Summary of the invention
The invention provides a kind of authentication method, certification agency terminal and system of set-top box, in order to realize the fail safe of certificate management, improved the unfailing performance of certificate management.
One aspect of the present invention provides a kind of authentication method of set-top box, comprising:
Set-top box sends the first request message to the certification agency terminal, and described the first request message comprises the identification information of certificate to be obtained, and stores described set-top box employed certificate when accessing media system in the described certification agency terminal;
Described set-top box receives described certification agency terminal according to the keyword message of the certificate of the identification information transmission of certificate described to be obtained;
Described set-top box accesses described media system according to the keyword message of described certificate.
The present invention provides a kind of authentication method of set-top box on the other hand, comprising:
The first request message that certification agency terminal receiver top box sends, this first request message comprises the identification information of certificate to be obtained, and stores described set-top box employed certificate when accessing media system in the described certification agency terminal;
Described certification agency terminal is sent to described set-top box according to the identification information of certificate described to be obtained with the keyword message of certificate, so that described set-top box accesses described media system according to the keyword message of described certificate.
The present invention provides a kind of set-top box on the other hand, comprising:
The first sending module is used for sending the first request message to the certification agency terminal, and described the first request message comprises the identification information of certificate to be obtained, and stores set-top box employed certificate when accessing media system in the described certification agency terminal;
The first receiver module is used for receiving the keyword message of the certificate that described certification agency terminal sends according to the identification information of certificate described to be obtained, so that described set-top box accesses described media system according to the keyword message of described certificate.
The present invention provides a kind of certification agency terminal on the other hand, comprising:
Memory module is used for memory machine top box employed certificate when accessing media system;
The second receiver module is used for the first request message that receiving set up box sends, and this first request message comprises the identification information of certificate to be obtained;
The second sending module is used for according to the identification information of certificate described to be obtained the keyword message of certificate being sent to described set-top box, so that described set-top box accesses described media system according to the keyword message of described certificate.
The present invention provides a kind of communication system on the other hand, comprise aforesaid set-top box, certification agency terminal, certificate granting terminal and media system, wherein, set-top box and certification agency terminal interaction, certification agency terminal and certificate granting terminal interaction, set-top box and media system are mutual, media system and certificate granting terminal interaction.
As shown from the above technical solution, the authentication method of set-top box of the present invention, certification agency terminal and system, by certification agency terminal management certificate, and then first request message that can send according to the set-top box keyword message of issuing licence under the set-top box, realize the fail safe of certificate management, improved simultaneously the unfailing performance of certificate management.
Embodiment
For making the purpose, technical solutions and advantages of the present invention clearer, below in conjunction with the accompanying drawing in the embodiment of the invention, the technical scheme in the embodiment of the invention is clearly and completely described, obviously, described embodiment is the present invention's part embodiment, rather than whole embodiment.Based on the embodiment among the present invention, those of ordinary skills belong to the scope of protection of the invention not making the every other embodiment that obtains under the creative work prerequisite.
The flow chart of the authentication method of the set-top box that Fig. 1 provides for one embodiment of the invention, as shown in Figure 1, the authentication method of set-top box is as described below.
101, set-top box sends the first request message to the certification agency terminal, and this first request message comprises the identification information of certificate to be obtained, and stores set-top box employed certificate when accessing media system in the described certification agency terminal.
For instance, the identification information of certificate to be obtained can be the coding of certificate.
102, set-top box acceptance certificate proxy terminal is according to the keyword message of the certificate of the identification information transmission of certificate to be obtained, so that set-top box is according to the keyword message access media system of certificate.
For instance, the keyword message of certificate can be the key of certificate.Further, the set-top box in the present embodiment is not preserved the keyword message of certificate.
In the present embodiment, before the step 101, the authentication method of set-top box also comprises:
Set-top box sends the request log messages to media system;
The first response message that set-top box receiving media system sends according to the request log messages, the first response message comprises the identification information of certificate.In actual applications, this first response message comprises that also request provides the information of the keyword message of certificate.
And then step 101 can be specially: set-top box sends the first request message according to the first response message to the certification agency terminal.
In actual applications, before step 102, the authentication method of set-top box also comprises: the certification agency terminal is carried out authentication to set-top box, and then, the message that the authentication that set-top box acceptance certificate proxy terminal sends is passed through.
Especially, set-top box also the certificate to be obtained that sends of acceptance certificate proxy terminal exist and effective state information.
