Risk assessment method and device for open source software licensing agreements

Abstract

The present application discloses a method and device for determining the risk of an open source software license agreement. The method includes: creating a license risk library, the license risk library including a license agreement library, a risk factor library and a correspondence library, the risk factor library storing all risk factors of all license agreements in the license agreement library and risk scores corresponding to the risk factors, and the correspondence library storing mapping relationships between each license category and each license agreement in the license agreement library and each risk factor in the risk factor library; matching the number of the license agreement to be determined with the number of each license agreement in the license agreement library; if the match is successful, obtaining the risk scores corresponding to all risk factors from the risk factor library based on the mapping relationship in the correspondence library; if the match is unsuccessful, selecting a license category from the license agreement library, and obtaining the risk scores of all corresponding risk factors from the risk factor library based on the mapping relationship; and determining the risk based on the sum of the risk scores of each risk factor.

Description

Technical Field

[0001] The present application relates to the technical field of risk assessment of open source software license agreements, and in particular to a method and device for risk assessment of open source software license agreements. Background Art

[0002] Open source software licenses are agreements developed by the open source community to protect the legal rights of authors and contributors and to prevent theft by commercial organizations or individuals, which could impact the software's development. Every open source software release is accompanied by a license agreement, a standard contract that outlines a range of rights and obligations, including copyright, patents, and commercial use.

[0003] Therefore, open source software has certain compliance risk issues. Currently, people's risk assessment of license agreements is more based on manual methods, interpreting license agreements, and making actual risk predictions by interpreting and analyzing the content, so as to understand risk information.

[0004] However, the manual method has the following problems:

[0005] (1) Because there is no standardized evaluation standard, the risk ratings given manually for the same license agreement may be inconsistent.

[0006] (2) Due to the large number of licensing agreements, manual evaluation alone is too inefficient. Summary of the Invention

[0007] The purpose of this application is to provide a risk assessment method, device, electronic device and computer-readable storage medium for open source software license agreements, which are conducive to more objective risk assessment and can improve the efficiency of risk assessment.

[0008] To achieve the above objectives, the present application provides a risk assessment method for open source software license agreements, which is characterized by including:

[0009] Creating a license risk library, the license risk library including a license agreement library, a risk factor library, and a correspondence library. The license agreement library stores a license agreement for each license category. The risk factor library stores all risk factors for all license agreements in the license agreement library and risk scores corresponding to the risk factors. The correspondence library stores a mapping relationship between each license category and each license agreement in the license agreement library and each risk factor assigned a risk score in the risk factor library.

[0010] Matching the serial number of the license agreement to be determined with the serial numbers of the license agreements in the license agreement library;

[0011] If the match is successful, then obtaining the risk scores corresponding to all the risk factors of the license agreement to be judged from the risk factor library based on the mapping relationship in the corresponding relationship library;

[0012] If the match is unsuccessful, selecting the license category to which the license agreement to be judged belongs from the license agreement library, and obtaining the risk scores of all risk factors corresponding to the selected license category from the risk factor library based on the mapping relationship in the corresponding relationship library;

[0013] The risk of the license agreement to be determined is determined according to the sum of the acquired risk scores of the risk factors.

[0014] Optionally, before matching the serial number of the license agreement to be determined with the serial numbers of the license agreements in the license agreement library, the method further includes:

[0015] parsing the license agreement to be judged to obtain all risk factors in the license agreement to be judged;

[0016] After obtaining the risk scores of all risk factors corresponding to the selected license category from the risk factor library, the method further includes:

[0017] If the license agreement to be determined contains a non-public risk factor that is not included in the license category to which it belongs, the risk score of the non-public risk factor is obtained according to the user's settings.

[0018] Optionally, parsing the license agreement to be judged to obtain all risk factors in the license agreement to be judged includes:

[0019] The characteristic field representing the risk factor in the license agreement to be judged is parsed to obtain the corresponding risk factor.

[0020] Optionally, judging the risk of the license agreement to be judged based on the obtained sum of the risk scores of the risk factors includes:

[0021] Matching the sum of the risk scores of the risk factors obtained with the preset score ranges of the risk levels;

[0022] The successfully matched risk level is used as the risk level of the license agreement to be determined.

