JP2004070590A - License distribution authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform highly reliable and certain license distribution management capable of protecting the right of a license provider without damaging the convenience of a license receiver and other users. <P>SOLUTION: A license provider or license receiver at a member computer device 5 side or a mediating agent at a mediating business side server device 10 side are authenticated by using a certificate issued by the independent digital authenticating station of an authenticating station server device 12 or of a route authenticating station server device 13. Also, the mediating business side server device 10 mediates the provision of a trust right while thus carrying out authentication. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a license distribution / authentication system, and more particularly, to a highly reliable and reliable license distribution management that can protect the rights of a license provider without impairing the convenience of a license recipient or other users. The present invention relates to a license distribution / authentication method and an intermediary server device that can be performed, and a computer program related to the license distribution / authentication method and the mediator server device.
[0002]
[Prior art]
Japanese Patent Application Laid-Open No. H11-238038 discloses a technique in which, when using content data via a network, a license recorded on a recording medium is taken into the network, and a server computer determines a license. In Japanese Patent Application Laid-Open No. 2001-236219, in order to prevent unauthorized use of a software license, a software name, an identification number of a license management server, a license identification number for each license contract, and a license generation number indicating a new or old license license are used. A technology is disclosed in which a license management server sends out a license based on a license.
[0003]
[Problems to be solved by the invention]
However, in Japanese Patent Application Laid-Open No. 11-238038, in the process in which a license provider or a receiver proceeds with trading while exchanging information online, these participants are not authenticated. Therefore, damage due to so-called spoofing is also assumed.
[0004]
SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned conventional problems, and has high reliability and reliability in which the rights of the license provider can be protected without impairing the convenience of the license receiver and other users. It is an object of the present invention to provide a license distribution authentication system capable of managing license distribution.
[0005]
It should be noted that the license (right) to be distributed, shared, or managed according to the present invention is not particularly limited. For example, contents (hereinafter referred to as “electronic contents”) provided through a network such as the Internet or through various electronic recording media include documents and computer programs, and those in which sound and images are recorded. It is becoming more diverse and the providers and users are becoming more widespread. The present invention can also cover such copyrights and other licenses of electronic content.
[0006]
[Means for Solving the Problems]
First, the license distribution authentication method according to the first invention of the present application uses the certificate issued by an independent digital certificate authority to authenticate a license provider, a license recipient, and an intermediary business operator, By entrusting the license receiver with information on the rights to be provided to the license receiver in a license management database device and, based on the license management database, newly issuing an electronic rights document to the license receiver. By newly contributing the consignment right to the license recipient and updating the license management database device with the contribution, thereby mediating the consignment of the consignment right, It is a solution to the problem.
[0007]
In the following, a license, a license provider, and a license receiver to which the present invention is applied are also referred to as a right, a rights provider, and a rights receiver, respectively. In addition, the electronic rights document is simply referred to as a rights document. The co-granting of rights is sometimes simply referred to as co-granting or as assignment.
[0008]
In the license distribution / authentication method, the entrusted right is a use right of the license receiver side for using the digitized content provided by the license provider side, and the license right is used by the electronic right document. In addition, the above problem is solved by certifying that the electronic right statement is issued to the license receiver using a data communication network.
[0009]
Next, the intermediary server device according to the second invention of the present application is a certificate for referencing a certificate issued by an independent digital certificate authority for authenticating a license provider, a license receiver, and an intermediary operator. A document reference device, a user management database device for storing registration information about a license provider and a member registered as a license recipient, and a right to be entrusted by the license provider and provided to the license recipient. A license management database device that stores information about the license management database, and a new electronic right document is issued to the license recipient based on the license management database, whereby the entrusted right is newly shared with the license recipient. A new right issuance processing unit for updating the license management database device in accordance with the sharing; Provided, thereby it has to be co-given intermediary of the consignment right by, it is obtained by solving the above problems.
[0010]
Further, a computer program according to a third invention of the present application has solved the above-described problem by providing a computer program for realizing the license distribution authentication method according to the first invention and the intermediary server device according to the second invention. Things.
[0011]
Hereinafter, the operation of the present invention will be briefly described.
[0012]
The present invention uses a certificate issued by an independent digital certificate authority to authenticate a license provider, a license recipient, and a broker. For this reason, it is possible to prevent spoofing of these participants, and it is possible to enhance reliability.
[0013]
Note that the present invention does not specifically limit the authentication of the digital certificate authority. For example, in the embodiment described later, authentication using a secret key and a public key is performed, but other forms of authentication may be used.
[0014]
In addition, while performing such authentication, the license management database device stores information on rights entrusted by the license provider and provided to the license receiver. In addition, by issuing a new electronic right document to the license receiver based on the license management database, the entrusted right is newly provided to the license receiver, and the license is accompanied with the license. Update the management database device.
[0015]
Since the mediation of the consignment right is provided while the authentication is performed in this way, it is possible to perform reliable and reliable license distribution management. For example, a consignment requester can consign a license sharing and its management with confidence.
[0016]
As described above, according to the present invention, it is possible to perform reliable and reliable license distribution management that can protect the rights of the license provider without impairing the convenience of the license receiver and other users. It is.
[0017]
Electronic contents have become diversified, such as documents and computer programs, and sound and video recordings, and the number of providers and users has been widened. In addition, the price for providing the license is also diversified, and some are expensive and others are inexpensive.
[0018]
However, in order to provide electronic content at low cost, it is necessary to manage and provide licenses reliably and inexpensively. Conventionally, as described in Japanese Patent Application Laid-Open No. H11-238038, it has been premised that license management is performed on original electronic contents, so that the efficiency of license management is low, the management cost increases, and facilities for license management are used. However, there is a problem that the initial cost becomes large.
[0019]
On the other hand, the present invention authenticates a license provider, a license recipient, and an intermediary using a certificate issued by an independent digital certificate authority. Therefore, the authentication can be performed with high reliability at a low facility cost.
