License management method, physical machine, and computer-readable storage medium

Abstract

A license management method according to the present disclosure comprises: a step for, in a virtual machine constructed in a physical machine, registering first identification information for uniquely identifying the virtual machine; a step for acquiring, from a license management device, second identification information that is created on the basis of the first identification information and represents the right to use software; a step for registering the second identification information in a virtual disk; and a step for comparing the first identification information and the second identification information in software installed in the virtual disk, and disabling the use of the software when the first identification information and the second identification information do not match.

Description

License Management Method, Physical Machine, and Computer-Readable Storage Medium

[0001] The present disclosure relates to a license management method, a physical machine, and a computer-readable storage medium.

[0002] There is virtualization technology that abstracts physical hardware resources and uses them as a plurality of virtual machines. Ease of replication is one of the characteristics of virtualization technology. Virtualization has the advantages of improved operation efficiency and availability. However, ease of replication leads to the problem of unauthorized use of software.

[0003] As a technology for preventing unauthorized use of software, there is a method of creating a license by obtaining and combining the individual information of two entities, a virtual machine and a physical machine. For example, Patent Document 1.

[0004] Japanese Patent Application Laid-Open No. 2013-131015

[0005] However, when trying to prevent unauthorized use of software in a virtual machine in a complex way, it is necessary to obtain data from multiple devices, and unexpected events may occur. Furthermore, the physical machine on which the virtual machine operates is important for security and availability, and obtaining the individual information of the physical machine is often not permitted. It is difficult to use the information of the physical machine as identification information.

[0006] It is desired to prevent copying of software in a virtual machine in a simple way.

[0007] The license management method according to the present disclosure includes, in a virtual machine constructed on a physical machine, registering first identification information that uniquely identifies the virtual machine, obtaining second identification information that is created based on the first identification information and represents the usage right of software from a license management device, registering the second identification information in a virtual disk constructed in the virtual machine, and in the software installed in the virtual disk, collating the first identification information and the second identification information, and if they do not match, invalidating the use of the software.

[0008] This is a diagram showing the configuration of the license management system 100. This is a block diagram showing the configuration of the license management device and virtual machines in the first embodiment. This is a block diagram showing the configuration of the license management device and virtual machines in the second embodiment. This is a diagram illustrating the state of the first identification information and the second identification information when multiple virtual machines are authenticated. This is a diagram showing an example of a site where the license management system 100 is applied. This is a hardware configuration diagram of the physical machine 30.

[0009] Embodiments of this disclosure will be described below with reference to the drawings. In the following description, components having the same or similar functions will be denoted by the same reference numerals. Duplication of these components may be omitted.

[0010] In this application, "based on XX" means "based on at least XX," and includes cases where it is based on another element in addition to XX. Furthermore, "based on XX" is not limited to cases where XX is used directly, but also includes cases where it is based on something that has been calculated or processed. "XX" is any element (for example, any information).

[0011] The license management system 100 of this embodiment will be described with reference to Figures 1 and 2. The license management system 100 consists of a license management device 11 and a virtual machine 12. The virtual machine 12 records software provided by a software provider (vendor) 20 onto a virtual disk 13. The software includes a license verification program. The license verification program functions as a license verification unit 14 on the virtual machine 12.

[0012] The license management device 11 may be part of an external network such as a cloud, part of an internal network, or may not be connected to a network at all. The software may be downloaded via the network or read from a portable storage medium.

[0013] [First Embodiment] Figure 2 is a block diagram showing the configuration of the license management device 11 and the virtual machine 12 of the first embodiment. The license management device 11 includes an identification information creation unit 15. The virtual machine 12 is virtually constructed on the physical machine 30. The virtual machine 12 includes a virtual disk 13, which is a virtual storage device.

[0014] The identification information creation unit 15 acquires first identification information. The first identification information is an identifier for uniquely identifying the virtual machine 12. The type of first identification information is not limited; it may be created by the identification information creation unit 15 or acquired from an external source. Hereinafter, the MAC address will be described as the first identification information. The first identification information is acquired (purchased) from the IEEE (Institute of Electrical and Electronics Engineers). The MAC address acquired from the IEEE is a unique identifier that does not overlap.

[0015] The identification information creation unit 15 creates second identification information based on the first identification information (MAC address). The second identification information represents the right to use the software running on the virtual machine 12. The second identification information is, for example, a license file. The license file records information regarding the software license. The second identification information includes information based on the first identification information. Information based on the first identification information is either the first identification information itself or information obtained by processing the first identification information. Processing of the first identification information includes encryption. Existing methods are used for encryption.

[0016] The first identification information and the second identification information are provided from the license management device 11 to the virtual machine 12. The medium through which they are provided is not particularly limited. They may be provided via a network or via a portable storage medium.

