WO2015087444A1

WO2015087444A1 - License management system and license management method

Info

Publication number: WO2015087444A1
Application number: PCT/JP2013/083486
Authority: WO
Inventors: 治峯田
Original assignee: 株式会社日立システムズ
Priority date: 2013-12-13
Filing date: 2013-12-13
Publication date: 2015-06-18

Abstract

　The present invention provides a means capable of reliably detecting the illegal use of a license in a virtual environment or a cloud environment, and a system and method for correctly managing a software license while moving, duplicating, and deleting a virtual machine in the cloud environment. License manager software is installed and used in a physical machine using software within a network environment. To ensure that the total number of licenses used in all networks being used by a user is less than or equal to the number of purchased licenses, communication is performed among an on-site which is a user's network environment, a cloud site, and an application vendor site which is the source of an application being provided, the total number of licenses is confirmed, and license authentication is performed at each site.

Description

License management system and license management method

The present invention relates to a license management system and method, and more particularly to a floating license management, a license manager, a license management system, and a license management method corresponding to a cloud and a virtual environment.

In a computer network environment that does not include a virtual machine and includes only a physical machine, there are roughly two types of software license management technologies. A node-locked license method for specifying a physical device using a physical device such as a USB device, There is a floating license technique that uses unique information (host ID, MAC address, etc.) of a physical machine and monitors and manages software activation in the same network by license management software called a license manager.

However, in recent years, with the progress of virtualization and cloud environments, license protection technology, license management system, and license management method in environments including virtual machines are becoming important technical issues for application vendors, users, and cloud vendors. In other words, if one or more software licenses purchased by the user from an application vendor for a fee are copied, a virtual machine file containing the software for which the license has been activated (authenticated) can be duplicated, and licenses that are not originally permitted can be easily obtained. There is a problem of being duplicated and authenticated. On the other hand, however, there are demands for rapid load balancing of computer resources and disaster recovery (Disaster Recovery) by virtual machine duplication and migration as virtual merits and cloud technology. In addition, with the advancement of cloud technology in the future, users' computer resources will be quickly arranged among environments such as on-site user network environment, user's private cloud environment using specific cloud vendors, multiple different public cloud environments, It is assumed that the entire computer resources are efficiently operated by migration and diversion.

Non-Patent Document 1 is known as a conventional technique for managing software licenses in a virtual environment. Specifically, when a physical machine is equipped with a license manager that performs license management, it is prohibited to virtualize the machine with the license manager, and when license-managed software is used in a virtual environment, By authenticating the virtual machine with the license manager in advance, the virtual machine and the physical information of the physical machine having the license manager are linked. Then, the software to be used for the authenticated virtual machine is installed. In this case, after installing the license manager on a physical machine in the company and then installing the software on a virtual machine on an external cloud site, the user creates the virtual machine and then the global IP of the physical machine in the company. After performing the procedure of specifying the address and authenticating the virtual machine with the license manager, the software is installed in the virtual machine.

Further, in Non-Patent Document 2, in order to specify a virtual machine, a method using UUID is adopted, and a method of specifying a virtual machine by the same method as specifying a physical machine is adopted.

Special table 2008-547088 Special table 2009-503737 JP 2006-18815 A WO2011 / 083673 JP 2011-013729 A JP 2010-287081 A JP 2010-267909 A JP 2012-208752 A

However, the methods described in Non-Patent Documents 1 and 2 require a restriction condition that prohibits the use of software itself called a license manager that executes license management on a virtual machine, and the license manager is installed. It is requested as a prerequisite that the physical machine to be used is prepared and operated on the physical machine at the user site. In addition, when a user installs and uses an application in an external private cloud or public cloud, the cloud vendor does not disclose physical machine information to the user due to the general nature of the cloud. Can be used for a virtual machine and an OS environment on the virtual machine. Therefore, if you install the software application you want to use on this virtual machine on the cloud and use the application within the number of purchased licenses permitted by the application vendor in the license agreement, An operating application needs to access a license manager installed on a physical machine at a user site and perform license authentication processing. For this reason, it is a serious security issue that the user must open the physical machine prepared at the user site to the global IP address instead of the local IP address in the network, and install the physical machine outside the firewall. Challenges are essential. There arises a problem that the user has an information security problem that the global IP address of the physical machine in the company must be disclosed to the outside. Also, when planning to quickly migrate or replace a virtual machine between your company's site and cloud site, you can activate the license by simply copying the created virtual machine file to the machine where the corresponding software is installed. There is no need to repeat the installation procedure every time.

Further, in the method described in Non-Patent Document 3, UUID (Universal Unique Identifier) is used as a method of finger printing (fingerprint authentication) of a virtual machine, and by generating a UUID for each virtual machine, each virtual machine Uses a method of identification and identification. However, there is a possibility that the same ID is generated with a probability of 1/61 to the power of UUID, and as a practical means, it may be used, but there is a risk that a malfunction will occur with a certain probability Accompanied by.

Patent Documents 1 and 2 are inventions related to a license management technology called a license manager in one or a plurality of network environments, but the scope is only a physical machine, and in a virtual environment and a cloud environment, , Not applicable.