[0023] To achieve the above objectives, this application provides a risk assessment device for open source software license agreements, comprising:

[0024] a creation module, configured to create a license risk library, the license risk library comprising a license agreement library, a risk factor library, and a correspondence library, wherein the license agreement library stores a license agreement for each license category, the risk factor library stores all risk factors for all license agreements in the license agreement library and risk scores corresponding to the risk factors, and the correspondence library stores a mapping relationship between each license category and each license agreement in the license agreement library and each risk factor assigned a risk score in the risk factor library;

[0025] a matching module, configured to match the serial number of the license agreement to be determined with the serial numbers of the license agreements in the license agreement library;

[0026] A first acquisition module is configured to acquire, if the match is successful, risk scores corresponding to all the risk factors of the license agreement to be judged from the risk factor library based on the mapping relationships in the corresponding relationship library;

[0027] a second acquisition module configured to, if the match is unsuccessful, select a license category to which the license agreement to be determined belongs from the license agreement library, and acquire risk scores of all risk factors corresponding to the selected license category from the risk factor library based on the mapping relationships in the correspondence library;

[0028] The judgment module is configured to judge the risk of the license agreement to be judged according to the sum of the risk scores of the acquired risk factors.

[0029] Optionally, the risk judgment device further includes:

[0030] a parsing module, configured to parse the license agreement to be judged to obtain all risk factors in the license agreement to be judged before matching the serial number of the license agreement to be judged with the serial numbers of the license agreements in the license agreement library;

[0031] The third acquisition module is used to obtain the risk scores of all risk factors corresponding to the selected license category from the risk factor library. If there are non-public risk factors in the license agreement to be judged that are not included in the license category to which it belongs, the risk scores of the non-public risk factors are obtained according to the user's settings.

[0032] Optionally, parsing the license agreement to be judged to obtain all risk factors in the license agreement to be judged includes:

[0033] The characteristic field representing the risk factor in the license agreement to be judged is parsed to obtain the corresponding risk factor.

[0034] Optionally, judging the risk of the license agreement to be judged based on the obtained sum of the risk scores of the risk factors includes:

[0035] Matching the sum of the risk scores of the risk factors obtained with the preset score ranges of the risk levels;

[0036] The successfully matched risk level is used as the risk level of the license agreement to be determined.

[0037] To achieve the above objectives, the present application further provides an electronic device, comprising:

[0038] processor;

[0039] a memory storing executable instructions for the processor;

[0040] The processor is configured to execute the aforementioned risk determination method for the open source software license agreement by executing the executable instructions.

[0041] To achieve the above objectives, the present application also provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the risk judgment method for the open source software license agreement as described above.

[0042] The present application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to implement the risk assessment method for an open source software license agreement as described above.

[0043] The present application can establish a license agreement library in advance to store license agreements for each license category, establish a risk factor library to store all risk factors of all license agreements in the license agreement library and the risk scores corresponding to the risk factors, and establish a corresponding relationship library containing the mapping relationship between each license category, each license agreement and each risk factor assigned with a risk score. Then, when it is necessary to judge the risk of the license agreement encountered later, the number of the license agreement to be judged can be matched with the number of each license agreement in the license agreement library. If the match is successful, the risk scores corresponding to all risk factors of the license agreement to be judged are obtained from the risk factor library. If the match is unsuccessful, the license category to which the license agreement to be judged belongs is selected from the license agreement library, and based on the mapping relationship, the risk scores of all risk factors corresponding to the selected license category are obtained from the risk factor library, so that the present application can judge the risk of the license agreement to be judged by the sum of the risk scores of each risk factor obtained. Compared with the traditional manual risk judgment method, the present application is conducive to more objectively judging the risks in the open source software license agreement, and is conducive to avoiding the situation where the risk ratings given for the same license agreement are inconsistent, and can improve the efficiency of risk judgment. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flow chart of a method for determining risk in an open source software license agreement according to an embodiment of the present application.

[0045] Figure 2 It is a schematic block diagram of a risk judgment device for an open source software license agreement according to an embodiment of the present application.