[0017] The first identification information (MAC address) is stored in the virtual machine 12. For example, a software user creates the virtual machine 12 using virtualization software and sets the first identification information in the virtual network adapter (virtual NIC) 16. The second identification information is stored in the virtual disk 13 created in the virtual machine 12.

[0018] The software includes a license verification program. The license verification program functions as a license verification unit 14 on the virtual machine 12. The license verification program starts running when the software is installed, when the software is started for the first time, when the software is launched, etc. The license verification unit 14 displays, for example, a license registration screen. The user registers the second identification information (license file) according to the registration screen.

[0019] The license verification unit 14 obtains second identification information from the virtual disk 13 and first identification information from the virtual machine 12, and compares the second identification information with the first identification information. If the second identification information is encrypted, the license verification unit 14 decrypts the second identification information as necessary. If the first identification information and the second identification information match, the license verification unit 14 determines that the license is authenticated and permits the use of the software. If the first identification information and the second identification information do not match, the license verification unit 14 determines that the license is invalid and disables the use of the software.

[0020] Furthermore, in the example of the first embodiment, the MAC address obtained from IEEE is used as the identification information for the virtual machine 12. If the same MAC address exists on the same network, it will cause network problems, thus preventing the copying of the virtual machine.

[0021] [Second Embodiment] In the second embodiment, authentication is performed by combining two methods. Figure 3 is a block diagram showing the configuration of the license management device 11 and the virtual machine 12 in the second embodiment. The license management system 100 in the second embodiment has the same configuration as the license management system 100 in the first embodiment. The differences will be explained below.

[0022] The identification information creation unit 15 of the license management device 11 creates first identification information and second identification information. The first identification information is an identifier for uniquely identifying a virtual machine. The first identification information may be generated using existing technology. Examples of identifiers include UUID (Universally Unique Identifier) ​​and MAC address. The identifier may be obtained from an external organization, or an identifier may be created that does not overlap among specific virtual machines 12. Specific virtual machines 12 refer to virtual machines 12 included in the same network, virtual machines 12 grouped in the same cluster or segment, etc.

[0023] The identification information creation unit 15 creates second identification information based on the first identification information. The second identification information is a license file. The method for creating the second identification information is the same as in the first embodiment, so the explanation is omitted.

[0024] The first identification information and the second identification information are provided to the virtual machine 12. The first identification information is registered with the virtual machine 12. The second identification information is registered with the virtual disk 13 created on the virtual machine 12.

[0025] The software includes a license verification program. The license verification program functions as a license verification unit 14 on the virtual machine 12. The license verification program starts execution triggered by predetermined events such as software installation, initial software startup, or software launch.

[0026] The license verification unit 14 in the second embodiment verifies the license of the virtual machine 12 using two methods. The first method is the same as in the first embodiment, which involves comparing the first identification information with the second identification information. The license verification unit 14 obtains the second identification information from the virtual disk 13 and the first identification information from the virtual machine 12, and then compares the second identification information with the first identification information. If the first identification information and the second identification information match, the license verification unit 14 determines that the license is authenticated and permits the use of the software. If the first identification information and the second identification information do not match, the license verification unit 14 determines that the license is invalid and disables the use of the software.

[0027] The second method involves verifying the first identification information of other virtual machines 12. The license verification unit 14 collects the first identification information from a specific virtual machine 12 via the network. An example of how to obtain the first identification information is given. If the first identification information is a MAC address, the operating system (OS) of the virtual machine 12 can query the virtual machines 12 on the network to obtain the first identification information of other virtual machines 12.

[0028] The license verification unit 14 compares its own first identification information with the first identification information of other virtual machines 12. If no virtual machine 12 has matching first identification information, the license verification unit 14 determines that the license is authenticated and permits the use of the software. If a virtual machine 12 has matching first identification information, the license verification unit 14 determines that the license is invalid and disables the use of the software.

[0029] In the license management system 100 of the second embodiment, first identification information is obtained from other virtual machines 12 and compared with its own first identification information. If the first identification information of the other virtual machine 12 and its own first identification information are found to be duplicated, it is determined that the license is invalid.

[0030] In the license management system 100 of the second embodiment, as shown in Figure 4, a state is ensured in which the first identification information of the virtual machines 12 does not overlap. Under this state, the first identification information and the second identification information are compared.

[0031] Therefore, even without associating special information such as a serial number with the software, authentication is completed within the virtual machine 12 once the license management device 11 obtains the first identification information of the virtual machine 12 and issues the second identification information. The technology is self-contained between the license management device 11 and the virtual machine 12, making it unlikely that unexpected events will occur, and software duplication can be suppressed with a simple procedure. Furthermore, according to this embodiment, there is no need to obtain individual information of the physical machine. Since the virtual identification information used by the virtual machine 12 is obtained from an external source or generated internally, it can be used even in environments where obtaining individual information of the physical machine is not permitted.

