KR101094275B1 - Authentication method and apparatus for mobile device in internet protocol television - Google Patents

Abstract

The present invention is to support the user can subscribe to the service when the user can subscribe to the service through the mobile device available, i.e. a small mobile terminal, such as a smart phone, PDA, laptop, etc. An authentication method and apparatus.

Description

Authentication method and device for mobile terminal in IPTV environment {AUTHENTICATION METHOD AND APPARATUS FOR MOBILE DEVICE IN INTERNET PROTOCOL TELEVISION}

The present invention relates to an authentication system for a mobile terminal, a small terminal, and to support a mobile terminal owned by the subscriber subscribed to the service, the service can continue to use the service in the home as well as the home through the small terminal It relates to an authentication system and a method thereof.

Due to the rapid spread of the high-speed Internet network, IPTV (Internet Protocol Television: IPTV) service is rapidly becoming a reality. IPTV standardization is the FG IPTV (International Telecommunication Union Telecommunication Standardization Sector: ITU-T, hereinafter referred to as "ITU-T") SG 13 (Study Group: SG 13, hereinafter referred to as "SG 13"). Focus Group IPTV: FG IPTV, hereinafter referred to as "FG IPTV". Standardization of IPTV structure and security technology is underway. IPTV security, which is being standardized, is divided into service security and content security, and summarizes risk factors, security requirements, security structures, and security mechanisms.

Security technologies that are being considered for the protection of services and content in IPTV service environments include CAS (Conditional Access System (CAS)) and the rights of digital content owners and creators on the Internet. There is a DRM (Digital Right Management: DRM) developed for protection. However, these security technologies have limitations in applying to IPTV service environment. The CAS system cannot provide security for broadcast content that is redistributed among mobile IPTV service-enabled terminals existing in the home, that is, PDs, laptops, and smart phones. Providers are subject to CAS technology. In addition, in the case of DRM, there are problems in that interoperability between DRMs is not provided and security vulnerabilities due to the application of a single encryption in software. Recently, various researches have been conducted to compensate for these disadvantages. Recently, there is an active discussion on the IPTV service environment that can support the mobility of mobile terminals owned by subscribers who subscribe to the IPTV service in the IPTV service environment. In order to support this, there is a need for an authentication technology capable of securely authenticating various mobile terminals existing in a home and a method of safely redistributing content to an authenticated mobile terminal. In addition, when an authenticated mobile terminal moves out of the house, an authentication technique for network access authentication and IPTV service authentication for continuously providing IPTV service through a wireless network available in the mobile terminal is required.

Accordingly, an object of the present invention is to provide a mobile terminal registration and authentication management system to continuously receive an IPTV service in a home through a mobile IPTV service available terminal owned by a subscriber subscribed to the IPTV service.

The present invention also provides an IPTV service authentication for receiving an IPTV service and a network access authentication for using a wireless network accessible by a mobile terminal when an IPTV service subscriber having a mobile terminal registered and authenticated in the home moves out of the home.

을 상기 셋톱박스와 초기 인증 과정에서 공유한 마스터 세션 키를 토대로 상기 보안값을 검증하여 상기 아이피티브이 서비스 인증을 수행한다.
상기의 다른 기술적 과제를 달성하기 위한 본 발명에 따른 아이피티브이(IPTV) 서비스를 이동 단말을 통해 댁내외에서 제공받기 위해 상기 이동 단말에 대해 인증 서비스를 제공하는 셋톱박스에 있어서, 아이피티브이 서비스 제공업자의 인증 서버와 초기 인증을 수행한 후 상기 인증 서버로부터 서명 권한을 위임받아, 사전에 등록된 아이피티브이 서비스 가입자의 이동 단말에 인증용 서명을 생성하여 발급하며, 상기 이동 단말로부터 수신된 상기 인증용 서명을 기초로 상기 이동 단말을 인증하고, 상기 인증이 완료된 이동 단말에 상기 아이피티브이 서비스를 이용할 수 있도록 서비스키를 전송하는 것을 특징으로 한다.
상기의 다른 기술적 과제를 달성하기 위한 본 발명에 따른 아이피티브이(IPTV) 서비스를 이동 단말을 통해 댁내외에서 제공받기 위해 상기 이동 단말에 대해 인증 서비스를 제공하는 인증장치에 있어서, 상기 인증장치로부터 서명 권한을 위임받은 셋톱박스가 발급한 서명에 포함되어 있는 보안값

