JP5277935B2 - License management system and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a license management system which is applicable even to a stand-alone computer, and can easily perform a processing related with the displacement of software. <P>SOLUTION: In the license management system 1, a PC 2 makes an IC card 3 authenticate an authentication code stored at the PC 2 side in starting software 5. The IC card 3 authenticates an authentication code by using a reference seed making a pair with the seed of the authentication code, and when the authentication succeeds, the IC card 3 increments a reference counter included in a reference seed. When the IC card 3 succeeds in the authentication of the authentication code, the PC 2 permits the start of the software 5, and increments the authentication counter included in the seed, and makes the IC card 3 generate the authentication code on the basis of the seed, and stores the authentication code generated by the IC card 3 as the authentication code to be used for the next start management. <P>COPYRIGHT: (C)2010,JPO&amp;INPIT

Description

  The present invention relates to a technique for managing a license of software installed in a computer, and more particularly to a technique for managing a license of the software by managing execution of the software.

  Since software sales are sales of licenses (licenses), it is strictly prohibited to install one piece of software on multiple computers. Of course, it is necessary to install more than the number of software licenses. The act to use becomes an illegal act.

  However, software is stored on media such as CD-ROMs and sold, and if some countermeasures are not taken, unauthorized installation can be easily performed, so software licenses must be managed.

As a method for managing software licenses , a method for managing software installation by an installer, which is a computer program for installing software on a computer, authenticating a license key input to the computer is widely used. Yes.

  Patent Document 1 discloses an invention for managing the number of software licenses using an IC card. In Patent Document 1, an IC card provided with an area for storing MAC addresses for the number of licenses given to the user is prepared, and when the software is installed in the computer, the MAC address of the computer is written in the IC card, When the software is uninstalled from the computer, the software license is managed by deleting the MAC address of the computer from the IC card.

  These technologies described above are technologies for prohibiting unauthorized software installation. On the other hand, although software can be installed on a computer, an invention for managing software licenses by managing execution of the software is also disclosed. Has been.

  For example, in the invention disclosed in Patent Document 2, a device for managing a license is installed on a network, and the device has a software license when the number of licenses is larger than the number of software used in a computer. Is configured to be licensed.

  However, if the use of software installed on a computer is managed using a device connected to a network as in Patent Document 2, the software is connected to a computer connected to a network where external connection is prohibited. When installing software on a computer that is not connected to a network and used stand-alone, the computer cannot access the device and cannot manage the use of the software.

  As an invention that solves this problem, for example, Patent Document 3 discloses an invention that manages licenses by controlling the activation of software even in a computer that is used in a stand-alone manner.

  In the invention disclosed in Patent Document 3, the software installed in the computer includes a main function module and an authentication module, a license key is generated from the MAC address of the computer on which the software is installed, and the license key is stored in the computer. Installed.

  When the software is started, the authentication module is first started. The authentication module generates a license verification key from the MAC address of the computer on which the software is started, and verifies the license key stored in the computer with the license verification key. To manage software startup.

  That is, in the invention disclosed in Patent Document 3, if the computer that is the target when the license key is issued and the computer on which the software is installed are different, the MAC address of each computer is different, so the software is activated. No longer.

  However, in the invention disclosed in Patent Document 3, even a computer used in a stand-alone manner can manage the execution of software installed on the computer, but when the software is transferred to another computer. The license key must be generated again, and there is a problem that the processing related to the transfer becomes complicated.

JP 2002-268774 A JP 2003-99142 A JP 2004-86404 A

  Therefore, the present invention uses a method different from the contents disclosed in Patent Document 2 and Patent Document 3 to control the activation of the software installed in the computer, and to manage the license of the software, so that it is a stand-alone. Another object of the present invention is to provide a license management system and method that can be applied to various computers and that can easily perform processing related to software relocation.

  A first invention that solves the above-described problem is a license management system that includes at least a token and a computer device, and manages a license of software installed in the computer device. The computer device stores the software. When the activation operation is performed, the authentication code stored on the computer side is authenticated by the token, and when the token is successfully authenticated, the activation of the software is permitted and the authentication code is obtained from the software. The first variable element included in the seed is changed according to a predetermined rule, and then the seed is transmitted to the token so that the token generates the authentication code, and the token generates the authentication code next time. The authentication code used for managing startup The token is stored in the token-side memory and paired with the seed. The code generation means generates the authentication code based on the seed transmitted from the computer. And authenticating an authentication code transmitted from the computer using a reference seed including a second variable element that is synchronized with the first variable element, and succeeding in authenticating the authentication code, the predetermined rule is followed. A license management system comprising: code authentication means for changing the second variable element.

