KR20190068886A - Blockchain based Method and system for supporting open source software license compliance - Google Patents

Abstract

The present invention provides a system and method, in which a software information input terminal inputs information on a part or all of the software in accordance with a form provided by a corresponding terminal, a block chain node constituting a software information block chain network records the software information received through the software information input terminal on a ledger of each node, and an open source SW license compliance terminal of an open source SW license compliance system receives the information on the ledger of a block-chain network through a block-chain receiving unit upon request of open source SW license compliance and returns a compliance result. Through the present invention, it is possible to provide software information corresponding to a standard to a repository of the software information for an open source software license and extend the scope of the software information to provide license information that is not updated or missing. Further, it is possible to prevent the problem of forgery or falsification of information due to a problem or loss of a part of a network through the block-chain network.

Description

[0001] Blockchain based method and system for supporting open source software license compliance [

Systems that enter information about part or all of the software to verify compliance with the open source SW licenses of this invention, record that information via a block-chain-based network, support open source SW license compliance, ≪ / RTI >

Open source SW licensing technology

Open-source software license technology is an open-source software developer's description of the rights to open-source software, and specifies the scope of usage methods and conditions to the user. In order to use open source software, it must comply with the license of open source software, and if it is violated, it should have legal liability, product recall and redevelopment. Open source software requires licenses to meet the ten requirements of the Open Source Initiative (OSI) Open Source Definition (OSD), and to protect against open source software licensing disputes Many domestic and foreign companies involved in source SW compliance participate and conduct research and development.

Software Package Data eXchange (SPDX) technology

Software Package Data eXchange (SPDX) technology is a specification for exchanging package information in software, and was released by the Linux Foundation in 2010 to effectively address open source software licensing compliance. License information and copyright information related to the software package are comprehensively included. Details of the 2.1 version in 2017 include SPDX document creation information, package information, package configuration file information (File Information, Snippet Information, Other Licensing Information, SPDX Element Relationship Information, and Annotations, which track software license information in a standardized way with reduced redundancy. And deliver software information to the software supply chain.

Block Chain Technology

Blockchain technology is a decentralized system, which is different from a centralized database. It is also called a distributed branching technology that creates a block by grouping a lot of information and stores information through a distributed branch of nodes participating in a block chain. The block contains the hash value of the previous block plus the computational power, and since the nodes maintain the block chain through the distributed ledger, astronomical costs are incurred in order to modulate and counterfeit certain parts. Through this, the block chain is not only decentralization but also security and stability.

SUMMARY OF THE INVENTION The present invention has been made in order to solve the problems of the prior art, and an existing open source software (hereinafter referred to as an open source SW) license compliance verification terminal refers to an individual open source SW license database for compliance, There is a case where the source SW license is excluded or the information of the past is inputted before. Since this problem involves the problem of lowering the credibility of compliance results for open source SW licenses, the present invention provides a block chain system that an open source SW license terminal can reference, and that the open source SW license compliance terminal is reliable In the future.

It is another object of the present invention to provide a software information block for use in a software information block chain as structured and standardized documents for software information, And to prevent forgery and alteration of software information while disposing a specific central server utilizing a block-chain network without causing problems.

Another object of the present invention is to provide universality for storing software information by using standardized document format for verifying open source software license as a record of software information input terminal and block chain network, And to prevent tampering and tampering of the software information caused by the software.

According to a first aspect of the present invention, there is provided a software information input terminal for inputting information on part or all of software in accordance with a format provided by a corresponding terminal, The block chain node records the software information received through the software information input terminal on the node's own ledger, and when the open source software license compliance terminal of the open source software license compliance system receives the open source software license compliance request, And a method for receiving the information from the block chain receiver and returning the compliance result.

The software information input terminal requests to record on the block chain network after checking the grammar and regular parts to see whether the information is inputted according to the corresponding form.