[0046] Figure 3 It is a schematic block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to explain the technical content, structural features, achieved objectives and effects of this application in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0048] Example 1

[0049] See also Figure 1 This application discloses a risk assessment method for open source software license agreements, including:

[0050] 101. Create a license risk library, which includes a license agreement library, a risk factor library, and a correspondence library. The license agreement library stores license agreements for each license category. The risk factor library stores all risk factors of all license agreements in the license agreement library and the risk scores corresponding to the risk factors. The correspondence library stores the mapping relationship between each license category and each license agreement in the license agreement library and each risk factor assigned with a risk score in the risk factor library.

[0051] Before creating a license risk library, you can manually analyze a small number of open source licenses to identify the risk factors and assign appropriate risk scores. You can then build a model to analyze a larger number of open source licenses to create a license risk library. Of course, this isn't the only approach.

[0052] In addition, only a relatively small number of license agreements need to be stored in the license risk library. For license agreements that do not exist in the subsequent license risk library, corresponding risk factors and risk scores can be obtained by selecting corresponding license categories.

[0053] The license agreements in the license agreement library are classified according to the license categories to which they belong. They can be classified according to their identity information. The identity information can be a unique number (ID) of the license agreement. When mapping, the identity information can also be used for mapping.

[0054] License categories include GPL, LGPL, BSD, MIT, MPL, Apache, etc. It will be understood that the license categories here are only enumerated.

[0055] Risk factors include commercial use, code distribution, patent licensing, license modification, open source, and so on. It should be understood that the above risk factors are merely a list. Furthermore, the number of risk factors included may vary between different license categories and license agreements. For a license category, the risk factors included are those common to all license agreements within that category. For some license agreements, some license categories include non-public risk factors in addition to the public risk factors. When assessing risk, these non-public risk factors may be considered as part of the assessment, depending on the circumstances.

[0056] To facilitate understanding of this application, risk factors are briefly explained.

[0057] For example, for commercial use, some license categories allow unrestricted commercial use, some license categories allow restricted commercial use (such as only allowing commercial use in the form of library reference), and some license categories do not allow commercial use.

[0058] Regarding the distribution of code, some license categories allow the distribution of code, while others do not.

[0059] For patent licenses, some license categories allow free use, while others do not.

[0060] For risk factors in the risk factor library, one risk factor typically corresponds to more than one risk score. For example, for commercial use, unrestricted commercial use corresponds to one risk score (e.g., 0 points), restricted commercial use corresponds to one risk score (e.g., 3 points), and no commercial use corresponds to one risk score (e.g., 5 points). For mapping relationships in the corresponding relationship library, the risk factors that are mapped are all risk factors that have been assigned a risk score. The same risk factor that has been assigned different risk scores is considered a different mapping object.

[0061] 102. Match the serial number of the license agreement to be determined with the serial numbers of each license agreement in the license agreement library. If the match is successful, proceed to step 103; if the match is unsuccessful, proceed to step 104.

[0062] Since there are already some license agreements and their mapping relationship with the risk factors assigned risk points in the license risk library, the number of the license agreement to be judged can be directly matched with the numbers of each license agreement in the license agreement library. If the match is successful, it will be helpful to quickly obtain all the risk factors and risk points of the license agreement to be judged, which is convenient for accurate risk judgment.

[0063] 103. Obtain risk scores corresponding to all risk factors of the license agreement to be judged from the risk factor library based on the mapping relationships in the corresponding relationship library.

[0064] 104. Select the license category to which the license agreement to be determined belongs from the license agreement library, and obtain the risk scores of all risk factors corresponding to the selected license category from the risk factor library based on the mapping relationship in the corresponding relationship library.

[0065] If the match in step 102 is unsuccessful, the license category to which the license agreement to be judged belongs can be directly selected from the license agreement library, and the risk score of all risk factors (public risk factors) corresponding to the license category can be obtained. For some license categories, all risk factors corresponding to the license category may be all of its risk factors. For other license categories, all risk factors corresponding to the license category may not be part of its risk factors. In addition, it also includes non-public risk factors. When judging the risk later, it can be judged only based on the public risk factors, or it can be judged by obtaining non-public risk factors through other means and combining the risk scores of the two to make a judgment.

[0066] 105. Determine the risk of the license agreement to be determined based on the sum of the risk scores of the obtained risk factors.

[0067] Specifically, judging the risk of the license agreement to be judged based on the sum of the risk scores of the acquired risk factors includes:

[0068] Match the sum of the risk scores of each risk factor obtained with the preset score ranges of each risk level;

[0069] The risk level of the successfully matched license agreement is used as the risk level of the license agreement to be determined.

