JP2016015728A - Content transmitter and content transmission method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make an access to a content of a copyright protection target in a home from out of the home, using equipment for use in a mobile environment.SOLUTION: A mobile device 700, which accesses an STB 100 having a record reproduction function in the home from out of the home, determines a method of a secure communication path which is established with a router 500 beforehand in the home, and executes first authentication processing and registration processing with which becomes necessary when accessing from out of the home, with the STB 100 having the record reproduction function, to cause to register information related to the mobile device 700 and out-of-home access information into an out-of-home equipment information table provided in the STB 100 having the record reproduction function. The STB 100 having the record reproduction function in the home which is accessed from the mobile device 700 transmits a content to the mobile device 700 only when the information related to the mobile device 700 is registered in the out-of-home equipment information table and second authentication processing using the out-of-home access information is successful between both devices.

Description

  The present invention relates to a technology for transmitting and receiving content such as video and audio via a network, and more particularly to a content transmission apparatus and content transmission method suitable for protecting the copyright of transmitted content.

  When content is transmitted between digital AV devices, encryption is performed on the content transmission device side, and information for decryption is shared with the content reception device side, so that the content reception device that is the transmission destination Copy protection is implemented to prevent the creation of unlimited copies so as to prevent content from being correctly received and decrypted by other devices.

  As an example of such a copy protection method, there is a method described in Patent Document 1, for example, which is incorporated in a digital AV device. In the method described in Patent Document 1, content is “Copy free (can be copied without restriction)”, “Copy free with EPN asserted (can be copied without restriction with output protection)”, “Copy one generation (possible one generation copy)”, “No” It is classified and managed as “more copies (prohibit re-copying)” and “Copy never (copy-prohibited)”. The recording device records only the contents of “Copy free”, “Copy free with EPN asserted”, and “Copy one generation”. Once the “Copy one generation” content is recorded, it is handled as “No more copies” and is encrypted on the bus except for the “Copy free” content on the bus. By performing transmission by performing processing, so that not be a copy of unlimited content.

  In Patent Document 1 and Patent Document 2, in content transmission in a wired or wireless network, content that is subject to copyright protection, such as a broadcast program recorded in the home, does not seem to be distributed unrestrictedly outside the home. Discloses a technique for determining whether the network is a home network.

JP 2005-269288 A JP2007-36351

  For users who have devices used in mobile environments using portable information terminals such as notebook PCs and portable terminals, contents in the home can be used from travel destinations and trains on the way to work by using these devices. There is a request to access. On the other hand, in the above prior art, when transmitting copyright-protected content via a wired or wireless network, it is confirmed that the sending and receiving devices are in the same house, A function for transmitting content only to devices in the network is incorporated. For this reason, it is not possible to access content that is subject to copyright protection from the outside.

  In order to solve the above problems, for example, the configuration described in the claims is adopted.

  The user can view the contents in the house from outside the house by using the operation method almost the same as in the house without exceeding the range of personal use, and the convenience for the user is improved.

  Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

It is a block diagram which shows the structural example of a system. It is a block diagram which shows the structural example of a system. It is a block diagram which shows the structural example of STB with a recording / reproducing function. It is a block diagram which shows the structural example of TV with a recording / reproducing function. It is a block diagram which shows the structural example of a mobile apparatus. It is a block diagram which shows the structural example of the router corresponding to a remote access. It is a figure which shows the software structural example of STB with a recording / reproducing function. It is a figure which shows the software structural example of a mobile apparatus. It is a figure which shows the software structural example of the router corresponding to a remote access. It is a figure which shows an example of the apparatus information which STB with a recording / reproducing function manages. It is a figure which shows an example of the apparatus information which a mobile apparatus manages. It is a figure which shows an example of the content transfer sequence in a house. It is a figure which shows an example of the apparatus authentication processing sequence in a house. It is a figure which shows an example of the apparatus information which a remote access corresponding router manages. It is a figure which shows an example of the setup processing sequence of the mobile apparatus in a house. It is a figure which shows an example of the apparatus registration process sequence of the mobile apparatus in a house. It is a figure which shows an example of the screen which a mobile apparatus displays. It is a figure which shows an example of the screen which a mobile apparatus displays. It is a figure which shows an example of the connection processing sequence from outside the house to the house. It is a figure which shows an example of the content transfer sequence from the house to the house outside. It is a figure which shows an example of the apparatus authentication processing sequence from the outside to the house. It is a figure which shows the structural example of the transmission data which STB with a recording / reproducing function transmits. It is a figure which shows an example of the screen which a mobile apparatus displays.

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. In the drawings, the same reference numerals indicate the same or corresponding parts. Further, the present invention is not limited to the illustrated example.

In this embodiment, a method for remotely accessing an in-home device from an out-of-home device and remotely viewing content stored in the in-home device will be described.
<System configuration>
FIG. 1 shows an example of the system configuration of this embodiment.

  1 is a user's home that receives the broadcast, 2 is a place where the user's home 1 cannot be directly accessed (for example, a hotel or a company), 3 and 4 are broadcasting stations as content providers, 5 and 6 are communication service providers, 7 Is a server that provides a Dynamic Domain Name System (DDNS) service, 12 and 14 are access networks provided by the communication service providers 5 and 6, and 13 is the Internet that connects bases such as the access networks 12 and 14.

  In this embodiment, the broadcast station 3 and the broadcast station 4 send out broadcasts using different broadcast methods. Here, a case where the broadcasting station 3 transmits terrestrial digital broadcasting using terrestrial waves and the broadcasting station 4 transmits digital cable television (CATV) broadcasting via a transmission path will be described as an example. The broadcasting systems of the broadcasting station 3 and the broadcasting station 4 may be different from each other, and may be a combination of BS digital broadcasting and CATV broadcasting transmitted by satellite waves.

  In user home 1, 8 is a broadcast receiving antenna, 9 and 10 are distributors, 500 is a router, 19 is a hub, and 200 is a recording / reproducing function having a function of receiving and recording / reproducing a terrestrial digital broadcast transmitted from the broadcasting station 3. Attached TV 300 is an STB (Set Top Box) that receives a CATV broadcast transmitted from the broadcasting station 4, and 100 is a STB 400 with a recording / reproducing function having a function of receiving, recording, and reproducing the CATV broadcast transmitted from the broadcasting station 4. Is a monitor that outputs video and audio data reproduced by the STB 300 and the STB 100 with a recording / reproducing function.

  The broadcast receiving antenna 8 receives the terrestrial digital broadcast transmitted from the broadcast station 3, and the received digital broadcast is distributed to the TV 200 with a recording / reproducing function capable of receiving the terrestrial digital broadcast via the distributor 9.

  The CATV broadcast transmitted from the broadcasting station 4 is transmitted to the user's home 1 via a dedicated transmission path, and distributed to the STB 300 that can receive the CATV broadcast and the STB 100 with a recording / reproducing function via the distributor 10. The CATV broadcast received by the STB 300 and the STB 100 with recording / reproducing function and the content reproduced by the STB 100 with recording / reproducing function are output to the monitor 400 and displayed.

  The user at the user home 1 can use the STB 100 with a recording / reproducing function, the TV 200 with a recording / reproducing function, and the STB 300 using the respective remote controllers 17, 15, and 18.

  The STB 100 with recording / reproducing function, the TV 200 with recording / reproducing function, and the STB 300 of the user home 1 can be connected to each other via a hub 19 via a wired LAN (Local Area Network) 11, and these devices (recording) connected to the hub 19 The home network of the user home 1 is constructed by the STB 100 with a reproduction function, the TV 200 with a recording / reproduction function, and the STB 300). Each device on the LAN 11 can be connected to the access network 12 and the Internet 13 provided by the communication provider 5 via the router 500.

The mobile device 700 at the outside location 2 can communicate with the wireless access point 20 provided free of charge or for a fee via the wireless LAN 16, and is connected to the access network 14 provided by the communication service provider 6 and the Internet 13 via the router 600. it can.
Here, in FIG. 1, each device in the user's home 1 is connected to the router 500 via the hub 19 via the wired LAN 11. However, the hub 19 and the router 500 may be integrated. The hub 19 and / or the router 500 may be integrated with a wireless access point (not shown), and communication between devices in the user home 1 may be performed using a wireless LAN instead of a wired LAN. Is possible. In this case, wireless LAN communication can be performed by incorporating a wireless function in each device in the user home 1 or by attaching a wired LAN-wireless LAN conversion adapter to each device.

  In this embodiment, the router 500 is integrated with the wireless access point, and when the mobile device 700 taken out to the destination 2 in FIG. 1 is used in the user home 1, the user home via the router 500 is used. It is assumed that communication with each device in 1 is possible.

  The wired LAN 11, the access networks 12 and 14, the Internet 13, and the wireless LAN 16 in the user home 1 use standard IP (Internet Protocol) as a network protocol, and TCP (Transmission Control Protocol) and higher level transport protocols. UDP (User Datagram Protocol) is used. For transmission of various types of information and contents, higher-level application protocols such as RTP (Real-time Transport Protocol), HTTP (Hyper Text Transfer Protocol), FTP (File Transfer Protocol), and the like are used. Note that IP has IPv4 and IPv6 as the version differences, but this embodiment is not limited to either one.

  FIG. 2 is an example of another system configuration of the present embodiment.

  Reference numerals 21 and 22 denote IP distribution providers that provide VOD (Video on Demand) service, IP broadcast, content download service, and the like as content providers via a network.

  The IP distribution provider 21 provides various services on the access network 12 provided by the communication service provider 5 contracted with the user home 1. The STB 100 with a recording / reproducing function, the TV 200 with a recording / reproducing function, and the STB 300 in the user's home 1 can use the VOD service, the content download service, and the like described above via the router 500 and the hub 19 via the access network 12. It is.

The IP distribution provider 22 provides various services on the Internet 13. The STB 100 with recording / reproducing function, the TV 200 with recording / reproducing function, and the STB 300 in the user's home 1 receive the above-described VOD service, content download service, and the like via the router 13 and the hub 19 via the Internet 13 and the access network 12. It is possible. Other configurations are the same as those in FIG.
<Configuration block of each device>
FIG. 3 is a block diagram illustrating a configuration example of the STB 100 with a recording / reproducing function.

  The STB 100 with a recording / reproducing function includes a tuner 101, a demodulation / decoding unit 102, a demax unit 103, an audio decoding unit 104, a video decoding unit 105, a data decoding unit 106, a synthesis unit 107, a communication unit 108, a recording / reproducing unit 109, and a recording medium 119. , Limited reception IF 120, control unit 111, memory 110, operation IF unit 112, time management / timer unit 113, antenna connection terminal 114, digital audio signal output terminal 115, digital video signal output terminal 116, network terminal 117, operation signal reception Part 118.

  The CATV broadcast is input from the antenna connection terminal 114 to the tuner 101. The tuner 101 extracts a channel frequency band of a channel to be received, and outputs the channel frequency band to the demodulation / decoding unit 102 as a baseband signal by orthogonal demodulation.

  The demodulating / decoding unit 102 performs synchronous demodulation using, for example, 8PSK (Phase Shift Keying) on the baseband signal, performs error correction such as Viterbi decoding and RS (Reed-Solomon) decoding, and decodes the digital broadcast signal. To the demax unit 103. Here, as a digital broadcast signal, a case will be described in which MPEG2-TS compressed and encoded by the MPEG (Moving Picture Experts Group) method and multiplexed by the TS (Transport Stream) method is described.

  The demax unit 103 separates and extracts a signal used in the subsequent stage from the multiplexed MPEG2-TS. Then, the demux unit 103 acquires key information and the like received via the limited reception IF (Interface) 120 and held in the limited reception information storage unit 123, and uses this information to protect the MPEG2- The scramble applied to the TS is canceled, and the video signal, audio signal, subtitle signal stream such as PES (Packetized Elementary Stream) or ES (Elementary Stream), data broadcasting, etc., which output content such as a broadcast program is output. .

The audio decoding unit 104 decodes the PES or ES of the audio signal separated and extracted by the demax unit 103 and outputs it to the digital audio signal output terminal 115.
The video decoding unit 105 decodes the PES or ES of the video signal separated and extracted by the demux unit 103 and outputs the decoded PES or ES to the synthesis unit 107.
The data decoding unit 106 decodes the subtitles and data broadcast signals separated / extracted by the demax unit 103 and outputs them to the combining unit 107.

  The combining unit 107 combines the signals input from the video decoding unit 105 and the data decoding unit 106 to form a display screen, and outputs the display screen to the digital video signal output terminal 116.

  The communication unit 108 includes an encryption / decryption unit 121, and transmits / receives data and content to / from other devices on the LAN 11 connected to the hub 19 via the network terminal 117, or servers outside the home via the router 500. I do. The encryption / decryption unit 121 encrypts data and content to be transmitted to another device on the LAN 11 in the user home 1 or a server outside the home. The encryption / decryption unit 121 also decrypts data and content received from another device on the LAN 11 in the user's home 1 or a server outside the home.

  The recording / playback unit 109 includes an encryption / decryption unit 122. The recording / playback unit 109 includes a recording process of writing content such as a received broadcast program or content acquired via a network to the recording medium 119, and reading and outputting the recorded content from the recording medium 119. Responsible for playback processing and recorded content deletion processing. When the content is recorded on the recording medium 119, the encryption / decryption unit 122 performs an appropriate encryption process on the recorded content. When reading the content from the recording medium 119, the encryption / decryption unit 122 decrypts and outputs the encryption applied at the time of recording. A key used for encryption / decryption is generated in accordance with a predetermined algorithm and held in the memory 110 or the recording medium 119.

  The recording medium 119 includes either a removable recording medium such as a hard disk, a removable recording medium such as an optical disk, a removable hard disk, or a memory card, or both. Moreover, you may provide several types of recording media like a hard disk, an optical disk, and a memory card.

  The control unit 111 performs an OS (Operating System) and application execution process, and causes the STB 100 with a recording / reproducing function to function.

  The memory 110 includes a volatile memory and a nonvolatile memory. The nonvolatile memory stores software and fixed data for operating the STB 100 with a recording / reproducing function such as an OS or an application. The volatile memory temporarily stores data necessary for software operation.