  Here, the token stores an encryption key used for a digital signature or the like with high tamper resistance, such as an IC card or a USB token, and uses the encryption key in response to a request from an external device. It means a physical device with a function to perform operations.

Furthermore, the second invention is the license management system according to the first invention, wherein the first variable element and the second variable element are counters, and the activation management means of the computer device is the If the token is successfully authenticated the authentication code, by a means for incrementing a counter to be the first variables by a predetermined value, the code authentication means of the token, upon successful authentication of the authentication code, said first The license management system is characterized in that it is means for incrementing a counter, which is a variable element of 2, by a predetermined value.

  Further, according to a third invention, in the license management system according to the second invention, the activation management means of the computer device includes a hash value of a counter value serving as the first variable element in the seed. The code authentication means for the token calculates a hash value of a counter value serving as the second variable element included in the reference seed, and authenticates the authentication code. .

Further, the fourth invention is the license management system according to the third invention, wherein the software is installed in the reference seed stored on the token side from the program code of the software when installed in the computer. The activation management means of the computer device is a means for calculating a hash value from the program code of the software and including the hash value in the seed. It is.

  Furthermore, a fifth invention is the license management system according to the third or fourth invention, wherein the reference seed stored on the token side is calculated from all or part of the software installation information. The activation management means of the computer device calculates a hash value from all or part of the installation information when the software is installed in the computer, and uses the hash value as the seed. It is a license management system characterized by being included.

  Furthermore, a sixth invention is the license management system according to any one of the first to fifth inventions, wherein the computer device is configured such that the reference seed stored in the token is an initial value. A license management system comprising: installation means for writing the seed obtained from the software into the token as the reference seed after installing the software on the computer device.

Further, a seventh invention, in the first sixth license management system according to any one of the invention from the invention, the computer device are both uninstalling the software from the computer device, the token An uninstall means for requesting initialization of the reference seed stored on the side, wherein the token comprises means for initializing the reference seed in accordance with a request from the computer device. It is a management system.

  Further, an eighth invention is a license management method for managing a license of software installed at least on a computer, comprising at least a token and a computer device, wherein the computer is operated when an operation for starting the software is performed. The apparatus converts the authentication request of the authentication code stored on the computer side into the token a, the token is obtained from the software and is paired with a seed including a first variable element, and the first When the authentication code transmitted from the computer is authenticated using the reference seed including the second variable element to be synchronized with the variable element, and when the authentication code is successfully authenticated, the second variable element is set to a predetermined value. Step b, returning the authentication result to the computer When the computer successfully authenticates the authentication code, the computer device permits the activation of the software and changes the first variable element included in the seed obtained from the software according to a predetermined rule. Transmitting the seed to the token and requesting generation of the authentication code; c generating the authentication code based on the seed transmitted from the computer by the token; and generating the generated authentication code. Including a start management step in which a step d of returning to the computer and a step e in which the computer device stores the authentication code received from the token as the authentication code used for the next start management are executed. This is a featured license management method.

  Furthermore, a ninth invention is the license management method according to the eighth invention, wherein the first variable element and the second variable element are counters, and in the step b of the startup management process, When the authentication of the authentication code transmitted from the computer is successful, the token increments the counter serving as the second variable element included in the reference seed by a predetermined value, and in step c of the activation management process The computer device increments the counter serving as the first variable element by a predetermined value when the token succeeds in authenticating the authentication code, and then sets the counter value serving as the first variable element to the value. It is a license management method characterized in that it is included in a seed.

  Furthermore, a tenth aspect of the invention is the license management method according to the ninth aspect of the invention, wherein, in the step b of the activation management step, the token is a counter of the second variable element included in the reference seed. A hash value of the value is calculated to authenticate the authentication code, and in the step c of the activation management step, the computer device includes a hash value of a counter value serving as the first variable element in the seed The license management method is characterized in that:

  Furthermore, an eleventh aspect of the invention is the license management method according to the tenth aspect of the invention, wherein the software is installed in the reference seed stored on the token side from the program code of the software when installed in the computer. In the step c of the activation management step, the computer device calculates a hash value from the program code of the software, and includes the hash value in the seed. It is a management method.

  Further, the twelfth invention is the license management method according to the tenth invention or the eleventh invention, wherein the reference seed stored on the token side is calculated from all or part of the software installation information. In step c of the startup management step, the computer device calculates a hash value from all or part of the installation information when the software is installed in the computer, and the hash value is calculated. A license management method characterized in that a value is included in the seed.