이 포함된 아이피티브이 서비스 인증 요청 메시지를 전달받고, 상기 셋톱박스와 공유하는 마스터 세션 키를 이용하여 상기 보안값을 복호화 한 후 상기 이동 단말의 식별정보와 상기 셋톱박스의 식별정보를 확인하여 이동 단말을 검증하는 것을 특징으로 한다. In the mobile terminal authentication method performed in the set-top box to provide an authentication service for the mobile terminal to receive the IPTV service according to the present invention for achieving the technical problem in the home and abroad through a mobile terminal, (a) the iPiP performing initial authentication with a service provider's authentication server and then delegating signature authority from the authentication server; (b) receiving, by an IP, the mobile terminal held by the service subscriber; (c) generating and issuing a first signature to the registered mobile terminal; (d) authenticating the mobile terminal based on the first signature received from the mobile terminal; And (e) transmitting the service key through which the iFitive can use the service to the mobile terminal in which the authentication is completed, so that the iFT is provided with the service through the service key.
Preferably, the step (a) includes (a1) authentication of a set-top box with a master session key (master session key) shared with the authentication server, including a PDH public disclosure value, time information, and IP service profile information. Encrypting and transmitting the information to the authentication server; And (a2) receiving a master session key encrypted by the authentication server and a signature generated by the authentication server receiving the authentication information to delegate the signature generation authority to the set-top box.
Also preferably, the step (b) may include: (b1) transferring a first parameter necessary for verifying a second signature and signature issued by the authentication server to the mobile terminal; (b2) receiving a second parameter for signature generation including a shared session key generated by a Diffiemann key generation method from a mobile terminal which has completed verification of the second signature based on the transmitted first parameter; And (b3) registering the mobile terminal transmitting the second parameter.
In the mobile terminal authentication method performed in the authentication server for providing an authentication service to the mobile terminal to receive the IPTV service according to the present invention for achieving the above another technical problem in the home and abroad through the mobile terminal (a) receiving an authentication request from the mobile terminal registered in advance in a set top box; (b) receiving a signature issued by the set-top box, which is delegated the signature authority of the authentication server, from the mobile terminal; (c) verifying whether the received signature is a signature generated and issued by the set-top box to authenticate the mobile terminal; And (d) requesting the content server to provide content to the content server so that the iFive can receive the service for the mobile terminal on which the authentication is completed.
Preferably, in the step (d), the security value included in the signature issued by the set-top box received from the mobile terminal

The iP performs service authentication by verifying the security value based on a master session key shared during the initial authentication process with the set-top box.
In the set-top box for providing an authentication service for the mobile terminal to receive the IPTV service according to the present invention for achieving the above-mentioned other technical problem through a mobile terminal in-house or outside, the service provider of the service provider After performing initial authentication with an authentication server, a signing authority is delegated from the authentication server, and a previously registered iP generates and issues an authentication signature to a mobile terminal of a service subscriber, and receives the authentication signature received from the mobile terminal. It is characterized in that for transmitting the service key so as to authenticate the mobile terminal based on the authentication, the mobile can use the service to the authentication is completed.
In the authentication device for providing an authentication service for the mobile terminal to receive an IPTV (IPTV) service according to the present invention to achieve the above and other technical problems through a mobile terminal, the signature authority from the authentication device Security value included in the signature issued by the delegated set-top box

The received iP is received a service authentication request message, decrypts the security value using a master session key shared with the set-top box, and then checks the identification information of the mobile terminal and the identification information of the set-top box. It is characterized by verifying.

According to the present invention, a subscriber set up a wireless environment in a home by having a set-top box installed in a service subscriber's premises, which is authorized to create a signature by a service provider's authentication server, issues a signature to a mobile terminal that the subscriber wants to use in the home. It provides mobile terminal authentication technology to use iPi, and wireless network authentication and IPI service authentication, and mobile terminal authentication using the signature issued by the set-top box through the mobile terminal registered to the set-top box by the subscriber. By providing a technology for sharing a shared secret key with a wireless access point, iPiT provides a technology that allows a service subscriber to continuously receive an iPiT provided from a home using a mobile terminal while on the go.

