JP2005012570A - Device and program for user terminal authentication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a user terminal authentication device and a user terminal authentication program capable of improving convenience in use of digital literary work while mortgaging rights of the digital literary work. <P>SOLUTION: A rights protection system 10 comprises a user terminal authentication device 1, a plurality of user terminals 2i (i=a, b, ...n) connectable to the user terminal authentication device 1, a user identification device 3 provided with a customer management database (hereinafter referred to as customer management DB) 5, and a computer network 4 such as Internet connecting the user identification device 3 and the user terminal authentication device 1. The computer system allows a user to freely view digital literary works within the limit of personal. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a user terminal authentication device and a user terminal authentication program in consideration of user convenience while observing the rights of digital works.
[0002]
[Prior art]
With the advancement of IT (Information Technology) technology and the spread of Internet technology, the usage forms of copyrighted works are diversified. For example, once a genre of work such as music was used on a device purchased by an individual using media that exists as hardware, such as tape, record, CD (Compact Disc), You can copy the work saved on these hardware in another format (for example, MP3 (MPEG-1 Audio Layer-3) format), or you can purchase and rewrite the work saved on the Internet It has come to be stored and used in various media (memory, etc.).
[0003]
At this time, the problem is that copying can be done indefinitely without degrading the quality. Previous copies (from records to tape, etc.) were allowed to some extent because quality deteriorated, but with current technology, duplicates can be easily and unlimitedly made without degradation of the same quality As a result, illegal distribution of copyrighted works has been triggered. In particular, illegal distribution of copyrighted works among individuals called P2P (Peer to Peer) has become a major problem.
[0004]
Based on this situation, at present, copyright protection using a copyright management (Digital Rights Management, hereinafter referred to as DRM) system, the number of times of copying as seen in MD (Mini Disk), and playback are possible. Measures are taken to prevent illegal copying of copyrighted works by fixing the terminal.
[0005]
The prior art document information related to this application includes the following.
[0006]
[Patent Document 1]
JP 2002-314533 A
[0007]
[Patent Document 2]
Japanese National Patent Publication No. 10-512074
[0008]
[Problems to be solved by the invention]
However, the countermeasures as described above are also restricted when used inside an individual. For example, suppose that an individual copies music for a valid reason and uses it on a certain device. In order to play back using another device different from this device, it is necessary to perform the right protection process again. For this reason, there is a problem that it is difficult to make personal use of digital works among devices owned by the user.
[0009]
The present invention has been made to solve the above-described problems, and a user terminal authentication apparatus and a user that can improve the convenience of using a digital work while ensuring the protection of the rights of the digital work. An object is to provide a terminal authentication program.
[0010]
[Means for Solving the Problems]
In order to achieve the above object, the present invention as claimed in claim 1 is connected to one or a plurality of user terminals for viewing digital works through a first computer network, and includes a second computer network. A user terminal authentication device connected to a user certification device comprising customer information storage means for storing information relating to a customer who uses the second computer network, the user terminal using the user terminal User information transmission means for transmitting information about a user to the user certification device via the second computer network, and the user certification device based on information about the user and information about the customer. The user is authenticated, and if the authentication is successful, a user certificate to be transmitted is sent to the second computer network. A certificate receiving means for receiving the user certificate, a device enabling means for enabling the use of the user terminal authentication device by receiving the user certificate, and the encrypted digital work Personal key generation means for generating an individual key for encrypting a copyrighted work decryption key as a common key based on information uniquely defining the user terminal authentication device, and the use from the user terminal A user terminal information receiving means for receiving user terminal identification information for uniquely defining a user terminal via the first computer network, and when the user terminal is authenticated based on the user terminal identification information Personal key transmission means for transmitting the individual key to the user terminal that has transmitted the user terminal identification information via the first computer network. Obtains the encrypted digital work and the decryption key storage unit obtained by encrypting the work decryption key with the individual key, and obtains the individual key transmitted from the user terminal authentication device. The gist is to decrypt the decryption key storage unit using the decryption key and decrypt the digital work encrypted using the decrypted work decryption key.
[0011]
According to a second aspect of the present invention, there is provided the second computer according to the first aspect, wherein the user certification device is acquired when the user terminal authentication device and the user certification device are connected. In accordance with network identification information of the network, information related to the customer is retrieved from the customer information storage means, and the user is authenticated by comparing the retrieved information related to the customer with information related to the user. And
[0012]
According to a third aspect of the present invention, in the first or second aspect of the invention, the information for uniquely identifying the user terminal authentication device is transmitted from a device identification number of the user terminal authentication device, the user certification device. The gist of the present invention is user identification information for identifying the user stored in the customer information storage means, or information that takes into account the device identification number and the user identification information.