  The thirteenth invention is the license management method according to any one of the eighth to twelfth inventions, wherein the computer device stores the software in the token before installing the software on the computer device. If the reference seed is an initial value, and if the reference seed is an initial value, after installing the software on the computer device, the seed obtained from the software is used as the reference seed in the token. A license management method including an installation step of writing.

Furthermore, the fourteenth invention, in the license management method according to any one of the thirteenth aspect of the eighth invention, both when the computing device is to uninstall the software from the computer device, the token The license management method is characterized in that it includes an uninstall step of requesting initialization of the reference seed stored on the side, and initializing the reference seed in accordance with a request from the computer device.

  According to the present invention described above, the authentication code based on the seed including the first variable element obtained from the software and changed when the authentication code is successfully authenticated is generated in advance using the token, and the software. When the next activation management is performed, the token is paired with the seed and is generated in advance using a reference seed that includes the second variable element that is synchronized with the first variable element. If the authentication code was successfully authenticated and the authentication code was successfully authenticated, the second variable element was changed and the computer device was allowed to start the software so that it was installed on another computer device. The first variable of the seed obtained from the software does not match the second variable of the reference seed stored in the token, such as when the software is started If not allowed to start the software, the computer system can start the software can be substantially limited to one.

  As described above, the present invention does not require a device connected to a network, and therefore the present invention can also be applied to a computer device used in a stand-alone manner. In addition, when uninstalling software from a computer device, if the reference seed stored in the token is initialized, the software can be installed on other computer devices. Can be.

  Now, preferred embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a schematic configuration diagram of a license management system 1 in the present embodiment.

  The license management system 1 according to the present embodiment is, for example, as shown in FIG. 1, a personal computer 2 (hereinafter abbreviated as “PC”) that is a computer device in which software 5 stored in a CD-ROM 4 is installed. PC (Personal Computer) and at least an IC card 3 which is a token used for managing the activation of the software 5 installed in the PC 2, and the PC 2 is a device for data communication with the IC card 3. An IC card reader 2a is connected.

  In the license management system 1 of FIG. 1, the activation of the software 5 installed in the PC 2 is managed by authentication using a reservation type authentication code. Here, authentication using a reservation-type authentication code means that an authentication code to be used next time is generated in advance, and next time authentication is performed using an authentication code generated in advance.

  In order to manage activation of the software 5 by authentication using a reservation type authentication code, the PC 2 on which the software 5 is activated, when the software 5 is activated, uses the authentication code stored in the software 5 as an IC card. 3, when the IC card 3 successfully authenticates the authentication code, the IC card 3 generates an authentication code based on the seed obtained from the software 5, and the authentication code obtained from the IC card 3 is The IC card 3 includes activation management means for storing in the software 5 as an authentication code used for activation management. The IC card 3 includes code generation means for authenticating the authentication code using a reference seed paired with the seed, and the seed Code authentication means for generating the authentication code is provided.

  Note that in such authentication using a reservation-type authentication code, the same authentication code will be used repeatedly unless the mechanism for changing the authentication code is provided. In the embodiment, the PC 2 includes the first variable element in the seed obtained from the software 5, and includes the second variable element in the reference seed stored in the IC card 3.

  The first variable element and the second variable element included in the seed obtained by the PC 2 from the software 5 and the reference seed stored in the IC card 3 are desirably elements that do not change until the next activation of the software 5. In the present embodiment, a counter (here, 4 bytes) that is incremented by a predetermined value every time the IC card 3 successfully authenticates the authentication code is used.

  From here, the apparatus which comprises the license management system 1 illustrated in FIG. 1 is demonstrated. FIG. 2 is a block diagram illustrating a configuration example of the PC 2 in the present embodiment, and FIG. 3 is a block diagram illustrating a configuration example of the IC card 3 in the present embodiment.

  As shown in FIG. 2, the PC 2 includes a control board 20 including a CPU 20a (Central Processing Unit), a RAM 20b (Random Access Memory) and a ROM 20c (Read-Only Memory), and a hard disk as a large-capacity data storage device. 21, a display 22 for displaying characters and images, a keyboard 23 that is an input device, a mouse 24 that is a pointing device, and an external interface for connecting various external devices (here, the IC card reader 2 a). The software 5 having 25 (here, USB interface) and stored in the CD-ROM 4 is stored in the hard disk 21 of the PC 2.

  As shown in FIG. 3, the IC card 3 is a card medium on which an IC chip 30 is mounted. The IC chip includes a CPU 31, a RAM 32, a ROM 33, an EEPROM 34, a cryptographic coprocessor 35, and a UART 36.