  An operation IF (Interface) unit 112 receives an input signal from the remote controller 17 by the operation signal receiving unit 118 and processes it. The remote controller 17 may be a mouse, a keyboard, a touch panel, or the like, for example.

  The operation signal receiving unit 118 may receive an input signal from the remote control 17 wirelessly using infrared rays or the like, or may connect the remote control 17 via a connection terminal and receive an input signal from the remote control 17. good.

  The time management / timer 113 uses time information included in a broadcast signal input via the tuner 101 and time information provided by an NTP (Network Time Protocol) server existing on the access network 12 or the Internet 13. Manage time. NTP is a protocol for synchronizing the clock held by a device to the correct time in a device connected to a network. Further, the time management / timer 113 has timer setting / execution functions for setting / executing reservation viewing and reservation recording and controlling timeout of various operations.

  A conditional access IF (Interface) 120 is an interface for connecting the conditional access information storage unit 123. The limited reception information storage unit 123 holds key information for releasing scramble.

  The system bus 40 is a data bus connected to all the components of the STB 100 with a recording / reproducing function. The system bus 40 is used for communication of control signals and data signals between the components.

  The digital audio signal output terminal 115 and the digital video signal output terminal 116 are uncompressed digital audio for an external television or the like in order to view contents such as a broadcast program received by the STB 100 with a recording / playback function or a recorded broadcast program. This is an output terminal for outputting a signal and a digital video signal, respectively. The digital audio signal output terminal 115 and the digital video signal output terminal 116 may be physically separated connectors, or may be mounted as a single connector using a connector having a plurality of output terminals. In addition, a control signal output terminal may be assigned to the connector, and the control signal output terminal may output a display device control signal for controlling an externally connected display device such as a display.

FIG. 4 is a block diagram illustrating a configuration example of the TV 200 with a recording / reproducing function.
The TV 200 with a recording / playback function includes a tuner 201, a demodulation / decoding unit 202, a demax unit 203, an audio decoding unit 204, a video decoding unit 205, a data decoding unit 206, a synthesis unit 207, an audio output unit 208, a display unit 209, and a communication unit 210. , Recording / playback unit 211, recording medium 223, conditional access IF 224, control unit 213, memory 212, operation IF unit 214, time management / timer unit 215, antenna connection terminal 216, audio signal input terminal 217, digital audio signal output terminal 218 A video signal input terminal 219, a digital video signal output terminal 220, a network terminal 221, and an operation signal receiver 222.

  The terrestrial digital broadcast is input from the antenna connection terminal 216 to the tuner 201.

  The audio output unit 208 decodes the non-compressed digital audio signal output from the audio decoding unit 204 and reproduces it through a speaker. Also, the uncompressed digital audio signal input from the audio signal input terminal 217 is decoded and reproduced by a speaker, or an analog audio signal is reproduced by a speaker. The communication unit 210 includes an encryption / decryption unit 226, and the recording / playback unit 211 includes an encryption / decryption unit 227.

The display unit 209 decodes the non-compressed digital video signal output from the synthesis unit 207 and displays it on a monitor. Further, the uncompressed digital video signal input from the video signal input terminal 219 is decoded and displayed on the monitor, or the analog video signal is displayed on the monitor.
Parts other than those described above have the same functions as in FIG.

FIG. 5 is a block diagram illustrating a configuration example of the mobile device 700.
The mobile device 700 includes a demux unit 701, an audio decoding unit 702, a video decoding unit 703, a data decoding unit 704, a synthesis unit 705, an audio output unit 706, a display unit 707, a wireless communication unit 708, a wide area wireless communication unit 720, and a recording / reproduction. 709, recording medium 716, control unit 711, memory 710, operation IF unit 712, time management / timer unit 713, GPS (Global Positioning System) 717, camera 721, digital audio signal output terminal 714, and wireless network terminal 715 . The wireless communication unit 708 has an encryption / decryption unit 718, and the recording / playback unit 709 has an encryption / decryption unit 719.

  The wide area wireless communication unit 720 is a wireless communication part for performing telephone and packet communication, such as 3G, LTE (Long Term Evolution), and WiMAX (Worldwide Interoperability for Microwave Access).

The operation IF unit 712 receives and processes an input signal from the touch panel.
The GPS 717 receives a signal from a GPS satellite and acquires a current position.

The camera 721 takes a photograph or a QR code (Quick Response registered trademark). The control unit 711 associates the data of the photograph taken by the camera 718 with the information of the GPS 717 and stores it in the recording medium 716 via the recording / playback unit 709 or directly in the memory 710.
About parts other than the above, it shall be provided with the function similar to FIG. 3, FIG.

FIG. 6 is a block diagram illustrating a configuration example of the router 500.
The router 500 includes a control unit 502, a memory 501, a time management / timer unit 503, an operation IF unit 504, a local access communication unit 508, a remote access communication unit 505, an operation signal input unit 512, a wired network connection terminal 514, and wireless network communication. A terminal 515 and an outside network connection terminal 513 are provided.

The operation IF unit 504 receives and processes an input signal from the operation signal input unit 512 of the operation button.
The local access communication unit 508 includes an Ethernet (registered trademark) connection unit 510, a wireless access point unit 511, and an encryption / decryption unit 509, and transmits / receives data and content to / from other devices in the user home 1.

  The Ethernet connection unit 510 transmits data and content on the wired LAN via the wired network connection terminal 514, or receives data and content from other devices in the user home 1 via the wired LAN.

  The wireless access point unit 511 transmits data and content on the wireless LAN via the wireless network communication terminal 515 or receives data and content from other devices in the user home 1 via the wireless LAN.

  The encryption / decryption unit 509 encrypts data and content output to the Ethernet connection unit 510 and the wireless access point unit 511, or decrypts data and content output from the Ethernet connection unit 510 and the wireless access point unit 511. To do.

  The remote access communication unit 505 includes an external connection unit 507 and an encryption / decryption unit 506. The remote access communication unit 505 includes a distribution server of the IP distribution provider 21 and the IP distribution provider 22 outside the user home 1 and the mobile device 700 taken out to the destination 2 Send and receive data and content.

  The external connection unit 507 transmits data and content to the access network 12 via the external network connection terminal 513 and receives data and content via the access network 12.

About parts other than the above, it shall be provided with the function similar to FIG. 3, FIG.
<Software configuration of each device>
FIG. 7 is a diagram showing a software configuration example of the STB 100 with a recording / reproducing function shown in FIG.

  Control software 7000 for realizing the functions of the STB 100 with recording / reproducing function is developed in the memory 110 of the STB 100 with recording / reproducing function and executed by the control unit 111. FIG. 7 is functionally divided into blocks, and each block can be divided and integrated. The control software 7000 need not be realized by a single program, and may be realized by a combination of two or more programs.

  The control software 7000 includes a reservation management unit 7001, a reservation recording service 7002, a program information processing unit 7003, a program information providing unit 7004, a content management unit 7005, a content information providing unit 7006, a content directory service 7007, a device information service 7008, and device information. Management unit 7009, device authentication processing unit 7010, key management unit 7011, key generation unit 7012, encryption processing 7013, streaming connection service 7014, media distribution service 7015, message analysis unit 7016, message generation unit 7017, communication processing unit 7018, program A table generation unit 7019 is included.

  The reservation management unit 7001 accepts recording and viewing reservations set by the user by operating an electronic program guide or the like, and recording reservations designated from the reservation recording service 7002, and stores them in the memory 110 or the recording medium 119 for management. To do. In addition, the reservation management unit 7001 performs a setting process when executing a reservation. For example, the reservation management unit 7001 monitors the start time of a reserved program using the time management / timer 113 and appropriately sets a channel received by the tuner 101. In the case of recording reservation, the reservation management unit 7001 performs setting so that a stream constituting a content such as a broadcast program is output from the demax unit 103 to the recording / playback unit 109.

  The program guide generation unit 7019 uses the program information acquired with reference to the program information processing unit 7003 to browse the information of the program scheduled to be broadcast by the user, select a desired program, select a channel, or select a desired program An electronic program guide is provided that provides a user interface that enables program recording and viewing reservations.

  The program information processing unit 7003 obtains program information such as a broadcast schedule and a program title from the PES or ES including the information of the broadcast program separated and extracted by the demax unit 103, forms a program information table, and stores it in the memory 110 or the recording Recorded on the media 119. The program information processing unit 7003 acquires program information of all broadcast stations that can be received by the STB 100 with a recording / playback function. When the obtained program information is changed or new program information is acquired, the program information table is updated each time. The program information is inserted into, for example, MPEG-TS program identification information (PSI) or program arrangement information (SI).

  The program information providing unit 7004 refers to the program information processing unit 7003, and in accordance with a request from the content directory service 7007 described later, the contents of the organized channel list information, the program list information of the designated channel, the information of each program, etc. The directory service 7007 is provided.

  When the content management unit 7005 records content on the recording medium 119, the content management unit 7005 generates content information of the content (a database function may be used) and records the content information on the memory 110 or the recording medium 119. The content information is acquired from the program information processing unit 7003 when the recorded content is a broadcast program, and is acquired from the content transmission source when the content is acquired via a network. The content management unit 7005 also associates content with content information, updates content information when content is deleted or moved, manages the number of copies for content with a limited number of copies, and manages the status of the content (stop) Management of remote access restrictions (possible / impossible) added in advance (or defined) to channels and contents.

  The content information providing unit 7006 refers to the content management unit 7005 and provides a list of recorded programs, detailed information about a specified recorded program, and the like according to a request from a content directory service 7007 described later.

The device authentication processing unit 7010 is a device that conforms to a specific authentication protocol with other devices and is properly certified with each other in order to send and receive copyright protection content via a wired or wireless network. The key used for encryption / decryption of data and content is shared with other devices only when the authentication is successful.
The device information management unit 7009 acquires information (unique information, address information, etc.) on the network connection device successfully authenticated by the device authentication processing unit 7010 from the device authentication processing unit 7010, and manages registration, update, deletion, and the like. I do. Such information is held in the memory 110.

  When the authentication is successful in the device authentication processing unit 7010, the key management unit 7011 stores the key shared with the connection device on the network and attached information about the key (label and data managed by the device information management unit 7009). Related information) is acquired from the device authentication processing unit 7010, and management such as registration, update, and deletion is performed. Such information is held in the memory 110.

  The key generation unit 7012 obtains a key and attached information managed by the key management unit 7011 when transmitting data and content to and from a device that has been successfully authenticated by the device authentication processing unit 7010, and uses the key and attached information to determine An encryption key is generated in accordance with the algorithm. In addition, the encryption key is periodically updated according to a predetermined protocol.

  The encryption processing unit 7013 displays the encryption key acquired from the key generation unit 7012 when transmitting data or content stored in the recording medium 119 or a broadcast program received via the tuner 101 to a connection device on the network. 3 is set in the encryption / decryption unit 121 in the communication unit 108, and data or content is encrypted. The encryption processing unit 7013 acquires a new encryption key every time the encryption key is updated by the content key generation unit 7012, and changes the encryption key. The encrypted data or content is transmitted to another device via the communication processing unit 7018 using an appropriate communication protocol. Here, some contents stored in the recording medium 119 are encrypted by the recording / playback unit 109 when stored. In this case, after the encrypted content read from the recording medium 119 is decrypted by the encryption / decryption unit 122 in the recording / playback unit 109, the encryption processing unit 7013 performs the above-described encryption, and the encrypted content is stored in the other content. Sent to other devices.

The communication processing unit 7018 performs communication protocol interpretation and communication data flow control. The communication processing unit 7018 processes communication data according to a communication protocol when transmitting / receiving content and control messages to / from other devices connected via a network.
The communication data is transmitted / received via the communication unit 108 and the network connection terminal 117 in FIG.

  The message analysis unit 7016 interprets a message such as a control request generated according to a predetermined format that is transmitted and received between devices on the network, and distributes the request to a service that processes the requested control. A service is a function that a device provides to other devices and that can be used remotely via a network. In FIG. 7, the reservation recording service 7002, the content directory service 7007, the device information service 7008, the streaming connection service 7014, and the media distribution service 7015 correspond to this.

  The message generation unit 7017 generates a response to the requested control output by the service and a control request for another device in a message according to a predetermined format used between devices on the network. The generated message is transmitted to another device via the communication processing unit 7018 using an appropriate communication protocol.

  The scheduled recording service 7002 provides settings for registering or deleting scheduled recordings via a network, list information of reserved recordings, and the like.

  The content directory service 7007 provides metadata information such as the title and genre of content for all content that the STB 100 with recording / playback function can provide to other devices. The content directory service 7007 collects metadata information from the content information providing unit 7006 for the content recorded on the recording medium 119 and from the program information providing unit 7004 for the broadcast program information.

The device information service 7008 includes device description information describing the device itself, part or all of the device information acquired from the device information management unit 7009, and service detailed information describing details of the service provided by the device (its own URL ( (Including Uniform Resource Locator) information) to other devices. It also notifies the home network when it connects to the network, leaves the network, and responds to device searches from other devices.
Here, the device description information includes information such as device information and a service information list.

The device information describes basic information about the device. The device type, the device name, the manufacturer name, the model name, the serial number, the network ID (the memory 710 is an ID for uniquely identifying the device on the network). Information) such as version and icon information. The device type indicates a function that the device provides to the network. For example, a device having a content distribution function such as video, audio, and electronic program guide information is a media server (MediaServer), and a device having a function of receiving and playing content via a network is a media renderer (MediaRenderer). Define.

  The service information list is list information of services provided to other apparatuses depending on the device type implemented by the device. For each service, a service type (indicating the function of the service, such as a content directory), a service ID (ID that uniquely identifies the service), a service description URL (a control method for using the control provided by the service ( (Access destination for acquiring detailed service information), control URL (destination of action command for control using service), event URL (when an event occurs in the service) Registration destination for sending event distribution registration to receive notifications).

  The service detailed information includes information such as an action list and a service status table. The action list is a list including information of one or more actions (action name, argument information, etc.). An action is a description of a control method for using control provided by a service. The service state table is a table that includes one or more pieces of state variable information (such as data types, default values, and setting ranges of arguments used in actions).