[0013]
According to a fourth aspect of the present invention, there is provided a user terminal authentication apparatus connected to one or a plurality of user terminals for viewing a digital work through a computer network, wherein the encrypted digital work is stored in the user terminal authentication apparatus. An individual key generating means for generating an individual key for encrypting a copyrighted work decryption key to be decrypted as a common key based on device identification information that uniquely defines the user terminal authentication device; and from the user terminal User terminal information receiving means for receiving user terminal identification information uniquely defining a user terminal via the computer network, and when authenticating the user terminal based on the user terminal identification information, Personal key transmission means for transmitting the individual key to the user terminal that has transmitted the user terminal identification information via the computer network, and When the terminal obtains the encrypted digital work and the decryption key storage unit obtained by encrypting the work decryption key with the individual key, the individual key transmitted from the user terminal authentication device The decryption key storage unit is decrypted by using the decryption method, and the digital work encrypted by using the decrypted work decryption key is decrypted and reproduced.
[0014]
According to a fifth aspect of the present invention, in the invention according to any one of the first to fourth aspects, when the individual key transmitting means authenticates the user terminal, the individual held by the user terminal When requesting to transmit another key and receiving the individual key held from the user terminal, request to delete the individual key held in the user terminal, from the user terminal When the individual key deletion completion notification is received, the gist is to transmit the individual key to the user terminal that has transmitted the user terminal identification information.
[0015]
According to a sixth aspect of the present invention, in the invention according to any one of the first to fifth aspects, the individual key transmission means includes a number of authentications of the user terminal in the user terminal authentication device. When the number is less than the stored key issuance limit number, the gist is to transmit the individual key.
[0016]
The present invention according to claim 7 is connected to one or a plurality of user terminals for viewing a digital work through a first computer network, and the second computer network A user terminal authentication program in a user terminal authentication device connected to a user certification device comprising customer information storage means for storing information relating to a customer who uses a computer network, wherein the user terminal is used A user information sending step for sending information about the user to the user certification device via the second computer network, and the user certification device is based on the information about the user and the information about the customer; The user is authenticated, and if the authentication is successful, the user certificate to be transmitted is changed to the second compilation. A certificate reception step received via a data network, a device validation step for validating use of the user terminal authentication device by receiving the user certificate, and the encrypted digital work A personal key generating step for generating a personal key for encrypting a copyrighted work decryption key for decrypting an object as a common key based on information uniquely defining the user terminal authentication device; and A user terminal information receiving step for receiving user terminal identification information for uniquely defining a user terminal via the first computer network; and when the user terminal is authenticated based on the user terminal identification information Transmits the individual key to the user terminal that has transmitted the user terminal identification information via the first computer network. The user terminal authenticating apparatus, and the user terminal includes the decrypted key storage unit that encrypts the encrypted digital work and the work decryption key with the individual key. When acquired, the decryption key storage unit is decrypted using the individual key transmitted from the user terminal authentication device, and the digital work encrypted using the decrypted work decryption key is decrypted. The gist is to decrypt and reproduce.
[0017]
According to an eighth aspect of the present invention, in the invention according to the seventh aspect, the user certification device is the second computer acquired when the user terminal authentication device and the user certification device are connected. In accordance with network identification information of the network, information related to the customer is retrieved from the customer information storage means, and the user is authenticated by comparing the retrieved information related to the customer with information related to the user. And
[0018]
The invention according to claim 9 is the invention according to claim 7 or 8, wherein the information for uniquely identifying the user terminal authentication device is transmitted from a device identification number of the user terminal authentication device and the user certification device. The gist of the present invention is user identification information for identifying the user stored in the customer information storage means, or information that takes into account the device identification number and the user identification information.
[0019]
A tenth aspect of the present invention is a user terminal authentication program in a user terminal authentication apparatus connected via a computer network to one or a plurality of user terminals for viewing digital works. A personal key generation step of generating a personal key for encrypting a digital work decryption key for decrypting the digital work as a common key based on device identification information uniquely defining the user terminal authentication device; A user terminal information receiving step for receiving user terminal identification information for uniquely defining the user terminal from the user terminal via the computer network; and authenticating the user terminal based on the user terminal identification information. In this case, the individual key is sent via the computer network to the user terminal that has transmitted the user terminal identification information. The individual terminal key transmitting step is executed by the user terminal authenticating device, and the user terminal encrypts the encrypted digital work and the work decryption key with the individual key. When the decryption key storage unit is obtained, the decryption key storage unit is decrypted using the individual key transmitted from the user terminal authentication device, and encrypted using the decrypted work decryption key The gist is to decrypt and reproduce the digital work.