[0020]
Also, the license sharing and the management thereof to which the present invention is applied are performed while appropriately authenticating the participants, and are highly reliable, and can be contracted out by a license provider. Therefore, the outsourcer does not need the equipment required for license sharing and its management, or can reduce the number of equipment.
[0021]
Therefore, according to the present invention, a highly reliable license sharing and its management can be performed at a small equipment cost, or a license sharing and its management are entrusted, and the entrustment requester aims to reduce the equipment. And a license distribution / authentication system capable of performing such operations.
[0022]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0023]
FIG. 1 is a block diagram showing the overall configuration of the present embodiment to which the present invention is applied.
[0024]
In the present embodiment, in response to a request from the member computer device 5, the electronic content is provided from the electronic content providing server device 15 via the data communication network 1 or the provider server device 17. Note that a network using such a data communication network 1 or the provider server device 17 will be generically referred to as a data communication network 1 below.
[0025]
The electronic content is registered in the provider server device 17 by the individual having the member computer device 5. The digitized content is provided in accordance with the price, and the mediation of the right to use is entrusted to the operator of the provider server device 17. A person who uses the member computer device 5 can be a digitized content provider, and can be a person who provides a right to use the digitized content (right provider). On the other hand, a person who uses the member computer device 5 can be a user of the digitized content, and can be a person who receives a right to use the digitized content (a right recipient).
[0026]
For convenience, the member computer device 5 on the side of the right provider is referred to as the right provider member computer device 5. On the other hand, the member computer device 5 on the side of the right receiver is referred to as the right receiver member computer device 5.
[0027]
In the present embodiment, an electronic right document to which the present invention is applied is issued from the intermediary service server device 10 in response to a payment in some form such as a credit card. The provision of the electronic content is performed after the electronic right document is electronically presented to the electronic content providing server device 15 via the data communication network 1. The value of the digitized content collected by the digitized content providing server device 15 is paid to the person who provided the digitized content.
[0028]
In various operations related to such an electronic right document, the mediation service server device 10, the right provider member computer device 5, and the right recipient member computer device 5 are authenticated by the certificate authority server device 12. You. The authentication and issuance of a certificate related to the authentication are performed by the certificate authority server device 12. Further, if necessary, the certification authority server device 12 itself may be authenticated by the root certification authority server device 13.
[0029]
Note that the authentication relating to the certificate authority server device 12 and the root certificate authority server device 13 is digital authentication widely used in recent years, and is a method using a public key and a secret key.
[0030]
FIG. 2 is a block diagram showing a configuration of the certificate authority server device 12 of the present embodiment.
[0031]
As shown in the figure, the certificate authority server device 12 includes a certificate issuance processing unit 20 for issuing a certificate for authentication, and an authentication process for providing a public key and other processes for authenticating the certificate. And a unit 22. The root certificate authority server device 13 has the same configuration as the certificate authority server device 12.
[0032]
FIG. 3 is a block diagram illustrating the configuration of the brokerage service server device 10 according to the present embodiment.
[0033]
As shown in the figure, the intermediary service server device 10 includes a certificate request processing unit 30, a member registration processing unit 32, a right sharing request reception processing unit 33, a new right issuance processing unit 34, a right registration It has a processing unit 35, a right reissue processing unit 36, and a right deletion processing unit 37. Further, a license management database device 40 storing information on registered rights, a user management database device 42 storing information on registered members, and individual members for authenticating such members. And a certificate archive storage device 44 in which the above certificate is stored.
[0034]
First, the certificate request processing unit 30 requests the certificate authority server device 12 for a certificate for authentication of the intermediary service server device 10 itself. The member registration processing unit 32 receives a member registration of a person who intends to become a right provider or a right receiver, and performs processing related thereto. Further, the right sharing request reception processing unit 33 receives a new right issuance request from the member computer device 5. The new right issuance processing unit 34 actually issues the new right in response to the request. The right registration processing unit 35 performs right registration at the request of the right provider. The right reissue processing unit 36 reissues the already issued right. The right deletion processing unit 37 deletes and deletes the right pertaining to the issued right document.
[0035]
Next, FIG. 4 is a block diagram showing a configuration of the member computer device 5 on the right provider side of the present embodiment. FIG. 5 is a block diagram showing the configuration of the member computer device 5 on the right recipient side.
[0036]
As shown in the figure, first, the right provider member computer device 5 includes a certificate request processing unit 30, a member registration request processing unit 53, a rights document reception processing unit 55, a rights document transmission processing unit 56, It has a right document presentation processing unit 52, a right registration request processing unit 57, a sharing confirmation processing unit 58, and a right destruction request processing unit 59. On the other hand, the right receiver computer 5 includes a certificate request processing unit 30, a member registration request processing unit 53, a right receipt receiving unit 55, a right sharing request processing unit 62, and a right revocation request processing unit. 59.
[0037]
The configuration of the right provider computer device 5 and the configuration of the right recipient member computer device 5 may be realized by a single member computer device 5.
[0038]
First, the member registration request processing unit 53 performs a process of requesting a member registration to the intermediary service server device 10 as a right provider or a right receiver. The rights document reception processing unit 55 performs a process of receiving a rights document from the intermediary service server device 10 by new issuance or reissuance. The rights document transmission processing unit 56 performs a process of transmitting the rights document possessed by the rights provider as the rights provider.
[0039]
The right registration request processing unit 57 performs processing for registering the right provided by the right provider in the intermediary service server device 10. The co-confirmation processing unit 58 processes the right provider computer 5 when the relevant right receiver computer 5 newly receives a right from the intermediary service server 10. The right revocation request processing unit 59 performs processing on the right provider side member computer device 5 side when the right provider side member computer device 5 deletes and destroys the right registered in the intermediary service server device 10. do.
[0040]
Alternatively, the right revocation request processing unit 59 performs processing on the right recipient computer apparatus 5 when deleting and revoking the acquired right on the right recipient computer apparatus 5 side. The right sharing request processing unit 62 performs processing on the right recipient computer apparatus 5 when requesting the right to be obtained on the right recipient member computer apparatus 5 side.