If the non-existent state information of certificate described to be obtained that set-top box acceptance certificate proxy terminal sends, then set-top box sends response message according to the non-existent state information of certificate to be obtained to the certification agency terminal, so that the certification agency terminal is obtained certificate according to response message to the certificate granting terminal.
In addition, if the state information that the certificate to be obtained that set-top box acceptance certificate proxy terminal sends lost efficacy, then set-top box sends response message according to the state information that certificate to be obtained lost efficacy to the certification agency terminal, so that the certification agency terminal is obtained certificate according to response message to the certificate granting terminal.
The authentication method of the set-top box in above-described embodiment, by certification agency terminal management certificate, and the keyword message of issuing licence under the set-top box according to the request of set-top box, realized the fail safe of certificate management, reduce simultaneously the performance requirement of set-top box in the prior art, enlarged the range of application of set-top box.
On the basis of above-described embodiment, as shown in Figure 2, Fig. 2 shows the flow chart of the authentication method of the set-top box that another embodiment of the present invention provides, and wherein, the authentication method of set-top box is as mentioned below.
201, set-top box sends the request log messages to media system.
202, media system receives after the request log messages, sends the first response message to set-top box, and this first response message comprises the identification information of certificate and the information that request provides the keyword message of certificate.
203, set-top box receives after the first response message, send the first request message to the certification agency terminal, the identification information that comprises certificate to be obtained in this first request message stores set-top box employed certificate when accessing media system in the certification agency terminal.
The identification information of certificate to be obtained can be title, coding, identification code of certificate to be obtained etc.
204, after the certification agency terminal receives the first request message, search its inside according to the identification information of certificate to be obtained and whether store the certificate that remains to be obtained.
If the certificate that storage remains to be obtained in the 205 certification agency terminals, and it is effective that the certification agency terminal views certificate described to be obtained, then send certificate existence and effective state information to set-top box, and the keyword message of certificate that will be to be obtained is sent to set-top box, so that set-top box is according to the keyword message access media system of certificate.
If do not store certificate to be obtained in the 206 certification agency terminals, then the certification agency terminal sends the non-existent state information of certificate to set-top box, so that set-top box sends response message to the certification agency terminal after receiving the non-existent state information of described certificate, and then the certification agency terminal is obtained certificate according to response message to the certificate granting terminal.
If the certificate that storage remains to be obtained in the 207 certification agency terminals, but the certification agency terminal views certificate to be obtained to lose efficacy, then the certification agency terminal sends the state information that certificate lost efficacy to set-top box, so that send response message to the certification agency terminal after the state information that the set-top box acceptance certificate lost efficacy, and then the certification agency terminal is obtained certificate according to response message to the certificate granting terminal.
The authentication method of the set-top box in above-described embodiment, by certification agency terminal management certificate, and the keyword message of issuing licence under the set-top box according to the request of set-top box, realized the fail safe of certificate management, reduce simultaneously the performance requirement of set-top box in the prior art, enlarged the range of application of set-top box.
On the basis of above-described embodiment, as shown in Figure 3, Fig. 3 shows the schematic flow sheet of authentication method of the set-top box of another embodiment of the present invention, and wherein, the authentication method of set-top box is as mentioned below.Need to prove that the certification agency terminal in the present embodiment can be managed the certificate that a plurality of set-top box are used in order to access media system.
301, set-top box sends the request log messages to media system.
302, media system receives after the request log messages, sends first response message of asking log messages to set-top box, and this first response message comprises the identification information of certificate and the information that request provides the keyword message of certificate.
303, set-top box receives after the first response message, sends the first request message according to the first response message to the certification agency terminal, comprises the identification information of certificate to be obtained and the identification information of set-top box in this first request message.
The identification information of set-top box can be the coding of set-top box in the present embodiment.The identification information of certificate to be obtained can be title, coding, identification code of certificate to be obtained etc.
304, after the certification agency terminal receives the first request message, according to the identification information of set-top box set-top box is carried out authentication, if authentication pass through, execution in step 305, otherwise, send the unsanctioned message of authentication to set-top box.
If 305 certification agency terminals are passed through the set-top box authentication, set-top box is searched its inside according to the identification information of certificate to be obtained and whether is stored the certificate that remains to be obtained.
If the certificate that storage remains to be obtained in the 306 certification agency terminals, and it is effective that the certification agency terminal views certificate to be obtained, then send certificate existence and effective state information to set-top box, and the keyword message of certificate that will be to be obtained is sent to set-top box.