[0070] The user can be reminded intuitively by determining the risk level.

[0071] For example:

[0072] For a risk factor, the risk score can include 0, 3, 5, etc., where 0 indicates no risk, 5 indicates a higher risk, and 3 indicates less risk than 5. In addition, the risk score can be set to 0 for unrestricted commercial use, 3 for restricted commercial use, and 5 for no commercial use.

[0073] Risk levels can be set as no risk, low risk, medium risk, high risk, or extreme risk. Risk levels can be determined based on score ranges, such as no risk: 0, low risk: [1, 10), medium risk: [10, 30), high risk: [30, 50), and extreme risk: [50, total factor score A]. Score classification is determined based on the sum of the risk scores of each risk factor in the license category or license agreement.

[0074] In some embodiments, before matching the serial number of the license agreement to be determined with the serial numbers of each license agreement in the license agreement library in step 102, the method further includes:

[0075] Parsing the license agreement to be judged to obtain all risk factors in the license agreement to be judged;

[0076] After obtaining the risk scores of all risk factors corresponding to the selected license category from the risk factor library in step 104, the method further includes:

[0077] If the license agreement to be judged contains non-public risk factors that are not included in the license category to which it belongs, the risk score of the non-public risk factor is obtained according to the user's settings.

[0078] By parsing the license agreement to be judged to obtain all its risk factors, after obtaining the risk scores of all risk factors corresponding to the selected license category, it is possible to confirm whether the license agreement to be judged also includes non-public risk factors. If so, the risk scores of non-public risk factors can be obtained, which is conducive to more accurate risk judgment of the license agreement to be judged.

[0079] Specifically, parsing the license agreement to be judged to obtain all risk factors in the license agreement to be judged includes:

[0080] The characteristic field representing the risk factor in the license agreement to be judged is parsed to obtain the corresponding risk factor.

[0081] Since the same risk factors in different license agreements are expressed using the same or similar fields, the risk factors in the license agreement to be judged can be quickly obtained through the characteristic fields representing the risk factors.

[0082] Specifically, after obtaining the risk score of the non-public risk factor of the license agreement to be judged, the risk score can be calculated and summed with the risk score of the obtained public risk factor of the license category to more comprehensively reflect the risk of the license agreement to be judged. Of course, this is not limited to this.

[0083] The present application can establish a license agreement library in advance to store license agreements for each license category, establish a risk factor library to store all risk factors of all license agreements in the license agreement library and the risk scores corresponding to the risk factors, and establish a corresponding relationship library containing the mapping relationship between each license category, each license agreement and each risk factor assigned with a risk score. Then, when it is necessary to judge the risk of the license agreement encountered later, the number of the license agreement to be judged can be matched with the number of each license agreement in the license agreement library. If the match is successful, the risk scores corresponding to all risk factors of the license agreement to be judged are obtained from the risk factor library. If the match is unsuccessful, the license category to which the license agreement to be judged belongs is selected from the license agreement library, and based on the mapping relationship, the risk scores of all risk factors corresponding to the selected license category are obtained from the risk factor library, so that the present application can judge the risk of the license agreement to be judged by the sum of the risk scores of each risk factor obtained. Compared with the traditional manual risk judgment method, the present application is conducive to more objectively judging the risks in the open source software license agreement, and is conducive to avoiding the situation where the risk ratings given for the same license agreement are inconsistent, and can improve the efficiency of risk judgment.

[0084] Example 2

[0085] See also Figure 2 This application discloses a risk judgment device for an open source software license agreement, comprising:

[0086] 201. A creation module is used to create a license risk library. The license risk library includes a license agreement library, a risk factor library, and a correspondence library. The license agreement library stores license agreements for each license category. The risk factor library stores all risk factors of all license agreements in the license agreement library and risk scores corresponding to the risk factors. The correspondence library stores a mapping relationship between each license category and each license agreement in the license agreement library and each risk factor assigned a risk score in the risk factor library.

[0087] Before creating a license risk library, you can manually analyze a small number of open source licenses to identify the risk factors and assign appropriate risk scores. You can then build a model to analyze a larger number of open source licenses to create a license risk library. Of course, this isn't the only approach.