Patent Document 3 relates to an accounting method for an application and an OS on a virtual machine in a virtual environment, and automatically checks the OS or application license required for newly creating a virtual machine while checking the number of licenses used. In case of authorization or shortage, it is devised to automatically obtain the license from the license vendor if necessary, but there is no clear way to authenticate the license when the user duplicates the virtual machine. Therefore, it is impossible to solve the problem that this patent devise aims.

Patent document 4 is a disclosure of information based on a gazette related to the priority claim in Japan of a US application patent, but it is a so-called patent concerning individual identification, identification, and fingerprint authentication (Finger Printing) of virtual machines. Identification management technology based on the premise that there is a privilege to manage the hypervisor on the hypervisor that is the virtual infrastructure on the physical server by associating the information of the physical server that is the parent to the generated virtual machine The method for identifying the license of the application for each virtual machine is not presented. In addition, even if an assertion is made that this technology is applicable and can be applied to application license management, license management during migration of virtual machines usually performed by users between cloud environments, In order to apply the technology, it is essential to access the database managed by the hypervisor from any application, and there is no guarantee that it can be applied arbitrarily depending on the configuration and design contents of the application. I have to say that the possibilities are limited. Even if it can be applied, in order for an application to access license management information, communication with database information managed by the hypervisor is indispensable. It is assumed that the performance cannot be achieved as specified.

Patent Document 5 is a method for registering and managing link information between a virtual machine host and a virtual machine in a DB for a virtual machine created on a virtual machine host on a physical server. It assumes administrator privileges on the visor and proposes a method for identifying and specifying the creation, duplication, and deletion of individual virtual machines. It can be said that the present invention is also difficult to solve the problem aimed by the present invention for the same reason as the patent document 4 of the previous example.

Patent Document 6 is a process in which a software ID is pre-assigned to an application in a virtual machine environment, the state (starting, stopped, etc.) is held as DB data outside the hypervisor, and has a hypervisor privilege. Regarding how to manage the number of licenses for an application, it is necessary to have hypervisor privileges, there is no explicit way to prevent virtual machine duplication, malicious license abuse, and new application installations. In such a case, it is necessary to register in advance in the SW-ID and the corresponding database, and there is a strong restriction that it cannot be realized only by user authority. In other words, there is no method for dealing with migration of virtual machines between clouds that is assumed to be used by the user in the cloud environment, which places strong restrictions on the user's use environment.

Further, Patent Document 7 discloses a system and method for counting the number of licenses according to the accounting type and method between a user and a software vendor in a virtual environment, and it is also possible to cope with copying of a virtual machine and the like. However, the countermeasures for license management for each virtual machine, duplication after activation, and duplication of the license management apparatus are not clearly described.

Patent Document 8 discloses a management method in which a virtual machine and a physical server are linked on a hypervisor, and the license management standard is not only a valid number of licenses but also a type in which the license cost varies depending on the number of CPU sockets. It is disclosed as a method that can cope with a license system. However, in the present invention, a method for preventing unauthorized use of a license when a virtual machine whose application license is once authenticated is not clearly described, and the object cannot be achieved.

As described above, there are some problems in the software license protection, authentication and management methods and systems in the cloud and virtual environments. In this situation, users plan to virtualize and cloud in order to reduce the cost of IT systems. However, in order to be able to use many softwares that have been used in virtual and cloud environments, It is necessary for application vendors to be able to use the license management method in a virtual environment and cloud environment in a reliable manner in a reliable manner.

Therefore, the present invention reliably protects software licenses sold by application vendors in the cloud and virtual environments, and also allows users to quickly migrate and build environments between different clouds and virtual environments. The present invention provides a license management system and a license management method in a cloud and a virtual environment that can exhibit the advantages of the cloud and the virtual environment.

In addition, when users use licensed software in the cloud and virtual environments, the cloud and virtual environments do not cause security problems such as external disclosure of the global IP address of the physical machine at their site. A license management system and a license management method are provided.

In order to solve the above-mentioned problems, the present invention installs a license manager that manages licenses of operating software on a physical machine at a user site, an application vendor site, and a physical machine at a cloud site, so that user information and cloud site information are provided. By checking each license manager information and the number of licenses used, it is possible to prohibit the license manager from becoming a virtual machine and to verify the number of purchased licenses and the number of concurrent uses for each user. In addition, it is possible to reliably execute license management even if a virtual machine with the corresponding software installed, including multiple cloud sites, is moved or copied.

According to the present invention, in the virtual environment and the cloud environment, the license management technology of the application vendor is ensured in the virtual environment and the cloud environment, and the limited provision of the software license that the application vendor has conventionally limited to the physical environment is provided. Can be provided with the same level of certainty as before, and users can dynamically move and copy virtual machine files, which are the merits of the virtual environment and cloud, without being restricted by license management technology. It becomes possible.

FIG. 1 is an explanatory diagram showing a license management system according to the present invention. FIG. 2 is an explanatory diagram showing an example of moving and copying a virtual machine in which a user has installed software between a company site and a plurality of cloud sites on the license management system of the present invention. FIG. 3 shows a license authentication permission / denial method for copying a virtual machine including an application subject to license management in a case where a virtual machine copy is copied in the same physical machine in the license management system of the present invention. It is explanatory drawing shown typically. FIG. 4 shows the license authentication permission and non-permission of the license management system according to the present invention when the virtual machine copy is copied between different physical machines in the same network. It is explanatory drawing which shows the method of permission typically. FIG. 5 is a diagram showing a method for managing the number of licenses in a state where the application process once properly activated is stopped for some reason and the license manager has not detected it yet. It is a schematic diagram. FIG. 6 is an explanatory diagram showing a mode of performing license management of two softwares in the license management system of the present invention. FIG. 7 is an explanatory diagram of a license management system showing another embodiment of the present invention. FIG. 8 is a flowchart showing the operation of the license management system of the present invention. FIG. 9 is a flowchart showing the operation of the license management system of the present invention. FIG. 10 is an explanatory diagram showing an application example of the license management system of the present invention.

