Means for encrypting and storing in the BIOS.

  When an APL (individual application program) is started, the device-specific information of the information processing terminal device is compared with the device-specific information stored in the BIOS, and the individual APL is executed only when there is a match. In this way, a management unit that activates an individual application only to a specific user of a specific model is realized.

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the best mode of a program activation authentication system according to the present invention will be described in detail with reference to the drawings.
FIG. 1 is a configuration diagram showing the overall configuration of a program activation authentication system according to an embodiment of the present invention.

  In the figure, the program activation authentication system of the present embodiment includes an information processing terminal device 1, a management device 2 including an OS (operating system) and an APL (application program), a network 3 including an Internet network, and an information processing. A LAN (local area network) 4 and a gateway device 6 that connect the terminal device 1 and the network 3, and a LAN 5 and a gateway device 7 that connect the management device 2 and the network 3 are configured.

The information processing terminal device 1 includes, on an M / B (motherboard), a BIOS-ROM 11, a BIOS-RAM 12, a TPM 13 controlled by the CPU, a RAM 14, and a CPU 15 (main computer device) operating as a main control device, And an OS 17 (operating system) installed on the HDD, an LCD (display device such as a liquid crystal) 18, and a keyboard 19 (input device). Here, the BIOS-ROM 11 is a storage device for storing the model code 111, and the BIOS-RAM 12 is a storage device for storing the encrypted device individual code 121.

  The OS 17 installs an individual APL 171 (Applet operation) of a processing program and a setting tool 172 for a control program. The setting tool 172 includes a code extraction tool 1721, a HASH (hash code) creation tool 1722, and an erasure. Program 1723.

  On the other hand, the management apparatus 2 includes an OS 21 of an operating system. Here, the OS 21 includes a processing program APL 22 (application program body: SV) as a control target.

Hereinafter, each component included in the program activation authentication system of the present embodiment will be described.
A code extraction tool 1721 of the setting tool 172 is a tool for extracting (or storing) a model code (first code) and an encrypted device individual code (third code) from the BIOS.

A HASH creation tool 1722 of the setting tool 172 is a tool for generating a HASH value (hash code) using a HASH function such as SHA-1.
An erasing program 1723 of the setting tool 172 is a program for erasing after random data is once written in an arbitrary address space of the RAM 14 and the HDD.

The information processing terminal device 1 and the management device 2 are connected through a network 3, gateway devices 6 and 7, and LAN 4 and 5 lines.
The number of each component described above is arbitrary, and in particular, the management device 2 may be at least one in total. The individual APL 171 does not necessarily need to be an applet operation (Applet operation). For example, an application in which the program main body is held in the information processing terminal device 1 and operates with authentication with the management device 2 only at the time of activation. It may be.

The TPM 13 has an encryption key inside and cannot be taken out to the outside by hardware (even if it is taken out, it can be prevented from being used).
The encryption key possessed by the TPM 13 is unique to each information processing terminal device 1, and therefore does not operate normally even if the TPM 13 is illegally installed and used in another information processing terminal device 1. . That is, the information processing terminal device 1 in which the TPM 13 is illegally installed cannot be used.

  Management of the code unique to the hardware of the information processing terminal device 1 on the management device 2 side for all the information processing terminal devices increases the management cost. It would be better to be able to recognize the code specific to the wearer without being aware of it. For this reason, a code (specifically, “apparatus individual code”) that is uniquely determined for each model and user is set in the information processing terminal device 1 and authenticated on the information processing terminal device 1 side.

  In addition, in order to uniquely determine the “device individual code” for each model and user, “model code (first code)” and “user individual code (second code)” are prepared. The “model code” is a code written in the BIOS at the time of factory shipment, and the “user individual code” is a code set on the OS.

  The “model code” is set to “AAAA” for A series terminals, for example. Of course, different codes may be set for each device (for example, “AAAA01”, “AAAA02”, etc.).

On the other hand, the “user individual code” is a code set for each user (for example, all the information processing terminal devices for B bank are set as “BBBBB”).
Further, in order to prevent leakage of the “model code”, the “model code” cannot be viewed or changed on the BIOS setting screen. Further, the address indicating the “model code” in the BIOS is arbitrarily shuffled to prevent the “model code” from being found even if the BIOS information is dumped.