[0020]
The present invention according to claim 11 is the invention according to any one of claims 7 to 10, wherein the individual key transmission step includes authenticating the user terminal and authenticating the user terminal. When requesting to transmit another key and receiving the individual key held from the user terminal, request to delete the individual key held in the user terminal, from the user terminal When the individual key deletion completion notification is received, the gist is to transmit the individual key to the user terminal that has transmitted the user terminal identification information.
[0021]
According to a twelfth aspect of the present invention, in the invention according to any one of the seventh to eleventh aspects, in the individual key transmission step, the number of authentications of the user terminal is within the user terminal authentication device. When the number is less than the stored key issuance limit number, the gist is to transmit the individual key.
[0022]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0023]
FIG. 1 is a schematic configuration diagram of a right protection system 10 according to an embodiment of the present invention. A right protection system 10 shown in FIG. 1 includes a user terminal authentication device 1, a plurality of user terminals 2i (i = a, b,... N) connectable to the user terminal authentication device 1, and a customer management database (hereinafter, referred to as a user management database). A user certification device 3 (referred to as a customer management DB) 5, and a computer network 4 such as the Internet network connecting the user certification device 3 and the user terminal authentication device 1. This is a computer system that allows a user to freely view digital works within personal use.
[0024]
The user terminal authentication device 1 is provided for each user, and is a device that clarifies the range of personal use (the right range in which a digital work can be freely viewed). That is, by authenticating that the user terminal authentication device 1 is the user terminal 2i owned by the user, the authenticated user terminal 2i can freely use and copy the digital work. It will be.
[0025]
Therefore, the user terminal authentication device 1 has a function of generating an individual key key3 described later, and distributes the individual key key3 to the user terminal 2i.
[0026]
Here, the range of personal use of the digital work in this embodiment will be described. FIG. 2 is a diagram showing a personal use range of a digital work. According to FIG. 2, in the user terminal 2i that is connected and authenticated under each user terminal authentication device 1i (i = a, b,... N) included in each user, the user is authorized. It is possible to use and reproduce the digital work obtained in the above, and the range of use and duplication is the personal use range of the digital work. Therefore, as shown in FIG. 2, even if the user terminal 2i outside this range is copied and used, it cannot be used, and the rights of the digital work are sufficiently protected.
[0027]
Further, the user terminal authentication device 1 can communicate with the user certification device 3 via the computer network 4, so that the user certification device 3 can be a legitimate user of the right protection system 10. It is guaranteed to be.
[0028]
When the user terminal 2i is authenticated by the user terminal authentication apparatus 1, the above-described usage range is clarified using an authentication database (hereinafter referred to as an authentication DB) 11. FIG. 4 shows a specific example of the DB configuration of the authentication DB 11. According to FIG. 4, the authentication DB 11 is connected to the user identification information that can identify the individual user and the user certification device 3. Is managed, user terminal information related to the authenticated user terminal 2i, and license information of the digital work to be used, and the terminal ID of the user terminal 2i uniquely identifies the record in the authentication DB 11. This is identification information to be determined.
[0029]
The user terminal 2i is capable of mutual communication with the user authentication terminal device 1 via a wired or wireless computer network 6, and is a terminal for viewing a digital work owned by the user. Computers, video terminals, music playback terminals, etc. Then, by performing terminal authentication with the above-described user terminal authentication device 1, the digital work can be freely used at the user terminal 2i.
[0030]
The digital work used in the user terminal 2i is distributed in the right protection system 10 with the configuration of the digital work d10 as shown in FIG. The digital work d10 includes an encrypted digital work body (hereinafter also referred to as a rights-protected digital work) d11 and a work decryption key key2 for decrypting the digital work body d11. And a decryption key storage unit d12 encrypted by.
[0031]
Here, the digital work body d11 is obtained by encrypting a reproducible digital work d1 (digital work before encryption) with a work encryption key key1, and the individual key key3 is: It is generated in the user terminal authentication device 1 and is a common key that can be encrypted and decrypted with the same key. The literary work encryption key key1 and the literary work decryption key key2 are different for each digital work, and the individual key key3 is information unique to each user terminal authentication device 1 (for example, use The user terminal authentication apparatus 1 is a key that is different for each user terminal authentication apparatus 1. Furthermore, the rights protection of the digital work d11 may be performed using a conventional general rights protection technology.
[0032]
Note that the individual key key3 is not generated from the information unique to the user terminal authentication device 1 as described above, but the user-specific information transmitted from the user certification device 3 (stored in the customer management DB 5). May be generated based on the customer information). Further, in order to further enhance the security of the personal possession key key3, the individual key key3 may be generated in consideration of the device ID and user-specific information transmitted from the user certification device 3.