Hereinafter, embodiments of the present invention will be described in detail. FIG. 1 shows a license management system for performing license management of specific software 50. A user's on-site network environment (11) (hereinafter referred to as on-site), a private cloud environment (12) (hereinafter referred to as private cloud) constructed as a cloud environment, and an application vendor site (hereinafter referred to as application vendor) (Referred to as a site) (10) is connected via the Internet.
The application vendor site (10) includes at least a server (60) as a physical machine, and the server (60) includes a license manager for managing a license of software (50) used by a specific user. The server (60) on the application vendor site (10) side is made public on the Internet (that is, a global IP is assigned), the license manager on the application vendor site side is accessed from the license manager on the user side, and the license is related. It is not necessary to disclose the global IP address in the on-site environment (11) and the private cloud environment (12), and the license is not reduced without reducing the security on the network on the user side. Management can be performed.

The on-site (11) and the private cloud (12) are composed of a plurality of physical machines (20). Under each network environment, at least one physical machine (20) includes a license manager (31), (32). Further, the physical machine (20) different from the license managers (31) and (32) includes a hypervisor (foundation software for starting a virtual machine), and the physical machine (20) includes one or more virtual machines. (40) is activated. The physical machine (20) and the virtual machine (40) are permitted to be used with activation of the software (50) only for those that have been subjected to the activation process described later.

In FIG. 1, the number of physical machines (20) and the number of virtual machines in the onsite (11) and private cloud (12) are the same, but these numbers are appropriately selected by the user in each environment. It is possible and is not limited to the configuration shown in FIG.

In FIG. 1, the user purchases the right to use the software (50) from an application vendor and obtains one or more licenses from the application vendor. The software (50) can be installed on physical and virtual machines in the onsite (11) environment. In order to activate and authenticate a license, a license manager (31) which is software for managing a license included in a physical machine (20) on the same network as the installed software (50) By performing communication, the license of the software is valid, and a predetermined user purchases and confirms the number of purchased licenses and information for specifying the network environment as the usage environment. The authentication of (50) is performed. The user information, the network environment as the usage environment, and the information on the physical machine (20) in which the license manager (31) is installed communicate with the server (60) of the application vendor site (10) via the Internet. The server (60) is authenticated by the license manager (30) of the application vendor site.

Further, in FIG. 1, in addition to the on-site (11) network, a private network, that is, a private cloud (12) is constructed at the same location, another business office, or a cloud vendor site that provides the cloud, and the software is installed. Shows how it is being used. Also in this case, as in the case of the on-site (11), the license manager (32) is provided in at least one physical machine (20), and the network information and physical information of the private cloud (12) are provided from the license manager (32). The machine information and user ID information are transmitted to the license manager (30) of the application vendor site (10), and the license manager (32) itself is first authenticated. In addition, the software (50) is installed on the physical machine (20) and the virtual machine (40) in the private cloud (12), and license authentication is realized.

Further, in FIG. 1, actions such as movement, duplication, new creation, and deletion of the virtual machine (40) between both the on-site (11) network and the private cloud (12) network, that is, about the virtual environment and Editing means such as movement, duplication, new creation, and deletion of data files that are normally used in a cloud environment can be implemented. In the present invention, even in such a case, software license authentication can be realized as it is.

That is, as the virtual machine (40) is moved as a file, the number of valid licenses in each of the on-site (11) and the private cloud (12) varies, so the license managers (31), ( 32) detects the change in the number of licenses, updates the latest information by communicating with the license manager (30) of the application vendor site (10), and exceeds the number of available licenses. When (50) is activated, this is prohibited.

In addition to other sites, that is, on-site (11) and private cloud (12) shown in FIG. 1, there are similar network environments (for example, second and third private clouds), and the use of software is also performed there. If the number fluctuates, the number of valid licenses is confirmed with the license manager (30) of the application vendor site (10). If the number of valid licenses exceeds the upper limit, the software (50) is newly activated. However, both the physical machine (20) and the virtual machine 40 are prohibited.

The application example of the present invention shown in FIG. 2 is an embodiment in a general-purpose cloud environment using a public cloud or the like. The user who uses the software (50) confirms the information (one or more) of the destination cloud service vendor and the physical machine information provided with the license manager, and the license manager installed in the company site. In addition to the physical machine information including the information, it is registered on the application vendor site.

Each license manager is limited to be provided on a physical machine. Even if a physical machine having a license manager is virtualized and duplicated, the system information of the OS (operating system) on the virtual machine is included. By accessing, it is possible to detect that a physical device such as a CPU (Central Processor Unit) or NIC (Network Interface Card) being used is a virtualized device. Since the physical machine including the manager also has information uniquely specified by physical hardware specific information such as HostID, MAC address, Volume Serial, etc., for example, as shown in FIG. M01) is copied to the cloud site 1 as the virtual machine 13 (VM13), or the virtual machine 12 (VM12) of the cloud site 1 is moved to the cloud site (12) as the virtual machine 22 (VM22). The license manager (10) can detect and identify whether the software is a software operating on a registered physical machine or a software copied as a virtual machine.