[0088] In addition, only a relatively small number of license agreements need to be stored in the license risk library. For license agreements that do not exist in the subsequent license risk library, corresponding risk factors and risk scores can be obtained by selecting corresponding license categories.

[0089] The license agreements in the license agreement library are classified according to the license categories to which they belong. They can be classified according to their identity information. The identity information can be a unique number (ID) of the license agreement. When mapping, the identity information can also be used for mapping.

[0090] License categories include GPL, LGPL, BSD, MIT, MPL, Apache, etc. It will be understood that the license categories here are only enumerated.

[0091] Risk factors include commercial use, code distribution, patent licensing, license modification, open source, and so on. It should be understood that the above risk factors are merely a list. Furthermore, the number of risk factors included may vary between different license categories and license agreements. For a license category, the risk factors included are those common to all license agreements within that category. For some license agreements, some license categories include non-public risk factors in addition to the public risk factors. When assessing risk, these non-public risk factors may be considered as part of the assessment, depending on the circumstances.

[0092] To facilitate understanding of this application, risk factors are briefly explained.

[0093] For example, for commercial use, some license categories allow unrestricted commercial use, some license categories allow restricted commercial use (such as only allowing commercial use in the form of library reference), and some license categories do not allow commercial use.

[0094] Regarding the distribution of code, some license categories allow the distribution of code, while others do not.

[0095] For patent licenses, some license categories allow free use, while others do not.

[0096] For risk factors in the risk factor library, one risk factor typically corresponds to more than one risk score. For example, for commercial use, unrestricted commercial use corresponds to one risk score (e.g., 0 points), restricted commercial use corresponds to one risk score (e.g., 3 points), and no commercial use corresponds to one risk score (e.g., 5 points). For mapping relationships in the corresponding relationship library, the risk factors that are mapped are all risk factors that have been assigned a risk score. The same risk factor that has been assigned different risk scores is considered a different mapping object.

[0097] The matching module 202 is used to match the serial number of the license agreement to be determined with the serial numbers of each license agreement in the license agreement library. If the match is successful, the process enters the first acquisition module 203; if the match is unsuccessful, the process enters the second acquisition module 204.

[0098] Since there are already some license agreements and their mapping relationship with the risk factors assigned risk points in the license risk library, the number of the license agreement to be judged can be directly matched with the numbers of each license agreement in the license agreement library. If the match is successful, it will be helpful to quickly obtain all the risk factors and risk points of the license agreement to be judged, which is convenient for accurate risk judgment.

[0099] The first acquisition module 203 is configured to acquire risk scores corresponding to all risk factors of the license agreement to be determined from the risk factor library based on the mapping relationships in the corresponding relationship library.

[0100] The second acquisition module 204 is configured to select a license category to which the license agreement to be determined belongs from the license agreement library, and acquire risk scores of all risk factors corresponding to the selected license category from the risk factor library based on the mapping relationship in the corresponding relationship library.

[0101] In the event that the matching module 202 fails to match, the license category to which the license agreement to be judged belongs can be directly selected from the license agreement library, and the risk score of all risk factors (public risk factors) corresponding to the license category can be obtained. For some license categories, all risk factors corresponding to the license category may be all of its risk factors. For other license categories, all risk factors corresponding to the license category may not be part of its risk factors. In addition, it also includes non-public risk factors. When judging the risk later, it can be judged based on only the public risk factors, or it can be judged by obtaining non-public risk factors through other means and combining the risk scores of the two to make a judgment.

[0102] The judgment module 205 is configured to judge the risk of the license agreement to be judged based on the sum of the risk scores of the acquired risk factors.

[0103] Specifically, judging the risk of the license agreement to be judged based on the sum of the risk scores of the acquired risk factors includes:

[0104] Match the sum of the risk scores of each risk factor obtained with the preset score ranges of each risk level;

[0105] The risk level of the successfully matched license agreement is used as the risk level of the license agreement to be determined.

[0106] The user can be reminded intuitively by determining the risk level.

[0107] For example:

[0108] For a risk factor, the risk score can include 0, 3, 5, etc., where 0 indicates no risk, 5 indicates a higher risk, and 3 indicates less risk than 5. In addition, the risk score can be set to 0 for unrestricted commercial use, 3 for restricted commercial use, and 5 for no commercial use.