Furthermore, in order to prevent leakage of the “user individual code”, it is preferable that the information of the “user individual code” is not deleted from the information processing terminal device.
For this reason, after the encrypted device individual code is generated, the contents of the memory and HDD in which the “user individual code” is written are erased using an erasure program. This erasing program is stored in advance in the HDD, and is erased after writing random data once in the corresponding memory space.

  The “device individual code” is formed from a hash value of “model code” (hereinafter also referred to as “HASH value”) and a hash value of “user individual code”. As a result, the “device individual code” is uniquely determined. Further, since the HASH function for calculating the hash value is a complete one-way function, it is impossible to determine the original “model code” and “user individual code” from the “device individual code”.

  Further, the “device individual code” is encrypted using a TPM (Trusted Platform Module) of the security chip and stored in the BIOS. Further, after encryption, the “device individual code” is erased by the erasure program in the same manner as the “user individual code”. As a result, even if only the HDD is stolen, it is impossible to decrypt and use the original “device individual code”, and even if the BIOS is memory dumped, it is decrypted because it is encrypted data. Becomes very difficult.

  Further, “user individual codes” are stored in a list on the management apparatus 2 side. The information processing terminal device 1 obtains the “device individual code” (fourth code) by calculating the HASH value with the “model code” extracted from the BIOS after acquiring the “user individual code” from the management device. It is configured to generate.

  Therefore, the encrypted “device individual code” stored in the BIOS can be decrypted and compared with the regenerated “device individual code”. Only when the two coincide, the individual APL program is activated.

  Hereinafter, the processing operation at the time of connection of the program activation authentication system according to the present embodiment will be described, but before that, the processing operation at the time of connection of the conventional program activation authentication system will be described for comparison.

(Connection process using the conventional method)
First, as a prerequisite,
(1) In order to compare the operations, the system configuration is the same as the configuration of the program activation authentication system according to the present embodiment (FIG. 1).
(2) It is assumed that a terminal ID and a password are set in advance in the information processing terminal device 1 individually or for each group.
(3) It is assumed that terminal IDs and passwords are listed in the management apparatus 2 and stored as a list file in the HDD.

FIG. 2 is a flowchart showing a flow of connection to the management apparatus 2 in the conventional method. Hereinafter, the flow of connection to the management apparatus 2 in the conventional method will be described using the flowchart shown in FIG. 2 with reference to FIG.
Assuming that the above precondition is satisfied, the flow of connection processing to the management apparatus 2 in the conventional method is as follows.

In step S <b> 1, the information processing terminal device 1 requests terminal connection to the management device 2 in order to use the individual APL 171.
In step S <b> 2, the management device 2 requests the terminal device for a terminal ID and a password in order to authenticate the validity of the information processing terminal device 1 in response to the request from the information processing terminal device 1.

In step S <b> 3, the information processing terminal device 1 inputs a terminal ID and a password using the keyboard 19 and transmits them to the management device 2.
In step S4, the management apparatus 2 collates the terminal ID and password of the regular terminal previously listed and held in the HDD with the received terminal ID and password.

In step S5, the management device 2 transmits a connection permission message to the terminal device when the two match. Otherwise, if the two cannot be matched, an error message is transmitted to the terminal device.
In step S 6, the terminal device that has received the connection permission message establishes a connection with the management device 2 and activates the program of the individual APL 171.

Next, an operation including connection processing of the program activation authentication system according to the present embodiment will be described. First, the operation at the time of initial setting of the information processing terminal device 1 will be described.
(Operation during initial setting)
FIG. 3 is a flowchart showing an operation flow at the time of initial setting of the information processing terminal device 1 according to the present embodiment. FIG. 4 is an explanatory diagram showing the flow of information when the information processing terminal device 1 is initially set.
Hereinafter, the operation at the time of initial setting of the information processing terminal device 1 will be described with reference to FIG. 4 and the flowchart shown in FIG.