  Next, computer programs and data used in the license management system 1 shown in FIG. 1 will be described. 4 is a diagram for explaining the software 5, FIG. 4 (a) is a diagram for explaining the contents of the CD-ROM 4, and FIG. 4 (b) is a diagram showing the contents of the hard disk 21 of the PC 2 after the software 5 is installed. It is a figure explaining.

  As shown in FIG. 4A, the CD-ROM 4 has an archive 40 of software 5 installed in the PC 2 and a software 5 installed in the PC 2 as a computer program for operating the control board 20 of the PC 2. An installer 42 and an archive 41 of an uninstaller 6 for uninstalling the software 5 from the PC 2 are stored.

Archive 41 Archive 40 and uninstaller software 5 is recorded in the CD-ROM 4 in a compressed state, the main module 50 to the archive 40 software 5, a computer program for implementing the main functions of the software 5 A compressed file 40a, a compressed file 40b of the activation management module 51 which is a computer program for managing activation of the software 5, and a compressed file 40c of the setting file 52 in which data used for activation management is stored. Yes.

When the installer is started, the archive 40 of the software 5 and the archive 41 of the uninstaller 6 stored in the compressed state in the CD-ROM 4 are expanded on the hard disk 21 of the PC 2, and the software is stored on the hard disk of the PC 2. 5 and uninstaller 6 is installed.

  The main module 50 included in the software 5 is a computer program that provides a function that the user wants to use. The function is, for example, a word processor, spreadsheet software, graphic drawing software, or the like.

  The activation management module 51 included in the software 5 is a computer program for causing the PC 2 to function as an activation management unit when activated on the PC 2.

  Further, the setting file 52 included in the software 5 includes an authentication counter 53 used as a seed variable element that is the basis of the authentication code 54 and an authentication code 54 used for the next authentication.

  The activation management module 51 included in the software 5 is activated when the software 5 is activated (for example, double-clicking on an icon), and authenticates the authentication code 54 stored in the software 5 using the IC card 3. When the IC card 3 succeeds in authenticating the authentication code 54, the IC card 3 is caused to generate an authentication code 54 based on the seed obtained from the software 5, and the authentication code 54 obtained from the IC card 3 is generated next time. It is stored in the setting file 52 as an authentication code 54 used for activation management.

  In the present embodiment, in order to cause the IC card 3 to generate the authentication code 54, the seed obtained from the software 5 by the activation management module 51 included in the software 5 is at least the main module 50 developed on the hard disk 21 of the PC 2. The hash value of the program code, the hash value of the predetermined item of the installation information managed by the operating system of the PC 2, and the hash value of the value of the authentication counter 53 included in the setting file 52 are included.

  The reason why the hash value of the value of the authentication counter 53 is included in the seed obtained from the software 5 is to make the authentication code 54 generated in the IC card 3 different from the previous value, as described above.

  The seed obtained from the software 5 may include the value of the authentication counter 53 instead of the hash value of the value of the authentication counter 53. This is to keep the value of the authentication counter 53 secret when transmitted to the IC card. is there.

  Also, the hash value of the software 5 is included in the seed obtained from the software 5 so that the software 5 installed in the PC 2 can be confirmed.

  FIG. 5 is a diagram for explaining the contents of the memory of the IC chip 30 mounted on the IC card 3. As shown in FIG. 5, the ROM 33 of the IC chip 30 stores the IC of the IC card 3 as code generation means for generating an authentication code 54 based on the seed transmitted from the PC 2 as a command for operating the IC chip 30. A code generation command 300 realized by a computer program for causing the chip to function and a computer program for causing the IC chip of the IC card 3 to function as code authentication means for authenticating the authentication code 54 transmitted from the PC 2 A code authentication command 301 is implemented, and although not shown in FIG. 5, a general IC card 3 such as a command for writing data transmitted from the PC 2 to the EEPROM 34 or a command for deleting data instructed from the PC 2 from the EEPROM 34. The commands provided in It is.

  Further, in the EEPROM 34 of the IC card 3, an authentication key 302 used for generating and authenticating the authentication code 54 as data for using a command mounted on the ROM 33, and a reference seed 303 for authenticating the authentication code 54. Are stored in the reference seed 303, and a reference counter 304 synchronized with the authentication counter 53 stored in the setting file 52 of the software 5 and a reference hash value 305 which is a hash value calculated when the software 5 is installed. It is included.

  The code generation command 300 is a command for calculating the authentication code 54 using the authentication key from the seed received from the PC 2 according to a predetermined algorithm and returning the calculation result to the PC 2.