  The streaming connection service 7014 provides information on the transfer protocol, content type, and data format supported by the STB 100 with a recording / playback function. The transfer protocol is HTTP, RTP (Real-time Transport Protocol), or the like. The content type indicates video, audio, image, and the like, and the data format includes MPEG (Moving Picture Experts Group), MP3 (MPEG Audio Layer-3), H.264, and H.264. An encoding method of content such as H.264 is shown.

  The media distribution service 7015 provides a service for sending specified content to other devices via the home network (that is, the network in the user's home 1) or the access network 12 or the Internet 13. The media distribution service 7015 outputs content such as a broadcast program received by the STB 100 with a recording / playback function and a broadcast program recorded on the recording medium 119 to the communication processing unit 7018 in accordance with a request from another device. It also provides an interface for controlling the distribution of contents such as start, stop, pause, and skip distribution via the network.

  FIG. 8 is a diagram illustrating a software configuration example of the mobile device 700 illustrated in FIG.

  Control software 8000 that implements the functions of the mobile device 700 is deployed in the memory 710 of the mobile device 700 and executed by the control unit 711. FIG. 8 is functionally divided into blocks, and each block can be divided and integrated. Further, the control software 8000 need not be realized by a single program, and may be realized by a combination of two or more programs.

  The control software 8000 includes a content management unit 8001, a content information acquisition unit 8002, a message analysis unit 8005, a message generation unit 8006, a device information management unit 8009, a device authentication processing unit 8010, a key management unit 8011, a key generation unit 8012, and a decryption process. 8013, remote access detection proxy unit 8014, remote access client unit 8015, remote access connection proxy unit 8016, communication processing unit 8017, device detection unit 8021, streaming connection controller 8003, content directory controller 8004, media reception controller 8007, device information service 8008, a content viewing application 8019, and a setting application 8020.

  When the content management unit 8001 records content on the recording medium 716, the content management unit 8001 acquires content information of the content from the content transmission source via the network and records the content information in the memory 710 or the recording medium 716. The content management unit 8001 also associates content with content information, updates content information when content is deleted or moved, and manages the number of copies for content with a limited number of copies.

  The content information acquisition unit 8002 holds the metadata information of the content acquired by the content directory controller 8004, and generates a UI (User Interface) screen that provides the user with content information that can be acquired via the network.

The device authentication processing unit 8010 is a device that conforms to a specific authentication protocol with other devices in order to send and receive copyright-protected content over a wireless network, and whether or not the devices are properly certified with each other. Only when authentication is successful, a key used for encryption / decryption of data and content is shared with other devices.
The device information management unit 8009 acquires information (specific information, address information, etc.) on the network connection device successfully authenticated by the device authentication processing unit 8010 from the device authentication processing unit 8010, and manages registration, update, deletion, and the like. I do. Such information is held in the memory 710.

  When authentication is successful in the device authentication processing unit 8010, the key management unit 8011 stores the key shared with the connection device on the network and attached information about the key (label and data managed by the device information management unit 8009). Related information) is acquired from the device authentication processing unit 8010, and management such as registration, update, and deletion is performed. Such information is held in the memory 710.

  The key generation unit 8012 obtains a key and attached information managed by the key management unit 8011 when receiving data and content with a device that has been successfully authenticated by the device authentication processing unit 8010, and uses the key and attached information to obtain a predetermined value. A decryption key is generated in accordance with the algorithm. Also, the key generation unit 8012 periodically updates the decryption key according to a predetermined protocol.

  When receiving data or content from a connection device on the network via the communication processing unit 8017, the decryption processing unit 8013 encrypts / decrypts the decryption key acquired from the key generation unit 8012 in the wireless communication unit 708 of FIG. This is set in the unit 718 and data or content is decrypted. The decryption processing unit 8013 acquires a new decryption key and changes the decryption key every time the content key generation unit 8012 updates the decryption key. The decrypted data or content is recorded on the recording medium 716 by the recording / playback unit 709 or output to the demax unit 701 and played back by the audio output unit 706 and the display unit 707. Here, when the decrypted content is recorded on the recording medium 716, the recording / playback unit 709 encrypts it using its own encryption / decryption unit 719 as necessary.

  The communication processing unit 8017 performs communication protocol interpretation and communication data flow control. The communication processing unit 8017 includes a local network communication processing unit and a remote access communication processing unit, and processes communication data according to a communication protocol when transmitting / receiving contents and control messages to / from other devices connected thereto. I do. Communication data is transmitted and received via the wireless communication unit 708 and the wireless network terminal 715 of FIG. Here, the communication processing unit 8017 may transmit and receive the communication data via the wide area wireless communication unit 720 instead of the wireless communication unit 708. For example, in the environment where the user can use both the wireless communication unit 708 and the wide-area wireless communication unit 720, which is to be used preferentially is set in advance in the setting application 8020 of the mobile device 700, and the setting value If the communication processing unit 8017 detects that an appropriate wireless access point 20 is not found in the vicinity of the mobile device 700 at the time of communication execution, the communication processing unit 8017 determines which one to use. There are a method of using the communication unit 720, a method in which the user instructs the setting application 8020 and the content viewing application 8019 to use, and the communication processing unit 8017 acquires the contents and switches to one of them. .

  The remote access detection proxy unit 8014 detects a device connected to the network in the user home 1 via the remote access communication processing unit of the communication processing unit 8017. The remote access detection proxy unit 8014 acquires information related to a device connected to the network in the user home 1 from the device in the user home 1 via the remote access communication processing unit of the communication processing unit 8017, and relates to the acquired connection device. Information is provided to a device connected via the local network communication processing unit of the communication processing unit 8017. In addition, the remote access detection proxy unit 8014 monitors a search request and response between devices connected via the remote access communication processing unit of the communication processing unit 8017, and exchanges such as a connection notification and a disconnection notification, When the state of the apparatus changes, the state change is notified to the apparatus in the user home 1 via the remote access communication processing unit of the communication processing unit 8017 as necessary.

  The remote access client unit 8015 includes a connection setting information management unit 8018, and performs settings necessary for remote access from outside the home to the device in the user home 1 via the local network communication processing unit of the communication processing unit 8017. ,to manage.

  The remote access connection proxy unit 8016 uses the environment setting information (device information table 1110 described later) managed by the connection setting information management unit 8018 via the remote access communication processing unit of the communication processing unit 8017. In order to communicate with a device connected to a network within 1, a secure communication path is established with a specific device (in this embodiment, the router 500). For example, a communication channel is established between the router 500 using existing technologies such as IPsec (Security Architecture for Internet Protocol) and SSL (Secure Socket Layer) / TLS (Transport Layer Security) (multiple combinations may be used). And prevent tampering and unauthorized use of communication data.

  The device detection unit 8021 detects notification of connection or disconnection of another device to the network, and when detecting the connection of the device to be controlled, acquires device information and provided service information of the device. Further, if necessary, a device search request for searching for a desired control target device on the network is transmitted.

  The streaming connection controller 8003 requests the transfer protocol, content type, and data format information from other devices.

  The content directory controller 8004 requests and acquires metadata information such as the title and genre of the content according to an instruction from the content viewing application 8019 or the like. Further, the content directory controller 8004 outputs the acquired metadata information to the content information acquisition unit 8002.

  The media reception controller 8007 receives the content transmitted via the home network (that is, the network within the user home 1), the access network 12 or the Internet 13, and records it on the recording medium 716 by the recording / playback unit 709, or And output to the demax unit 701. In addition, the media reception controller 8007 sends a command for controlling the distribution of content such as distribution start, stop, pause, and skip to the content distribution source by a user operation.

  The content viewing application 8019 provides a user with a function of acquiring and viewing content provided by a device connected via the local network communication processing unit of the communication processing unit 8017 or a device connected via the remote access communication processing unit. It is an application to be provided. The content viewing application 8019 controls the device detection unit 8021, the remote access detection proxy unit 8014, the content directory controller 8004, the media reception controller 8007, the remote access client unit 8015, the remote access connection proxy unit 8016, etc. Get content.

  The setting application 8020 is an application that provides the user with environment settings necessary for communicating control commands, data, content, and the like with other devices via the communication processing unit 8017. The setting application 8020 performs communication settings by controlling the device detection unit 8021, the remote access detection proxy unit 8014, the remote access client unit 8015, the communication processing unit 8017, and the like.

  Here, the content viewing application 8019 and the setting application 8020 have a relationship such as control and data reference with almost all of the software blocks constituting the control software 8000. However, since the figure becomes complicated, the relationship lines for other software blocks are Omitted.

  Parts other than those described above have the same functions as in FIG.

  Here, although a software configuration example of the TV 200 with a recording / playback function is not illustrated, the content recorded on the recording medium 223 or the content received by the tuner 201 is connected to another device (for example, the STB 300) connected to the home network via the communication unit 210. In order to realize the provision to the mobile device 700), the software configuration of the STB 100 with the recording / reproducing function is included. Furthermore, in order to realize that the TV 200 with a recording / playback function receives and views content from another device (for example, the STB100 with a recording / playback function) connected to the home network via the communication unit 210, the mobile device described above The same configuration as the software configuration 700 (except for the remote access detection proxy unit 8014, the remote access client unit 8015, and the remote access connection proxy unit 8016) is included.

  FIG. 9 is a diagram illustrating a software configuration example of the router 500 illustrated in FIG. 6.

  Control software 9000 that implements the functions of the router 500 is expanded in the memory 501 of the router 500 and executed by the control unit 502.

  The control software 9000 includes a remote access detection proxy unit 9001, a remote access connection proxy unit 9003, a remote access server unit 9004, a remote access communication processing unit 9007, a local access communication processing unit 9008, and a routing management unit 9009. FIG. 9 is functionally divided into blocks, and each block can be divided and integrated. The control software 9000 need not be realized by a single program, and may be realized by a combination of two or more programs.

  The remote access detection proxy unit 9001 detects a device connected to the network in the user home 1 from outside the home via the remote access communication processing unit 9007. The remote access detection proxy unit 9001 acquires information related to a device that can be connected from outside the home via the remote access communication processing unit 9007, and the device connected to the acquired information related to the connected device via the local access communication processing unit 9008 To provide. In addition, the remote access detection proxy unit 9001 monitors a search request and a response between devices connected via the local access communication processing unit 9008, and exchanges such as a connection notification and a disconnection notification. In the case of a change, a change in state is notified to a device outside the home via the remote access communication processing unit 9007 as necessary.

  The remote access server unit 9004 includes a filter setting service 9005 and a connection setting information management service 9006. A device in the user home 1 can be used from outside the home by using an existing technology such as a STUN (Simple Travel of UDP through NAT) client function. Check whether the environment allows remote access. In addition, since the IP address assigned to the remote access communication unit 505 of the router 500 by the communication provider 5 may change dynamically, the remote access server unit 9004 is generally free or charged by a communication provider or communication carrier. Using the DDNS client function that provides the service, when the assigned IP address is updated, the DDNS server registered in advance is notified.

  The filter setting service 9005 provides information related to devices in the user home 1 connected via the local access communication processing unit 9008 to devices outside the home connected via the remote access communication processing unit 9007. Manage filter information and environment setting information. Similarly, the filter setting service 9005 provides information on devices outside the home connected via the remote access communication processing unit 9007 to devices in the user home 1 connected via the local access communication processing unit 9008. Manages filter information and environment setting information to provide. These pieces of information are provided to the remote access detection proxy unit 9001.

  The connection setting information management service 9006 provides an IF for setting environment settings necessary for the remote access connection proxy unit 9003 to establish a communication path with a device outside the home via the remote access communication processing unit 9008. , Manage the set information.

  The remote access connection proxy unit 9003 uses the environment setting information (external device information table 1440 described later) managed by the connection setting information management unit 9006 via the remote access communication processing unit 9007. In this embodiment, a secure communication path is established with the mobile device 700). For establishing a secure communication path, an existing technology such as IPsec or SSL / TLS may be used (a plurality may be combined).

  The remote access communication processing unit 9007 can connect to the Internet 13 via the access network 12 of FIG. 1 via the remote access communication unit 505 and the external network connection terminal 513 of FIG. Communication data is processed according to the communication protocol when content and control messages are transmitted and received between the devices.

  The local access communication processing unit 9008 transmits / receives contents and control messages to / from devices in the user home 1 via the local access communication unit 508 and the wired network connection terminal 514 or the wireless network communication terminal 515 of FIG. The communication data is processed according to the communication protocol.

The routing management unit 9009 manages a routing table necessary for relaying communication between a device connected to the network in the user home 1 and a device connected to the external network, and determines a communication path. I do.
<Configuration of device information handled by each device>
FIG. 10 is a configuration example of device information handled by the device information management unit 7009 and the device information service 7008 of the STB 100 with a recording / playback function. Note that these pieces of device information are stored in the memory 110.

The device information includes a definition table 1000, a home device information table 1010, and a home device information table 1030.
The definition table 1000 includes an authentication device maximum number 1001, a home device registration maximum number 1002, a remote device registration maximum number 1003, a counter maximum value 1004, a home simultaneous access maximum number 1005, and a remote home simultaneous access maximum number 1006.

The maximum number of authenticated devices 1001 indicates the maximum number of devices that can be authenticated by the device authentication processing unit 7010 in FIG. 7, and is set to “34”, for example.

  The in-home device registration maximum number 1002 indicates the maximum number of in-home devices that can be registered. For example, “20” is set.

The maximum number of registered outdoor devices 1003 indicates the maximum number of devices that can be registered for remote access. For example, “10” is set. In the case of an apparatus in which the maximum number of registered home devices 1002 and the maximum number of registered external devices 1003 are the same, either one may be held.
The counter maximum value 1004 indicates the maximum value of the valid period of information registered in the in-home device information table 1010 or the out-of-home device information table 1030, and is set to “120 minutes”, for example. The time management / timer 113 in FIG. 3 is used for measuring the time of the effective period. In the case of an apparatus for which the validity period is individually set in the in-home device information table 1010 and the out-of-home device information table 1030, the definition table 1000 has different definition values such as the maximum value in the home counter and the maximum value in the home counter. Just hold it.
The in-home simultaneous access maximum number 1005 indicates the maximum number of content access requests allowed in the home, and for example, “7” is set.
The maximum number of simultaneous outside accesses 1006 indicates the maximum number of contents access requests allowed from outside the house, and is set to “1”, for example. In the case of an apparatus in which the maximum number of simultaneous in-home access 1005 and the maximum number of simultaneous external access 1006 have the same value, the definition table 1000 may have one of them.