[0032] Furthermore, the license management system 100 can also be used to assist with license management. By issuing a warning when a non-malicious user unintentionally copies the software, it can alleviate the burden on users regarding license management.

[0033] [Example] Figure 5 shows an example of a site where the license management system 100 is applied. In the example in Figure 5, the license management system 100 is installed in a factory. The factory is equipped with industrial PCs. Applications (software) such as robot control, temperature control, vibration control, production quantity management, and image processing are running on the industrial PCs. Virtualizing the industrial PCs allows multiple tasks to be performed, but software license management in a virtualized environment is complex. The license management system of this embodiment is expected to be useful for managing software license types and software assets that can be used in a virtualized environment.

[0034] The following describes the hardware configuration of a physical machine to which this disclosure is applied. The license management device also has a similar hardware configuration. The description of the license management device is omitted. Figure 6 is a hardware configuration diagram of the physical machine 30. The physical machine 30 is implemented as a computer comprising, for example, a processor 101, main memory 102, auxiliary memory 103, a network interface 104, and a device interface 105, which are connected via a bus 106.

[0035] The physical machine 30 in Figure 6 has one of each component, but it may have multiple of the same component.

[0036] The processor 101 may be at least an electronic circuit (processing circuit, processing circuit, processing circuit, CPU, GPU, FPGA, ASIC, etc.) that performs either computer control or calculations. Alternatively, the processor 101 may be a general-purpose processor, a dedicated processing circuit designed to perform specific calculations, or a semiconductor device that includes both a general-purpose processor and a dedicated processing circuit.

[0037] The main memory 102 may store instructions executed by the processor 101 and various data, and the information stored in the main memory 102 may be read by the processor 101. The auxiliary memory 103 is a memory device other than the main memory 102.

[0038] The network interface 104 is an interface for connecting to a communication network by wire or wireless connection. The communication network may be a WAN (Wide Area Network), LAN (Local Area Network), PAN (Personal Area Network), or a combination thereof. The physical machine 30 exchanges information with the external device 107 via the network interface 104. The device interface 105 is an interface such as USB for direct connection to the external device 108. The external devices 107 and 108 may be personal computers, tablet terminals, or smartphones. The external devices may also be storage devices.

[0039] While embodiments of this disclosure have been described in detail above, this disclosure is not limited to the individual embodiments described above. These embodiments can be added, replaced, modified, partially deleted, etc., in any way that does not depart from the spirit of the invention or from the idea and intent of this disclosure derived from the claims and their equivalents. For example, the order of operations and processes in the embodiments described above are shown as examples only and are not limited thereto. The same applies when numerical values ​​or mathematical formulas are used in the description of the embodiments described above.

[0040] The following are annotations relating to embodiments of the present disclosure. (Annotation 1) A license management method according to one aspect of the present disclosure includes the steps of: a virtual machine (12) constructed on a physical machine (30) registers first identification information that uniquely identifies the virtual machine (12); a license management device (11) obtains second identification information created based on the first identification information and representing the right to use the software; a virtual disk (13) constructed on the virtual machine (12) obtains second identification information; and software installed on the virtual disk (13) compares the first identification information with the second identification information, and if there is a mismatch, disables the use of the software. (Annotation 2) A license management method includes the steps of: obtaining first identification information of another virtual machine (12) via a network; comparing its own first identification information with the first identification information of the other virtual machine (12), and if its own first identification information matches the first identification information of the other virtual machine (12), disables the use of the software. (Note 3) The other virtual machine (12) is another virtual machine (12) included in the same network. (Note 4) The first identification information is a MAC address. (Note 5) The second identification information is a license file containing the first identification information. (Note 6) A physical machine (30) on which a virtual machine (12) according to one aspect of the present disclosure is constructed is capable of registering a first identification information that uniquely identifies the virtual machine (12), and is capable of registering a second identification information created based on the first identification information and representing the right to use the software on a virtual disk (13) constructed on the virtual machine (12). The software installed on the virtual disk (13) includes a license verification unit (14) that compares the first identification information with the second identification information and, if there is a mismatch, disables the use of the software.(Note 7) A computer-readable storage medium (102, 103, 107, 108) according to one aspect of the present disclosure stores a program that operates as a virtual machine (12) which registers first identification information that uniquely identifies a virtual machine (12), obtains second identification information from a license management device (11) that is created based on the first identification information and represents the right to use the software, registers the second identification information on the virtual disk (13), and in the software installed on the virtual disk (13), compares the first identification information with the second identification information and, if there is a mismatch, disables the use of the software.

[0041] 100 License management system 11 License management device 12 Virtual machine 13 Virtual disk 14 License verification unit 15 Identification information creation unit 16 Virtual network adapter 30 Physical machine 101 Processor 102 Main memory 103 Secondary memory

Images