1 is an IPTV Head End composed of a TA, a content server, a network switch, and other IPTV broadcasting equipments, which is an authentication server of an IPTV service provider according to an embodiment of the present invention, an STB installed in a home, and an IPTV existing in a home. FIG. 5 is a diagram illustrating an IPTV service environment including a home composed of IPTV service-enabled terminals such as a media, a laptop, a smart phone, and an internet accessible through a wired / wireless network.
2 is a diagram illustrating a registration and authentication process of a home mobile terminal according to an embodiment of the present invention.
3 is a diagram illustrating a network access authentication and IPTV service authentication process for a mobile terminal so that a subscriber who moves out of the home with a mobile terminal registered in a home STB according to an embodiment of the present invention can continuously receive an IPTV service. Drawing.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an IPTV authentication server (IPTV Trust Authority: IPTV TA, hereinafter referred to as "IPTV TA") 201, and a content server (CS) hereinafter referred to as "CS" according to an embodiment of the present invention. .) (202), IPTV Head End 100 and Set Top Box (STB) consisting of network switch 203 and other broadcast equipment required for IPTV service (204). Is a diagram illustrating a home 101 and an internet environment 103 composed of a mobile terminal capable of using an IPTV service such as an IPTV 205, a PDA 206, a smartphone 208, a notebook 207, and the like. Mobile terminals 206-208 can access the Internet through multiple wireless interfaces that can connect to WLAN 301 and WiBro 302.

Referring to FIG. 1, an IPTV service provider delivers multimedia content for IPTV to the STB 204 installed in a home, that is, a home, of a service subscriber through the Internet. There are also small mobile terminals owned by the user, such as wired IPTV 205, PDA 206, notebook 207, and smartphone 208, which are delivered to STB 204 through these terminals. You can watch multimedia content.

Figure 2 is securely provided with an IPTV in the home through a small mobile terminal such as a PD 206, a notebook 207, and a smart phone 208 owned by a user existing in the home according to an embodiment of the present invention FIG. 1 is a diagram illustrating a mobile terminal registration and authentication process for supporting the service.

Referring to FIG. 2, when a user who wants to receive an IPTV service subscribes to the IPTV service, the IPTV service provider installs the STB 204 in the subscriber's home. At this time, the subscriber is provided with the master session key (MSK, hereinafter referred to as "MSK") shared with the TA 201, which is the authentication server of the IPTV service provider, to the subscriber through a secure method such as a smart card. (401). The smart card is added to the STB 204 installed in the home and used for the authentication process with the TA 201 of the IPTV service provider.

When the STB 204 is installed in the home, the STB 204 performs an initial authentication process with the TA 201 online. At this time, the STB 204 includes the identification information of the STB 204, the Diffhelman public value of the STB 204, and the time information in the message 402 encrypted by the subscriber securely distributed through a smart card. (402). Upon receiving the message encrypted and transmitted by the STB 204, the TA 201 checks the identification information of the STB 204 after decryption using a master session key shared with the subscriber. At this time, the identification information of the STB 204 checked by the TA 201 is assigned by the IPTV service provider when the subscriber subscribes to the IPTV service.

와 q를 선택한 다음

를 구한다. 그 다음 임의의

를

에서 선택한 다음

를 구한다. 서명 검증을 위해 사용하는 공개 키는

와 같이 구한다. 여기까지의 과정은 초기인증 수행 전에 미리 준비된다. 이후 STB (204)에게 전달한 서명을 다음의 수식 1과 같이 생성한다. 수식에서 H는 SHA_1 과 같은 해쉬함수를 이용하여 생성하는 해쉬 값이다.If the TA 201 verifies and authenticates the STB 204 successfully, the TA 201 generates a signature for delegating its signature generation authority to the STB 204 (403). The signature generation method used here uses Schnorr's signature scheme. To this end, Schnorr's signature algorithm is applied to the TA 201, the STB 204, and the mobile terminal in advance. TA 201 is any large prime

And q then

. Then random

To

Select from

. The public key used for signature verification is

Obtain as The process up to this point is prepared before the initial authentication is performed. Thereafter, the signature passed to the STB 204 is generated as shown in Equation 1 below. In the formula, H is a hash value generated using a hash function such as SHA_1.