  The in-home device information table 1010 includes an in-home exchange key 1011, in-home registration number 1012, in-home simultaneous access number 1013, in-home device authentication number 1014, ID 1020, device ID 1021, address information 1022, counter value 1023. , Status 1024 and move exchange key 1025.

The in-home exchange key 1011 indicates key information shared with other apparatuses as a result of the device authentication processing executed by the device authentication processing unit 7010 in FIG. 7 and additional information (label, key type, etc.). Details will be described with reference to FIG.
The number of registered homes 1012 indicates the number of devices currently registered in the home device information table 1010. When this value reaches the above-mentioned maximum number of registered home devices 1002, the device information management unit 7009 does not accept subsequent registration requests, or deletes one registration and newly registers.

  The number of simultaneous accesses 1013 indicates the number of connected devices that are about to start content reception with the own device or are already executing content reception. When this value reaches the above-mentioned maximum in-home simultaneous access number 1005, the STB 100 with a recording / playback function does not execute subsequent content transmission or does not accept a content transmission request from another device.

The in-home device authentication number 1014 indicates the number of devices that have performed device authentication with devices connected to the home network and shared the home exchange key 1011. When the total value of this value and the out-of-home device authentication number 1033 described later reaches the device authentication maximum number 1001, the device authentication processing unit 7010 rejects a device authentication request issued from another device thereafter. .
ID 1020 indicates the registration number of the table.

  The device ID 1021 indicates an identifier for uniquely identifying each device. The device ID 1021 is generated by a specific certification authority and is stored in the nonvolatile memory of the memory 110 in advance when each device is manufactured, or is recorded in the nonvolatile memory safely after executing a specific registration process after purchase. This is information and has a unique value for each device. The device ID 1021 may include other information such as a public key.

The address information 1022 indicates an IP address (IPv4 / IPv6) or a MAC address of each device on the network. The IP address may be limited to an address form that is assumed to be used at home, such as a private address or a local address.
The counter value 1023 indicates the current value of the home counter set in the time management / timer 113.

The status 1024 indicates a content transmission status (for example, being accessed or stopped) to other devices on the home network.
The move exchange key 1025 indicates key information used for encryption processing and its additional information (label, key type, etc.) when moving (move) content to another device on the home network. The exchange key for MOVE is shared with other devices in accordance with a predetermined procedure, and is used differently from the home exchange key 1011 and has a different value for each content transmission destination device.

  In FIG. 10, device information 1026 for the TV 200 with a recording / playback function, device information 1027 for the STB 300, and device information 1028 for the mobile device 700 are shown as examples.

  The out-of-home device information table 1030 includes an out-of-home registration number 1031, an out-of-home access number 1032, an out-of-home device authentication number 1033, information on one device as ID 1040, device ID 1041, address information 1042, out-of-home exchange key 1043, It has a status 1044 and an out-of-home counter value 1045.

  The number of outside registrations 1031 indicates the number of registrations of a device that has permitted remote access from the outside of the device. The registration procedure will be described with reference to FIGS. When this value reaches the maximum number of registered external devices 1003, the device information management unit 7009 does not accept subsequent registration requests, or deletes one registration and newly registers.

  The number of simultaneous outside accesses 1032 indicates the number of devices outside the house that are about to start receiving content with the own device or are already executing content reception. When this value reaches the above-mentioned maximum number of simultaneous simultaneous accesses 1006, the subsequent content transfer is not executed, or a content transmission request from another device is not accepted.

The out-of-home device authentication number 1033 indicates the number of devices that have executed an out-of-home access device authentication process with devices connected to a network outside the home and shared the exchange key 1037 for out-of-home. When the total value of this value and the above-mentioned home device authentication number 1014 reaches the device authentication maximum number 1001, the device authentication processing unit 7010 rejects a device authentication request issued from another device thereafter.
ID 1040 indicates the registration number of this table.
The device ID 1041 indicates an identifier for uniquely identifying each device, and is information similar to the device ID 1016 described above.
The address information 1042 indicates an IP address, a MAC address, a URI (Uniform Resource Identifier), and the like of a content receiving apparatus accessed from outside the house.
The out-of-home exchange key 1043 is the key information shared with other devices and the additional information (label, key type, etc.) as a result of the out-of-home access device authentication processing executed by the device authentication processing unit 7010 in FIG. ). Details will be described with reference to FIG.
The status 1044 indicates a content transmission status (for example, being accessed or stopped) to a device outside the home.
The outside counter value 1045 indicates the current value of the outside counter set in the timer 1091.

  FIG. 10 shows device information 1046 for the mobile device 700 as an example.

  Here, in this embodiment, the counter value 1023 and the counter value for outdoor 1045 are provided separately in the home device information table 1010 and the external device information table 1030, respectively. The value 1023 may be shared.

  FIG. 11 is a configuration example of device information handled by the device information management unit 8009 and the device information service 8008 of the mobile device 700. Note that these pieces of device information are stored in the memory 710.

The device information includes a definition table 1100 and a device information table 1110.
The definition table 1100 includes a server registration maximum number 1101, a router registration maximum number 1102, a support profile number 1103, and detailed information 1104 and 1105 regarding support profiles.

The server registration maximum number 1101 indicates the maximum number of devices that can provide content to the mobile device 700 and is set to “10”, for example.
The maximum number of router registrations 1102 indicates the maximum number of routers that can be registered when the mobile device 700 accesses remotely from outside the house. For example, “10” is set.
The support profile number 1103 indicates that the remote access connection proxy unit 8016 in FIG. 8 remotely accesses via the communication processing unit 8017 when the mobile device 700 remotely accesses an in-home device from outside the home. Indicates the number of connection information profiles that are used to establish a secure communication channel with the remote access connection proxy unit 9003 of the router 500 existing in the network. For example, “2” is set.

  “Profile A” 1104 and “Profile B” 1105 describing detailed information regarding the support profile indicate detailed information of the connection information profile defined by the number indicated by the number of support profiles 1103. For example, for secure data communication Protocol name and version, such as IPsec and SSL / TLS, package name of installed software (for example, OpenSSL, OpenVPN, etc.), and related information related to key information.

  The device information table 1110 includes a server registration number 1111, a router registration number 1112, information relating to one router, router ID 1120, address information 1121, remote access server function presence / absence 1123, usage profile 1124, DDNS server information 1125, and one device The information regarding the ID 1130, device ID 1131, home address information 1132, remote access function 1133, router information 1134, status 1135, and home exchange key 1136.

The server registration number 1111 indicates the number of content providing apparatuses currently registered in the device information table 1110.
The number of registered routers 1112 indicates the number of routers currently registered in the device information table 1110.

The router ID 1120 indicates an identifier for uniquely identifying the registered router.
The address information 1121 indicates the IP address, MAC address, URI, etc. of the router.
The remote access server function presence 1123 indicates that the remote access server unit 90 is connected to the router.
04, whether or not the functions of the remote access detection proxy unit 9001 and the remote access connection proxy unit 9003 are provided.
The usage profile 1124 indicates the type of connection information profile in which setting information necessary for establishing a secure channel when remotely accessing the registered router is accessed. In this embodiment, it is assumed that “profile A” 1104 is used out of the support profiles “profile A” 1104 and “profile B” 1105 described above, and the remote access connection proxy unit 8016 refers to this information to the router. A secure communication path is established with 500.

    The DDNS server information 1125 acquires an IP address on the WAN (Wide Area Network) side assigned to the remote access communication unit 505 of the router 500 from the communication service provider 5 when the router 500 is remotely accessed from outside the house. The information regarding the DDNS server utilized for this is shown. The value set in the DDNS server information 1125 is, for example, information such as address information, a user name, and a password for accessing the DDNS server.

ID 1130 indicates the registration number of the content providing apparatus registered in the device information table 1110.
The device ID 1131 indicates an identifier for uniquely identifying each content providing apparatus.
Home address information 1132 indicates the IP address, MAC address, URI, and the like of each content providing apparatus.
The remote access function 1133 indicates whether or not each content providing device has a function of transmitting content to a device remotely accessed. The value set in the remote access function 1133 is, for example, whether or not the device authentication processing unit 7009 of each device supports an out-of-home access device authentication process 2005 described later.

The router information 1134 indicates information related to the router connected to each content providing apparatus.
The status 1135 indicates a content reception status (for example, being accessed or stopped) from each content providing apparatus.
The exchange key 1136 for outside the house is the key information shared with each apparatus and the additional information (label, key type, etc.) shared with each apparatus as a result of the apparatus authentication processing for outside access executed by the apparatus authentication processing unit 7009 of each apparatus. Indicates. Details will be described with reference to FIG.
<Viewing content at home>
FIG. 12 is an example of a processing sequence when the user views content stored in the recording medium 119 of the STB 100 with a recording / playback function using the mobile device 700 in the user home 1 in the system configuration shown in FIG. is there. In FIG. 12, data transmission / reception for establishing and discarding a connection by TCP is omitted.

  When the operation IF unit 712 of the mobile device 700 accepts an operation from the user and activates the content viewing application 8019, the device detection unit 8021 searches for a server having a content distribution function according to an instruction from the content viewing application 8019. Then, the “device search request” message is generated by the message generation unit 8006 and transmitted to all devices constituting the home network via the local network communication processing unit of the communication processing unit 8017 (S1201). Here, it is assumed that the message generation unit 8006 generates subsequent messages to be transmitted to other devices.

  The STB 100 with a recording / playback function that has received the “device search request” message for searching for the content distribution device processes the message in the device information service 7008 via the message analysis unit 7016. Since the STB 100 with a recording / playback function has a content distribution function, the device information service 7008 uses the message generation unit 7017 to generate a message including a URI indicating the acquisition destination of its own device description information. Via the mobile device 700 (S1202). Here, a message to be transmitted to another device is generated by the message generation unit 7017.

  Upon receiving the response, the device detection unit 8021 of the mobile device 700 accesses the URI included in the response message, and transmits a “device information acquisition request” message requesting device description information to the STB 100 with a recording / playback function (S1203).

  The STB 100 with a recording / playback function that has received the “device information acquisition request” message for the device description information acquisition destination URI processes the message in the device information service 7008 via the message analysis unit 7016. Then, the device information service 7008 generates a message including its device description information and responds to the mobile device 700. The device information is described in the response message in a format such as XML (Extensible Markup Language), for example (S1204).

  Upon receiving the response, the device detection unit 8021 of the mobile device 700 interprets the response message, confirms that the STB 100 with a recording / playback function provides a content directory service, a media distribution service, a streaming connection service, and the like. The description URL is accessed, and a “service information request” message for requesting detailed service information is transmitted to the STB 100 with a recording / playback function (S1205).

  Upon receiving the “service information request” message for the service description URL of the content directory service 7007, the media distribution service 7015, and the streaming connection service 7014, the STB 100 with a recording / playback function processes the message in the device information service 7008. Then, a response message including detailed service information including an action list for using the service and a service state table is generated, and the response message is returned to the mobile device 700 (S1206).

  Upon receiving the response, the device detection unit 8021 of the mobile device 700 passes the service directory information of the content directory service to the content directory controller 8004. Further, the service detailed information of the media distribution service 7015 is transferred to the media distribution controller 8007, and the service detailed information of the streaming connection service 7014 is transferred to the streaming connection controller 8003. Each controller interprets the service detailed information and recognizes the action provided by each service. In addition, the device detection unit 8021 requests the device information management unit 8009 to register the STB 100 with a recording / playback function. The device information management unit 8009 registers the STB 100 with a recording / reproducing function in the device information table 110 of FIG. Specifically, after adding ID 1130 and registering the device ID 1131 and home address information 1132 of the STB 100 with recording / reproducing function, the server registration number 1111 is incremented by one (S1207).

  Thereafter, the content viewing application 8019 of the mobile device 700 displays the device registered in the device information table 110 on the display unit 707. When the user selects a device (STB 100 with a recording / playback function in this embodiment) that the user wants to view via the operation IF unit 712, the content directory controller 8004 displays the recording / playback function according to the instruction of the content viewing application 8019. An action “content information acquisition request” message for using the content information providing service is transmitted to the content directory service 7007 of the attached STB 100 (S1208).

  The STB 100 with recording / playback function that has received the “content information acquisition request” message processes the message in the content directory service 7007. First, the content directory service 7007 acquires content information that the STB 100 with a recording / playback function can provide to other devices constituting the home network 11 from the content information providing unit 7006. The content information providing unit 7006 acquires information related to the content recorded on the recording medium 119 from the content management unit 7005, and refers to this information and the current device status (content transferable status) as necessary. Then, information on the contents that can be provided is extracted and notified to the contents directory service 7007. The content directory service 7007 uses the acquired information to provide content information (content name, format, source information, time, copy control information, URI and port information necessary for viewing, etc.) (S1209) and respond to the mobile device 700 (S1210).

  The content viewing application 8019 of the mobile device 700 that has received the response message including the content information generates, for example, the content list screen 2300 illustrated in FIG. 23 using the content information and displays the content list screen 2300 on the display unit 707.

  The content list screen 2300 can be provided via a network such as the STB 100 with recording / reproducing function, the TV 200 with recording / reproducing function, and the STB 300 that are detected using the procedure of S1201 to S1205 and registered in the device information table 110. The device is displayed. When the STB 100 with a recording / reproducing function is selected from among them according to a user instruction, the content viewing application 8019 acquires content information that can be provided by the STB 100 with a recording / reproducing function using the procedure of S1208 to S1210 described above. It is displayed on the screen 2300. In this case, the contents include contents 2301 to 2304 recorded on the recording medium 119 and programs 2305 to 2306 that are currently being broadcast or can be received by the tuner 101. What is displayed as information of the contents 2301 to 2304 recorded on the recording medium 119 is, for example, a content name, information on the provider of the content (such as the name of a broadcasting station or IP distribution provider), playback time, HD, SD, A recording mode such as double speed, and various types of restriction information (viewing restriction and copy control information). Information displayed on the programs 2305 to 2306 includes, for example, a program name, information on a program provider (broadcast station, channel number, etc.), playback time, recording mode, and various restriction information. In addition to the method of displaying all of the content information acquired from the content directory service 7007 of the STB 100 with recording / playback function, the method of displaying content information on the screen 2300 includes the content viewing application 8019, the streaming connection controller 8003, There is also a method of displaying only content that the media reception controller 8007 can handle.