  The code authentication command 301 calculates a hash value of the value of the reference counter 304 included in the reference seed 303 stored in the EEPROM 34, and based on the calculated hash value and reference hash value of the reference counter 304, According to the same algorithm as the code generation command 300, a reference code is calculated using an authentication key, and the verification code 54 received from the PC 2 is authenticated by collating the calculated reference code with the authentication code 54 received from the PC 2, When the authentication code 54 is successfully authenticated, the reference counter 304 included in the reference seed 303 is incremented by a predetermined value (for example, “+1”), and then the authentication result of the authentication code 54 is returned to the PC 2.

  The specifications of the code generation command 300, the code authentication command 301 and the authentication key 302 provided in the IC card 3 depend on the algorithm specifications for generating the authentication code 54, and the algorithm specifications for generating the authentication code 54 are arbitrary. For example, a MAC (Message Authentication code) Algorithm of ISO / IEC9797-1 (1999) can be used.

  When the IC card 3 is issued, the reference hash value 305 is an initial value, and when the software 5 is installed in the PC 2, the reference hash value 305 is written into the IC card 3.

  From here on, the procedure executed by the license management system 1 shown in FIG. 1 will be described together with the description of the license management method according to the present invention.

  First, the procedure for installing the software 5 on the PC 2 will be described with reference to FIG. FIG. 6 is a flowchart showing a procedure for installing the software 5.

  When installing the software 5 on the PC 2, first, the user of the software 5 attaches the CD-ROM 4 storing the software 5 to the PC 2 and clicks the icon of the installer 42 displayed on the display 22 of the PC 2. The installer 42 stored in the ROM 4 is activated on the PC 2 (S1).

  When the installer 42 is activated, the PC 2 inquires of the IC card reader 2a connected to the PC 2 whether the IC card 3 is detected, and branches the process depending on the inquiry result (S2).

  When the IC card reader 2a does not detect the IC card 3, the PC 2 stops the installation of the software 5 and ends this procedure. When the IC card reader 2a detects the IC card 3, the PC 2 Continue the installation of 5.

  When the IC card reader 2a detects the IC card 3, the PC 2 requests the IC card 3 to read the reference seed 303 by sending a command message of a command for reading the reference seed 303 to the IC card 3 ( S3) When receiving the command message of the command, the IC card 3 transmits the reference seed 303 stored in the IC card 3 to the PC 2 (S4).

  The PC 2 branches the process depending on the content of the reference counter 304 included in the reference seed 303 received from the IC card 3 (S5). If the reference counter 304 is not the initial value, the PC 2 stops the installation of the software 5 and ends this procedure. If the reference counter 304 is the initial value, the PC 2 continues the installation of the software 5.

  When the reference counter 304 obtained from the IC card 3 is an initial value, the PC 2 stores the archive 40 of the software 5 and the archive 41 of the uninstaller 6 stored in a compressed state on the CD-ROM 4 and the hard disk 21 of the PC 2. Further, the software 5 is installed on the PC 2 by creating the installation information of the software 5 on the hard disk 21 (S6).

  When the PC 2 installs the software 5 on the hard disk 21, the hash value of the program code of the main module 50 of the software 5 and the hash of a predetermined item of the installation information are calculated according to a predetermined algorithm (S 7), By sending a command message of a write command including these hash values, the IC card 3 is requested to write these hash values (S8).

  When the IC card 3 receives the above-described command message from the PC 2 on which the installer is started, the IC card 3 updates the reference hash value 305 included in the reference seed 303 stored in the EEPROM 34 to the hash value included in the command message, and the hash The value writing result is notified to the PC 2 (S9).

  Upon receiving a response to the write command from the IC card 3, the PC 2 ends the installation of the software 5 by displaying on the display 22 a screen indicating that the installation of the software 5 has ended, and the procedure illustrated in FIG. Ends.

  Next, a procedure for managing the activation of the software 5 installed in the PC 2 will be described with reference to FIG. FIG. 7 is a flowchart showing a procedure for managing the activation of the software 5.

  When the software 5 icon is double-clicked, the activation management module 51 of the software 5 is activated on the PC 2 (S10). When the activation management module 51 is activated, the PC 2 connects to the IC card reader 2a connected to the PC 2. An inquiry is made as to whether the IC card 3 is detected, and the process branches depending on the inquiry result (S11).

  When the IC card reader 2a does not detect the IC card 3, the PC 2 stops the activation process of the main module 50 of the software 5 and ends this procedure, and the IC card reader 2a detects the IC card 3. In this case, the activation management module 51 continues the activation process of the main module 50 of the software 5.

  When the IC card reader 2a detects the IC card 3, the PC 2 acquires the authentication code 54 included in the setting file 52 of the hard disk 21, and sends the command message of the code authentication command 301 including the authentication code 54 to the IC card. 3, the authentication request of the authentication code 54 is made to the IC card 3 (S12).