을 생성한 다음 검증 값

등의 정보를 마스터 세션키로 암호화하여 STB (204)에게 전달한다 (404).Signature for delegating signature authority as above

The validation value

And the like are encrypted with a master session key and transmitted to the STB 204 (404).

Receiving an encrypted message that includes a signature for delegation of signature authority delivered by the TA 201, the STB 204 decrypts the message via the master session key and verifies the signature (405). The signature verification method is shown in Equation 2 below.

을 이용하여 TA (201) 대신 서명을 생성할 때 사용하는 대리 서명용 개인 키

와 대리 서명을 검증할 때 사용하는 대리 서명용 공개 키

를 다음 수식 3과 같이 계산한다.Signature verification issued by TA 201 upon successful verification of the signature, as in the above formula

Private key for the surrogate signature used when generating a signature on behalf of the TA 201 using

And public key for proxy signatures used to verify proxy signatures

Is calculated as shown in Equation 3 below.

와

는 STB의 디피헬만 개인 값과 공개 값이다. STB (204)는 위와 같이 대리 서명용 개인 키와 공개 키를 생성한 다음 보관한다. 이후 가입자는 자신이 소유한 이동 단말 (206)을 STB (204)에 등록하여 댁내에서 이동 단말을 이용하여 IPTV를 시청하기 위한 STB (204)등록 과정을 수행한다.Used to calculate the private key for the surrogate signature

Wow

Diffhelman's private and public values of the STB. The STB 204 generates and then stores the private and public key for the surrogate signature as above. Thereafter, the subscriber registers the mobile terminal 206 owned by the STB 204 and performs the registration process of the STB 204 for watching IPTV using the mobile terminal in the home.

등의 값을 함께 전달한다 (406). 이 값을 이동 단말 (206)에서 수신하면 수식 2에서와 같은 방법으로 서명을 검증하고, 디피헬만 키 생성 방법을 이용하여 STB (204)와 공유하게 되는 세션 키

를 생성한다 (407). 그리고 STB (204)에게 자신의 식별 정보 (이동 단말의 시리얼 번호 등이 사용될 수 있음), 디피헬만 공개 값, 그리고 생성된 공유 세션 키를 포함하여 계산한

를 함께 STB (204)로 전달한다 (408).The registration process of the mobile terminal 206 is performed by connecting the mobile terminal 206 directly to the STB 204 using a wired cable such as a USB cable or the like, and then connecting the mobile terminal 206 to the STB 204 by wire. The subscriber directly performs the registration procedure while viewing the screen, and registration of the mobile terminal 206 via the wire is performed only once. When the mobile terminal is connected to the STB 204 by wire, the STB 204 is a parameter required for verifying the signature issued by the TA 201, its own Diffhelmann public value, and the signature.

Pass a value such as 406. When receiving this value from the mobile terminal 206, the signature is verified in the same manner as in Equation 2, and the session key is shared with the STB 204 using the Defiemann key generation method.

Generates (407). And calculates the STB 204 including its identification information (the serial number of the mobile terminal can be used), the Diffellmann public value, and the generated shared session key.

Together to STB 204 (408).

값을 검증하여 메시지 무결성을 확인한다 (409). 이후 이동 단말 (206)을 등록하고 이동 단말 (206)에게 발급할 서명을 TA (201)를 대신하여 수식 4와 같이 생성한다 (409).The STB 204 receives the message and then calculates the shared session key in the same way as the mobile terminal.

Verify the message integrity by verifying the value (409). Thereafter, the mobile terminal 206 is registered and a signature to be issued to the mobile terminal 206 is generated in place of the TA 201 as shown in Equation 4 (409).