[0033]
The user certification device 3 includes a communication line (telephone network, optical fiber network, ADSL network, etc.) of the computer network 4 connecting the user terminal authentication device 1 and the user certification device 3, from the user terminal authentication device 1. Based on the transmitted user information and the customer information stored in the customer management DB 5, the user is identified for each user terminal authentication device 1 and the legitimacy of the user who uses the right protection system 10 is proved. Device.
[0034]
The customer management DB 5 is a database that stores customer information used when the user certification device 3 proves the legitimacy of the user. For example, the customer management DB 5 has a DB configuration as shown in FIG. It is what you are doing. The customer management DB 5 shown in FIG. 5 includes a telephone number, a contractor name, a user name, a contact number, a withdrawal account, a user terminal authentication device for each line ID (identification number for uniquely determining the communication line described above). Information on one device ID is managed.
[0035]
The above-described user terminal authentication device 1, user terminal 2i, and user certification device 3 are a central processing unit (CPU) having at least a calculation function and a control function, and a RAM having a function for storing programs and data. The electronic device has a main storage device (memory) composed of the above.
[0036]
Next, the operation of the right protection system 10 according to the present embodiment will be described for each process with reference to FIGS. Here, FIG. 6 is a sequence diagram for explaining the cooperation processing between the user terminal authentication device 1 and the user certification device 3, and FIG. 7 shows the cooperation processing between the user terminal authentication device 1 and the user terminal 2i. FIG. The process shown in FIGS. 6 and 7 is a pre-process that is necessary for the user to use the right protection system 10. 8 to 10 are diagrams for explaining the use of the right protection system 10, that is, the use of the digital work in the user terminal 2i.
[0037]
(1) Cooperation processing between the user terminal authentication device 1 and the user certification device 3
In order for the user terminal authentication device 1 to be able to use the right protection system 10, it is necessary to register user terminal authentication device information in the user certification device 3 and to issue a certificate. Hereinafter, a cooperation process between the user terminal authentication device 1 and the user certification device 3 will be described.
[0038]
First, the user terminal authentication device 1 connects to the user certification device 3 via the computer network 4 (steps S10 and S20). This is connected to the user certification device 3 based on the address of the user certification device 3 stored in the authentication DB 11 of the user terminal authentication device 1 (note that the initial state of the user terminal authentication device 1 is In the state, information related to the device ID and the address of the user certification device 3 is already stored in the authentication DB 11. Also, information specifying the user such as name and address is registered in the authentication DB 11 by the user. And).
[0039]
Next, since the user certification device 3 that has received the connection request from the user terminal authentication device 1 requests user information from the user terminal authentication device 1, the user terminal authentication device 1 receives this request. The user information is transmitted to the user certification device 3 (steps S30 to S60). This user information is information relating to the name and address stored in the authentication DB 11.
[0040]
Next, the user certification device 3 receives the user information received from the user terminal authentication device 1 and the line ID that can be automatically acquired during connection with the user terminal authentication device 1, and authenticates this information. Is confirmed (steps S70 and S80). This obtains corresponding customer information data from the customer management DB 11 according to the line ID, and checks whether the customer information and the user information received from the user terminal authentication device 1 match (step). S90, S100).
[0041]
When the user information is correct, the user certification device 3 requests the user terminal authentication device information from the user terminal authentication device 1, and the user terminal authentication device 1 responds to the authentication DB 11 accordingly. The stored device ID is transmitted as user terminal authentication device information (steps S110, S120, S150 to S170).
[0042]
On the other hand, when the user information is not correct, the user certification device 3 transmits a message indicating that the right protection system 10 cannot be used to the user terminal authentication device 1 (steps S110 to S140).
[0043]
Next, the user certification device 3 that has received the device ID reflects the device ID in the corresponding customer information data in the customer management DB 5 (steps S180 to S210). When a user terminal information registration completion notification is received from the customer management DB 5, a certificate as a registration end notification is issued and transmitted to the user terminal authentication device 1 (steps S220 to S240).
[0044]
The user terminal authentication device 1 that has received the certificate reflects the date and time when the certificate is received in the latest linkage date and time of the authentication DB 11, thereby enabling its own device and exchanging with the user certification device 3. Is terminated (steps S260 to S280).
[0045]
Therefore, according to the right protection system 10 of the present embodiment, the user terminal authentication device 1 transmits user information to the user certification device 3, and the user certification device 3 stores the user information and the customer management DB. Since the legitimacy of the user is proved from the stored customer information and the user terminal authentication device 1 is validated after the certification, the user terminal authentication device 1 possessed by the legitimate user uses the right protection system 10. Is possible.
[0046]
(2) Cooperation processing between user terminal authentication device 1 and user terminal 2i
Next, in order for the user terminal 2 i to be able to use the right protection system 10, it is necessary to register user terminal information in the user terminal authentication device 1. Hereinafter, the cooperation process between the user terminal authentication device 1 and the user terminal 2i will be described. For example, the case where the user terminal 2i newly purchased by the user is registered in the user terminal authentication apparatus 1 will be described.