The block-chain network, which is maintained through a block-chain node containing one software information ledger and one or more block-chain nodes, writes the information received from the software information input terminal to the software information ledger of each block-chain node. This allows the block-chain network to provide software information including open source SW information as well as private software information.

An open source SW license compliance system is a system that returns results on requests for compliance with open source SW licenses. An open source SW license that stores information gathered via block chain receivers. You can configure the collected open source SW license database.

The open source SW license terminal extracts the information to be compared from the block chain receiver or open source SW license database for software targeted for open source software license compliance, enforces open source software licensing compliance and returns the results.

The software information input form of the software information input terminal may include the source code information of the software, the software license information used as a basis, and the basic key value corresponding to the license information as a method of supporting license compliance.

Using a standardized form for software information, the information input form of the software information input terminal contains information for identifying the components, licenses, and copyrights associated with the software package.

The information recorded in the ledger of the software information block chain network is configured so as to include the same or the corresponding form according to the information input form of the software information input terminal.

Software information block The nodes in the chain network store and transfer the software information on the block chain network. In the block chain receiver of the open source software license compliance system, the information of the block chain network is processed as refined data as needed, Or selectively.

By recording the software information on the block-chain network through the system and method supporting the open-source SW license compliance of the inventive block chain as described above, the recording range of the software information storage corresponding to the existing open source SW license storage is expanded And the lack of credibility for open source software licensing compliance that was caused by missing and non-renewed information.

In addition, by recording software information on a block-chain network, all participating nodes maintain a ledger, thereby causing a problem in a part of the network, preventing forgery and tampering even in an attack such as DDos, and being recorded on a block- By utilizing the format of standardized documentation of software information, each open source SW compliance has an effect on the variety of formats and the inconsistency of content.

FIG. 1 is an overall configuration diagram of an open source SW license compliance support system based on a block chain comprising a software information input terminal, a software information block chain network, and an open source SW license compliance system according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. In the following description and the accompanying drawings, substantially the same components are denoted by the same reference numerals, and redundant description will be omitted. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

The present invention receives software information including information serving as a primary key for tracking software information, as well as source code and license information, and constitutes an asset of a block chain node so as to record the corresponding form, Configure the chain network to record software information. Here, the block chain platform or the development methodology changes the implementation and creation method of the software block chain network. The open source software license compliance system receives the information of the software information block chain network and uses open source SW license compliance The database is configured to support compliance through open source SW license compliance terminals.

1 is a block diagram of a block chain-based open source SW license compliance support system 100 according to an embodiment of the present invention. The system includes a software information input terminal 101, a software information block chain network 102, an open source SW license The software information block chain network 102 internally comprises one or more block chain nodes 201 and the open source software license compliance system 103 comprises a block chain receiver 301, an open source SW license database 302, and an open source software license compliance terminal 303.

The block chain-based open source software license compliance support system 100 is a system in which a requestor who wants to leave software information through the software information input terminal 101 records information in the software information block chain network 102, The consumer of the SW License Compliance Service receives an open source SW license system (103) through which the open source SW license is collided.

Since the record of the software information block chain network 102 is distributed in the ledger of the block chain node 201 participating in the block chain network and all the nodes are stored in the form of sharing the same record, even if the specific network is lost or attacked It is possible to prevent a situation where forgery and alteration occur.

A requester wishing to input software information of the software information input terminal 101 can be a developer who has developed the software, or a person who simply wants to leave information of the software. The software information input terminal 101 may be a device of such an information requester, which means any device capable of connecting to a block-chain network and recording information.

The information to be input through the software information input terminal 101 requires input related to tracking in order to support software license compliance. In addition, in order for the platform to support various open source SW licensing compliance schemes, the present invention should support standardized software information schemes rather than suggesting and following proprietary forms. As an example, this embodiment explains using the 2.1 version of SPDX (Software Package Data eXchange), which is standardized by the Linux Foundation for software information input.