  When the IC card 3 receives the command message of the code authentication command 301 including the authentication code 54 from the PC 2, the IC card 3 activates the code authentication command 301 and the reference counter 304 included in the reference seed 303 stored in the IC card 3. A hash value is calculated, and a reference code based on the reference hash value 305 included in the reference seed 303 and the hash value of the reference counter 304 is calculated and received from the PC 2 according to a predetermined algorithm using the authentication key. By verifying the authentication code 54 and the reference code, the authentication code 54 received from the PC 2 is authenticated (S13).

  The code authentication command 301 of the IC card 3 branches the processing of the authentication code 54 received from the PC 2 according to the authentication result (S14), and when the authentication of the authentication code 54 is successful, the reference counter 304 of the IC card 3 After incrementing the value by a predetermined value (for example, “+1”) (S15), the process proceeds to S16. When the authentication code 54 fails to be authenticated, the process proceeds to S16 without incrementing the value of the reference counter 304. .

  After successfully authenticating the authentication code 54 and incrementing the value of the reference counter 304 of the IC card 3 by a predetermined value, or after failing to authenticate the authentication code 54, the IC card 3 An authentication result (success or failure) is transmitted to the PC 2 (S16).

  When receiving the authentication result (success or failure) of the authentication code 54 from the IC card 3, the PC 2 branches the process according to the authentication result of the authentication code 54 (S17).

  If the authentication command authentication result indicates “success”, the PC 2 continues the startup process of the main module 50 of the software 5, and if the authentication command authentication result indicates “failure”, the PC 2 indicates that the software 5 main module 50 50 start processing is stopped, and the procedure illustrated in FIG. 7 ends.

  When the authentication result of the authentication command indicates “success”, the PC 2 in which the main module 50 is activated sets the value of the authentication counter 53 of the setting file 52 stored in the hard disk 21 of the PC 2 to a predetermined value (for example, “+1”). ') Is incremented (S18), the program code of the main module 50 of the software 5 and the hash value of the installation information are calculated (S19), and the hash value and the hash value of the incremented authentication counter 53 are seeded. Is sent to the IC card 3 to request the IC card 3 to generate the authentication code 54 (S20).

  When the IC card 3 receives the command message of the code generation command 300, the IC card 3 activates the code generation command 300, and uses the authentication key 302 to generate an authentication code 54 based on the seed included in the command message according to a predetermined algorithm. The generated authentication code 54 is transmitted to the PC 2 (S21).

  Upon receiving the authentication code 54 from the IC card 3, the PC 2 overwrites the authentication code 54 in the setting file 52 provided in the hard disk 21 of the PC 2 as the authentication code 54 used for the next authentication. (S22) The main module 50 of the software 5 is activated (S23), and the procedure illustrated in FIG.

  Finally, the procedure for uninstalling the software 5 installed on the PC 2 will be described with reference to FIG. FIG. 8 is a flowchart showing a procedure for uninstalling the software 5.

  When uninstalling the software 5 to the PC 2, first, the user of the software 5 starts up the uninstaller 6 on the PC 2 by double-clicking the icon of the uninstaller 6 installed on the PC 2 (S30).

  When the uninstaller 6 is activated, the PC 2 inquires of the IC card reader 2a connected to the PC 2 whether the IC card 3 is detected, and branches the process depending on the inquiry result (S31).

  If the IC card reader 2a does not detect the IC card 3, the PC 2 stops the uninstallation of the software 5 and terminates this procedure. If the IC card reader 2a detects the IC card 3, the PC 2 The process of uninstalling 5 is continued.

  When the IC card reader 2a detects the IC card 3, the PC 2 transmits a command for rewriting the reference counter of the reference seed 303 to the initial value and a command for rewriting the reference hash value of the reference seed 303 to the initial value. The IC card 3 is requested to initialize the reference seed 303 (S32).

  When receiving the command message of the command for initializing the reference seed 303 from the PC 2 on which the uninstaller 6 is activated, the IC card 3 sets the reference counter and the reference hash value included in the reference seed 303 as initial values ( For example, by rewriting to “All 0h”), the reference seed 303 is initialized, and the initialization result of the reference seed 303 is returned to the PC 2 (S33).

  When receiving the initialization result of the reference seed 303 from the IC card 3, the PC 2 uninstalls the software 5 from the PC 2 by deleting the program code and installation information of the software 5 on the hard disk 21 of the PC 2 (S34). ), The procedure illustrated in FIG.