[0109] Risk levels can be set as no risk, low risk, medium risk, high risk, or extreme risk. Risk levels can be determined based on score ranges, such as no risk: 0, low risk: [1, 10), medium risk: [10, 30), high risk: [30, 50), and extreme risk: [50, total factor score A]. Score classification is determined based on the sum of the risk scores of each risk factor in the license category or license agreement.

[0110] In some embodiments, the risk determination device for the open source software license agreement of this application further includes:

[0111] a parsing module, configured to parse the license agreement to be judged to obtain all risk factors in the license agreement to be judged before matching the serial number of the license agreement to be judged with the serial numbers of each license agreement in the license agreement library;

[0112] The third acquisition module is used to obtain the risk scores of all risk factors corresponding to the selected license category from the risk factor library. If there are non-public risk factors in the license agreement to be judged that are not included in the license category to which it belongs, the risk scores of the non-public risk factors are obtained according to the user's settings.

[0113] By parsing the license agreement to be judged to obtain all its risk factors, after obtaining the risk scores of all risk factors corresponding to the selected license category, it is possible to confirm whether the license agreement to be judged also includes non-public risk factors. If so, the risk scores of non-public risk factors can be obtained, which is conducive to more accurate risk judgment of the license agreement to be judged.

[0114] Specifically, parsing the license agreement to be judged to obtain all risk factors in the license agreement to be judged includes:

[0115] The characteristic field representing the risk factor in the license agreement to be judged is parsed to obtain the corresponding risk factor.

[0116] Since the same risk factors in different license agreements are expressed using the same or similar fields, the risk factors in the license agreement to be judged can be quickly obtained through the characteristic fields representing the risk factors.

[0117] Specifically, after obtaining the risk score of the non-public risk factor of the license agreement to be judged, the risk score can be calculated and summed with the risk score of the obtained public risk factor of the license category to more comprehensively reflect the risk of the license agreement to be judged. Of course, this is not limited to this.

[0118] The present application can establish a license agreement library in advance to store license agreements for each license category, establish a risk factor library to store all risk factors of all license agreements in the license agreement library and the risk scores corresponding to the risk factors, and establish a corresponding relationship library containing the mapping relationship between each license category, each license agreement and each risk factor assigned with a risk score. Then, when it is necessary to judge the risk of the license agreement encountered later, the number of the license agreement to be judged can be matched with the number of each license agreement in the license agreement library. If the match is successful, the risk scores corresponding to all risk factors of the license agreement to be judged are obtained from the risk factor library. If the match is unsuccessful, the license category to which the license agreement to be judged belongs is selected from the license agreement library, and based on the mapping relationship, the risk scores of all risk factors corresponding to the selected license category are obtained from the risk factor library, so that the present application can judge the risk of the license agreement to be judged by the sum of the risk scores of each risk factor obtained. Compared with the traditional manual risk judgment method, the present application is conducive to more objectively judging the risks in the open source software license agreement, and is conducive to avoiding the situation where the risk ratings given for the same license agreement are inconsistent, and can improve the efficiency of risk judgment.

[0119] Example 3

[0120] Please combine Figure 3 , the present application discloses an electronic device, comprising:

[0121] Processor 30;

[0122] a memory 40 in which executable instructions of the processor 30 are stored;

[0123] The processor 30 is configured to execute the risk determination method for the open source software license agreement as described in the above embodiment by executing executable instructions.

[0124] Example 4

[0125] The present application discloses a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the risk judgment method for an open source software license agreement as described in the above embodiment is implemented.

[0126] Example 5

[0127] The present application discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to implement the risk assessment method for an open source software license agreement.

[0128] It should be understood that in the embodiments of the present application, the processor referred to may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0129] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by hardware associated with computer program instructions. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0130] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0131] The above disclosure is only a preferred example of the present application and cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are all within the scope covered by the present application.