As described above, the license manager function can be disabled by copying by virtualizing a physical machine having a license manager, which is the first problem of software license protection in a virtual environment and a cloud environment.

Next, as a second issue of software license protection when virtual environments coexist, license protection when a physical machine or virtual machine with installed software is duplicated will be described. First, consider a case where software is installed in a physical machine, a license of the software installed in the physical machine is authenticated and activated by a license manager in the network, and the physical machine is virtualized.

First, since multiple virtual machines created on the same physical machine inherit the host ID, MAC Address, Volume Serial, etc. from the physical machine, each ID information of the virtual devices included in all virtual machines The virtual machine is the same as that of the created physical machine. However, considering the precondition that the network connection function is indispensable, the management function of the hypervisor (virtualization infrastructure software) on the physical machine is indispensable for actually using the virtual machine. The network IP addresses of all virtual machines are necessarily different and must be set so that they do not overlap.

As a result, it is inevitable that all virtual machines created on the same physical machine have different IP addresses as long as the network function is used. Therefore, the license manager that manages licenses for software placed on the same network as the physical machine has the same host ID, MAC Address, Volume Serial, etc. for virtual machines created on the same physical machine. In addition, it is possible to identify and specify individual virtual machines by identifying that the IP addresses are different. Therefore, the license manager correctly manages the virtual machines and physical machines that use the software license correctly by strictly counting the number of licenses for virtual machines created on the same physical machine. Can be prevented from being illegally used. If this occurs simultaneously on your own site or multiple cloud sites, ensure that the total number of licenses that are used effectively is less than or equal to the number of purchase contract licenses to properly protect the software licenses. I can do it.

Next, when multiple virtual machines are created on multiple physical machines in the same network, or when a virtual machine on one physical machine is moved or replicated on another physical machine in the same cloud think of. In this case, as described above, since the unique information of the original physical machine is different, the virtual CPU information, the virtual NIC information, and the like are different, but it is natural that the network IP addresses are the same. . In this case, the network constructed on the two physical machines as seen from the end user is separated, such as when different physical machines are limited to independent end users. In the cloud site, the case where the network IP address is applied may occur. Therefore, in such a case, the license manager confirms other Host ID and MAC address information only when the information that the license manager is a virtual machine and the network IP address is the same, and the same It is possible to identify whether it is a duplicate of a virtual machine or another virtual machine. As a result, the license manager can uniquely identify a virtual machine existing in the same network, so that it is possible to correctly manage the license of the software being used and to prevent unauthorized use of the license.

As another license monitoring method, the network function is disabled in the same physical machine installed in the same cloud site, and then the virtual machine is duplicated as the same one and the CPU resource is used in the virtual machine. When using software by duplicating and duplicating software licenses, that is, after creating a virtual machine on one physical machine and activating the software correctly, multiple copies of the virtual machine are used Is assumed. In this case, it relates to the problem of how to activate the software installed in the virtual machine and how to activate the normal operation using the license manager existing in the same cloud. Generally, at the timing when this software is activated, a communication process for performing license authentication to the license manager is performed. However, if a virtual machine that contains software after license authentication is copied and used, the software on the copied virtual machine is already authenticated, and the software is not always in an abnormal state. You will be able to use it normally.

However, even when a virtual machine including license-authenticated software is activated and activated by the hypervisor software, the virtual OS on the virtual machine recognizes the activation of the software. After identifying that the software is in a state different from the normal activation state, the license authentication process is performed by performing activation license confirmation processing on the license manager.
Therefore, even if a license-authenticated virtual machine is duplicated, the software is activated by the license manager when the software is activated, so that the software has the same valid license ID and virtual machine information as the copy source. However, it is possible to identify that the use of the software by the replicated virtual machine is illegal by the license confirmation process from the replicated machine.

Furthermore, license authentication when the virtual machine information such as the above-mentioned IP address is all the same requires classification under the following conditions and addition of software-based function processing to the license authentication process.

In other words, if the software on the virtual machine or physical machine that was successfully activated first is operating normally, the software activation and virtual If the license authentication process at the time of starting the machine is performed, it will be the second time together with the first normal process, and it is possible to refuse the license use, but in this case, it is used normally at the copy source It is necessary to perform software processing on what kind of judgment is appropriate when software or a virtual machine using a license that has been used is suddenly stopped or deleted. In this case, if the license manager cannot recognize that the execution process of the software has disappeared, one license that must be released is inadvertently occupied. In such a case, depending on the individual design of each software, it is a process that notifies the license manager when a specific process stops or disappears, or at a certain time interval. Various application examples such as a manager confirming the process operating state of software are possible.

In FIG. 2, each of the user site, the plurality of cloud sites, and the application vendor site is described. However, as different from FIG. 1, there are various cloud usage forms, and the application of the present technology is possible. Each method is compatible with each method.

Also, as a modification, a method that does not use the application vendor site, that is, does not use authentication of user or cloud site information by communication processing with the application vendor site is conceivable. In this case, the application vendor manages license information such as which cloud the user who purchased the software is using, and the like only by information in advance notification. There is no contradiction.