[0047]
First, the user terminal 2i connects to the user terminal authentication device 1 via the computer network 6 (steps S310 and S320).
[0048]
Next, since the user terminal authentication device 1 that has received the connection request from the user terminal 2i requests user terminal information from the user terminal 2i, the user terminal 2i receives the request and receives the user terminal information. Information is transmitted to the user terminal authentication device 1 (steps S330 to S360). This is to transmit the terminal ID of the user terminal 2i (identification information for uniquely determining the user terminal 2i) as user terminal information.
[0049]
The user terminal authentication device 1 that has received the user terminal information (terminal ID), when confirming the user terminal information, requests to transmit the individual key key3 held in the user terminal 2i ( Steps S370 to S390). Here, the confirmation of the user terminal information means whether or not the received user terminal information is information related to the new user terminal 2i from the data stored in the authentication DB 11 based on the terminal ID. To do.
[0050]
Since the user terminal 2i is not yet used in the right protection system 10, the individual key non-holding information that the individual key key3 is not held is transmitted to the user terminal authentication device 1 (steps S400 and S410). . This is because the user terminal 2i has an individual key storage area in which only one individual key key3 can be stored on the terminal, but in the initial state, key information is stored in this individual key storage area. Since the null data is stored (the null data is stored), the null data is transmitted as individual key non-holding information.
[0051]
Next, when receiving the individual key non-retention information, the user terminal authentication device 1 confirms the individual key non-retention information, reflects the terminal ID received in step S370 in the authentication DB 11, and requests the individual key deletion. Is transmitted to the user terminal 2i (steps S420 to S450).
[0052]
Upon receiving the individual key deletion request, the user terminal 2i deletes the individual key and transmits a deletion completion notification to the user terminal authentication device 1 (steps S460 and S470). Here, since the user terminal 2i does not store the key information in the individual key storage area, it is not necessary to delete the key information in this case, but the individual key information remains in the user terminal 2i due to some accident. In this case, the deletion process is performed as a coping method.
[0053]
Next, the user terminal authentication device 1 that has received the individual key deletion completion notification transmits the personal key key3 generated by itself to the user terminal 2i, and the individual key key3 has already been issued. The fact that the terminal 2i has been authenticated is reflected in the authentication DB 11 (steps S480 to S500).
[0054]
On the other hand, when the user terminal 2i receives the individual key key3, the user terminal 2i overwrites and saves the individual key key3 in the individual key storage area, and thereafter uses the digital work using the individual key key3. (Steps S510 to S530).
[0055]
In the above-described cooperation processing between the user terminal authentication device 1 and the user terminal 2i, all the authentication processing of the user terminal 2i is automated, but a confirmation operation by the user may be put in the middle of the processing. Good. In this case, in the user terminal information confirmation step in step S380, the user terminal authentication device 1 notifies the user that there is a registration request from the user terminal 2i (for example, electronic communication such as electronic mail). (Depending on the tool), after the user's permission, the subsequent processing is continued. Thereby, compared with the case of an automation process, the improvement of security can be aimed at more.
[0056]
Moreover, although the cooperation process of the user terminal authentication device 1 and the user terminal 2i described above has been described as a specific example in which a newly purchased user terminal 2i is registered in the user terminal authentication device 1, a right has already been obtained. Even when the user terminal 2i used in the other person's personal use range of the protection system 10 is moved to the own personal use range, the processing flow shown in FIG. 7 is executed.
[0057]
However, when the user terminal 2i that has already been used in another person's personal range of the right protection system 10 is moved to his / her own personal range, the user terminal 2i already has another personal key key3. Therefore, in step S410, the individual key key3 is transmitted instead of the non-held information as described above, and the held individual key key3 is deleted in step S470. Further, in step S430, the user terminal authentication device 1 confirms that the user terminal authentication device 1 is different from its own individual key key3, so that it is possible to grasp that the user terminal 2i has been moved from another person's personal range.
[0058]
Therefore, in the right protection system 10 of the present embodiment, the user terminal 2 i transmits user terminal information to the user terminal authentication device 1, and the user terminal authentication device 1 stores the user terminal information and the authentication DB 11. If it is confirmed from the stored information that the user terminal is a new terminal, the personal key generated by the user is transmitted to the user terminal 2i, so that the user terminal 2i having the personal key key3 The right protection system 10 can be used.
[0059]
Further, the individual key key3 is generated for each user terminal authentication apparatus 1 and functions only in the user's personal use range, so that the rights of digital works can be protected. Furthermore, even if the user terminal 2i is moved from another personal use range, the user terminal 2i has the function of transmitting and deleting the personal key key3 held by the user terminal 2i. Can be used.