는 이동 단말 (206)이 댁외로 이동할 경우 IPTV 서비스 인증에 사용되는 보안 값이다. 그리고 서명

는 이동 단말 (206)에게 분배되는 서명이다. 이렇게 서명이 생성되면 STB (204)는 TA (201)에게 자신에게 등록된 이동 단말 (206)의 등록 정보를 TA (201)와 공유하는 비밀 키로 암호화하여 전달한다 (410). 이 메시지를 수신한 TA (201)는 STB (204)에 등록된 이동 단말 (206)과 STB (204)의 식별정보를 바인딩하여 보관한다. 이후 STB (204)는 생성한 서명

와 TA (201)가 STB (206)에게 전달해준 검증 값

등을 공유 세션 키로 암호화하여 등록 성공 메시지에 포함하여 전달한다 (411). 이 메시지를 수신한 이동 단말 (206)이 서명과 검증 값 등을 저장하면 이동 단말 (206)의 등록 과정이 마무리된다. 이후 댁내에서는 무선 환경을 통해 STB (204)에 등록된 이동 단말 (206)을 통해 IPTV를 제공받게 된다.Generated by the above formula

Is a security value used for IPTV service authentication when the mobile terminal 206 moves out of the house. And signature

Is the signature distributed to the mobile terminal 206. When the signature is generated, the STB 204 encrypts the registration information of the mobile terminal 206 registered to the TA 201 with a secret key shared with the TA 201 and transmits the registration information to the TA 201 (410). Upon receiving this message, the TA 201 binds and stores identification information of the mobile terminal 206 registered with the STB 204 and the STB 204. The STB 204 then generates the signature

And validation values passed to the STB 206 by the TA 201.

And the like are encrypted with a shared session key and included in the registration success message (411). When the mobile terminal 206 receiving the message stores a signature, a verification value, and the like, the registration process of the mobile terminal 206 is completed. Thereafter, in the home, the IPTV is provided through the mobile terminal 206 registered with the STB 204 through a wireless environment.

를 STB (204)에게 전달한다 (412). 이 메시지를 수신한 STB (204)는 이동 단말 (206)을 인증하고, IPTV 서비스를 사용하는데 필요한 CAS의 서비스 키를 공유 세션 키로 암호화하여 이동 단말로 전달한다 (413). 이 메시지를 수신한 이동 단말 (206)은 CAS 시스템의 서비스 키를 알게 되고, 서비스 키를 통해 제어 단어로 스크램블 되어 전달되는 멀티미디어 콘텐츠를 복호화하여 안전하게 IPTV 서비스를 제공받게 된다.When the subscriber uses the IPTV service using the mobile terminal 206 registered with the STB 204, the mobile terminal 206 is signed.

To the STB 204 (412). Receiving this message, the STB 204 authenticates the mobile terminal 206, encrypts the service key of the CAS required to use the IPTV service with the shared session key, and delivers it to the mobile terminal (413). Receiving this message, the mobile terminal 206 knows the service key of the CAS system, and decodes the multimedia content scrambled as a control word through the service key to safely receive the IPTV service.

A mobile terminal 206 normally registered with the STB 204 may update the signature periodically or as required by the user. When the mobile terminal 206 forwards the request message for signature renewal to the STB 204, the newly selected Diffhelmann public value is encrypted with the shared session key and passed to the STB 204 (414). The STB 204 then generates a signature that includes the new Diffhelman public value of the mobile terminal 206 and a new shared session key and then transfers the updated signature to the mobile terminal 206 (415) to obtain the mobile terminal's signature. Update

3 is a diagram illustrating a method for providing network authentication and IPTV service authentication necessary for a subscriber to move out of the home with a mobile terminal 206 registered to the STB 204 and continuously receive an IPTV service according to an embodiment of the present invention. A diagram illustrating the process.