  When the selection of an arbitrary content on the content list screen 2300 is accepted by the operation of the operation IF unit 712 by the user (S1211), the viewing application 8019 of the mobile device 700 records that the content can be properly viewed. In order to have the STB 100 with a reproduction function authenticate, the device authentication processing unit 8010 is instructed to execute an authentication process with the STB 100 with a recording / reproduction function. The device authentication processing unit 8010 executes device authentication processing with the device authentication processing unit 7010 of the STB 100 with a recording / playback function via the communication processing unit 8017 (S1212). If the device authentication processing is successful, the device authentication processing unit 8010 of the mobile device 700 shares information necessary for content encryption / decryption with the device authentication processing unit 7010 of the STB 100 with a recording / playback function, and device authentication is performed. The viewing result is notified to the viewing application 8019.

  When the device authentication process described above fails, the viewing application 8019 of the mobile device 700 notifies the user that the selected content cannot be viewed, for example, by displaying an error message screen on the display unit 707. When the device authentication process is successful, the content viewing application 8019 instructs the media reception controller 8007 to start content acquisition. The media reception controller 8007 generates a “content transmission request” message and transmits it to the STB 100 with a recording / playback function via the communication processing unit 8017 (S1213).

  The STB 100 with a recording / playback function that has received the “content transmission request” message via the communication processing unit 7018 processes this message with the media distribution service 7015 via the message analysis unit 7016. The media distribution service 7015 instructs the key generation unit 7012, the encryption processing unit 7013, and the content management unit 7005 to read out the content recorded on the recording medium 119 by the recording / playback unit 109, and at the encryption / decryption unit 122 as necessary. The key generation unit 7012 generates the encryption key based on the information shared in the device authentication process S1212 described above, and the encryption processing unit 7013 encrypts the content using the encryption key, and the communication processing unit 7018 Is transmitted to the mobile device 700 via S1 (S1214). Here, as an algorithm for encrypting the content, an existing encryption technology such as AES (Advanced Encryption Standard) or M6, 3DES (Data Encryption Standard) may be used.

  The content viewing application 8019 or the media reception controller 8007 of the mobile device 700 that has received the encrypted content via the communication processing unit 8017 instructs the decryption processing unit 8013 and the key generation unit 8012 to share in the device authentication processing S1212 described above. A decryption key is generated based on the information, and the decryption processing unit 8013 decrypts the content using the decryption key. Thereafter, the content viewing application 8019 or the media reception controller 8007 separates the decrypted content into audio data and video data by the demax unit 701, and the audio data is decoded by the audio decoding unit 702 and output to the audio output unit 706. The video data is decoded by the video decoding unit 703 and output to the display unit 707.

  With the above procedure, the user can view the content stored in the recording medium 119 of the STB 100 with a recording / playback function using the mobile device 700 in the user home 1.

  Here, in S1202, the response content from the STB 100 with recording / reproducing function and the contents of the device information table 110 in S1207 are referred to. If this STB 100 with recording / reproducing function has already been registered, S1203, or S1204 and S1205 are registered. Both of them may be skipped.

In S1203 to S1206, the content information providing unit 7006 and content directory service 7007 of the STB 100 with recording / playback function, the device authentication processing unit 7010, and the device information management unit 7009 provide the content to be copyright protected outside the home. May be included in the provided function or the service detailed information to respond that the function is provided.
FIG. 13 is an example of a device authentication processing sequence S1212 executed between the STB 100 with a recording / playback function in the user home 1 and the mobile device 700. Hereinafter, the authentication process described in FIG. 13 is referred to as normal authentication.

  Here, TCP is used as a protocol for transmission / reception of information for device authentication processing. When various information such as an authentication request to the other device and an authentication response to the other device is transmitted, the reception confirmation is received from the other device. As a result, a communication path capable of detecting a transmission error is secured. In FIG. 13, data transmission / reception for establishing and discarding a connection by TCP is omitted.

  Data transmitted and received between the STB 100 with recording / reproducing function and the mobile device 700 is transmitted as an IP packet. In the device authentication process at home, the STB 100 with recording / playback function and the mobile device 700 monitor the TTL (Time To Live) of the received packet, and the TTL value exceeds a predetermined TTL value (for example, TTL = 3). Is discarded, the access from outside the user home 1 is prevented. The TTL is a value representing an effective period of a packet represented by an integer value up to 255. The TTL is attached to the packet, and the value decreases by 1 every time it passes through a router or the like.

  In order to prevent access from outside the user's home 1, the STB 100 with recording / reproducing function and the mobile device 700 set the TTL of the packet to be transmitted to be equal to or less than the predetermined TTL value.

  In this sequence, first, the mobile device 700 creates an authentication request. The device authentication processing unit 8010 of the mobile device 700 attaches the device-specific information including the device ID described above to the authentication request and a certificate for the device-specific information to the STB 100 with a recording / reproducing function via the communication processing unit 113. Send (S1301).

  The device authentication processing unit 7010 of the STB 100 with recording / reproducing function receives the authentication request via the communication processing unit 113 and sends the reception confirmation to the mobile device 700 (S1302), and then the device authentication processing of the STB 100 with recording / reproducing function. The unit 7010 creates an authentication request from its own side, attaches the unique information of the STB 100 with a recording / playback function and its certificate to the mobile device 700 in the same manner as the mobile device 700 (S1303).

  The device authentication processing unit 8010 of the mobile device 700 receives the authentication request and sends the reception confirmation to the STB 100 with a recording / playback function (S1304).

  Next, the device authentication processing unit 7010 of the STB 100 with a recording / playback function verifies each piece of information received in the authentication request and sends an authentication response with parameters necessary for generating key information to the mobile device 700 (S1305). .

  The device authentication processing unit 8010 of the mobile device 700 receives the authentication response and sends the reception confirmation to the STB 100 with a recording / playback function (S1306), and then creates an authentication response from its own side, as in the case of the content transmission device. Is sent to the STB 100 with recording / reproducing function (S1307), and a recording / reproducing function is added using the necessary parameters attached to the authentication response received from the STB 100 with recording / reproducing function. An authentication key common to the STB 100 is generated.

  The device authentication processing unit 7010 of the STB 100 with a recording / playback function receives the authentication response and sends a reception confirmation to the mobile device 700 (S1308). Similarly to the mobile device 700, the device authentication processing unit 7010 needs to be attached to the authentication response received from the mobile device 700. A common authentication key with the mobile device 700 is generated using various parameters.

  Through the procedure so far, the device authentication processing unit 7010 of the STB 100 with a recording / playback function and the device authentication processing unit 8010 of the mobile device 700 generate and share a common authentication key. The following processing is performed only when the authentication key is shared. If the authentication key cannot be shared, the device authentication process is terminated.

  Next, the STB 100 with a recording / playback function registers the mobile device 700 in the home device information table 1010 of the device information management unit 7009 in order to check whether the mobile device 700 is a home device, and the home counter It is confirmed whether or not a value is set in the value 1023 (the setting of the value in the home counter value 1023 will be described later in S1318). As a result, if the mobile device 700 is not registered in the device information table 1010, or if the home counter value 1023 is not set or “0”, the mobile device 700 is notified that preparation for home check is to be performed. (S1309).

  When the device authentication processing unit 8010 of the mobile device 700 receives the notification of in-home confirmation preparation and sends the reception confirmation to the STB 100 with a recording / reproducing function (S1310), the device authentication processing unit 8010 creates an in-house confirmation preparation notification from its own side, It is sent to the STB 100 with function (S1311).

  When the device authentication processing unit 7010 of the STB 100 with a recording / playback function receives the notification of the in-home confirmation preparation and sends the reception confirmation to the mobile device 700 (S1312), the device authentication processing unit 7010 sends an in-home confirmation setting request with information necessary for in-home confirmation to the mobile The data is sent to the device 700 (S1313).

  The device authentication processing unit 8010 of the mobile device 700 receives the home confirmation setting request, performs message authentication code generation processing based on data included in the home confirmation setting request as preparation necessary for home confirmation, and records and reproduces the reception confirmation It is sent to the STB 100 with function (S1314).

  Upon receiving the reception confirmation, the device authentication processing unit 7010 of the recording / playback function STB 100 performs message authentication code generation processing based on the data transmitted to the mobile device 700 in S1313, and starts the timer 1091 in the device information management unit 103. After that, in order to check whether the mobile device 700 exists in the home, a home check execution request including the generated message authentication code is sent to the mobile device 700 (S1315).

  The device authentication processing unit 8010 of the mobile device 700 receives the in-home confirmation execution request, and sends a reception confirmation including the message authentication code generated in S1314 to the STB 100 with a recording / playback function (S1316).

  Upon receiving the reception confirmation, the device authentication processing unit 7010 of the recording / reproducing function STB 100 stops the timer 1091 and measures the measured value (T1) from when the in-home confirmation execution request in S1315 is issued until the reception confirmation in S1316 is received. ) Does not exceed the home check timeout value (T) 1921 of the home check threshold table 1920. Further, it is confirmed whether or not the message authentication code included in the received reception confirmation is correct.

  If the measured value (T1) ≦ the in-home confirmation threshold value (T) 1921 of the in-home confirmation threshold table 1920 and the received message authentication code is correct, the mobile device 700 exists in the home and exists within the range of personal use. It is determined that the device is a device to be transmitted to the mobile device 700 as a home confirmation result (S1317).

  On the other hand, if measured value (T1)> in-house confirmation timeout value (T) 1921 in in-house confirmation threshold table 1920, or if the received message authentication code is invalid, mobile device 700 may exist outside the house. After determining that the device is a certain or unauthorized device and transmitting the home confirmation result (S1317), the processing of S1309 to S1316 is retried. When the number of retries exceeds a predetermined value, the subsequent process is interrupted and the device authentication process is terminated.

  The device authentication processing unit 8010 of the mobile device 700 that has received the in-home confirmation result confirms whether or not the message authentication code received in S1315 is correct. If it is determined to be correct, the device authentication processing unit 8010 sends a reception confirmation to the STB 100 with a recording / playback function (S1318). ).

  When the device authentication processing unit 7010 of the STB 100 with recording / playback function that has received the reception confirmation determines that the mobile device 700 is installed in the home in S1316 and S1317, the mobile device 700 is registered in the device information management unit 7009. Instruct. The device information management unit 7009 registers and manages information related to the mobile device 700 in the home device information table 1010 (S1319). For example, as shown in the record 1028 of ID 1020 in the home device information table 1010, the device ID of the mobile device 700 received in S1301 is set as the device ID 1021, and the IP address of the mobile device 700 on the network is address information 1022 , The counter maximum value 1004 in the definition table 1000 is set to the home counter value 1023, and “stop” is set to the status 1024. The home counter value 1023 in which the maximum counter value 1004 is set is being transmitted as shown in S1214 of FIG. 12 (when the status 1024 is “accessing”, for example, every predetermined time or every predetermined transmission size). When the home counter value 1023 becomes “0”, the countdown is stopped.

  S1309 to S1318 are home confirmation methods for home access in normal authentication. Here, the device authentication processing unit 7010 of the STB 100 with a recording / playback function, when the mobile device 700 is registered in the home device information table 1010 and a value is set in the counter value 1023, the home confirmation from S1309 to S1318. The process is omitted.

  If the message authentication code received in S1316 is invalid, the subsequent processing is interrupted and the device authentication processing is terminated.

  In step S1319, the device authentication processing unit 7010 of the STB 100 with a recording / playback function in which information related to the mobile device 700 is registered generates an exchange key to be used when encrypting content distributed by itself, and the exchange key is used using the authentication key. Is sent to the mobile device 700 together with an ID for identifying the exchange key (S1320). The device authentication processing unit 7010 instructs the key management unit 7011 to hold and manage the generated exchange key.

  The device authentication processing unit 8010 of the mobile device 700 decrypts the exchange key transmitted from the STB 100 with the recording / reproducing function using the authentication key, and sends a reception confirmation (S1321). The key management unit 8011 is instructed to hold and manage the generated exchange key.

With the processing procedure shown in FIG. 13, the device authentication processing unit 7010 of the STB 100 with recording / playback function and the device authentication processing unit 8010 of the mobile device 700 can share a common exchange key. The exchange key is set in the in-home exchange key 1011 in the in-home device information table 1010 together with additional information relating to the exchange key, and is used to generate a common key for encrypting / decrypting the content. Further, the processing of S1309 and S1313 and the processing of S1317 and S1319 may be summarized.
<Device registration processing for remote access>
Next, a device registration process required in advance for the mobile device 700 taken out of the house (such as a place where it is out of the office or a company) to use content stored in the STB 100 with a recording / playback function or the TV 200 with a recording / playback function. Will be described.

  When the mobile device 700 accesses a device on the home network from outside the home, it needs to go through the remote access compatible router 500.

  First, a configuration example of device information handled by the remote access server unit 9004 of the remote access compatible router 500 will be described with reference to FIG. Note that these pieces of device information are stored in the memory 501.

The device information includes a definition table 1400, an in-home device information table 1410, and an out-of-home device information table 1440.
The definition table 1400 includes a maximum number of in-home device registrations 1401, a maximum number of external device registrations 1402, a maximum number of simultaneous accesses from home 1403, a maximum number of simultaneous accesses from outside the home 1404, a maximum number of DDNS server registrations 1405, and the number of support profiles. 1406.