[0060]
(3) Use of rights protection system 10
First, acquisition of a digital work will be described. Regarding acquisition of digital works, acquisition from works recorded in hardware and acquisition via a computer network can be considered, and each case will be described below.
[0061]
FIG. 8A is a diagram showing an acquisition process from a literary work recorded in hardware. Here, acquisition from the work recorded on the hardware means that the digital work d1 stored in the recording medium is duly copied using the user terminal 2i and the electronic processing of the user terminal 2i is performed. This means that the digital work d10 is generated using the function 900 and the individual key key3.
[0062]
More specifically, the digital work d1 recorded in hardware is an electronic processing function 900 (which applies a conventional digital copyright protection mechanism. Note that the conventional digital copyright protection mechanism and The encrypted digital work d11 and the work decryption key key2 for decrypting the encrypted digital work d11 are provided to the user. The digital work main body d11 encrypted in the part 902 and a work decryption key key2 for decrypting the digital work d11 are generated.
[0063]
Next, the decryption key protection processing unit 101 encrypts the copyrighted work decryption key key2 using the individual key key3 transmitted from the user terminal authentication device 1 to obtain a decryption key storage unit d12.
[0064]
Finally, in the final processing unit 102, the digital work body d11 and the decryption key storage unit d12 are combined to generate one digital work d10. Thereby, the digital work d10 that can be distributed by the right protection system 10 can be acquired.
[0065]
FIG. 8B is a diagram showing acquisition processing via a computer network. Here, the acquisition via a computer network is a digital work sold via the Internet network or the like (applying a conventional copyright protection mechanism for a digital work. This means the copyrighted work decryption key key2 (assuming that the digital work sold via the computer network is protected on the right) and the user terminal 2i holds the personalized It means generating a digital work d10 using the key key3.
[0066]
More specifically, when the digital work body d11 and the work decryption key key2 are acquired via the computer network, the decryption key protection processing unit 101 uses the individual key key3 transmitted from the user terminal authentication device 1 to create the work. The decryption key key2 is encrypted and used as the decryption key storage unit d12.
[0067]
Then, in the final processing unit 102, the digital work body d11 and the decryption key storage unit d12 are combined to generate one digital work d10. Thereby, the digital work d10 that can be distributed by the right protection system 10 can be acquired. That is, in the case of acquisition via a computer network, it is not necessary to perform a copy process and a protection process for the digital work d1 as compared to the case of acquisition from a work recorded on hardware.
[0068]
The above-described processing related to acquisition of a digital work is performed by the user terminal 2i. However, the user terminal authentication apparatus 1 may include this function and perform processing related to acquisition of a digital work. Good. In this case, the user terminal authentication device 1 can manage digital works in a unified manner.
[0069]
Next, a case where the digital work obtained in this way is used will be described. FIG. 9 is a diagram showing a digital work use process.
[0070]
First, the user terminal 2i separates the acquired digital work d10 into a digital work body d11 and a decryption key storage unit d12 in the work pre-processing unit 103.
[0071]
Next, the decryption key extraction unit 104 decrypts the separated decryption key storage unit d12 using the individual key key3 to obtain the literary work decryption key key2.
[0072]
Finally, the decryption unit 105 decrypts the digital work main body d11 using the work decryption key key2, generates a reproducible digital work d1, and reproduces (views) the digital work d1. .
[0073]
The above-described digital work use process is the same because the same digital key key3 is used for decryption even when the digital work is acquired from another user terminal 2i within the personal use range. It has an effect. Here, in the case of acquiring a digital work from another user terminal 2i within the personal use range, for example, the digital work is copied from the user terminal 2a shown in FIG. 2 to the user terminal 2b. This is the case.
[0074]
Therefore, according to the right protection system 10 of the present embodiment, the digital work can be freely copied and used while securing the right protection between the user terminals 2i within the personal use range.
[0075]
When the digital work d10 is managed in the user terminal authentication apparatus 1, in addition to the above-described processing, a process for copying the digital work d10 to the user terminal 2i is required in advance.
[0076]
FIG. 10 is a diagram illustrating a process in a case where the digital work d10 is acquired from another user terminal 2i outside the personal use range and the digital work d10 is used. Here, when acquiring a digital work from another user terminal 2i outside the personal use range, for example, the digital work is copied from the user terminal 2g shown in FIG. 2 to the user terminal 2a. This is the case.
[0077]
Even in this case, the same flow as the process shown in FIG. 9 is followed, but the decryption key extraction unit 104 cannot decrypt the decryption key storage unit d12. This is because the decryption key storage unit d12 is not encrypted with its own individual key key3. If the decryption fails, the decryption key reacquisition unit 106 prompts the user to obtain a regular work decryption key key2 via the computer network. This urges a person who sells digital works over a computer network to purchase rights for the digital works. It should be noted that the processing after acquisition when the copyrighted work decryption key “key2” is acquired through such digital copyrighted right purchase processing is the same as the copyrighted work use processing shown in FIG.