, 검증 값

, STB (204)의 대리 서명 검증용 공개 키

, 이동 단말 (206)의 디피헬만 공개 값

, STB의 디피헬만 공개 값

, 그리고

이 포함되어 전달된다 (501). 이렇게 전달된 인증 요청 메시지를 무선 네트워크 접속 지점 (301)에서 수신하면 다음 수식 5와 같이 STB (206)의 대리 서명용 공개 키

를 검증하여 TA (201)가 정상적으로 서명 생성 권한을 위임한 STB (204)가 생성한 서명인지를 검증하고, 이동 단말 (206)을 인증한다 (502).In order for the mobile terminal 206 to receive the IPTV service from outside the home, the mobile terminal 206 must first perform authentication for accessing the wireless network and then perform service authentication for receiving the IPTV service. The mobile terminal 206 moving out of the home finds accessible wireless network access points 301-302. When the mobile terminal 206 moves to the WLAN environment 301, it transmits an authentication request message to the wireless access point 301 of the WLAN (501). The certificate request message contains a signature issued by the STB 204.

, Validation value

Public key for proxy signature verification for STB 204

, Diffiehlmann's public value of mobile terminal 206

, STB's Diffelmann public value

, And

This is included and delivered (501). When the received authentication request message is received at the wireless network access point 301, the public key for the surrogate signature of the STB 206, as shown in Equation 5 below.

Verifies that the signature is generated by the STB 204 to which the TA 201 normally delegates the signature generation authority, and authenticates the mobile terminal 206 (502).

If the public key verification for the surrogate signature succeeds as shown in the above equation, the signature is verified using the public key, thereby performing network access authentication for the mobile terminal 206 (502).

를 디피헬만 방법을 통해 생성하고, 생성된 키를 통해

을 계산한 다음 자신의 디피헬만 공개 값, TA가 발급한 서명을 네트워크 인증 응답 메시지에 포함하여 이동 단말 (206)로 전달한다 (503). 이 메시지를 수신한 이동 단말 (206)은 무선 접속 지점 (301)의 디피헬만 공개 값을 이용하여 동일한 임시 공유 세션 키

를 생성한다.If the mobile terminal 206 is successfully authenticated, the wireless access point 301 shares a temporary shared session key with the mobile terminal 206.

Is generated by the Diffelmann method, and the generated key

After calculating the Diffelmann public value, the signature issued by the TA is included in the network authentication response message and forwarded to the mobile terminal 206 (503). Receiving this message, the mobile terminal 206 receives the same temporary shared session key using the Defiemann public value of the wireless access point 301.

.

이 포함되어 전달된다. 상기 보안 값을 수신한 CS (202)는 TA (201)에게 보안 값을 전달하고 (505), TA (201)는 STB (204)와 공유하는 MSK를 이용하여 보안 값을 복호화한 다음 이동 단말 (206)의 식별 정보와 STB (204)의 식별 정보를 확인하여 STB (204)에 정상적으로 등록된 이동 단말 (206)인지를 검증한다. 이렇게 TA (201)에서 이동 단말 (206)에 대한 IPTV 서비스 인증이 성공적으로 수행 (506)되면 TA (201)는 CS (202)에게 STB (204)의 식별정보와 이동 단말 (206)의 식별 정보를 안전한 체널을 통해 전달한다 (507). 이 정보를 수신한 CS (202)는 이동 단말 (206)을 위한 IPTV 서비스 콘텐츠를 무선 접속 지점으로 전달하고 (508), IPTV 서비스 콘텐츠를 수신한 무선 접속 지점 (301)은 이동 단말 (206)로 전달한다 (509). 이때 전달되는 IPTV 서비스 콘텐츠는 CAS 시스템을 통해 보호되고, 제어단어로 스크램블된 콘텐츠는 STB (204)가 이동 단말에게 알려준 서비스키로 복호화하여 IPTV 서비스 콘텐츠를 사용할 수 있다.After successfully performing authentication of the mobile terminal 206, the wireless access point 301 forwards an IPTV service authentication request message to the CS 202 for the IPTV service authentication of the mobile terminal 206 (504). This message contains the security value contained in the signature issued by the STB 206 to the mobile terminal 206.