The maximum number of registered home devices 1401 indicates the maximum number of devices in the home that can be registered in the router 500. For example, “20” is set.
The maximum number of out-of-home devices registered 1402 indicates the maximum number of out-of-home access devices that can be registered in the router 500. For example, “10” is set. In the case of an apparatus in which the maximum number of registered home devices 1401 and the maximum number of registered external devices 1402 are the same, the definition table 1400 may have either one.

The maximum number of simultaneous accesses 1403 from the home indicates the maximum number of access requests allowed in the home, for example, “7” is set.
The maximum number of simultaneous accesses 1404 from outside the house indicates the maximum number of access requests from outside the house, and is set to “1”, for example. In the case of a device in which the maximum number of simultaneous in-home access 1403 and the maximum number of simultaneous external access 1404 have the same value, the definition table 1400 may have either one.

  The DDNS server registration maximum number 1405 indicates the maximum number of DDNS servers 7 that can be registered in the router 500, and is set to “10”, for example. Registration information 1408 related to the DDNS server 7 registered in the router 500 is held in the memory 501. The router 500 notifies / sets the address information used by the external connection unit 507 periodically or when the address information changes to the DDNS server 7 registered using the DDNS client function.

  The support profile number 1406 is used to establish a secure communication channel between a device accessed from outside the home (for example, the mobile device 700) and the remote access communication processing unit 9007 and the remote access communication unit 505 of the router 500. The number of supported secure communication protocols (SSL, IPsec, VPN, etc.) is shown. For example, “3” is set in the support profile number 1406, and the actual support profile content includes a list as shown in 1407.

  The registration information 1408 regarding the DDNS server registers the identification information of the DDNS server 7 (name, name of the company that operates the DDNS server, etc.), URL, and user name / password necessary for accessing the DDNS server 7 as necessary. For each DDNS server. The router 500 may provide a setting screen in HTML format to a device on the home network 11 via the local access communication unit 508, and may receive registration information 1408 regarding the DDNS server from the user, or the device may be on the home network 11. When connected, the router 500 may receive information related to the DDNS server stored in advance in the connected device and set the information in the registration information 1408.

  The in-home device information table 1410 includes in-home registration number 1411, in-home simultaneous access number 1412, ID1421, device ID1422, address information 1423, category 1424, status 1425, external release 1426, and port number 1427. Have.

The in-home registration number 1411 indicates the number of devices currently registered in the in-home device information table 1410. When this value reaches the above-described maximum number of registered home devices 1401, the remote access server unit 9004 does not accept subsequent registration requests, or deletes any registration information and newly registers it.
The in-home simultaneous access count 1412 indicates the number of devices that are starting to access the router 500 or are already accessing the router 500. When this value reaches the above-mentioned maximum in-home simultaneous access number 1404, subsequent access requests are not accepted.

ID 1421 indicates a registration number in the home appliance information table 1410.
The device ID 1422 indicates an identifier for uniquely identifying each device. The device ID 1021 is device-specific information that is stored in advance in the nonvolatile memory of the memory 110 when each device is manufactured, or that automatically generates an arbitrary ID according to a predetermined algorithm, and has a unique value for each device.

The address information 1423 indicates the IP address (IPv4 / IPv6) and MAC address of each device on the home network. The IP address may be limited to an address form that is assumed to be used at home, such as a private address or a local address.
The category 1424 indicates the device type of each apparatus on the home network (for example, the function provided by the device included in the device information of the device description information described above). In this embodiment, a media server (DMS) and a media renderer (DMP) are shown as examples of device types.

The status 1425 indicates a current connection state between the router 500 and each device, and has a value indicating a state such as connected, not connected, or connected.
The outside disclosure 1426 indicates whether or not the router 500 discloses information related to each device to a device that accesses the router 500 from outside (outside home). When this information is “valid”, the device information service 9002 of the router 500 provides information regarding each device to devices outside the house only when a predetermined condition is satisfied. In the case of “invalid”, information regarding each device is not provided to devices outside the home. The default value of this setting value is “invalid”.
The port number 1427 is used only when the setting value of the outside-the-home public 1426 is “valid”, and indicates a communication port number for the router 500 to accept access from a device outside the house on behalf of each device. The port number 1427 may be a different number for each device, or may be a common number for a plurality of devices.

  The external device information table 1440 includes an external registration number 1441, an external remote simultaneous access number 1442, information about one device ID 1451, device ID 1452, address information 1453, an external exchange key 1454, status 1455, usage profile 1456, Use DDNS1457.

  The out-of-home registration number 1441 indicates the number of registrations of devices that are permitted to access the router 500 from outside the home. When this value reaches the maximum number of registered external devices 1402, the remote access server unit 9004 does not accept subsequent registration requests, or deletes one arbitrary registration information and newly registers it.

  The number of simultaneous outside accesses 1442 indicates the number of devices outside the house that are about to start access to the router 500 or are already accessing. When this value reaches the maximum number of simultaneous external accesses 1404, the remote access server unit 9004 does not accept subsequent access requests.

ID 1451 indicates a registration number in the external device information table 1440. The device ID 1452 indicates an identifier for uniquely identifying each device, and is the same information as the device ID 1422 described above.
The address information 1453 indicates the IP address (IPv4 / IPv6) and MAC address of each device on the network outside the home.
The category 1454 indicates the device type of each device on the home network, and is the same information as the category 1424 described above.
The status 1455 indicates the current connection state between the router 500 and each device outside the home, and has a value indicating a state such as connected, not connected, or connected.

  The usage profile 1456 indicates a method of using a secure communication path established between the router 500 and each device outside the home, and corresponds to one of the support profile contents described above.

  The used DDNS 1457 indicates information related to the DDNS server 7 that is used to acquire address information of the router 500 in order for a device outside the home to access a device on the home network via the router 500. The used DDNS 1457 is, for example, address information and registration information (device name, user name / password, etc.) necessary for the router 500 to notify / set the address information used by the external connection unit 507 to the DDNS server 7. Indicates.

  Next, using FIG. 15, FIG. 17, and FIG. 18, it is executed in advance to access the router 500 or a home device (such as the STB 100 with a recording / playback function) from a device taken out of the home (mobile device 700). A registration process that requires the following will be described.

  In the present embodiment, a procedure for registering the mobile device 700 in the router 500 and the STB 100 with a recording / playback function based on the operation of the mobile device 700 by the user will be described. Here, before the start of this registration procedure, the mobile device 700 preliminarily stores the address information used in the local access communication processing unit 9008 and the wireless access point unit 511 of the router 500 and the name or unique identifier for uniquely identifying the router 500. It shall be acquired.

  When the setting application 8020 is activated according to the operation of the operation IF unit 712 of the mobile device 700 by the user, the setting application 8020 displays a screen 1701 on the display unit 707, for example. The screen 1701 displays a “network setting” menu for setting the network environment of the mobile device 700 and a “connection server setting” menu for selecting a server from which various contents and data are acquired.

  When the user selects the “network setting” menu on the displayed screen 1701, the setting application 8020 displays a screen 1702, for example. A screen 1702 includes a “wireless LAN setting” menu for setting information related to wireless communication of the wireless communication unit 708 and the communication processing unit 8017, a communication processing unit 8017, a remote access detection proxy unit 8014, a remote access client unit 8015, a remote access connection The type of network to be set, such as a “mobile network setting” menu for setting information related to remote access communication from outside the home of the proxy unit 8016, is displayed. When the selection by the user operation of the “mobile network setting” menu on the screen 1702 is accepted, the setting application 8020 uses the communication processing unit 8017 and the wireless communication unit 708 to send an address used by the external connection unit 507 to the router 500. A “WAN side IP address acquisition request” message for acquiring information is transmitted.

  Upon receiving the “WAN side IP address acquisition request” message via the local access communication unit 509 (in this case, the wireless access point unit 511) and the local access communication processing unit 9008, the remote access server unit 9004 of the router 500 receives the STUN client. Using the technology such as the function, the WAN side IP address information assigned to the remote access communication unit 505 is acquired from the communication service provider 5 and notified to the mobile device 700. When the WAN-side IP address cannot be acquired, the remote access server unit 9004 returns a message to that effect to the mobile device 700 (S1501).

  The setting application 8020 of the mobile device 700 that has acquired the WAN-side IP address determines that the network communication is possible between the home and the outside via the router 500, and the DDNS server 7 registered in the router 500 A “DDNS setting information acquisition request” message for acquiring information regarding the message is transmitted to the router 500. If the WAN-side IP address cannot be acquired from the router 500, the setting application 8020 displays a screen such as “Cannot connect to the Internet” on the display unit 707 and notifies the user.

  The remote access server unit 9004 of the router 500 that has received the “DDNS setting information acquisition request” message notifies the mobile device 700 of registration information 1408 regarding the DDNS server 7. If the registered DNS server 7 does not exist in the device information of the router 500, the remote access server unit 9004 of the router 500 returns that fact to the mobile device 700 (S1502).

  When the setting application 8020 of the mobile device 700 receives a notification that the DDNS server 7 registered in the router 500 does not exist, for example, a warning screen indicating that “new registration of DDNS server needs to be performed” is displayed on the display unit. In step 707, the main registration process is interrupted or the process proceeds to a new registration process for the DDNS service.

  On the other hand, when the mobile device 700 receives the registration information 1408, that is, when one or more DDNS servers 7 registered in the router 500 exist, the router 500 establishes a secure communication path with the device outside the home. For this purpose, a “remote access secure method acquisition request” message for acquiring a supported protocol is transmitted to the router 500.

  The remote access server unit 9004 of the router 500 that has acquired the “remote access secure method acquisition request” message notifies the mobile device 700 of the support profile information 1407 registered in the device information using the connection setting information management service 9006. (S1503).

  The setting application 8020 of the mobile device 700 that has received the support profile information 1407 from the router 500 is included in its device information 1100 in the support profile information 1407 using the connection setting information management unit 8018 of the remote access client unit 8015. It is checked whether or not there is information that conforms to the profile information 1104 and 1105 to be checked. As a result, if there is no match, the setting application 820 displays, for example, a warning screen “Communication protocol is not supported. Download necessary software.” The process shifts to processing for downloading software for interrupting or realizing the secure method.

  On the other hand, when one or more compatible methods exist, the setting application 8020 of the mobile device 700 displays, for example, the screen 1703 on the display unit 707, prompts the user to select a secure communication method to be used, and selects the secure communication method. Accept. Here, in addition to accepting a secure communication method by the user, the setting application 8020 can use any standard (for example, there is a communication method that has already been registered, a high usage frequency or high security strength, or the latest software is installed). Based on the above, the setting application 8020 may automatically select the secure communication method.

Next, the setting application 8020 of the mobile device 700 selects and displays the information regarding the DDNS server 7 acquired in S1502 as shown in the screen 1704 on the display unit 707, and prompts the user to select the DDNS server 7 to be used. The selection of the server 7 is accepted. Here, in addition to selecting the DDNS server 7 based on a user instruction, the setting application 8020 has an arbitrary standard (for example, there is already registered DDNS server information, a frequently used one, or the latest software is installed. The DNS server 7 may be selected based on the above. When the setting application 8020 of the mobile device 700 accepts the selection of the DDNS server 7 based on a user instruction, the setting application 8020 displays, for example, the screen 1705 on the display unit 707 and accesses the DDNS server 7 selected by the router 500 and / or the mobile device 700. An input of a user name and a password necessary for the user is received from the user via the operation IF unit 172. When the mobile device 700 already holds the user name and password, the setting application 8020 may not display the screen 1705. (S1504)
Next, the setting application 8020 of the mobile device 700 transmits a “remote access secure method setting request” message including the secure communication method selected in S1504 to the router 500.

  The remote access server unit 9004 of the router 500 that has received the “remote access secure method setting request” message registers information 1458 related to the mobile device 700 in the external device information table 1440 using the connection setting information management service 9006, and The ID 1452 and the profile name of the secure communication method included in this message are set in the usage profile 1456. Then, the remote access server unit 9004 returns to the mobile device 700 whether or not the usage profile 1456 has been set.

  The setting application 8020 of the mobile device 700 that has received the setting result newly adds the ID 1120 of the device information table 1110 using the connection setting information management unit 8018 of the remote access client unit 8015, and adds the name of the router 500 or a unique name to the router ID 1121. Set the identifier to identify, set the IP address on the WAN side acquired in S1501 in the address information 1122 and the IP address to be used in the home if necessary, set the presence or absence of the remote access server function 1123, The profile information of the secure communication method selected in S1504 is set in the usage profile 1124. (S1505).

  Subsequently, the setting application 8020 of the mobile device 700 transmits a “DDNS information setting request” message including the identification information, URL, and user name / password of the DDNS server 7 selected in S1504 to the router 500.

  Upon receiving the “DDNS information setting request” message, the remote access server unit 9004 of the router 500 uses all the information contained in this message or identification information in the use DDNS 1457 of the information 1458 related to the mobile device 700 in the external device information table 1440. Only necessary parts such as URL are set. Then, it returns to the mobile device 700 whether or not it has been set.

Upon receiving the setting result, the setting application 8020 of the mobile device 700 uses the remote access client unit 8015 to perform remote access to the DDNS server information 1125 of the device information table 1110 from the outside of the home to the router 500 or a home device. Information (URL, user name / password, etc.) for accessing the server 7 is set. Then, the setting application 8020 of the mobile device 700 displays a screen 1706, for example, on the display unit 707, notifies the user of the completion of necessary network settings, and then sets the destination device settings for remote access from outside the house. Encourage transition. (S1506)
Next, the setting application 8020 of the mobile device 700 displays, for example, a screen 1801 shown in FIG. 18 on the display unit 707, and is necessary for the mobile device 700 taken out to access the content held by the home device. The process shifts to “information setting processing related to devices in the home”. First, the setting application 8020 of the mobile device 700 transmits an “acquisition of device information related to home network” message to the router 500 in order to acquire information related to a device on the home network that is permitted the remote access function.

  The remote access server unit 9004 of the router 500 that has received the “acquisition of device information related to home network” message uses the filter setting service 9005 to store the outside public information 1426 from the device information registered in the home device table 1410. The device information whose setting value is “valid” is extracted, and the extracted content is returned to the mobile device 700.