[0041]
Hereinafter, the operation of the present embodiment will be described.
[0042]
The rights provided in the present embodiment are not particularly limited. The right only needs to be shared by the right provider. For example, the right provider may be able to receive or use a limited number of items to be transferred, or the rights provider may have a limited amount of supply such as electronic content. It may be the right to receive or use something that is not.
[0043]
In the present embodiment, in order to receive the service to which the present invention is applied by the intermediary service server device 10, it is necessary to perform processing in advance in the following procedures A1 to A3.
[0044]
A1. Authentication registration processing (corresponding to each of FIGS. 6 to 8): Both those who want to receive services as the rights provider (FIG. 6) and those who want to receive services as the rights receiver (FIG. 7) First, the certificate authority server device 12 registers and receives a certificate so that the identity can be authenticated by the corresponding right provider member computer device 5 or right recipient member computer device 5. The certificate is a so-called digital certificate. It should be noted that the certificate authority server device 12 has also received the same identity authentication with the brokerage service side server device 10 itself (FIG. 8). Further, the root certificate authority server device 13 has also received the same identity authentication as appropriate for the certificate authority server device 12.
[0045]
A2. Mediation member registration process (corresponding to each of FIGS. 9 and 10): After the authentication registration process, a person who wants to receive a service as a right provider (FIG. 9) and a person who wants to receive a service as a right receiver (FIG. 10), the relevant right provider member computer apparatus 5 and right receiver member computer apparatus 5 register in advance as a member in the intermediary service server apparatus 10.
[0046]
A3. Rights registration process (corresponding to FIG. 11): After the mediation member registration process, the member of the rights provider side transmits the right to be provided by the rights provider side member computer device 5 in the mediation service side server device 10. Register. By the registration, the right provider side member computer apparatus 5 receives a right certificate proving that the user has the right to provide from the intermediary service server apparatus 10.
[0047]
Further, the member on the right provider side can receive the following procedure from the intermediary service server device 10 as necessary.
[0048]
A4. Rights document reissue process (corresponding to FIG. 12): If necessary, the member of the rights provider uses the member computer device 5 of the rights provider to obtain “the right to be provided” obtained by A3. The reissue of the right certificate proving that "is present" can be received from the intermediary service server device 10.
[0049]
A5. Rights authentication process (corresponding to FIG. 13): If necessary, the member of the right provider side has “the right to be provided” obtained by A3 by the right side member computer device 5. It can be received from the intermediary service server device 10 that the right certificate certifying the effect is authenticated.
[0050]
If necessary, the member of the right receiver can receive the following procedure from the intermediary service server device 10 for the right obtained by the right transfer and sharing process of A10 described later.
[0051]
A6. Rights document reissue process (corresponding to FIG. 14): If necessary, the member of the right receiver receives the “transferred and shared right” obtained by A3 using the right receiver computer computer 5. A re-issue of the right certificate proving that "there is" can be received from the intermediary service server device 10.
[0052]
A7. Rights authentication processing (corresponding to FIG. 15): If necessary, the member of the right receiver receives the "transferred and shared right" obtained by A3 by the right receiver computer computer 5. The right certificate proving "" can be authenticated from the intermediary service server device 10.
[0053]
If necessary, the member of the right receiver receives the following procedure from the intermediary service side server device 10 as reference information or the like to be used in obtaining the right by the right transfer / granting process of A10 described later. Can receive.
[0054]
A8. Right document presentation acquisition process (from the holder. Corresponding to FIG. 16): If necessary, the right recipient member uses the right recipient member computer device 5 to “provide” issued in A3. A right certifying that the user has the right can be received from the right provider member computer device 5.
[0055]
A9. Right document presentation acquisition process (from the brokerage company side, corresponding to FIG. 17): If necessary, the member of the right receiver receives the "Let's provide" issued in A3 by the right receiver computer computer 5. It can be received from the intermediary service server device 10 with respect to a right certificate proving that the user has the right to have.
[0056]
The member of the right receiver receives the transfer and sharing of the right registered in A3 by the right receiver computer 5, and performs the following processing when trying to acquire the right. With regard to the transfer and co-assignment, usually, the procedure of payment of the compensation for the right (credit of credit payment, etc.) and the actual payment are performed by the right recipient member in advance.
[0057]
A10. Right transfer and share processing (corresponding to FIG. 18): The member of the right receiver receives the right transfer and share of the right registered by A3 using the right receiver member computer device 5, and sends the right server to the intermediary service server. It can be received from the device 10.
[0058]
When the member of the rights provider intends to abandon or delete the rights obtained by the rights receiver, which has been transferred and co-assigned under A10 by the rights provider member computer device 5, the following processing is performed. . The abandonment or deletion is a case where the rights received by the rights recipient and obtained by the rights recipient are not valid, for example, due to a delay in payment of the rights recipient.
[0059]
A11. Right Discarding Process (corresponding to FIG. 19): The member of the right provider can discard or delete the right obtained by the right receiver by A10 using the right-provider member computer device 5.
[0060]
In the case where the member of the right receiver is to abandon or delete the right acquired by the right receiver by the right transfer by the right-side member computer device 5, the following processing is performed. . The discard or deletion is, for example, when the recipient no longer needs the right.
[0061]
A12. Right Abandonment Process (corresponding to FIG. 20): The right recipient member computer 5 can destroy or delete the right obtained by the right recipient by A10 using the right recipient member computer device 5.
[0062]
In the following, in the present embodiment, electronic documents such as a license, a notice, a request, and a transmission are transferred between the member computer 5, the agency server 10, and the certificate authority server 12. At the time of transfer, the legitimacy of the creator of the electronic document is authenticated by a certificate issued by the certificate authority server device 12 or the root certificate authority server device 13 which has performed A1 in advance. I have. At the time of the authentication on the side receiving the electronic document, authentication is performed from the certificate authority server device 12 or the root certificate authority server device 13 via the data communication network 1. The authentication process is hereinafter referred to as a professional certificate authority certificate authentication.