Claims

1. A risk assessment method for open source software license agreements, characterized in that: include: Creating a license risk library, the license risk library including a license agreement library, a risk factor library, and a correspondence library. The license agreement library stores a license agreement for each license category. The risk factor library stores all risk factors for all license agreements in the license agreement library and risk scores corresponding to the risk factors. The correspondence library stores a mapping relationship between each license category and each license agreement in the license agreement library and each risk factor assigned a risk score in the risk factor library. Matching the serial number of the license agreement to be determined with the serial numbers of the license agreements in the license agreement library; If the match is successful, then obtaining the risk scores corresponding to all the risk factors of the license agreement to be judged from the risk factor library based on the mapping relationship in the corresponding relationship library; If the match is unsuccessful, selecting the license category to which the license agreement to be judged belongs from the license agreement library, and obtaining the risk scores of all risk factors corresponding to the selected license category from the risk factor library based on the mapping relationship in the corresponding relationship library; The risk of the license agreement to be determined is determined according to the sum of the acquired risk scores of the risk factors.

2. The risk assessment method for an open source software license agreement according to claim 1, wherein: Before matching the serial number of the license agreement to be determined with the serial numbers of the license agreements in the license agreement library, the method further includes: parsing the license agreement to be judged to obtain all risk factors in the license agreement to be judged; After obtaining the risk scores of all risk factors corresponding to the selected license category from the risk factor library, the method further includes: If the license agreement to be determined contains a non-public risk factor that is not included in the license category to which it belongs, the risk score of the non-public risk factor is obtained according to the user's settings.

3. The risk assessment method for an open source software license agreement according to claim 2, wherein: The step of parsing the license agreement to be judged to obtain all risk factors in the license agreement to be judged includes: The characteristic field representing the risk factor in the license agreement to be judged is parsed to obtain the corresponding risk factor.

4. The risk assessment method for an open source software license agreement according to claim 1, wherein: The step of determining the risk of the license agreement to be determined based on the sum of the risk scores of the acquired risk factors includes: Matching the sum of the risk scores of the risk factors obtained with the preset score ranges of the risk levels; The successfully matched risk level is used as the risk level of the license agreement to be determined.

5. A risk assessment device for an open source software license agreement, characterized in that: include: a creation module, configured to create a license risk library, the license risk library comprising a license agreement library, a risk factor library, and a correspondence library, wherein the license agreement library stores a license agreement for each license category, the risk factor library stores all risk factors for all license agreements in the license agreement library and risk scores corresponding to the risk factors, and the correspondence library stores a mapping relationship between each license category and each license agreement in the license agreement library and each risk factor assigned a risk score in the risk factor library; a matching module, configured to match the serial number of the license agreement to be determined with the serial numbers of the license agreements in the license agreement library; A first acquisition module is configured to acquire, if the match is successful, risk scores corresponding to all the risk factors of the license agreement to be judged from the risk factor library based on the mapping relationships in the corresponding relationship library; a second acquisition module configured to, if the match is unsuccessful, select a license category to which the license agreement to be determined belongs from the license agreement library, and acquire risk scores of all risk factors corresponding to the selected license category from the risk factor library based on the mapping relationships in the correspondence library; The judgment module is configured to judge the risk of the license agreement to be judged according to the sum of the risk scores of the acquired risk factors.

6. The risk judgment device for open source software license agreement according to claim 5, characterized in that: Also includes: a parsing module, configured to parse the license agreement to be judged to obtain all risk factors in the license agreement to be judged before matching the serial number of the license agreement to be judged with the serial numbers of the license agreements in the license agreement library; The third acquisition module is used to obtain the risk scores of all risk factors corresponding to the selected license category from the risk factor library. If there are non-public risk factors in the license agreement to be judged that are not included in the license category to which it belongs, the risk scores of the non-public risk factors are obtained according to the user's settings.

7. The risk judgment device for open source software license agreement according to claim 6, characterized in that: The step of parsing the license agreement to be judged to obtain all risk factors in the license agreement to be judged includes: The characteristic field representing the risk factor in the license agreement to be judged is parsed to obtain the corresponding risk factor.

8. The risk judgment device for open source software license agreement according to claim 5, characterized in that: The step of determining the risk of the license agreement to be determined based on the sum of the risk scores of the acquired risk factors includes: Matching the sum of the risk scores of the risk factors obtained with the preset score ranges of the risk levels; The successfully matched risk level is used as the risk level of the license agreement to be determined.

9. An electronic device, characterized in that: include: processor; a memory storing executable instructions for the processor; The processor is configured to execute the risk judgment method for the open source software license agreement according to any one of claims 1 to 4 by executing the executable instructions.

10. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the risk judgment method for an open source software license agreement according to any one of claims 1 to 4 is implemented.

Images