307, behind the keyword message of the certificate that sends of set-top box acceptance certificate proxy terminal, the keyword message of certificate is sent to media system.
308, media system is sent to the certificate granting terminal with the keyword message of the certificate of set-top box transmission, so that whether the keyword message of this certificate granting terminal authentication certificate is correct.If correct, execution in step 309, otherwise, to the message of media system transmission certificate error, and then the access of media system refusal set-top box.
If 309 certification authentications are passed through, the certificate granting terminal will be verified the message informing media system that passes through, and the message that media system passes through according to checking allows the set-top box access.
In the application process of reality, the certification agency terminal can regularly detect the validity of each certificate of storage inside.If detecting certificate, described certification agency terminal lost efficacy, then the certification agency terminal is searched the identification information of set-top box corresponding to this certificate, and issue licence under the set-top box according to the identification information of described set-top box and to need the message upgraded, comprise the identification information of certificate in this message.
After set-top box receives the message that described certificate need upgrade, send response message to the certification agency terminal, the certification agency terminal is obtained the valid certificate of corresponding this set-top box according to response message to the certificate granting terminal, and with the valid certificate storage of obtaining.
The authentication method of the set-top box in above-described embodiment, by certification agency terminal management certificate, and the keyword message of issuing licence under the set-top box according to the request of set-top box, realized the fail safe of certificate management, reduce simultaneously the performance of set-top box in the prior art, enlarged the range of application of set-top box.
On the basis of above-described embodiment, as shown in Figure 4, Fig. 4 shows the schematic flow sheet of authentication method of the set-top box of another embodiment of the present invention, and wherein, the authentication method of set-top box is as mentioned below.
401, the first request message of sending of certification agency terminal receiver top box, this first request message comprises the identification information of certificate to be obtained, and stores set-top box employed certificate when accessing media system in the described certification agency terminal;
402, the identification information of described certification agency terminal basis certificate to be obtained is sent to described set-top box with the keyword message of certificate, so that described set-top box is according to the keyword message access media system of certificate.
In the present embodiment, before step 402, the authentication method of set-top box also comprises:
The certification agency terminal is carried out authentication to set-top box, if authentication is passed through, then sends the message that authentication is passed through to set-top box.
Further, the certification agency terminal determines according to the identification information of certificate to be obtained that certificate to be obtained exists and effectively, and will certificate be obtained exist and effectively state information be sent to set-top box.
In actual applications, the authentication method of set-top box also comprises:
The certification agency terminal can repeat or regularly detect the validity of each certificate of this certification agency terminal inner storage, if detecting inner certificate, the certification agency terminal lost efficacy, then the certification agency terminal is searched the set-top box corresponding with this certificate, and issue licence under the set-top box and need the message upgraded, comprise the identification information of certificate in this message;
The certification agency terminal is after receiving the response message of described set-top box to certificate need updating message, in order to obtain effective certificate and storage according to response message to the certificate granting terminal.
The authentication method of the set-top box in above-described embodiment by certification agency terminal management certificate, and according to the keyword message that the request of set-top box is issued licence under the set-top box, has been realized the fail safe of certificate management, has improved the unfailing performance of certificate management.
According to a further aspect in the invention, the embodiment of the invention also provides a kind of set-top box, and as shown in Figure 5, Fig. 5 shows the structural representation of set-top box in an embodiment of the present invention, and wherein, set-top box comprises: the first sending module 51 and the first receiver module 52.Particularly, the first sending module 51 is used for sending the first request message to the certification agency terminal, and this first request message comprises the identification information of certificate to be obtained, and stores set-top box employed certificate when accessing media system in the certification agency terminal; The first receiver module 52 is used for the acceptance certificate proxy terminal according to the keyword message of the certificate of the identification information transmission of certificate to be obtained, so that set-top box is according to the keyword message access media system of certificate.
In the present embodiment, the first sending module 51 also is used for sending the request log messages to media system; The first receiver module 52 also is used for the first response message that the receiving media system sends according to the request log messages, and the first response message comprises the identification information of certificate; At this moment, the first sending module 51 is concrete for sending the first request message according to the first response message to the certification agency terminal.