This is included and delivered. Upon receiving the security value, the CS 202 transfers the security value to the TA 201 (505), and the TA 201 decrypts the security value using an MSK shared with the STB 204, and then the mobile terminal ( The identification information of the 206 and the identification information of the STB 204 are checked to verify whether the mobile terminal 206 is normally registered with the STB 204. When the IPTV service authentication for the mobile terminal 206 is successfully performed 506 in the TA 201, the TA 201 transmits identification information of the STB 204 and identification information of the mobile terminal 206 to the CS 202. Pass through the secure channel (507). Receiving this information, the CS 202 forwards the IPTV service content for the mobile terminal 206 to the wireless access point (508), and the wireless access point 301 receiving the IPTV service content is sent to the mobile terminal 206. Pass (509). At this time, the delivered IPTV service content is protected through the CAS system, and the content scrambled with the control word can be decoded with the service key that the STB 204 informs the mobile terminal to use the IPTV service content.

In-house registration and authentication, and out-of-door network authentication and service authentication method for the mobile terminal 206 according to the present invention is implemented in the form of program instructions that can be performed through various computer means, such as TA 201, STB 204, IPTV 205, and the mobile terminal (206 ~ 208) is installed in the equipment necessary to receive the IPTV service. As described above, the present invention has been described with reference to the accompanying drawings, but the present invention is not limited to the above embodiments, and various modifications and variations are possible to those skilled in the art to which the present invention pertains. .

Claims (7)

In the mobile terminal authentication method performed in a set-top box that provides an authentication service for the mobile terminal to receive an IPTV (IPTV) service from inside or outside the mobile terminal,
(a) the iPiP performing initial authentication with a service provider's authentication server and then delegating signature authority from the authentication server;
(b) receiving, by an IP, the mobile terminal held by the service subscriber;
(c) generating and issuing a first signature to the registered mobile terminal;
(d) authenticating the mobile terminal based on the first signature received from the mobile terminal; And
(e) transmitting a service key for using the service to the mobile terminal to which the authentication is completed, and receiving the service through the service key; authentication of the mobile terminal Way. The method of claim 1,
In step (a),
(a1) encrypting the authentication information including the identification information of the set-top box, the Diffhelmann public value, the time information, and the IP service profile information to the authentication server using a master session key shared with the authentication server; step; And
(a2) receiving, by the authentication server receiving the authentication information, a signature generated to delegate the signature generation authority to the set-top box and a master session key encrypted by the authentication server; Authentication method of the terminal. The method of claim 1,
In step (b),
(b1) transmitting a first parameter necessary for verifying a second signature and signature issued by the authentication server to the mobile terminal;
(b2) receiving a second parameter for signature generation including a shared session key generated by a Diffiemann key generation method from a mobile terminal which has completed verification of the second signature based on the transmitted first parameter; And
(b3) registering the mobile terminal having transmitted the second parameter. In the mobile terminal authentication method performed in the authentication server for providing an authentication service for the mobile terminal to receive the IPTV (IPTV) service from inside or outside the mobile terminal,
(a) receiving an authentication request from the mobile terminal registered in advance in a set top box;
(b) receiving a signature issued by the set-top box, which is delegated the signature authority of the authentication server, from the mobile terminal;
(c) verifying whether the received signature is a signature generated and issued by the set-top box to authenticate the mobile terminal; And
(d) requesting the content server to provide the content to the content server so that the idea can be provided with the service for the mobile terminal that has been authenticated. The method of claim 4, wherein
In step (d), the security value included in the signature issued by the set-top box received from the mobile terminal

Verifying the security value based on a master session key shared in the initial authentication process with the set-top box, and the iP performs a service authentication. In the set-top box that provides an authentication service for the mobile terminal to receive an IPTV (IPTV) service from inside or outside the mobile terminal,
After the iPiP performs initial authentication with the service provider's authentication server, the authority is delegated a signing authority from the authentication server, and a pre-registered iPi generates and issues a signature for authentication to the mobile subscriber of the service subscriber. And authenticating the mobile terminal based on the received signature for authentication, and transmitting a service key to the mobile terminal in which the authentication is completed, so that the intelligent can use the service. In the authentication device for providing an authentication service for the mobile terminal to receive an IPTV (IPTV) service from inside or outside the mobile terminal,
Security value included in the signature issued by the set-top box delegated the signing authority from the authentication device

The received iP is received a service authentication request message, decrypts the security value using a master session key shared with the set-top box, and then checks the identification information of the mobile terminal and the identification information of the set-top box. Authentication apparatus, characterized in that for verifying.

Images