  The setting application 8020 of the mobile device 700 that has acquired in-home device information that can provide the content held by the access device from outside the home displays the screen 1802 on the display unit 707, for example, and accesses from outside the home. The user is prompted to select a home device and the selection is accepted. Here, on the screen 1802, not only the device information acquired from the router 500 but also a copyright when the home device is searched in the above-described steps S1201 to S1206 in FIG. 12 (not registered in the router 500). When a home device capable of providing content to be protected outside the home is detected, such information may also be displayed.

  Here, the remote access server unit 9004 of the router 500 may send back information to the mobile device 700 including information related to a device that does not permit the remote access function (for example, information of the STB 300). In addition, the setting application 8020 of the mobile device 700 displays information on the device that is not permitted for the remote access function on the screen 1802 in a display method that allows the user to know that it is “not permitted” (S1507).

  When the selection of the home device to be remotely accessed on the screen 1802 is received from the user, the setting application 8020 of the mobile device 700 displays, for example, the screen 1803 and reconfirms the device selected by the user (in this case, the STB 100 with a recording / playback function). Is received from the user, the device authentication processing unit 8010 is instructed to execute remote access device registration processing with the device authentication processing unit 7010 of the STB 100 with a recording / playback function. Details of this remote access device registration processing will be described later with reference to FIG. 16 (S1508).

  When the remote access device registration process for the STB 100 with the recording / playback function fails, the setting application 8020 of the mobile device 700 displays a warning screen to notify the user and interrupts the device registration process, or Returning to the screen 1802, selection of another in-home device is accepted from the user.

  On the other hand, when the remote access device registration process is successful, the device information service 7008 of the STB 100 with recording / playback function confirms that the mobile device 700 is registered in the external device information table 1030 using the device information management unit 7009. After that, a “device information acquisition request” message is transmitted to the router 500.

  The remote access server unit 9004 of the router 500 that has received the “apparatus information acquisition request” message receives all or part of the information registered in the in-home apparatus information table 1410 and the information registered in the out-of-home apparatus information table 1440. All or a part is transmitted to the STB 100 with a recording / reproducing function (S1509).

  The device information service 7008 of the STB 100 with recording / reproducing function that has acquired the device information registered in the router 500 confirms whether or not the device information service 7008 itself has already been registered in the registration information of the router 500. If it has already been registered, the setting value of the outside disclosure 1426 is confirmed. Further, it may be confirmed whether or not the mobile device 700 has already been registered in the router 500 (S1510).

  If the registered information of the router 500 does not include its own information, or if the setting value of the public disclosure 1426 is “invalid” even if it has been registered, the device information service 7008 has received it. After editing the registered contents or creating the update request contents, a “display filter information update request” message including the contents is transmitted to the router 500. Here, if there is no need to modify or add to the registered content, nothing needs to be done.

  The remote access server unit 9004 of the router 500 that has received the “display filter information update request” message uses the filter setting service 9005 to add / update the registration contents of the home appliance information table 1410 as necessary (S1511).

  On the other hand, the mobile device 700 that has succeeded in the remote access device registration processing S1508 transmits a “display filter information acquisition request” message to the router 500 in order to acquire the registered contents of the home device information table 1410 of the router 500. To do.

  The remote access server unit 9004 of the router 500 that has received the “display filter information acquisition request” message transmits the contents of the home device information table 1410 to the mobile device 700 using the filter setting service 9005.

  The setting application 8020 of the mobile device 700 that has received the contents of the in-home device information table 1410 of the router 500 confirms whether or not the information of the STB 100 with a recording / playback function is registered, and further, the setting value of the outside public 1426 is If it is confirmed that it is “valid”, for example, a screen 1804 is displayed on the display 707 to notify the user that the main registration processing is completed.

  Here, when the information of the STB 100 with the recording / playback function is not registered, or the setting value of the outside-home disclosure 1426 is “invalid”, the setting application of the mobile device 700 immediately or after an arbitrary time has elapsed. The “display filter information acquisition request” message may be transmitted to the router 500 again. If the desired result cannot be obtained after retrying an arbitrary number of times, a warning screen notifying that the main registration process has failed is displayed on the display unit 707, and the main registration process is interrupted or displayed on the screen 1802. The processing may be returned (S1512).

  Through the above registration processing, the user can perform registration necessary for permitting remote access to the router 500 and the home device by using the setting application 8020 of the mobile device 700.

  Here, the processing of S1502 and S1503 or S1505 and S1506 may be combined into one, the order of S1502 and S1503 may be reversed, or the order of S1505 and S1506 may be reversed.

  In S1504, the secure communication method or the DDNS server used by the mobile device 700 is selected, but the mobile device includes the “DDNS setting information acquisition request” message in S1502 and the “Remote access secure method acquisition request” message in S1503. A method may be used in which the content supported by the device is transmitted, and the router 500 confirms its own registered content and the supported content of the mobile device 700 and selects an appropriate one.

  In S1507, the setting application 8020 of the mobile device 700 transmits the “acquisition of device information related to home network” message. Here, the device that has been searched or detected is displayed on the screen 1802. Then, instead of “acquisition of display filter information” in S1512, a “acquisition of device information relating to home network” message may be transmitted either before or after that.

  Further, the remote access server unit 9004 of the STB 100 with a recording / playback function may execute the processes of S1510 and S1511 without transmitting the “apparatus information acquisition request” message in S1509.

  Further, the remote access device registration process S1508 may be performed before S1501 or after S1501. In this case, S1509 to S1511 executed by the remote access server 9004 of the STB 100 with recording / reproducing device can be executed in parallel with S1502 to S1507 executed by the setting application 8020 of the mobile device 700.

  Next, the details of the remote access device registration processing S1507 executed between the mobile device 700 and the STB 100 with recording / reproducing function will be described with reference to FIG. It is assumed that the mobile device 700 is in the user home 1 when executing this procedure. In addition, the mobile device 700 and the STB 100 with a recording / playback function monitor the TTL of the packet received when executing this procedure, and discard the packet in which the TTL value exceeding the predetermined value is set, so that the user home 1 can Prevent execution of this procedure. For this reason, the mobile device 700 and the STB 100 with a recording / playback function always set the TTL of the packet transmitted by itself to a predetermined value or less.

  First, the mobile device 700 and the STB 100 with a recording / playback function perform the device authentication process S1212 described with reference to FIG.

  Thereafter, the device authentication processing unit 8010 of the mobile device 700 creates an “external access device registration request” and transmits it to the STB 100 with a recording / playback function (S1601). The remote access device registration request can include information unique to the device, a random number generated using a predetermined calculation algorithm, a password set for remote access by the user, and the like.

  The device authentication processing unit 7010 of the STB 100 with a recording / playback function receives the remote access device registration request, and in S1602, whether the mobile device 700 has been registered in the external device information table 1030, for example, the device ID 1041 or The determination is made using the address information 1042. If the mobile device 700 has already been registered, the device authentication processing unit 7010 returns a reception confirmation including a status indicating that the registration has been successful or has been registered to the mobile device 700, and the process proceeds to S1604.

  If the mobile device 700 is not yet registered, the device authentication processing unit 7010 refers to the number of outside registrations 1031 in the outside device information table 1030, and the number of devices registered for outside access is defined in the definition table. It is determined whether or not the maximum number of outdoor device registrations of 1000 is less than 1003. If the number of devices registered for outside access has already reached the maximum number, the device authentication processing unit 7010 interrupts the registration process and includes a status indicating that registration is not possible or the maximum number is included. A reception confirmation is transmitted to the mobile device 700.

  On the other hand, if the maximum number of devices registered for outside access has not yet reached the maximum number, it is possible to access remotely after confirming that the device IDs of the mobile devices 700 received in S1301 / S1601 match. A reception confirmation including the result of whether or not the mobile device 700 has been registered in the device information table for outdoor use as a device is transmitted to the mobile device 700 (S1603). The device authentication processing unit 7010 sets the identification information of the mobile device 700 in the device ID 1041 in the external device information table 1030, and sets the MAC address, IP address, and the like of the mobile device 700 on the network as the address information 1042. Then, “stop” is set in the transmission status 1044, and the counter maximum value 1004 in the definition table 1000 is set as the counter value for outdoor use 1045 (S1604).

  The device authentication processing unit 8010 of the mobile device 700 that has received the reception confirmation from the device authentication processing unit 7010 of the recording / playback function STB 100 refers to the registration result included in the reception confirmation, and the registration result is successful or has been registered. Is updated, the contents of the device information table 1110 stored in the device management information section 8009 are updated (S1605).

Through the above processing, the device authentication processing unit 7010 of the STB 100 with a recording / playback function and the device authentication processing unit 8010 of the mobile device 700 can perform registration processing as an out-of-home access device only for devices that have been successfully authenticated. .
<Connection process by remote access>
When the above-described device registration process for remote access is successful, the user can take the mobile device 700 out of the home and access the home device from outside the home.

  First, a communication procedure for accessing the router 500 from the mobile device 700 taken out to the destination 2 will be described with reference to FIG.

  When the remote access server unit 9004 of the router 500 detects that the IP address on the WAN 12 side used by the remote access communication processing unit 9008 assigned by the communication service provider 5 has changed (S1901), it is registered in the device information. The address information setting request is sent to these DDNS servers 7 by referring to the information related to the DDNS servers 7 and the WAN side IP address of the router 500 registered in the DDNS server 7 is updated to the latest information. (S1902).

Also, the remote access server unit 9004 or the remote access detection proxy unit 9001 of the router 500 transmits the “device search request” message described in S1201 of FIG. 12 to the home network periodically or at an arbitrary timing (S1903). When a response is received from a device on the home network (S1904), the status 1425 of the home device information table 1410 in the device information managed by itself is updated as necessary, and the connection state of the device in the home is constantly monitored ( S1905). Further, when the device on the home network is connected to the home network, the device broadcasts a “connection notification” to all devices on the home network (S1906), and when disconnecting from the home network, the device on the home network sends the “disconnect notification”. Broadcast to all the above devices (S1907) so that the router 500 can always maintain the latest connection state. Upon receiving the “connection notification” from the device on the home network, the remote access server unit 9004 or the remote access detection proxy unit 9001 of the router 500 sets the status 1425 of the home device information table 1410 to “connected” and “disconnect notification”. Is received from a device on the home network, the status 1425 of the home device information table 1410 is set to “not connected”.

  In such a state, when the user who has taken the mobile device 700 to the outside location 2 accesses a home device, the content viewing application 8019 is activated when the operation IF unit 712 accepts an operation from the user. When the content viewing application 8020 accepts selection of a home device for viewing the content displayed on the display unit 707 (STB 100 with a recording / playback function in this embodiment), the content viewing application 8019 connects to the remote access client unit 8015. Using the device information table 1110 managed by the setting information management unit 8018, an address information acquisition request for the router 500 is transmitted to the DDNS server 7 registered in the DDNS server information 1125 (S1908).

  In response to this, the DDNS server 7 transmits an input screen for inputting the user name and password to the mobile device 700 in order to determine whether or not the address of the router 500 may be transmitted (S1909). .

  The content viewing application 8019 of the mobile device 700 displays the received input screen on the display unit 707 and accepts input of a predetermined user name and password from the user, or is registered in the remote access client unit 8015 of the mobile device 700. A user name and password are set and transmitted to the DDNS server 7 (S1910).

  The DDNS server 7 that has received the user name and password determines that these input values are correct, and then transmits address information related to the router 500 to the mobile device 700 (S1911).

  The content viewing application 8019 of the mobile device 700 that has acquired the address information that is the access destination of the router 500 has a device information table 1110 between the remote access connection proxy unit 8016 and the remote access connection proxy unit 9003 of the router 500. In accordance with the secure communication method (SSL method in the present embodiment) set in the usage profile 1124, an instruction to establish a secure communication path is issued (S1912).

  If a secure communication channel can be established with the router 500 in S 1912, the remote access connection proxy unit 8016 of the mobile device 700 notifies the remote access detection proxy unit 8014 to that effect. Similarly, the remote access connection proxy unit 9003 of the router 500 notifies the remote access detection proxy unit 9001 that a secure communication path has been established with the mobile device 700.

  Next, the remote access detection proxy unit 9001 of the router 500 transmits a “device information acquisition request” message to the remote access detection proxy unit 8014 of the mobile device 700 (S1913).

  The remote access detection proxy unit 8014 of the mobile device 700 that has received the “device information acquisition request” message responds with the device information managed by the device information management unit 8009 and the device information service 8008 and the functions that can be provided. Is transmitted to the router 500 (S1914).

  Receiving this response, the remote access detection proxy unit 9001 of the router 500 confirms whether or not the information 1458 related to the mobile device 700 is registered in the external device information table 1440. If not registered, the remote access detection proxy unit 9001 interrupts the connection process. If registered, the remote access detection proxy unit 9001 sets the status 1455 to “connected” or “connected”, and then sets the access destination (for example, URL) for acquiring the device information of the router 500 as a mobile The data is transmitted to the device 700 (S1915).

  The remote access detection proxy unit 8014 of the mobile device 700 that acquired the access destination for acquiring the device information of the router 500 transmits a “device information acquisition request” message to the router 500 using the access destination (S1916). ).

  Upon receiving the “device information acquisition request” message, the remote access detection proxy unit 9001 of the router 500 transmits a response including the device information managed by the device information service 9002 and a function that can be provided to the mobile device 700. (S1917).

  Thereafter, the remote access detection proxy unit 9001 of the router 500 acquires the in-home device information table 1410 managed by the remote access server unit 9004, and opens to the public 1426 from devices currently connected to the home network. Information on the device for which “valid” is set in is transmitted to the mobile device 700 (S1918).

  The remote access detection proxy unit 8014 of the mobile device 700 that is currently connected to the home network and has acquired information about accessible devices includes the STB 100 with recording / reproducing function selected by the user in S1908. It is determined whether or not (S1920).

  If it is determined that the STB 100 with a recording / playback function is not currently connected to the home network, the remote access detection proxy unit 9001 of the mobile device 700 notifies the viewing application 8019 to that effect. The viewing application 8019 displays on the display unit 707 that the STB 100 with a recording / playback function cannot be used, and notifies the user. On the other hand, if it is determined that the STB 100 with a recording / playback function is currently connected to the home network, the remote access detection proxy unit 8014 of the mobile device 700 is connected to the remote access detection proxy unit 9001 of the router 500. It is requested to notify the devices on the home network that this is being done (S1921).