The virtual environment described above and the software license identification and counting method in the cloud will be described with reference to FIGS. These figures show a case classification when a user replicates a virtual machine with respect to a virtual machine constructed on a physical machine and a software application installed on the OS of the virtual machine. In order to simplify the explanation, it is assumed that the number of license purchases is N = 1.

FIG. 3 shows that in an independent network environment (onsite, private cloud, public cloud), a virtual machine (VM1) in which software (AP1) is installed is replicated in the same physical machine in one physical machine (SV1). The case where the virtual machine (VM1c) including the copied software (AP1c) is generated is shown. This state transition is schematically displayed as (SV1, VM1, AP1) → (SV1, VM1c, AP1c). In this network, there is an installed license manager (LM) limited to a physical machine, and (AP1) and (AP1c) communicate with the license manager (LM) in order to realize their operations and functions. Accordingly, when the number of licenses (activation) or the number of purchased licenses (license upper limit value) is exceeded, the license authentication is not permitted (deactivation). Whether a software process (AP1) has been authenticated or is not authenticated is realized by a processing method that can be executed in a communication process with the license manager (LM). For example, the presence or absence of an electronic file generated by the license manager (LM), electronic data described in the generated electronic file, or a variety of software processing methods can be used. The license manager (LM) can change the permission / non-permission of the data as necessary.

FIG. 4 shows a virtual machine (VM1) in which software (AP1) is installed between two different types of physical machines (SV1) and (SV2) in an independent network environment (onsite, private cloud, public cloud). A case where a virtual machine (VM1c) including the copied software (AP1c) is generated by copying between physical machines is shown. This state transition is schematically displayed as (SV1, VM1, AP1) → (SV2, VM1c, AP1c). In addition, in this network, there is a license manager (LM) installed only on a physical machine, and (AP1) and (AP1c) communicate with the license manager (LM) to realize their operations and functions. Accordingly, when the number of licenses (activation) or the number of purchased licenses (license upper limit value) is exceeded, the license authentication is not permitted (deactivation). Whether a certain software (AP1) has been authenticated or in an unauthenticated state is realized by a processing method that can be executed in a communication process with the license manager (LM). For example, the presence or absence of an electronic file generated by the license manager (LM), electronic data described in the generated electronic file, or a variety of software processing methods can be used. The LM can change the permission / deny of the data as needed.

FIG. 5 is a schematic diagram related to the state change of the virtual machine (VM1) and the software (AP1) described in FIG. 3 and FIG. The case where the software AP1 which has been operating normally ends abnormally due to a malfunction of the calculation processing or the like and the process of the software (AP1) is lost is shown. A schematic diagram of this state change is shown as (SV1, VM1, AP1) → (SV1, VM1, Null).

FIG. 6 schematically shows an example of processing based on the case of license authentication processing in accordance with the state change in FIGS. 3 to 5 described above. In order to simplify the description, the description will be made assuming that the total number of clouds is 1, and the upper limit of the number of licenses that can be used simultaneously by the user is 1. However, the same applies to the case where the number of licenses is 2 or more.

First, in the example of FIG. 3, when the software (AP1) uses one license on the virtual machine (VM1) and the virtual machine is replicated from (VM1) to (VM1c), the virtual machine (VM1) Since the virtual machine (VM1c) that is duplicated is managed by the hypervisor software as an equivalent electronic file, the software (AP1) that is running on the virtual machine (VM1c) is also duplicated and duplicated. The lost software (AP1c) is already authenticated in the same manner as the software (AP1). Therefore, in this state, two applications can be illegally used with respect to the upper limit number 1 of licenses. However, when the replicated virtual machine (VM1c) is activated, when the guest OS of the virtual machine (VM1c) is activated, a process associated with the software (AP1) is activated to automatically authenticate to the license manager (LM). It is possible to start the confirmation process.

Since the software AP1 operates under the OS on the virtual machine (VM1), if the authority is given by programming a process that can be executed in accordance with a command operation on the OS using a script language, etc., the guest Instead of the user managing the OS, it is possible to acquire virtual machine (VM1 specific information) such as HostID information and IP address information of the virtual machine (VM1). Therefore, the software (AP1) is a license manager. (LM) can notify the license manager (LM) of the HostID and IP address information of the virtual machine (VM1) in which the software (AP1) is operating. Similarly, the virtual machine (LM1) VM1c) HostID, IP address information from License Manager (LM) In the case of Fig. 3, since it is a copy of a virtual machine inside the same physical machine, the HostID is the same but the IP address is different. The license manager (LM) confirms the license information of the software (AP1c) that accompanies the generation of the virtual machine (VM1c) by checking that the software on the virtual machine (VM1c) is based on the condition “same HostID, different IP address”. It is possible to identify that the access from the (AP1c) is different from the access from the software (AP1) on the virtual machine (VM1), and therefore the software (AP1c) Process to cancel the activated license and change to the non-activated state. It will be.