[0063]
Also, when the certificate of the specialized certification authority is authenticated, a certificate issued by the certification authority and corresponding to the creator of the relevant electronic document is required. The certificate may be sent at the same time that the relevant electronic document is sent. Alternatively, in the member computer device 5 or the mediation service server device 10, a device that is stored in advance may be used.
[0064]
Also, the sender of the electronic document expects that the recipient has stored the certificate, and sends the certificate only at the time of sending the electronic document and only when requested by the recipient. You may send it.
[0065]
Further, in the case where a certificate stored in advance is used for the specialized certificate authority certificate authentication, the certificate once authenticated from the certificate authority server device 12 or the root certificate authority server device 13 via the data communication network 1 is used. Saves that the authentication has been received. Then, after the authentication, the authentication via the data communication network 1 may be omitted in the certification of the certification authority of the relevant electronic document.
[0066]
In the intermediary service side server device 10, such a certificate issued by a certificate authority of many members is stored in the certificate archive storage device 44. Also, in the member computer device 5, such a certificate may be stored for a limited period or number. Since some certificates have an expiration date, it is possible to determine whether the certificate can be used or to determine whether the certificate can be stored based on the certificate.
[0067]
Such storage may be performed at any time when the certificate is sent from the other party at the time of the certification of the specialized certification authority or at other times. Also, at the time of such storage, the information regarding whether or not the certificate has been once authenticated from the certificate authority server device 12 or the root certificate authority server device 13 via the data communication network 1 is stored in the present embodiment. In the form, it is stored. After the authentication, the authentication via the data communication network 1 is omitted for the certificate.
[0068]
Hereinafter, the operation of the present embodiment will be described in detail using a flowchart.
[0069]
In the flowchart of the present embodiment, each process is illustrated as being included in each corresponding processing unit in the device configuration. This indicates which processing unit performs the step.
[0070]
6 to 8 are flowcharts each showing an identity authentication process to be received by a corresponding one of the right provider, the right receiver, and the agent.
[0071]
In step 112, the right provider, the right receiver, or the relevant person on the intermediary side first determines his / her own private key and stores it on his own side. In addition, a public key corresponding to the secret key is created, and a certificate issuance request with the public key attached is created. Then, the certificate issuing request is transmitted to the certificate authority server device 12 via the data communication network 1.
[0072]
In step 113, the certificate authority server device 12 receives the request. In addition, the issue of this certificate is examined for validity.
[0073]
If there is no problem in the examination, in step 114, a request is issued from the right provider, the right receiver, or the relevant person on the side of the intermediary business, signed with the private key of the certificate authority server device 12 (digital signature). Create a certificate for identification. The secret key and the public key of the certificate authority server device 12 correspond to the identity authentication described above in A1, which is obtained by the certificate authority server device 12 in the root certificate authority server device 13.
[0074]
In step 115, the certificate created in step 114 is transmitted via the data communication network 1 to the right provider, the right receiver, or the relevant person on the intermediary side. In step 116, the certificate is received by the relevant person and stored in the user.
[0075]
FIG. 9 and FIG. 10 are flowcharts showing the processing of the intermediary member registration for registering as a rights provider or a rights receiver, respectively.
[0076]
In step 122, the person who is going to be registered as a rights provider or a rights recipient creates a membership registration request for this. The membership registration request includes necessary information on the applicant, such as a name, an address required for mailing, an e-mail address required for sending e-mail, and a telephone number required for telephone contact. It is included. Further, the request for membership registration is signed by the applicant using the secret key of A1's identity authentication. After the creation, the certificate obtained by A1 corresponding to the signature is attached if necessary, and the created membership registration request is transmitted to the intermediary service server device 10 via the data communication network 1. I do. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0077]
In step 123, the brokerage service server device 10 receives the request form.
[0078]
In step 124, the intermediary service server device 10 performs the certification of the specialized certification authority certificate and receives the signature of the request form. Then, the validity of the request form is determined.
[0079]
If it is determined that the certificate is valid, then in step 126, if the certificate has not been stored in the certificate archive storage device 44, the certificate is stored. Next, in step 127, the contents of the request form are examined to determine the validity of the member registration.
[0080]
If it is determined that there is no problem in the validity of the member registration, in step 128, the member of the applicant of the request form is registered. At this time, information on the applicant is stored in the user management database device 42 based on the items described in the request form.
[0081]
If the member registration has been properly performed, in step 129, a notice of registration completion is created. In the notification, a signature of the intermediary service server device 10 based on the authentication of the intermediary service server device 10 obtained in A1 is made. Then, the certificate of the intermediary service server device 10 corresponding to the signature is attached as necessary, and the notice is transmitted from the intermediary service server device 10 via the data communication network 1 to the corresponding request. Is transmitted to the member's computer device 5 of the user. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0082]
In step 132, the member computer apparatus 5 of the applicant receives the notice. In step 133, the member computer device 5 performs the certification of the special certification authority certificate and receives the certification of the signature related to the notice. Then, the validity of the notice is determined.
[0083]
If it is determined that the certificate is valid, then in step 135, if the certificate has not been stored in the member computer device 5, the certificate is stored. Next, at step 136, the contents of the notice are examined.
[0084]
FIG. 11 is a flowchart illustrating the rights registration process according to the present embodiment.
[0085]
In step 142, the right provider creates a request form for the current right registration. The request for right registration contains necessary information on the right to be registered, such as the name of the right, the address required for mailing for contact, the e-mail address required for sending e-mail, , A telephone number required for telephone communication and information on how to exercise the right. Further, the right registration request is signed by the right provider with the secret key of A1's identity authentication. After the creation, in step 143, the certificate obtained by A1 corresponding to the signature is attached if necessary, and the created right registration request form is transmitted via the data communication network 1 to the intermediary service server apparatus. Transmit to 10. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0086]
In step 144, the intermediary service server device 10 receives the request form.
[0087]
In step 145, the intermediary service server apparatus 10 performs the certification of the special certification authority certificate and receives the signature of the request form. Then, the validity of the request form is determined.