  Finally, the effect of the present invention will be described. FIG. 9 is a diagram for explaining the effect of the present invention. FIG. 9A is a diagram for explaining the effect when software is installed on two PCs 7a and 7b at the same time.

  Immediately after the software is installed simultaneously on the two PCs 7a, b, the values of the authentication counters 70a, b stored in the PCs 7a, b are initial values (here, “00000000h”) and are stored in the IC card 8a. Since the value of the reference counter 80a is also an initial value (here, “00000000h”), the software can be started by the two PCs 7a and 7b.

  However, when the software is activated on one of the two PCs 7a and 7b (here, the PC 7a), the authentication counter 70a stored in the PC 7a is incremented, and the value of the authentication counter 71a after the increment is “00000001h”. The reference counter 80a stored in the IC card 8a is also incremented, and the incremented reference counter 81a is also "00000001h".

  Therefore, even if the software is started on one PC 7b after the software is started on the PC 7a, the value of the authentication counter 70b stored in the PC 7b (here, “00000000h”) and the IC card 8a are stored. Since the value of the incremented reference counter 80a (here, “00000001h”) is different, if the procedure shown in FIG. 7 is followed, the IC card 8a fails to authenticate the authentication code, and the PC 7b does not start the software. In practice, the number of software that can be used is limited to one.

  FIG. 9B is a diagram for explaining the effect when the software is installed in the PC 7c and the software is uninstalled from the PC 7c.

  After the software is installed on the PC 7c, when the software is started once on the PC 7c, it is stored in the IC card 8b, and the incremented reference counter 80b is changed from the initial value “00000000h” to “00000001h”, as shown in FIG. If the procedure described above is followed, the reference counter stored in the IC card 8b is no longer the initial value, so that the software cannot be installed in another PC using the IC card 8b.

  However, by uninstalling the software from the PC 7c, according to the procedure shown in FIG. 8, it is stored in the IC card 8, and the reference counter 81b after the uninstallation returns to the initial value (here, “00000000h”). , The software can be installed in another PC using the IC card 8.

  It should be noted that the present invention is not limited to the embodiments described so far, and various modifications and changes can be made by those skilled in the art.

  For example, in the above-described embodiment, the token is an IC card, but a device other than the IC card, such as a USB token, can also be used as the token of the present invention.

  FIG. 10 is a diagram for explaining a USB token 9 that can be used as a token. The USB token 9 is a device in which a USB connector 92 for connecting to a USB interface of a computer device, a control chip 90 for controlling USB communication with the computer device, and an IC chip 91 for an IC card are incorporated. The commands and data illustrated in FIG. 5 are stored in the memory of the IC card IC chip 91 and used by being connected to the USB interface of the computer device.

  In addition, by using one IC card, it is possible to manage the activation of a plurality of software. When managing the activation of multiple software using a single IC card, the data for managing the activation of one software, that is, the reference seed is generated based on the software identification number included in the installation information When storing and managing software in association with a DF (DF: Dedicated File), an identification number is acquired from the installation information of the software, and a reference seed associated with the DF corresponding to the identification number is used. Manage software startup.

1 is a schematic configuration diagram of a license management system in the present embodiment. The block diagram which shows the structural example of PC in this embodiment. The block diagram which shows the structural example of the IC card in this embodiment. The figure explaining software. The figure explaining the content of the memory of the IC chip mounted in an IC card. The flowchart which showed the procedure when installing software. The flowchart which showed the procedure which manages starting of software. The flowchart which showed the procedure which uninstalls software. The figure explaining the effect of this invention. The figure explaining the USB token which can be used as a token.

Explanation of symbols

1 License management system 2 Personal computer (PC)
2a IC card reader 3 IC card 300 Code generation command 301 Code authentication command 302 Authentication key 303 Reference seed 304 Reference counter 305 Reference hash value 4 CD-ROM
42 Installer 5 Software 50 Main module 51 Startup management module 52 Setting file 53 Authentication counter 54 Authentication code 6 Uninstaller

Claims (14)