The software information input terminal 101 acquires SPDX document creation information (Document Creation Information), package information (Package Information), package configuration file information (File Information), file fragment information (Snippet Information), license information SPDX 2.1 specification information about the details of the specified attributes included in each information (Information), other licensing information, SPDX element relationship information, and annotations can be confirmed .

In this embodiment, a unit classified by each information such as package information and package configuration file information classified according to the form of each SPDX 2.1 is referred to as an SPDX element, and the software information input terminal 101 stores attributes defined in SPDX 2.1 In addition, to support open source SW license compliance, set SPDX Identifier for each SPDX Element to a key value that is a combination of randomly specified string or numeric values that is not redundant to SPDX Identifier. This value is specified as the value of Relation in the SPDX Element attribute, which can form a tracking relationship for the use of open source SW licenses for specific software.

When the SPDX is input from the software information input terminal 101, the process is performed in the software information block chain network 102. The software information block chain network 102 is composed of a block chain node 201 participating in a block chain. The method of configuring the software information block chain 102 is based on an electronic money based ehterum, a bit coin It is possible to construct a block chain by selecting one of various block chain platforms such as BitCoin, Ripple or Hyperledger which is a private block chain for business and R3 Corda, The records of the director of the company must have a way of recording software information.

The present embodiment will be described using a Hyperledger Fabric among Hyper-Threading Projects among block-chain platforms, and will be described using terminology of the platform. The software information block chain network 102 provides a function for storing the inputted SPDX Element and transmitting the received SPDX Element to the open source SW license compliance system 103 so that the open source SW license compliance system 103 can receive and utilize the SPDX Element through a Smart Contract .

The SPDX Element stored through the software information block chain network 102 is used through the open source SW license compliance system 103 when it desires to receive open source SW license compliance services.

The open source SW license compliance system 103 receives the information of the software information block chain network 102 through the block chain receiving unit 301 and designates the open source SW license database 302 as necessary, The receiving unit 301 can directly transmit information to the open source SW compliance terminal 303. [ However, if there is a performance problem due to information retrieval in a block-chain platform, an open source SW license database 302 that periodically receives information from the corresponding software information block chain network 102 is required.

Also, the open source SW license database 302 is needed when it is desired to collect refined data from the software information block chain network 102. In the case of using an electronic money-based block chain platform, since transactions related to mining operations for issuing electronic money are continuously generated, when data of the software information block chain network 102 is periodically received, The open source SW license database 302 is required to collect data from which mining operation information is excluded. Therefore, even if another block chain platform as well as an electronic money basis is used, information input from the software information input terminal 101 If you do not trust all but have a database of existing open source SW license compliance, you need an open source SW license database 302 if you want to collect refined data compared to your database.

The open source SW license compliance terminal 303 uses the information received from the block chain receiving unit 301 or the open source SW license database 302 to generate an open source SW license of the corresponding terminal such as source code similarity, Performs the compliance service and returns the results.

Through the present invention, it is possible to provide the software information corresponding to the standard of the software information for the open source software license and extend the scope of the software information to provide the license information that is not updated or missing, Thereby preventing the information from being falsified and altered.

An apparatus according to embodiments of the present invention may include a processor, a memory for storing and executing program data, a permanent storage such as a disk drive, a communication port for communicating with an external device, a touch panel, a key, Or the like, and the like. Methods implemented with software modules or algorithms may be stored on a computer readable recording medium as computer readable codes or program instructions executable on the processor. Here, the computer-readable recording medium may be a magnetic storage medium such as a read-only memory (ROM), a random-access memory (RAM), a floppy disk, a hard disk, ), And a DVD (Digital Versatile Disc). The computer-readable recording medium may be distributed over networked computer systems so that computer readable code can be stored and executed in a distributed manner. The medium is readable by a computer, stored in a memory, and executable on a processor.