[0088]
If it is determined that the certificate is valid, then in step 147, if the certificate has not been stored in the certificate archive storage device 44, the certificate is stored. In step 147, the contents of the request form are examined to determine the validity of the right registration. If it is determined that there is no problem with the validity of the right registration, the right registration is performed. At this time, information on the right is stored in the license management database device 40 based on the items described in the request form.
[0089]
If the right registration has been properly performed, in step 148, a right document is created to prove that the right is properly registered in the intermediary service server device 10. In addition, the license management database device 40 and the user management database device 42 are updated with the creation. It should be noted that a signature of the intermediary service side server device 10 based on the authentication of the intermediary service side server device 10 obtained in A1 is given to the right document.
[0090]
Then, in step 149, the certificate of the intermediary service server device 10 corresponding to the signature is attached as necessary, and the rights document is transmitted via the data communication network 1 to the intermediary service server device 10. Is transmitted to the member computer device 5 of the corresponding rights provider. By this transmission, the right is issued.
[0091]
In step 152, the member computer device 5 of the right provider receives the right. In step 153, the certification of the special certificate authority is performed, and the signature of the right certificate is authenticated. Then, the legitimacy of the right is determined.
[0092]
If it is determined that the certificate is valid, then in step 155, the right certificate received this time is stored, and if the certificate concerned is not yet stored in the member computer device 5, the certificate is stored. I do.
[0093]
FIG. 12 is a flowchart illustrating a rights issue reissue process according to the present embodiment.
[0094]
In step 162, the information about the right to be reissued is read from the license management database device 40 with the right to prove that the right provider has the right to be provided. To create the rights statement. The signature of the intermediary service side server device 10 based on the authentication of the intermediary service side server device 10 obtained in A1 is given to the right.
[0095]
Then, in step 163, the certificate of the intermediary service side server device 10 corresponding to the signature is attached as necessary, and the notice is transmitted via the data communication network 1 to the intermediary service side server device 10. Is transmitted to the member computer device 5 of the corresponding rights provider. With this transmission, re-issuance of the current rights document will be performed.
[0096]
In step 164, the member computer 5 of the right provider receives the right. In step 165, the certification of the special certificate authority is performed, and the signature of the right certificate is authenticated. Then, the legitimacy of the right is determined.
[0097]
If it is determined that there is validity, subsequently, in step 167, the reissue right certificate received this time is stored. If the certificate relating to this is not yet stored in the member computer device 5, the certificate is stored.
[0098]
FIG. 13 is a flowchart illustrating a right authentication process according to the present embodiment.
[0099]
In step 172, the rights provider creates a request for the current rights authentication. The request for right authentication contains necessary information on the right to be authenticated, such as the name of the right, the address required for mailing for communication, the e-mail address required for sending e-mail, , A telephone number required for telephone communication and information on how to exercise the right. Further, the right authentication request form is signed by the right provider with the secret key of A1's identification. After the creation, in step 173, if necessary, the certificate obtained by A1 corresponding to the signature is attached, and the created right authentication request is transmitted via the data communication network 1 to the intermediary service server device. Transmit to 10. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0100]
In step 174, the intermediary service server device 10 receives the request form.
[0101]
In step 175, the intermediary service server apparatus 10 performs the certification of the specialized certification authority certificate and receives the signature of the request form. Then, the validity of the request form is determined.
[0102]
If it is determined that the certificate is valid, then in step 177, if the certificate has not been stored in the certificate archive storage device 44, the certificate is stored. In step 177, the contents of the request form are examined with reference to the information stored in the license management database device 40, and the validity of the right authentication is determined. If it is determined that there is no problem in the validity of the right authentication, the right authentication is performed.
[0103]
If the right authentication has been properly performed, in step 178, a right authentication notice is created to prove that the right is properly registered in the intermediary service server device 10. In the notification, a signature of the intermediary service server device 10 based on the authentication of the intermediary service server device 10 obtained in A1 is made.
[0104]
Then, at step 178, the certificate of the intermediary service side server device 10 corresponding to the signature is attached as necessary, and the notice is transmitted via the data communication network 1 to the intermediary service side server device 10. Is transmitted to the member computer device 5 of the corresponding rights provider. By this transmission, the right authentication is performed this time.
[0105]
In step 179, the member computer device 5 of the right provider receives the notice. In step 180, the certification of the special certification authority is performed, and the signature of the notice is authenticated. Then, the validity of the notice is determined. If it is determined that the certificate is valid, the notice received this time is confirmed and stored, and if the certificate concerned is not yet stored in the member computer device 5, the certificate is stored.
[0106]
FIG. 14 is a flowchart illustrating a rights document reissue process according to the present embodiment.
[0107]
The reissue process of the rights document in this flowchart is a reissue of a rights document proving that the rights recipient has "the rights transferred and shared". The side server device 10 is to be reissued. However, the flow of the process is the same as that of the rights issue reissue process in FIG. 12, and the rights provider in FIG. This is the same as replacing the certifying right with a certifying that "we have the rights granted by transfer."
[0108]
FIG. 15 is a flowchart illustrating a right authentication process according to the present embodiment.
[0109]
The right authentication processing is authentication of a right certificate proving that the right receiver has "the right to be transferred and shared".
[0110]
In step 172, the rights receiver creates a request for rights authentication. The request contains necessary information about the right to be authenticated, such as the name of the right, the address required for mailing for communication, the e-mail address required for sending e-mail, and the telephone It contains the telephone numbers required for contact and information on how to exercise the right. Further, the request form is signed by the right recipient with the secret key of A1's identity authentication. After the creation, in step 173, the certificate obtained by A1 corresponding to the signature is attached if necessary, and the created request form is transmitted via the data communication network 1 to the intermediary service server apparatus 10. To be transmitted. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0111]
In step 174, the intermediary service server device 10 receives the request form.
[0112]
In step 175, the intermediary service server apparatus 10 performs the certification of the specialized certification authority certificate and receives the signature of the request form. Then, the validity of the request form is determined.