  A license management system comprising at least a token and a computer device and managing a license of software installed in the computer device, wherein the computer device is operated by the computer side when an operation for starting the software is performed. The stored authentication code is authenticated by the token, and when the token is successfully authenticated, the activation of the software is permitted, and a first variable element included in a seed obtained from the software is set to a predetermined value. Then, the authentication code is generated in the token by sending the seed to the token, and the authentication code generated by the token is stored as the authentication code used for next activation management. A startup management means, The token is stored in the token-side memory, the code generation means for generating the authentication code based on the seed transmitted from the computer, is paired with the seed, and is synchronized with the first variable element. The authentication code transmitted from the computer is authenticated using a reference seed including the second variable element, and when the authentication code is successfully authenticated, the second variable element is changed according to the predetermined rule. And a code authentication means. 2. The license management system according to claim 1, wherein the first variable element and the second variable element are counters, and the activation management means of the computer device has successfully authenticated the authentication code by the token. Then, the means for incrementing the counter serving as the first variable element by a predetermined value, and the code authenticating means for the token sets the counter serving as the second variable element to the predetermined when the authentication code is successfully authenticated. A license management system, characterized in that it is a means for incrementing by the value of.   3. The license management system according to claim 2, wherein the activation management unit of the computer device includes a hash value of a counter value serving as the first variable element in the seed, and the code authentication unit of the token includes A license management system for calculating a hash value of a counter value serving as the second variable element included in the reference seed and authenticating the authentication code. The license management system according to claim 3, wherein the reference seed stored on the token side includes a hash value calculated from a program code of the software when the software is installed in the computer, The license management system according to claim 1, wherein the activation management means of the computer device is means for calculating a hash value from a program code of the software and including the hash value in the seed.   5. The license management system according to claim 3, wherein the reference seed stored on the token side includes a hash value calculated from all or part of the software installation information, and the computer device. The activation management means is a means for calculating a hash value from all or part of the installation information when the software is installed in the computer, and including the hash value in the seed. License management system.   6. The license management system according to claim 1, wherein when the reference seed stored in the token is an initial value, the computer device installs the software on the computer device. The license management system further comprising an installation unit that writes the seed obtained from the software into the token as the reference seed. In the license management system according to any one of claims 1 to 6, wherein the computer device, uninstalling the software from the computer device together, the initial of the reference seed stored in the token side The license management system further comprising: uninstalling means for requesting conversion, and the token includes means for initializing the reference seed in accordance with a request from the computer device.   A license management method for managing a license of software installed in a computer, comprising at least a token and a computer device, wherein the computer device stores the computer side when the software is operated. An authentication request for an authentication code being used as the token; a second obtained from the software and paired with a seed including a first variable element and synchronized with the first variable element; When the authentication code transmitted from the computer is authenticated using the reference seed including the variable element of the above, and the authentication code is successfully authenticated, the second variable element is changed in accordance with a predetermined rule, and then the authentication is performed. B returning the result to the computer, wherein the token is the authentication code. If the authentication is successful, the computer device permits the activation of the software, changes the first variable element included in the seed obtained from the software according to a predetermined rule, and then changes the seed to the seed. Sending to the token and requesting the generation of the authentication code c, the token generates the authentication code based on the seed transmitted from the computer, and returns the generated authentication code to the computer License management comprising: a startup management step in which step d and step e in which the computer device stores the authentication code received from the token as the authentication code used for next startup management Method.   9. The license management method according to claim 8, wherein the first variable element and the second variable element are counters, and the token is transmitted from the computer in the step b of the activation management process. When the authentication code is successfully authenticated, the counter that is the second variable element included in the reference seed is incremented by a predetermined value, and in step c of the activation management step, the computer device determines that the token is When the authentication code is successfully authenticated, the counter serving as the first variable element is incremented by a predetermined value, and then the value of the counter serving as the first variable element is included in the seed. License management method.   The license management method according to claim 9, wherein, in the step b of the activation management step, the token calculates a hash value of a counter value serving as the second variable element included in the reference seed, The license management method, wherein the authentication code is authenticated, and in step c of the activation management step, the computer device includes a hash value of a counter value serving as the first variable element in the seed. .   The license management method according to claim 10, wherein the reference seed stored on the token side includes a hash value calculated from a program code of the software when the software is installed in the computer, In the step c of the activation management process, the computer device calculates a hash value from a program code of the software, and includes the hash value in the seed.   12. The license management method according to claim 10, wherein the reference seed stored on the token side includes a hash value calculated from all or part of the software installation information, and the activation management. In the step c of the process, the computer device calculates a hash value from all or a part of the installation information when the software is installed in the computer, and includes the hash value in the seed. License management method.   13. The license management method according to claim 8, wherein the reference seed stored in the token is an initial value before the computer device installs the software on the computer device. And, when the reference seed is an initial value, after installing the software on the computer device, an installation step of writing the seed obtained from the software into the token as the reference seed is included. License management method. In the license management method according to any one of claims 13 to claim 8, wherein the computer device, both when uninstalling the software from the computer device, the token of the reference seed stored in side initial A license management method, comprising: an uninstalling step of requesting the tokenization, wherein the token initializes the reference seed according to a request from the computer device.

Images