  As shown in FIG. 4, at the time of initial setting of the information processing terminal device 1 (for example, at the time of factory shipment or when a local maintenance person adjusts the system at the installation site), the BIOS of the information processing terminal device 1 is used. A device individual code is generated in the HDD of the information processing terminal device 1 from the stored model code 111 and a separately input user individual code, encrypted, and stored in the BIOS. Thereby, the information processing terminal device 1 acquires a function capable of recognizing a state in which the information processing terminal device 1 is legitimate. Hereinafter, the flow of connection after the initial setting will be described.

First, as a prerequisite,
(1) It is assumed that the model code indicating the model of the information processing terminal device 1 is written in the BIOS memory (BIOS-ROM) as the model code 111 in the information processing terminal device 1 at the time of factory shipment.
(2) It is assumed that addresses indicating the model code 111 and the device individual code (encryption) 121 in the BIOS are arbitrarily shuffled.
Assuming that the precondition is satisfied, the flow of processing at the time of initial setting of the information processing terminal device 1 is as follows.

  First, in step S <b> 11, the information processing terminal device 1 activates the setting tool 172 and separately inputs a user individual code from the keyboard 19. The input user individual code is temporarily held in a specific memory space of the RAM 14 or HDD.

   In step S12, the information processing terminal device 1 executes the code extraction tool 1721 of the setting tool 172, extracts the model code 111 and the user individual code from the BIOS, and temporarily holds them in the RAM 14 or the HDD memory space. To do.

  In step S13, the information processing terminal device 1 executes the HASH creation tool 1722 of the setting tool 172, calculates the model code (predecessor of the model code 111) extracted from the BIOS and the HASH value of the user individual code, A predecessor of the code (encryption) 121 is temporarily stored in the RAM 14 or the HDD memory space.

  In step S14, the setting tool 172 of the information processing terminal device 1 uses the TPM 13 to encrypt the predecessor of the device individual code (encryption) 121, and to the specific address in the BIOS via the code extraction tool 1721. , And stored as a device individual code (encryption) 121.

  In step S <b> 15, the information processing terminal device 1 executes the leakage prevention process by executing the erasing program 1723 of the setting tool 172. More specifically, random data is written in the memory space (RAM 14 or HDD) that temporarily holds the predecessor of the model code 111, the user individual code, and the device individual code (before encryption). Erase later.

  For the management device 2, the terminal ID, the password, and the user individual code corresponding to each of the information processing terminal devices 1 are listed and registered as a list file in the HDD.

Next, processing during operation of the program activation authentication system according to the present embodiment will be described.
(Processing during operation)
FIG. 5 is a flowchart showing the flow of processing operations during operation by the authentication system according to the present embodiment. FIG. 6 is an explanatory diagram showing a flow of information during operation by the authentication system according to the present embodiment.
Hereinafter, the flow of processing operations during operation by the authentication system according to the present embodiment will be described using the flowchart shown in FIG. 4 with reference to FIG.

First, as a prerequisite,
(1) It is assumed that a terminal ID indicating a regular information processing terminal device 1 and a password indicating a regular user are set in advance in the information processing terminal device 1 individually or for each group.
(2) It is assumed that the management device 2 lists the terminal ID, the password, and the user individual code corresponding to each of the information processing terminal devices 1 and holds them as a list file in the HDD.
(3) The information processing terminal device 1 is assumed to have a model code (model code 111) and the user individual code written in a BIOS memory (BIOS-ROM) at the time of factory shipment or the like (see above). Processing during initial setting).
(4) In the information processing terminal device 1, the model code and the user individual code are extracted in advance from the BIOS, and the HASH value of both is calculated as the device individual code, and further encrypted by the TPM 13. It is assumed that an object is stored in the HDD (the process at the time of initial setting).
Assuming that the above preconditions are satisfied, processing operations during operation in the information processing terminal device 1 and the management device 2 are as follows.

First, in step S <b> 21, the information processing terminal device 1 requests terminal connection to the management device 2 in order to use the individual APL 171.
In step S <b> 22, the management device 2 requests the information processing terminal device 1 for a terminal ID and a password in order to authenticate the validity of the terminal device in response to the request from the information processing terminal device 1.