[0113]
If it is determined that the certificate is valid, then in step 177, if the certificate has not been stored in the certificate archive storage device 44, the certificate is stored. In step 177, the contents of the request form are examined with reference to the information stored in the license management database device 40, and the validity of the right authentication is determined. If it is determined that there is no problem in the validity of the right authentication, the right authentication is performed.
[0114]
If the right authentication has been properly performed, in step 178, a right authentication notice is created to prove that the right is properly registered in the intermediary service server device 10. In the notification, a signature of the intermediary service server device 10 based on the authentication of the intermediary service server device 10 obtained in A1 is made.
[0115]
Then, at step 178, the certificate of the intermediary service side server device 10 corresponding to the signature is attached as necessary, and the notice is transmitted via the data communication network 1 to the intermediary service side server device 10. Is transmitted to the member computer device 5 of the right recipient. By this transmission, the right authentication is performed this time.
[0116]
In step 179, the member computer device 5 of the right receiver receives the notice. In step 180, the certification of the special certification authority is performed, and the signature of the notice is authenticated. Then, the validity of the notice is determined. When it is determined that the notification is valid, the notice received this time is confirmed and stored. If the certificate related to the notice is not yet stored in the member computer device 5, the certificate is deleted. Store.
[0117]
In step 182, the brokerage service-side server device 10 requests the rights provider-side member computer device 5 to perform a right authentication request from the right recipient, and also describes the contents of the authentication in step 182. Create a notification letter to contact and send it.
[0118]
If the notice has been sent, in step 183, the member computer device 5 of the right provider receives the notice. In step 184, the certification of the special certification authority is performed, and the signature of the notice is authenticated. Then, the validity of the notice is determined. When it is determined that the notification is valid, the notice received this time is confirmed and stored. If the certificate related to the notice is not yet stored in the member computer device 5, the certificate is deleted. Store.
[0119]
In the present embodiment, issuance of a rights document means new issuance of a rights document. The issuance of the rights document is, for example, when a new right is registered. At this time, a new rights document is issued. In addition, the authentication of the rights document is to confirm whether the existing rights document is valid. Reissuing a rights document means reissuing a rights document that has already been issued by a device of the relevant department. For example, if the issued rights document is lost due to a failure of the member computer device 5, such a rights document can be reissued. In the present embodiment, such a right certificate is issued, authenticated, and re-issued in the intermediary service server device 10.
[0120]
FIG. 16 is a flowchart showing the right presentation obtaining process in the present embodiment.
[0121]
In step 192, the rights provider sends the rights document to the rights recipient member computer device 5 to present the rights this time. At the time of sending, a sending letter is attached in this embodiment. The delivery note is signed by the rights provider with the secret key of A1's identity authentication. If necessary, a certificate obtained by A1 corresponding to the signature is attached. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0122]
In step 193, the right recipient's member computer device 5 accepts these, such as a written right and a letter of delivery.
[0123]
In step 194, the member computer device 5 performs the certification of the special certification authority certificate and receives the signature of the signature. Then, the legitimacy of the sentence is determined.
[0124]
In step 196, the member computer device 5 performs the certification of the certificate authority, and receives the signature of the signature. Then, the legitimacy of the right is determined. If it is determined that there is validity, subsequently, in step 198, the rights certificate is stored.
[0125]
FIG. 17 is a flowchart showing the right presentation obtaining process in the present embodiment.
[0126]
In step 202, the intermediary service side server device 10 refers to the license management database device 40 and creates a rights certificate to be presented. In step 203, the right is sent to the right-receiving member computer 5 in order to present the right. The rights certificate is signed by the intermediary service server device 10 with the secret key of A1's identity authentication. If necessary, a certificate obtained by A1 corresponding to the signature is attached. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0127]
In step 205, the member computer device 5 of the right receiver receives the right document or the like.
[0128]
In step 206, the member computer device 5 performs the certification of the certificate authority, and receives the signature of the signature. Then, the legitimacy of the right is determined. If it is determined that there is validity, then in step 208, the rights certificate is stored.
[0129]
FIG. 18 is a flowchart illustrating the rights transfer and sharing process according to the present embodiment.
[0130]
In step 232, the rights receiver prepares a request form for sharing and transferring the rights. The request contains necessary information on the right to be transferred and shared, such as the name of the right, the address required for mailing for contact, and the e-mail address required for sending e-mail. And information on the telephone number required for telephone contact and how to exercise the right. Further, the request form is signed by the right recipient with the secret key of A1's identity authentication. After the creation, in step 232, the certificate obtained by A1 corresponding to the signature is attached if necessary, and the created request form is transmitted via the data communication network 1 to the intermediary service server device. Transmit to 10. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0131]
In step 233, the brokerage service server device 10 receives the request form.
[0132]
In step 234, the intermediary service server apparatus 10 performs the certification of the special certification authority certificate and receives the signature of the request form. Then, the validity of the request form is determined.
[0133]
If it is determined that there is validity, then in step 236, a request confirmation is created. The request confirmation includes the above-described necessary information on the right to be transferred and shared, such as the name of the right. Further, the request confirmation is signed by the intermediary service server device 10 with the secret key of the identity authentication of A1. After the creation, in step 232, the certificate obtained by A1 corresponding to the signature is attached if necessary, and the created request confirmation is sent to the right provider via the data communication network 1. The data is transmitted to the member computer 5. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0134]
In step 242, the right provider member computer device 5 receives the request confirmation.
[0135]
At step 243, the right provider member computer device 5 performs the certification of the special certification authority, and obtains the certificate obtained by the right recipient by A1 and the request confirmation related to the request confirmation. The signature is authenticated. Then, the validity of the request confirmation is determined.