Similarly, in the example of FIG. 4, the virtual machine (VM1) is replicated to a virtual machine (VM1c) on another physical machine (SV2) in the same network. In this case, the Host ID is different, This corresponds to the case where the IP address is the same for the virtual machine (VM1) and the virtual machine (VM1c). In the replication of the virtual machine file between different physical machines, the information of the part corresponding to the model dependence is appropriately updated, but the change application process of the virtual machine file by these processes is irrelevant to the present invention. Here, the explanation is omitted. As in the case of FIG. 3, in the case of FIG. 4, in the course of the license authentication process from the software (AP1c) to the license manager (LM), the host ID is different and the IP address is the same. It is possible to notify the license manager (LM) from AP1) and (AP1c). Based on this information, the license manager (LM) can change the license of the software (AP1c) on the virtual machine (VM1c) to a non-activated state.

If the software process disappears after the authentication shown in Fig. 5, some cases are required. First, let us consider a case where the application process of the software (AP1) disappears for some reason after the virtual machine (VM1) is authenticated and the software (AP1) is not replicated. In this case, there are various cases such as whether the license authentication information authenticated by the license manager (LM) is stored as an electronic file or recorded in a specific registry on the physical machine where the license manager (LM) is installed. However, this is not a problem when the license manager (LM) is configured with an algorithm that automatically resets. The problem is that the license manager (LM) cannot confirm the disappearance of the software (AP1), and even if the process of the software (AP1) disappears, the license is still occupied and there is no free space for the new license. Is the case. In this case, there is no problem if the license manager (LM) can periodically check the process state of the software (AP1) to recognize the dead state of the process of the software (AP1) and release the license with this. For this purpose, however, it is necessary to check the process state of the software at an arbitrary timing such as one hour, ten minutes, or one minute interval. Although these methods are possible, it is not preferable that the new software cannot be started when the user tries to launch the software in a separate process before the license manager (LM) recognizes the license status of the software. There is a possibility that it will be recognized as a trap. In this situation, when the user restarts the software (AP1) on the virtual machine (VM1) whose process has disappeared, the combination of the registered HostID and IP address by accessing the license manager (LM). Since the software (AP1) of the already registered virtual machine can be identified, the license manager (LM) updates the license authentication information again and overwrites the software (AP1).

Subsequently, in a state where the process of the software (AP1) has disappeared, the user does not restart the software (AP1), but the virtual machine (VM1) and the software (AP1) are replaced with the virtual machine (VM1c) and the software (AP1c). ). In this case, both of the software (AP1) and (AP1c) are installed in the virtual machine and there is no activated process, but the data recording the license authentication information is “virtual machine (VM1), software (AP1) ”. In this state, when the software is started as “virtual machine (VM1c), software (AP1c)”, when the software accesses the license manager (LM), the license manager (LM) is not changed to the software (AP1c). On the other hand, processing for license authentication non-permission is performed. Therefore, as one embodiment of the present invention, the license authentication process is performed as follows. That is, in response to the license authentication request for “virtual machine (VM1c), software (AP1c)”, the corresponding HostID in the license authentication data recording information for the combination of “HostID, IP address” as the identification information. Are accessed to the virtual machine (VM) software having the same IP address and the software of the virtual machine having the same IP address, and the operation state of each software is confirmed. That is, it is confirmed whether the software is operating on a combination of virtual machines other than “virtual machine (VM1c), software (AP1c)”. If the software is not operating in any other combination, the requested license of “virtual machine (VM1c), software (AP1c)” is authenticated by resetting the license authentication state of the corresponding software to unused. And record the authentication status data. By this method, it is possible to correctly authenticate the license by updating the license information of the software that is in use on the license information record but has actually lost the process.

Similarly, even when the replication from the virtual machine (VM1) to (VM1c) is between different physical machines, even if the IP address is the same, by identifying the information that the Host ID is different, the “virtual machine” It is possible to change the license status of “(VM1), software (AP1)” to unused and correctly authenticate the license of “virtual machine (VM1c), software (AP1c)”.

In the above description, the case where one user uses one type of software has been described. However, the present invention is not limited to this. An example in which one user uses a plurality of types of software requiring license management in the company and at one or more cloud sites will be described with reference to FIG. In order to simplify the description, software used by the user is assumed to be two types, software A and software B. A server (60) having a license manager A0 (30a) is installed at the application vendor site A (10a), which is the provider of the software A. Similarly, a server (60) having a license manager B0 is also installed at the application vendor site B, which is the provider of the software B.

On-site (11) and private cloud (12), a license manager will be installed for each software used. Specifically, a plurality of physical machines (20) are installed at the on-site (11), and one of them always has a license manager corresponding to software. In this embodiment, the license manager A1 (31a) for the software A and the license manager B1 (31b) for the software B are installed in the same physical machine (20). May be. Similarly, the private cloud (12) is also configured to include a license manager A2 for software A and a license manager B2 for software B in any one of the plurality of physical machines (20). Thus, even when one user uses a plurality of software, the present invention can be applied without any problem.

Next, a case where the license management authority is given to the user from the application vendor site will be described with reference to FIG. FIG. 7 shows a case where the same cloud vendor is used by two users. Similarly to FIG. 6, software used by the user is assumed to be two types, software A and software B. A server (60) having a license manager A0 (30a) is installed at the application vendor site A (10a), which is the provider of the software A. Similarly, a server (60) having a license manager B0 is also installed at the application vendor site B, which is the provider of the software B. The license management authority is not given to the user 1, and the license manager for the software A (31a) and the license manager for the software B (31b) are provided in the onsite (11) of the user 1, and the cloud vendor has Are provided with a software A license manager (331a) for user 1 and a software B license manager (331b) for user 1. That is, license management for the user 1 is the same as that shown in FIG. Therefore, a detailed description of the license management method for the user 1 is omitted.