In step S <b> 23, the information processing terminal device 1 inputs its own terminal ID and password using the keyboard 19 and transmits them to the management device 2.
In step S24, the management device 2 collates the terminal ID and password of the regular terminal device stored in a list in advance with the terminal ID and password received from the information processing terminal device 1, and can both be matched? Verify whether or not.

  In step S <b> 25, the management device 2 sends, to the information processing terminal device 1, a message permitting connection and a user individual code corresponding to the information processing terminal device 1 when the matching is found in the collation. At the same time, control is passed to the information processing terminal device 1 to cause the information processing terminal device 1 to execute the processes in and after step S26. If the two cannot be matched, an error message is transmitted to the information processing terminal device 1. Thereby, in the information processing terminal device 1, this error message is displayed on the display device.

In step S26, the information processing terminal device 1 temporarily holds the received user individual code in the RAM 14 or the HDD memory space.
In step S27, the information processing terminal device 1 executes the code extraction tool 1721 of the setting tool 172, extracts the model code 111 from the BIOS, and temporarily holds it in the RAM 14 or the HDD memory space.

  In step S28, the information processing terminal device 1 calculates the HASH value of the received user individual code and the extracted model code, and temporarily holds them in the RAM 14 or the HDD memory space.

  In step S29, the information processing terminal device 1 activates the code extraction tool 1721 for the device individual code (encryption) 121 (that is, the device individual code encrypted by the TPM 13) previously stored in the BIOS. Take out and decrypt using the TPM 13.

  In step S30, the information processing terminal device 1 compares and compares the decrypted device individual code with the device individual code created from the received user individual code. The data is displayed on the display device, and an erase program 1723 is executed to release the RAM 14 or the HDD memory space for other jobs. If not, the process proceeds to step S31.

  In step S31, the information processing terminal device 1 establishes a connection with the management device 2 and releases the memory space of the RAM 14 or HDD for other jobs, and then activates the program of the individual APL 171.

  According to the present invention, even if a third party tries to connect an unauthorized information processing terminal device to the network and attempt an unauthorized connection to the management device, the unauthorized information processing terminal device will receive the “device individual code”. Since it is not possessed, it becomes impossible to activate the individual APL, and there is an effect that authentication with high reliability is possible.

  Moreover, even if only the HDD is taken out and connected to another unauthorized information processing terminal device and an unauthorized connection to the management device is attempted, there is no “encrypted device individual code”. After all, it becomes impossible to activate the individual APL, and there is an effect that authentication with high reliability is possible. Also, even if the contents of the Yoshinba BIOS (Basic Input / Output System) are extracted and copied to another motherboard, there is no TPM (or it is different), so the “encrypted device individual code” is decrypted. Therefore, there is an effect that authentication with high reliability is possible.

  In addition, even if the “encrypted device individual code” information is in the hands of an unauthorized user, this “encrypted device individual code” cannot be decrypted except by the TPM of the corresponding device. There is an effect that the leakage of the “device individual code” can be suppressed.

  In addition, even if the “encrypted device individual code” information is decrypted by the TPM of the corresponding device, it is not possible to find out from this “device individual code” to “model code” and “user individual code”. This is impossible due to the functional characteristics of the HASH value, enabling high-reliability authentication and preventing other devices and users from being affected.

  Even if the CMOS memory that stores the BIOS information is dumped and the contents are illegally viewed, the “model code” is stored with the memory address itself shuffled. ”Is difficult to assign.

  Even if the “user individual code” is illegally known, since the “model code” is different in the information processing terminal devices of different models, there is an effect of making it impossible to activate the individual APL.

  Further, each of the above effects has an effect of realizing an individual APL of a specific model that can be activated only by a specific user, and by using such an individual APL, an unauthorized third party can connect to the management apparatus. There is an effect that can be prevented in advance.

  It should be noted that at least a part of the processing of each component of the program activation authentication system according to the present invention is executed by computer control, and the above processing is executed by the computer according to the procedure shown in the flowcharts of FIGS. The program to be shown may be distributed by storing it in a computer-readable recording medium such as a semiconductor memory, a CD-ROM, or a magnetic tape. A computer including at least a microcomputer, a personal computer, and a general-purpose computer may read the program from the recording medium and execute the program.