[0136]
If it is determined that the request is valid, then in step 243, the content of the request confirmation is determined, and it is determined whether or not the right transfer sharing is accepted. If accepted, the rights provider creates an acceptance letter. The acceptance document includes necessary information on the right to be accepted, for example, information such as the name of the right. Further, the acceptance document is signed by the rights provider with the secret key of A1's identity authentication. After the creation, the certificate obtained by A1 corresponding to the signature is attached if necessary, and the created acceptance document is transmitted to the intermediary service server device 10 via the data communication network 1. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0137]
In step 252, the intermediary service server device 10 receives the acceptance document.
[0138]
In step 253, the intermediary service side server device 10 sends the certificate, which is obtained by the right provider of the current right acceptance by A1, according to the certificate by the certificate authority server device 12 via the data communication network 1, The signature of the request is authenticated. Then, the validity of the acceptance document is determined.
[0139]
If it is determined that the certificate is valid, then in step 253, if the certificate has not been stored in the certificate archive storage device 44, the certificate is stored. In step 253, the contents of the acceptance are checked with reference to the information stored in the license management database device 40, and the validity of the acceptance is determined.
[0140]
If it is determined that there is no problem with the legitimacy, a rights document to be transmitted to the right provider is created in step 256 in order to transfer and share the rights. The signature of the intermediary service side server device 10 based on the authentication of the intermediary service side server device 10 obtained in A1 is given to the right.
[0141]
Then, in step 257, the certificate of the intermediary service side server device 10 corresponding to the signature is attached as necessary, and the rights document is transmitted via the data communication network 1 to the intermediary service side server device 10. Is transmitted to the member computer device 5 of the right recipient. By this transmission, the right is issued.
[0142]
In step 262, the member computer device 5 of the right recipient receives the right. In step 263, the certification of the special certification authority is performed, and the signature of the right certificate is authenticated. Then, the legitimacy of the right is determined.
[0143]
If it is determined that there is legitimacy, subsequently, in step 265, the right certificate received this time is stored. If the certificate relating to this is not yet stored in the member computer device 5, the certificate is stored.
[0144]
In step 258, the intermediary service-side server device 10 notifies the rights provider-side member computer device 5 of a request to share and transfer the rights from the right receiving side to the right provider side, if necessary. Create a notice of completion of the co-administration to notify the details of the administration and send it.
[0145]
If the notice has been sent, in step 272, the member computer device 5 of the relevant right provider receives the notice. In step 273, the certification of the special certification authority is performed, and the signature of the notice is authenticated. Then, the validity of the notice is determined. When it is determined that the notification is valid, the notice received this time is confirmed and stored. If the certificate related to the notice is not yet stored in the member computer device 5, the certificate is deleted. Store.
[0146]
FIG. 19 is a flowchart illustrating the rights discarding process of the present embodiment.
[0147]
The right destruction process is a right destruction process related to the “right to provide” held by the right recipient.
[0148]
In step 282, the right provider creates a request form for the current right abandonment. The request for revoking rights includes necessary information on the right to be revoked, such as the name of the right. Further, the right destruction request is signed by the right provider with the secret key of A1's identity authentication. After the creation, in step 283, the certificate obtained by A1 corresponding to the signature is attached if necessary, and the created revocation request is sent via the data communication network 1 to the intermediary service server device. Transmit to 10. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0149]
In step 284, the intermediary service server device 10 receives the request form.
[0150]
In step 285, the intermediary service server apparatus 10 performs the certification of the special certification authority certificate and receives the signature of the request form. Then, the validity of the request form is determined.
[0151]
If it is determined that the request is valid, then at step 287, the contents of the request form are examined with reference to the license management database device 40, and the validity of the right revocation is determined. If it is determined that there is no problem with the validity of the right revocation, the right revocation is performed. At this time, the license management database device 40 is updated based on the items described in the request form.
[0152]
If the right destruction has been properly performed, in step 288, a notice for notifying that the right destruction has been correctly performed is created. In the notification, a signature of the intermediary service server device 10 based on the authentication of the intermediary service server device 10 obtained in A1 is made.
[0153]
Then, in step 288, the certificate of the intermediary service side server device 10 corresponding to the signature is attached as necessary, and the notice is transmitted via the data communication network 1 to the intermediary service side server device 10. Is transmitted to the member computer device 5 of the corresponding rights provider. By this transmission, this right revocation has been correctly performed.
[0154]
In step 292, the member computer device 5 of the right provider receives the notice. In step 293, the certification of the special certification authority is performed, and the signature of the notice is authenticated. Then, the validity of the notice is determined. If it is determined to be valid, the contents of the notification received this time are confirmed, and the notification is stored as necessary. If the current certificate has not been stored in the member computer device 5, the certificate is stored.
[0155]
FIG. 20 is a flowchart illustrating the rights discarding process of the present embodiment.
[0156]
The right destruction process is a right destruction process related to the “transferred rights” held by the right receiver.
[0157]
In step 312, the rights receiver prepares a request for rights destruction. The request includes necessary information on the right to be destroyed, such as the name of the right. Further, the request form is signed by the right recipient with the secret key of A1's identity authentication. After the creation, in step 313, the certificate obtained by A1 corresponding to the signature is attached if necessary, and the created request form is transmitted via the data communication network 1 to the intermediary service server apparatus 10. To be transmitted. If the certificate is already at the transmission destination, this certificate transmission is unnecessary.
[0158]
In step 322, the intermediary service server device 10 receives the request form.
[0159]
In step 323, the intermediary service server device 10 performs the certification of the specialized certificate authority, and receives the signature of the request. Then, the validity of the request form is determined.
[0160]
If it is determined that the request is valid, then in step 325, the contents of the request form are examined with reference to the license management database device 40, and the validity of the right revocation is determined. If it is determined that there is no problem with the validity of the right revocation, the right is deleted and the right revocation is performed. At this time, the license management database device 40 is updated based on the items described in the request form.
[0161]
If the right has been properly revoked, at step 326, a notice for notifying that the right has been correctly revoked is created. In the notification, a signature of the intermediary service server device 10 based on the authentication of the intermediary service server device 10 obtained in A1 is made.