The license management authority is given to the user 2 in both the software A and the software B. Unlike the case of the user 1, the license manager 32a and the license manager 32b included in the user 2 are registered on the application vendor site A ( It is assumed that the use of each software can be authenticated up to the upper limit of the license held by the user 2 alone without going through the license managers (30a, 30b) of 10a) and B (10b).

At this time, the license management status is notified from the license manager (332a, 332b) for the user 2 provided on the cloud vendor (13) side to the license manager (32a, 32b) on the onsite (11a) side of the user 2 Then, it is necessary to disclose the global IP address on the onsite (11a) side of the user 2, which is not preferable for communication security. Therefore, the authentication status is acquired from the license manager (32a, 32b) on the onsite (11a) side of the user 2 toward the license manager (332a, 332b) on the cloud vendor (13) side that is the provider of the public service. It is desirable to have a configuration that goes. As a result, the license manager (32a, 32b) installed on the site (11a) can access the license manager (332a, 332b) on the cloud vendor (13) side at any time, and the virtual machine Can handle a variety of individual cases and exceptions related to duplication.

However, it is difficult to obtain information on the above-described special examples (deletion of virtual machines, hang-ups, etc.) freely in the network on the on-site (11a) side as it is. In this case, the current status of the license information by communication between the license managers is not executed on demand on a timely basis, but in advance from the license manager (32a, 32b) on the onsite (11a) side at intervals of 5 minutes. By setting a rule such as periodically communicating to the license manager (332a, 332b) on the cloud vendor side, timely update can be performed with a resolution of 5 minutes. Of course, it is possible to set 5 minutes to other time.

A specific operation of the license management system 1 will be described with reference to FIGS. First, access is made to a machine that has been permitted to be used by the license manager, and whether or not the machine is being started is checked, and whether the machine is being stopped due to a failure or the like is checked (S401). Subsequently, it is determined whether or not the number of valid licenses is decreasing (S402). If the number of valid licenses has decreased (Yes in S402), the license manager LM1 updates the number of valid licenses at that time to the latest state in order to permit the activation of applications corresponding to the decreased number of licenses (S403). It communicates with the license manager of the application vendor site and sends the number of valid licenses in the cloud site to the server 60 that manages the total number of valid licenses (S404). The number of all valid licenses is updated to the latest state (S405). If the number of valid licenses has not decreased (No in S402), the processing from step S403 to step S405 is skipped.

After updating the number of valid licenses, the authentication process specific to the application startup is performed from either the physical machine or virtual machine in the cloud site and the physical machine or virtual machine on the user's on-site. The system waits until a notification is made to the license manager (S501). When the authentication process is executed and the process request is notified to the license manager (YES in S501), the process request is notified to the server 60 of the application vendor site (S502). It is determined whether or not the number of all valid licenses being activated by the user has reached the specified number (S503). If the predetermined number has not been reached, the total number of valid licenses is updated (S504), the license of the machine that has requested the authentication process is validated (S505), and the number of valid licenses is updated (S506). If the number of all active licenses being activated by the user has reached the specified number (No in S503), the activation request specific authentication request is notified that the number of licenses is insufficient, and the user is not authenticated (S507). ). When a series of authentication processes is completed, the process loops to step S401.

Subsequently, a case where a plurality of users use one round vendor will be described with reference to FIG. In this case, it is necessary to manage licenses of applications of different vendors by the same license management system, and to manage setting / operation using a predetermined template for the application vendors from the license management system. This template specifies at least the cloud vendor ID (CSVID) that identifies the cloud vendor, the global IP address of the physical machine that implements the license manager, the user ID (UID), the password used to authenticate the user ID, and the application Application ID (AID), and an application vendor ID (AVID) for specifying an application vendor site that provides the application.

Each symbol n, m, l shown in FIG. 10 stores (n: CSVID, m: UID, l: AVID). The cloud vendor 13 stores “1” in the CSV ID, the user 11 a is assigned “1” to the UID, the user 11 b is assigned “2”, and the user 11 c is assigned “n” sequentially. When creating a machine, it is required to be able to specify which virtual machine was created by which user by these UIDs. In addition, each application vendor site is given an AVID, and when accessing the license manager of the cloud vendor 13, the AVID is notified to identify which application vendor site provides the application. Manage licenses for applications provided by vendor sites. In this way, by assigning CSVID, UID, and AVID (including AID when the application vendor provides multiple types of applications) during the communication of the license manager, which user is in which cloud site By specifying which application of which application vendor is used, license management can be performed even when a plurality of users use several types of applications on the cloud.

That is, with the configuration shown in FIG. 10, the license management of the virtual machine deployed on the cloud site can be performed by one license manager installed in the cloud vendor 13. Moreover, even when there are a plurality of users, it is possible to identify the users by distinguishing the virtual machines for each UID based on the UID assigned in advance. Even if it is used, license management for each user can be performed correctly.

The embodiments of the present invention have been described in detail above. However, the present invention is not limited to the above-described embodiments, and various modifications can be made within the scope of the present invention. For example, the license information recording data described above is stored in an electronic file, database, registry database on the physical machine where the license manager is installed, as well as in an electronic file, database, registry database in each virtual machine, etc. The method can be implemented. For each virtual machine, when holding license information record data in each virtual machine, the program from the license manager and the script program are started by using the access from the license manager as a trigger. A method of accessing the registry database is also feasible.