For instance, the first above-mentioned receiver module 52 also is used for the message that authentication that the acceptance certificate proxy terminal sends is passed through.In addition, the certification agency terminal according to determine wait the identification information that obtains certificate wait obtain that certificate exists and effectively after, the first receiver module 52 is used for also that certificate to be obtained that the acceptance certificate proxy terminal sends exists and effective state information.The concrete function of this place's set-top box can be with reference to the description in the as above embodiment of the method.
Set-top box in above-described embodiment can be passed through certification agency terminal management certificate, and the keyword message of issuing licence under the set-top box according to the request of set-top box, realize the fail safe of certificate management, reduced simultaneously the performance of set-top box in the prior art, enlarged the range of application of set-top box.
According to a further aspect in the invention, the embodiment of the invention also provides a kind of certification agency terminal, as shown in Figure 6, Fig. 6 shows the structural representation of certification agency terminal in an embodiment of the present invention, wherein, the certification agency terminal comprises: memory module 60, the second receiver module 61 and the second sending module 62.Particularly, memory module 60 is used for memory machine top box employed certificate when accessing media system, and the second receiver module 61 is used for the first request message that receiving set up box sends, and this first request message comprises the identification information of certificate to be obtained; The second sending module 62 is used for according to the identification information of certificate to be obtained the keyword message of certificate being sent to set-top box, so that described set-top box is according to the keyword message access media system of certificate.
For instance, in the certification agency terminal according to determining wait the identification information that obtains certificate wait obtaining that certificate exists and effectively after the state information, the second sending module 62 also be used for will certificate be obtained exist and effectively state information be sent to set-top box.
Certification agency terminal in the present embodiment also comprises: the first authentication module is used for set-top box is carried out authentication; If authentication is passed through, the message that the second sending module 62 also is used for authentication is passed through is sent to set-top box.
Further, the certification agency terminal also comprises: detection module, and for detection of the validity of each certificate in the memory module 60.
Certification agency terminal in the present embodiment can provide for a set-top box service of certificate management, the service of certificate management also can be provided for a plurality of set-top box, for example, can be in a Small-scale LAN, the certification agency terminal can be the service that a plurality of set-top box provide certificate management.Further, by certification agency terminal management certificate, so that the security performance of certificate management improves.
According to a further aspect in the invention, the present invention also provides a kind of communication system, as shown in Figure 7, this communication system comprises the described set-top box 71 of any embodiment of the present invention, certification agency terminal 72, certificate granting terminal 73 and media system 74, and wherein, set-top box 71 is mutual with certification agency terminal 72, certification agency terminal 72 is mutual with certificate granting terminal 73, set-top box 71 is mutual with media system 74, and media system 74 is mutual with certificate granting terminal 73, so that set-top box 71 access media systems 74.
Need to prove: for aforesaid each embodiment of the method, for simple description, so it all is expressed as a series of combination of actions, but those skilled in the art should know, the present invention is not subjected to the restriction of described sequence of movement, because according to the present invention, some can adopt other orders or carry out simultaneously.Secondly, those skilled in the art also should know, the embodiment described in the specification all belongs to preferred embodiment, and related action and module might not be that the present invention is necessary.In the above-described embodiments, the description of each embodiment is all emphasized particularly on different fields, do not have the part that describes in detail among certain embodiment, can be referring to the associated description of other embodiment.The those skilled in the art can be well understood to, and is the convenience described and succinct, the system of foregoing description, and the specific works process of device and unit can with reference to the corresponding process among the preceding method embodiment, not repeat them here.
In several embodiment that the application provides, should be understood that, disclosed system, apparatus and method can realize by another way.For example, device embodiment described above only is schematic, for example, the division of described unit, only be that a kind of logic function is divided, during actual the realization other dividing mode can be arranged, for example a plurality of unit or assembly can in conjunction with or can be integrated into another system, or some features can ignore, or do not carry out.Another point, the shown or coupling each other discussed or direct-coupling or communication connection can be by some interfaces, indirect coupling or the communication connection of device or unit can be electrically, machinery or other form.
It should be noted that at last: above embodiment only in order to technical scheme of the present invention to be described, is not intended to limit; Although with reference to previous embodiment the present invention is had been described in detail, those of ordinary skill in the art is to be understood that: it still can be made amendment to the technical scheme that aforementioned each embodiment puts down in writing, and perhaps part technical characterictic wherein is equal to replacement; And these modifications or replacement do not make the essence of appropriate technical solution break away from the spirit and scope of various embodiments of the present invention technical scheme.