[0162]
Then, in step 326, the certificate of the intermediary service side server device 10 corresponding to the signature is attached as necessary, and the notice is transmitted via the data communication network 1 to the intermediary service side server device. 10 is transmitted to the member computer device 5 of the corresponding rights receiver. By this transmission, this right revocation has been correctly performed.
[0163]
In step 332, the member computer 5 of the right recipient receives the notice. In step 333, the certification of the special certification authority is performed, and the signature of the notice is authenticated. Then, the validity of the notice is determined. If it is determined to be valid, the contents of the notification received this time are confirmed, and the notification is stored as necessary. If the current certificate has not been stored in the member computer device 5, the certificate is stored.
[0164]
In step 327, if necessary, the intermediary service side server device 10 requests the rights provider side member computer device 5 to request the rights to be revoked from the right recipient and the content of the rights revocation. Create a notice to contact and send it.
[0165]
If the notice has been sent, in step 342, the member computer device 5 of the right provider receives the notice. In step 343, the certificate authority server device 12 authenticates the certificate or signature of the intermediary service server device 10 related to the notification via the data communication network 1. Then, the validity of the notice is determined. When it is determined that the notification is valid, the notice received this time is confirmed and stored. If the certificate related to the notice is not yet stored in the member computer device 5, the certificate is deleted. Store.
[0166]
As described above, according to the present embodiment, the present invention can be effectively applied.
[0167]
It should be noted that the identity authentication certificate (so-called digital authentication certificate) issued by the certificate authority server device 12 or the root certificate authority server device 13 may already be possessed by the other party. In such a case, transmission of the certificate may be omitted.
[0168]
【The invention's effect】
According to the present invention, it is possible to perform reliable and reliable license distribution management that can protect the rights of a license provider without impairing the convenience of the license receiver and other users. In addition, it is possible to provide reliable license consignment and management thereof at a low facility cost, or to outsource license consignment and its management so that the requester of the consignment can reduce the equipment. Or you can.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an overall configuration of a first embodiment to which the present invention is applied.
FIG. 2 is a block diagram showing a configuration of a certificate authority server device in the embodiment.
FIG. 3 is a block diagram showing a configuration of an intermediary service server device in the embodiment.
FIG. 4 is a block diagram showing a configuration of a member computer device of the right provider in the embodiment.
FIG. 5 is a block diagram showing a configuration of a member computer device on the right recipient side in the embodiment.
FIG. 6 is a flowchart showing identification authentication processing to be performed by a corresponding right provider in the embodiment.
FIG. 7 is a flowchart showing identification authentication processing to be performed by a corresponding right recipient in the embodiment.
FIG. 8 is a flowchart showing identification authentication processing to be performed by a corresponding person on the intermediary business side in the embodiment.
FIG. 9 is a flowchart showing a process of registering an intermediary member for registering as a right provider in the embodiment.
FIG. 10 is a flowchart showing a process of registering an intermediary member to be registered as a right receiver in the embodiment.
FIG. 11 is a flowchart showing a right registration process in the embodiment.
FIG. 12 is a flowchart showing rights issue reissue processing according to the rights provider in the embodiment.
FIG. 13 is a flowchart illustrating rights authentication processing according to the rights provider in the embodiment.
FIG. 14 is a flowchart showing rights issue reissue processing relating to a rights receiver in the embodiment.
FIG. 15 is a flowchart showing a rights authentication process for a rights receiver in the embodiment.
FIG. 16 is a flowchart showing a process of obtaining a right presentation from a right provider in the embodiment.
FIG. 17 is a flowchart showing a right presentation obtaining process from the intermediary business side in the embodiment.
FIG. 18 is a flowchart showing a right transfer / grant process in the embodiment.
FIG. 19 is a flowchart showing a rights discarding process according to the rights provider in the embodiment.
FIG. 20 is a flowchart showing rights revocation processing for the rights receiver in the embodiment.
[Explanation of symbols]
1. Data communication network
5 ... Member computer device
10: Intermediary service server device
12: Certificate authority server device
13 Root certificate authority server device
15. Computerized content providing server device
17 ... Provider server device
20: Certificate issuance processing unit
22: Authentication processing unit
30 ... Certificate request processing unit
32 ... Member registration processing section
33 ... Rights sharing request reception processing section
34… New rights issue processing section
35 ... Right registration processing unit
36 ... Rights Reissue Section
37 ... right deletion processing unit
40 ... License management database device
42 ... User management database device
44… Certificate archive storage device
52 ... Rights presentation processing unit
53 ... Member registration request processing section
55 ... Rights receipt processing unit
56 ... Delivery of rights document
57 ... Right registration request processing unit
58: Shared confirmation processing unit
59 ... Registration request processing unit
62 ... Rights sharing request processing unit

Claims (4)

Using certificates issued by an independent digital certificate authority, while authenticating license providers, license recipients, and intermediaries,
Stored in a license management database device is information entrusted by the license provider and rights to be provided to the license recipient,
A new electronic right document is issued to the license receiver based on the license management database, whereby the entrusted right is newly provided to the license receiver, and the license management database is additionally provided with the sharing. Update the device,
A license distribution / authentication method, wherein the mediation of the consignment right is mediated. The license distribution authentication method according to claim 1,
The entrustment right is a use right of the license recipient side for using the digitized content provided by the license provider side, and certifies the use right by the electronic right document.
A license distribution authentication method, wherein the issuance of the electronic right document to the license receiver is performed using a data communication network. A certificate reference device for referring to a certificate issued by an independent digital certificate authority for authenticating a license provider, a license recipient, and an intermediary agent;
A user management database device that stores registration information about a license provider and a member registered as a license recipient;
A license management database device that is entrusted by the license provider and stores information on rights to be provided to the license recipient;
A new electronic right is issued to the license receiver based on the license management database, whereby the entrusted right is newly provided to the license receiver, and the license management database device is additionally provided with the sharing. And a new rights issue processing unit that updates
In this way, the mediator server device is configured to mediate the consignment right sharing. A computer program for implementing any one of the license distribution authentication method according to claim 1 and claim 2 and the intermediary server device according to claim 3.

Images