In addition, the above embodiment has been described as a mode in which a license manager is installed in the application vendor site to manage the number of licenses for each user. However, the present invention is not limited to this. Even if the license manager in the cloud vendor site is configured to manage the total number of valid licenses, there is a risk of exposing the global IP address of the license manager, but this does not depart from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 1 License management system 10

Application vendor site

11, 11a On-site 12 Private cloud 13 Cloud vendor 20

Physical machine

30, 30a, 30b, 31, 31a, 31b, 32, 32a, 32b, 331a, 331b, 332a, 332b License manager 40 Virtual machine 50 software

Claims

A plurality of on-sites that are network environments individually provided by a plurality of users, and a network environment that includes a cloud shared by the plurality of users, and a physical machine that is a non-virtualized environment under each network environment; A license management system that allows software providers (hereinafter referred to as application vendors) to centrally manage licenses for software that is installed in and used by each physical machine and virtual machine, including multiple virtual machines. Because
A first license manager for managing licenses of software installed in a physical machine and a virtual machine for each user ID for uniquely identifying a specific user from the plurality of users;
In the application vendor environment, a second license manager is installed to manage the license activation information for each user ID.
The first license manager collects license activation information of the software used in the physical machine or virtual machine in the network environment, and transmits the license activation information to the second license manager via an external network. And
The second license manager performs license management by acquiring license-related information and license activation information of a user who has been granted a license to use the software,
When the physical machine or virtual machine is duplicated and a new virtual machine is created,
If the virtual machine is replicated in the same physical machine, detect the difference in the IP address of the virtual machine,
When a virtual machine is replicated from different physical machines in the same network, by detecting the difference in the host ID or MAC address of the virtual machine,
A license management system for performing license activation of the software by uniquely specifying and identifying a plurality of physical machines and virtual machines existing in the network environment.
The license activation of the software is performed by transmitting and receiving a license permission signal between a physical machine and a virtual machine in the network environment, and switching license activation in the network environment. License management system.
3. The software license activation according to claim 2, wherein the software license activation is performed by associating unique information of a software user who has been granted a license of the software with hardware / software on a physical machine. License management system.
4. The license management system according to claim 3, wherein the license activation of the software is performed by a software method incorporated in or associated with the software.
The license management system according to claim 3, wherein the license activation of the software is performed via a hardware device associated with the software.
In the software license activation, the software installed on the physical machine and the virtual machine is activated by the first license manager operating on the physical machine existing in each network,
The second license manager in the application vendor environment compares the total number of valid licenses of the software owned by the user with the total number of licenses in use in each network transmitted from the first license manager. The license management system according to claim 1, wherein if the upper limit is exceeded, license use is not permitted, and if the upper limit is not exceeded, license use is permitted.
7. The license management system according to claim 6, wherein, regarding a license activation method for software, license authentication is performed by communication between the software and the license manager when the software is activated.
A plurality of on-sites that are network environments individually provided by a plurality of users, and a network environment that includes a cloud shared by the plurality of users, and a physical machine that is a non-virtualized environment under each network environment; A license management system for centrally managing licenses of software that is installed and used in each physical machine and virtual machine in which a plurality of virtual machines are mixed.
A first license manager for managing licenses of software installed in a physical machine and a virtual machine for each user ID for uniquely identifying a specific user from the plurality of users;
In the application vendor environment, a second license manager is installed to manage the license activation information for each user ID.
The first license manager collects license activation information of the software used in the physical machine or virtual machine in the network environment, and transmits the license activation information to the second license manager via an external network. And
The second license manager performs license management by acquiring license-related information and license activation information of a user who has been granted a license to use the software,
When the physical machine or virtual machine is duplicated and a new virtual machine is created,
If the virtual machine is replicated in the same physical machine, detect the difference in the IP address of the virtual machine,
When a virtual machine is replicated from different physical machines in the same network, by detecting the difference in the host ID or MAC address of the virtual machine,
A license management method, wherein license activation of the software is performed by uniquely specifying and identifying a plurality of physical machines and virtual machines existing in the network environment.
9. The license activation of the software is performed by transmitting and receiving a license permission signal between a physical machine and a virtual machine in the network environment, and switching license activation in the network environment. License management method.
10. The software license activation method according to claim 9, wherein the software license activation is performed by associating specific information of a software user who is granted a license of the software with hardware / software on a physical machine. License management method.
The license management method according to claim 10, wherein the license activation of the software is performed by a software method incorporated in or associated with the software.
12. The license management method according to claim 11, wherein the license activation of the software is performed through a hardware device associated with the software.
In the software license activation, the software installed on the physical machine and the virtual machine is activated by the first license manager operating on the physical machine existing in each network,
The second license manager in the application vendor environment compares the total number of valid licenses of the software owned by the user with the total number of licenses in use in each network transmitted from the first license manager. 9. The license management method according to claim 8, wherein if the upper limit is exceeded, license use is not permitted, and if it is within the upper limit, license use is permitted.
14. The license management method according to claim 13, wherein, regarding a license activation method for software, license authentication is performed when the software is activated by communication between the software and the license manager.