It is a block diagram which shows the whole structure of the starting authentication system of the program which concerns on embodiment of this invention. It is a flowchart figure which shows the flow of the connection to the management apparatus 2 by the conventional method. It is a flowchart figure which shows the flow of the connection operation | movement at the time of the initial setting to the management apparatus 2 which concerns on this embodiment. 6 is an explanatory diagram showing a flow of information at the time of initial setting of the information processing terminal device 1. It is a flowchart figure which shows the flow of operation | movement at the time of the operation | movement by the authentication system which concerns on this embodiment. It is explanatory drawing which shows the flow of the information at the time of the operation | movement by the authentication system which concerns on this embodiment.

Explanation of symbols

1 Information processing terminal device 2 Management device 3 Network 4, 5 LAN
6,7 Gateway device 11 BIOS-ROM
12 BIOS-RAM
13 TPM
14 RAM
15 CPU
16 Network adapter 17 OS (terminal side)
18 LCD
19 Keyboard 21 OS (Management device side)
22 APL (sv)
171 Individual APL (Applet)

Claims (5)

Used in the system that performs authentication with the management device and the information processing terminal device, an information processing terminal device that performs activation authentication application program,
Encryption / decryption means for encryption and decryption mounted on the motherboard;
Code generated based on the second code is a code that is set for each user and the first code is a code that is set for the model of the information processing terminal device to the information processing terminal device A third code encrypted by the encryption / decryption means, a storage means mounted on a motherboard for storing the first code,
When the information processing terminal the held the management device the second code in association with the succeeds in authentication using the password received from the information processing terminal device, the management device or al the information processing Receiving means for receiving the second code corresponding to the terminal device ;
Arithmetic means for generating a fourth code based on the first code stored in the storage means and the second code received from the management device;
The encrypted third code stored in the storage means is decrypted by the encryption / decryption means, and the code obtained by decrypting the third code is generated by the computing means A determination means for collating the fourth code to determine whether or not both match;
An information processing terminal device comprising: an activation permission unit that permits activation of the application program when the determination unit determines that the code obtained by decoding the third code matches the fourth code. The storage means is a BIOS memory for storing the first code and the encrypted third code ;
The calculation means performs a predetermined calculation on the first code stored in the BIOS memory and the second code received from the management device to generate the fourth code ,
The encryption / decryption means decrypts the third code encrypted and stored in the BIOS memory,
The determination means determines whether the decoded third code , the first code, and the fourth code generated based on the second code received from the management device match. The information processing terminal device according to claim 1 for determination.   3. The information processing terminal device according to claim 1, wherein the encryption / decryption means is a security chip having encryption and decryption functions mounted on the motherboard. An authentication method for starting an application program of a system that performs authentication between a management device and an information processing terminal device ,
Code generated based on the second code is a code that is set for each user and the first code is a code that is set for the model of the information processing terminal device to the information processing terminal device A third code encrypted on the motherboard and storage means for storing the first code on the motherboard,
When the management device holding the second code in association with the information processing terminal device succeeds in authentication using the password received from the information processing terminal device, the information processing terminal device receiving the second code corresponding to the management device or al the information processing terminal device,
Generating a fourth code based on the first code stored in the storage means and the second code received from the management device;
The encrypted third code stored in the storage means is decrypted, the code obtained by decrypting the third code, the second code received from the management device, and the first code The fourth code generated based on the code of the above is collated to determine whether or not both match,
An application program activation authentication method for permitting activation of the application program when it is determined that the code obtained by decoding the third code matches the fourth code. The first code and the encrypted third code are stored in a BIOS memory;
Performing a predetermined operation on the first code stored in the BIOS memory and the second code received from the management device to generate the fourth code ;
Decrypting the third code encrypted and stored in the BIOS memory;
Determining whether the decoded third code , the first code, and the fourth code generated based on the second code received from the management device match;
5. The application program activation authentication method according to claim 4, wherein activation of the application program is permitted when the fourth code matches the third code .