Embodiments of the present invention may be represented by functional block configurations and various processing steps. These functional blocks may be implemented in a wide variety of hardware and / or software configurations that perform particular functions. For example, an embodiment may include an integrated circuit configuration such as memory, processing, logic, look-up tables, etc., which may perform various functions by control of one or more microprocessors or by other control devices Can be employed. Similar to the components of the present invention may be implemented with software programming or software components, embodiments may include various algorithms implemented in a combination of data structures, processes, routines, or other programming constructs, such as C, C ++ , Java (Java), assembler, and the like. Functional aspects may be implemented with algorithms running on one or more processors. The embodiments may also employ conventional techniques for electronic configuration, signal processing, and / or data processing. Terms such as "mechanism", "element", "means", "configuration" may be used broadly and are not limited to mechanical and physical configurations. The term may include the meaning of a series of routines of software in conjunction with a processor or the like.

The specific implementations described in the embodiments are, by way of example, not intended to limit the scope of the embodiments in any way. For brevity of description, descriptions of conventional electronic configurations, control systems, software, and other functional aspects of such systems may be omitted. Also, the connections or connecting members of the lines between the components shown in the figures are illustrative of functional connections and / or physical or circuit connections, which may be replaced or additionally provided by a variety of functional connections, physical Connection, or circuit connections. Also, unless explicitly mentioned, such as "essential "," importantly ", etc., it may not be a necessary component for application of the present invention.

The present invention has been described with reference to the preferred embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

100: Block Chain-Based Open Source SW Licensing Compliance Support System
101: software information input terminal
102: Software information block chain network
103: Open Source SW Licensing Compliance System
201: Block Chain Node
301: block chain receiver

Claims (9)

As a block chain-based open source software license compliance support system,
A software information input terminal for inputting information on part or all of the software in accordance with a format provided by the terminal;
A block chain node constituting a software information block chain network for recording software information received through the software information input terminal into the ledger of each node; And
And an open source SW license compliance terminal for receiving the information of the ledger of the block chain network via the block chain receiver upon request of the open source SW license compliance and returning a compliance result. Support system. The method according to claim 1,
Wherein the software information input terminal requests to record on the block chain network after confirming the syntax and regular parts of the information in accordance with the corresponding form. The method according to claim 1,
The block-chain network, which is maintained through a block-chain node containing one software information ledger and one or more block-chain nodes, writes the information received from the software information input terminal to the software information ledger of each block- Is capable of providing software information including open source SW information as well as private software information. ≪ RTI ID = 0.0 > [0002] < / RTI > The method according to claim 1,
The open source SW license compliance system is a system that returns the results of a request for compliance with an open source SW license and an open source SW license that stores information gathered via block chain receivers. Is an open-source software licensing compliance support system that is based on a block chain that features an open source SW licensing database that can be configured to collect. The method according to claim 1,
The open source SW license terminal extracts information to be compared from the block chain receiver or the open source SW license database for software targeted for open source software license compliance, enforces open source software license compliance and returns the results Features a block-chain-based open source software license compliance support system. The method according to claim 1,
Wherein the software information inputting form of the software information input terminal includes the source code information of the software and the software license information used as basic information and includes a basic key value corresponding to the license information as a method of supporting license compliance. Chain based open source software license compliance support system. The method according to claim 1,
Wherein the information input form of the software information input terminal contains information for identifying components, licenses, and copyrights related to the software package when using a standardized format for the software information. system. The method according to claim 1,
Wherein the information recorded in the ledger of the software information block chain network is configured to include the same or corresponding form according to the information input form of the software information input terminal. The method according to claim 1,
The nodes in the software information block chain network store and transfer the software information on the block chain network, and the block chain receiver of the open source software license compliance system processes the information of the block chain network into the refined data as needed Wherein said at least one of said at least one of said at least two of said at least one of said plurality of said at least one of said plurality of said at least one of said plurality of said at least one of said clients.

Images