  In response to this, the remote access detection proxy unit 9001 of the router 500 replies to the mobile device 700 (S1922), and then sets the status 1455 of the external device information table 1440 to “connected” and places it on the external network. Information about the connected device is held (S1923).

  Thereafter, the remote access detection proxy unit 9001 of the router 500 broadcasts a “connection notification” of the mobile device 700 to all devices connected to the home network on behalf of the mobile device 700 (S1924).

  The device on the home network that has received the “connection notification” broadcasts a “device search request” message to all devices on the home network (S 1925).

  The remote access detection proxy unit 9001 of the router 500 that has received the “device search request” message is a proxy for the mobile device 700 and sends a response including the device information and the provision function regarding the mobile device 700 acquired in S1914 to the “device search request”. The message is transmitted to the device that issued the message (S1926).

Through the above procedure, the mobile device 700 can establish a secure communication path with the router 500, and can acquire device information currently connected to the home network. In addition, it is possible to make a device on the home network recognize that it is connected.
<Content viewing processing by remote access>
Next, a procedure for viewing content that can be provided by the STB 100 with a recording / playback function on the mobile device 700 will be described with reference to FIG.

  The content viewing application 8019 of the mobile device 700 that has acquired the information of the device currently connected to the home network in S1918 transmits a “content information acquisition request” message to the STB 100 with a recording / playback function (S2001).

  Upon receiving the “content information acquisition request” message, the content directory service 7007 of the STB 100 with recording / playback function acquires content information using the content information providing unit 7006, and extracts content information that can be distributed outside the home from the content information. Then, list information is generated (S2002), and a response including these information is returned to the mobile device 700 (S2003). Here, examples of content that cannot be distributed outside the home include content with viewing restrictions, programs that are currently being received by the tuner 101 (live content), and IP broadcasts that are being received by the communication unit 108. However, if the content providers 3, 4, 21, and 22 permit, information regarding these contents may also be provided. It is assumed that the copyright protection target content being received from another device (for example, the TV 200 with recording / playback function or the STB 300) connected to the home network via the communication unit 108 cannot be distributed outside the home.

  The content viewing application 8019 of the mobile device 700 that has acquired viewable content information displays, for example, the screen 2310 of FIG. 23 on the display unit 707. The user instructs desired content from among these via the operation IF unit 712 (S2004). In this embodiment, for the screen 2310 used for content viewing by remote access from the mobile device 700, the content 2 that has viewing restrictions and the programs 1 and 2 (live content) that are viewed in real time are options as compared to the screen 2300. Is not displayed as.

  When the user selects desired content, the content viewing application 8019 of the mobile device 700 instructs the device authentication processing unit 8010 to execute device authentication processing for access outside the home with the STB 100 with a recording / playback function. (S2005).

  When the device authentication process for outside access is successful in S2005, the content viewing application 8019 of the mobile device 700 instructs the media reception controller 8007 to start content reception. The media reception controller 8007 transmits a “content transmission request” message to the STB 100 with a recording / playback function (S2006).

  Upon receiving the “content transmission request” message, the media distribution service 7015 of the STB 100 with recording / playback function generates a content key based on the exchange key shared in S2005 by using the content management unit 7005 and the key generation unit 7012, and performs encryption. Using the processing unit 7013, the content is transmitted to the mobile device 700 while being encrypted with the content key (S2007).

  The content viewing application 8019 or the media reception controller 8007 of the mobile device 700 that has received the encrypted content via the communication processing unit 8017 instructs the decryption processing unit 8013 and the key generation unit 8012 to share the exchange key shared in S2005. A content key is generated based on the content key, and the decryption processing unit 8013 decrypts the content using the content key. Thereafter, the decrypted content is separated into audio data and video data by the demux unit 701, the audio data is decoded by the audio decoding unit 702 and output to the audio output unit 706, and the video data is decoded by the video decoding unit 703. The data is output to the display unit 707.

  Here, the STB 100 with a recording / playback function permits the mobile device 700 to be remotely accessed to provide the content stored therein only for the purpose of viewing or moving (moving) the content, Copying (copying) may be prohibited.

  Here, the STB 100 with a recording / playback function can provide its own content to another device (for example, the STB 300) in the user's home 1 at the same time as transmitting the content to the mobile device 700 that is remotely accessed. To do.

  In addition, the mobile device 700 that performs remote access is prohibited from transmitting (transferring) the content to another device via the wide area wireless communication unit 720 while viewing the content received from the STB 100 with the recording / reproducing function. . However, only when the device authentication processing unit 8010 of the mobile device 700 executes the device authentication processing S1212 shown in FIG. 13 with another device via the wireless communication unit 708 and succeeds in the device authentication processing S1212. The content may be transmitted to another device via the wireless communication unit 708 while viewing the content received from the attached STB 100.

  FIG. 21 shows that the copyright-protected content stored in the STB 100 with recording / playback function is viewed between the STB 100 with recording / playback function and the mobile device 700 in order to view the copyright-protected content stored in the STB 100 with recording / playback function on the mobile device 700 outside the home. This is a device authentication processing procedure for remote access. Here, STB 100 with a recording / reproducing function and mobile device 700 do not monitor TTL of received packets.

  First, the device authentication processing unit 8010 of the mobile device 700 creates an out-of-home authentication request, attaches device-specific information including the device ID and a certificate for the device-specific information, and passes the communication processing unit 8017. To the STB 100 with a recording / reproducing function (S2101).

  Upon receiving the out-of-home authentication request, the device authentication processing unit 7010 of the recording / playback function STB 100 sends a reception confirmation for the out-of-home authentication request to the mobile device 700 (S2102).

  Next, the device authentication processing unit 7010 of the STB 100 with recording / reproducing function creates an out-of-home authentication request from its own side, and the unique information of the STB 100 with recording / reproducing function and the device specific, as in the case of the mobile device 700 Is attached to the mobile device 700 via the communication processing unit 7018 (S2103).

  The device authentication processing unit 8010 of the mobile device 700 receives the out-of-home authentication request and sends a receipt confirmation to the STB 100 with a recording / playback function (S2104).

  Next, the device authentication processing unit 7010 of the STB 100 with a recording / playback function verifies each piece of information received in the out-of-home authentication request and sends an out-of-home authentication response with parameters necessary for generating key information to the mobile device 700. Send (S2105).

The device authentication processing unit 8010 of the mobile device 700 receives the out-of-home authentication response and sends the receipt confirmation to the STB 100 with a recording / playback function (S2106), and then creates an out-of-home authentication response from its own side, As in the case of the STB with function 100, an out-of-home authentication response with parameters necessary for generating key information is sent to the STB 100 with a recording / playback function (S2107), and the necessary parameters attached to the received out-of-home authentication response are sent. Is used to generate an out-of-home authentication key common to the STB 100 with a recording / reproducing function.

The device authentication processing unit 7010 of the STB 100 with a recording / playback function receives the out-of-home authentication response, sends the reception confirmation to the mobile device 700, and, like the mobile device 700, the necessary authentication information attached to the received out-of-home authentication response. An authentication key common to the mobile device 700 is generated using the parameters (S2108).
Through the procedure so far, the device authentication processing unit 7010 of the STB 100 with a recording / playback function and the device authentication processing unit 8010 of the mobile device 700 generate and share a common authentication key.

  Next, the device authentication processing unit 7010 of the STB 100 with a recording / playback function confirms that the device ID of the mobile device 700 is registered in the device information table for external use 1030 managed in the device information management unit 7009. Check. If the device ID of the mobile device 700 is registered, it is confirmed whether or not the exchange key 1043 for outside the house is set in the outside device information table 1030. If the remote exchange key 1043 of the mobile device 700 has not been set, the value of the remote access number 1032 in the external device information table 1030 is greater than the value of the maximum remote access number 1006 in the definition table 1000. Make sure it is small. If the value of the simultaneous remote access number 1032 is smaller than the maximum simultaneous access number 1006, the device authentication processing unit 7010 of the STB 100 with a recording / playback function stores the simultaneous remote access number 1032 in the external device information table 1030. 1 is generated, and an out-of-home exchange key used when encrypting content to be transmitted to the mobile device 700 is generated. Then, the generated out-of-home exchange key is set in the out-of-home exchange key 1043 of the out-of-home equipment information table 1030 (S2109). Here, if the device ID of the mobile device 700 is not registered in the out-of-home device information table 1030, or the value of the out-of-home simultaneous access count 1032 in the out-of-home device information table 1030 is the same as the out-of-home simultaneous information in the definition table 1000. If the value is the same as or larger than the maximum number of accesses 1006, the device authentication process for access outside the home is interrupted.

  The device authentication processing unit 7010 of the STB 100 with a recording / playback function that has set the generated exchange key for outside the home in the device information table for outside home 1030 encrypts the exchange key for outside use generated in S2109 using the authentication key, and exchanges for outside the home It is transmitted to the mobile device 700 together with an ID for identifying the key (S2110). Thereafter, it instructs the key management unit 7011 to hold and manage the generated exchange key for outside the house.

  The device authentication processing unit 8010 of the mobile device 700 decrypts the remote exchange key transmitted from the STB 100 with the recording / reproducing function using the authentication key, and sends a reception confirmation (S2111). The key management unit 8011 is instructed to hold and manage the generated exchange key.

  FIG. 22 shows an example of data when content is transmitted using the HTTP protocol in S2007 described above. Here, TCP is used as the transport layer protocol, but the TCP header is omitted.

Transmission data 2000 when content is transmitted using the HTTP protocol includes an HTTP header 2001 and a content transmission packet 2002.
The content transmission packet 2002 includes a header part 20001 and a payload part 20022.

  The header part 20001 includes a type 200211, a reserved area (Reserved) 200212, an encryption method (C_A) 200213, an encryption mode (E-EMI) 200214, an exchange key label (Exchange_Key_Label) 200215, copy control information (PCP-UR) 200216, and a random value. (SNc) 200217, and payload size (Byte Length of Payload) 200218.

  Type 200211 has a fixed value for identifying the type of the content transmission packet 2002.

A reserved area (Reserved) 200212 is a reserved area, and is set to 0.
The encryption method (C_A) 2002213 indicates the encryption method of the payload portion, and clearly indicates that encryption is performed with AES having a key length of 128 bits, for example.

The encryption mode (E-EMI) 200214 indicates the encryption mode of the payload part, and is used for calculation of the content key together with the copy control information (PCP-UR) 200216 and the random value (SNc) 20017.
In the exchange key label (Exchange_Key_Label) 200215, a label for specifying the key exchanged in the authentication procedure 600 is set.

  The copy control information (PCP-UR) 200216 indicates copy control information of the payload part, a copy control information mode (UR Mode) indicating the type of the copy control information, a content type (Content Type) indicating the type of the payload part, analog APS for limiting output, ICT for limiting resolution, and the like are included.

In the payload size (Byte Length of Content) 200218, the size of the payload portion 17022 of the content transmission packet 1702 is set.
The payload portion 17022 is composed of encrypted content.

  For example, when content is transmitted using the RTP protocol, the content can be transmitted with the same configuration as in FIG. 22 by replacing the HTTP header 2001 with the RTP header. Alternatively, if both the RTP header and the content transmission packet 2002 are stored for each RTP packet, the copy control information can be transmitted more reliably.

  As described above, in this embodiment, a secure communication path is established between a device outside the home and the router 500 in the home, and content and control commands are exchanged on the secure communication path. Can be done. Also, devices outside the home can safely acquire information on devices connected to the home network, and devices on the home network can easily acquire information on devices accessed from outside the home.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

1 User's house 3, 4 Content provider (broadcasting station)
7 DDNS server 5, 6 Communication service provider 21, 22 Content provider (IP distribution provider)
100 STB with recording / playback function
200 TV with recording and playback function
300 STB
400 Monitor 500 Remote access compatible router 700 Mobile device 8019 Content viewing application 8020 Setting application 8004 Content directory controller 8007 Media reception controller 8008 Device information service 8009 Device information management unit 8010 Device authentication processing unit 8012 Key generation unit 8013 Decryption processing 8014 Remote access detection Proxy unit 8015 Remote access client unit 8018 Connection setting information management unit 8016 Remote access connection proxy unit 9001 Remote access detection proxy unit 9002 Device information service 9003 Remote access connection proxy unit 9004 Remote access server unit 9005 Filter setting service 9006 Connection setting information management service

Claims (5)

A router device having a routing function for connecting an outside network and an in-home network and relaying communication,
A remote access communication unit that transmits and receives content and data to and from devices on the outside network;
A local access communication unit that transmits and receives content and data to and from devices on the home network;
A remote access connection proxy unit that establishes a secure communication path between a device on the outside network and the remote access communication unit;
A remote access detection agent that provides information on devices connected to the external network to devices on the home network, and provides information on devices connected to the home network to devices on the home network;
Register and manage information about devices on the home and outside networks,
A network access server section for monitoring the connection state,
The remote access server unit is
Providing information on a secure method used when establishing a communication path in the remote access connection proxy unit to a device on a home network;
The information on the device on the home network to be registered and managed includes at least information on the device that the device on the home network has permitted to open to the device on the outside network,
Only when a secure communication path is established between the device on the outside network and the remote access communication unit, information on the device on the home network that is permitted to be disclosed is sent to the device on the outside network. A router device characterized by providing. The router device according to claim 1,
Of the devices on the home network registered in the remote access server unit, a device permitted to be disclosed has a content transmission function. The router device according to claim 1 or 2, wherein
The remote access server part
Managing the current number of accesses from a device on the outside network to a device on the home network;
Only when the number of accesses does not exceed a predetermined number, a router device permits access from a device on the outside network to a device on the home network thereafter. The router device according to claim 1, wherein:
The remote access server part
Register address information used in the remote access communication unit to a DDNS server on the outside network,
When the address information is changed, the router apparatus updates the registration information of the DDNS server. The router device according to claim 4, wherein
The remote access server part
A router apparatus for registering and managing information relating to the DDNS server.

Images