[0078]
Therefore, according to the right protection system 10 of the present embodiment, there is an effect that the digital work cannot be used when the digital work outside the personal use range is used. In addition to this, since formal purchase can be promoted, there is an effect that a digital work can be used when a right is purchased.
[0079]
In addition, operation | movement of the user terminal authentication apparatus 1 of the said embodiment is implement | achieved by running the program stored in the user terminal authentication apparatus 1. FIG. This program can be recorded on a computer-readable recording medium such as a flexible disk, CD-ROM, MO, DVD-ROM as well as a hard disk, or can be distributed via a communication network.
[0080]
While the embodiments of the present invention have been described above, various modifications and changes can be made to the embodiments of the present invention without departing from the spirit of the present invention. For example, in the right protection system 10 of the above-described embodiment, the user terminal authentication device 1 must have the user certification device 3 prove that it is a valid user. If the user who purchases or lends can be authenticated at the time when the authentication device 1 is purchased or lent, the right comprising the user terminal authentication device 1 and the user terminal 2i without using the user certification device 3 A protection system can be established.
[0081]
In the right protection system 10 of the above embodiment, the number of user terminals authenticated by the user terminal authentication device 1 is not limited. However, in order to make the prevention of unauthorized use more strict, The user terminal authentication apparatus 1 may limit the number of user terminals that are authenticated. In this case, the user terminal authentication device 1 stores a predetermined key issuance limit number, and if it is equal to or less than the key issuance limit number, the user terminal 2i can be freely registered and the personal possession key It can be issued.
[0082]
【The invention's effect】
As described above, according to the present invention, it is possible to provide a user terminal authentication device and a user terminal authentication program for improving the convenience of using a digital work while ensuring the protection of the rights of the digital work. Therefore, it is possible to promote the distribution of digital works.
[Brief description of the drawings]
FIG. 1 is a schematic configuration diagram of a right protection system according to an embodiment of the present invention.
FIG. 2 is a diagram for explaining a personal use range in which a digital work can be used in the right protection system according to the embodiment of the present invention.
FIG. 3 is a diagram illustrating a configuration of a digital work in the right protection system according to the embodiment of the present invention.
FIG. 4 is a diagram illustrating a configuration of an authentication DB in the right protection system according to the embodiment of the present invention.
FIG. 5 is a diagram illustrating a configuration of a customer management DB in the right protection system according to the embodiment of the present invention.
FIG. 6 is a sequence diagram illustrating user registration processing of the right protection system according to the embodiment of the present invention.
FIG. 7 is a sequence diagram illustrating user terminal registration processing of the right protection system according to the embodiment of the present invention.
FIG. 8 is a diagram for explaining acquisition of a digital work in the right protection system according to the embodiment of the present invention.
FIG. 9 is a diagram for explaining reproduction of a digital work in the right protection system according to the embodiment of the present invention.
FIG. 10 is a diagram for explaining reproduction of a digital work obtained from outside the personal use range in the right protection system according to the embodiment of the present invention.
[Explanation of symbols]
1 User terminal authentication device
2i user terminal
3 User certification device
4 Computer network
5 Customer management DB
10 Rights protection system
11 Authentication DB
101 Decryption key protection processing unit
102 Final processing section
103 Copyright Pre-Processing Department
104 Decryption key extraction unit
105 Decryption unit
106 Decryption key reacquisition unit
900 Commercial system application section
901 Replication processing unit
902 Protection processing unit
d1 Digital works
d10 Digital works in circulation
d11 Digital work body
d12 Decryption key storage unit
key2 Work decryption key
key3 Private key

Claims (12)

Information about a customer who is connected to one or a plurality of user terminals for viewing a digital work via a first computer network and who uses the second computer network. A user terminal authentication device connected to a user certification device comprising a stored customer information storage means,
User information transmitting means for transmitting information about a user who uses the user terminal to the user certification device via the second computer network;
The user certification device authenticates the user based on the information about the user and the information about the customer, and sends a user certificate to be transmitted when the authentication is successful, to the second computer network. A certificate receiving means for receiving via
Device validation means for validating the use of the user terminal authentication device by receiving the user certificate;
Individual key generation means for generating an individual key for encrypting a work decryption key for decrypting the encrypted digital work as a common key based on information uniquely defining the user terminal authentication device; ,
User terminal information receiving means for receiving, via the first computer network, user terminal identification information that uniquely defines the user terminal from the user terminal;
When the user terminal is authenticated based on the user terminal identification information, the individual key is transmitted to the user terminal that has transmitted the user terminal identification information via the first computer network. Personal key transmission means to perform,
Have
When the user terminal obtains the encrypted digital work and the decryption key storage unit obtained by encrypting the work decryption key with the individual key, the user terminal authenticating device transmits the User terminal authentication characterized in that the decryption key storage unit is decrypted using a personal key, and the digital work encrypted using the decrypted work decryption key is decrypted and played back apparatus. The user certification device is:
In accordance with the line identification information of the second computer network acquired when the user terminal authentication device and the user certification device are connected, the customer information storage means is searched for the information related to the customer, and the search is performed. The user terminal authentication apparatus according to claim 1, wherein the user authentication is performed by comparing the information related to the customer and the information related to the user. Information that uniquely defines the user terminal authentication device is:
Device identification number of the user terminal authentication device, user identification information for identifying the user stored in the customer information storage means transmitted from the user certification device, or the device identification number and the user The user terminal authentication device according to claim 1 or 2, wherein the information includes specific information. A user terminal authentication device connected via a computer network to one or more user terminals for viewing a digital work,
Individual key generation for generating an individual key for encrypting a work decryption key for decrypting the encrypted digital work as a common key based on device identification information that uniquely defines the user terminal authentication device Means,
User terminal information receiving means for receiving, via the computer network, user terminal identification information for uniquely determining the user terminal from the user terminal;
When authenticating the user terminal based on the user terminal identification information, the individual key that transmits the individual key via the computer network to the user terminal that has transmitted the user terminal identification information A key transmission means;
Have
When the user terminal obtains the encrypted digital work and the decryption key storage unit obtained by encrypting the work decryption key with the individual key, the user terminal authenticating device transmits the User terminal authentication characterized in that the decryption key storage unit is decrypted using a personal key, and the digital work encrypted using the decrypted work decryption key is decrypted and played back apparatus. The individual key transmission means includes:
When the user terminal is authenticated, the user terminal is requested to transmit the individual key held in the user terminal, and when the individual key held from the user terminal is received, the user terminal holds Requesting deletion of the individual key to be received, and receiving a personal key deletion completion notification from the user terminal, the personal key is sent to the user terminal that has transmitted the user terminal identification information. The user terminal authentication device according to claim 1, wherein the user terminal authentication device transmits the user terminal. The individual key transmission means includes:
6. The personal key is transmitted when the number of authentications of the user terminal is equal to or less than a key issuance limit number stored in the user terminal authentication device. The user terminal authentication device according to claim 1. Information about a customer who is connected to one or a plurality of user terminals for viewing a digital work via a first computer network and who uses the second computer network. A user terminal authentication program in a user terminal authentication device connected to a user certification device comprising a stored customer information storage means,
A user information transmission step of transmitting information about a user who uses the user terminal to the user certification device via the second computer network;
The user certification device authenticates the user based on the information about the user and the information about the customer, and sends a user certificate to be transmitted when the authentication is successful, to the second computer network. A certificate receiving step for receiving via:
A device enabling step for enabling the use of the user terminal authentication device by receiving the user certificate;
An individual key generation step for generating an individual key for encrypting a work decryption key for decrypting the encrypted digital work as a common key based on information uniquely defining the user terminal authentication device; ,
A user terminal information receiving step for receiving, via the first computer network, user terminal identification information for uniquely determining the user terminal from the user terminal;
When the user terminal is authenticated based on the user terminal identification information, the individual key is transmitted to the user terminal that has transmitted the user terminal identification information via the first computer network. Personal key sending step,
To the user terminal authentication device,
When the user terminal obtains the encrypted digital work and the decryption key storage unit obtained by encrypting the work decryption key with the individual key, the user terminal authenticating device transmits the User terminal authentication characterized in that the decryption key storage unit is decrypted using a personal key, and the digital work encrypted using the decrypted work decryption key is decrypted and played back program. The user certification device is:
In accordance with the line identification information of the second computer network acquired when the user terminal authentication device and the user certification device are connected, the customer information storage means is searched for the information related to the customer, and the search is performed. 8. The user terminal authentication program according to claim 7, wherein the user authentication is performed by comparing the information related to the customer and the information related to the user. Information that uniquely defines the user terminal authentication device is:
Device identification number of the user terminal authentication device, user identification information for identifying the user stored in the customer information storage means transmitted from the user certification device, or the device identification number and the user 9. The user terminal authentication program according to claim 7 or 8, wherein the user terminal authentication program includes specific information. A user terminal authentication program in a user terminal authentication device connected via a computer network to one or more user terminals for viewing a digital work,
Individual key generation for generating an individual key for encrypting a work decryption key for decrypting the encrypted digital work as a common key based on device identification information that uniquely defines the user terminal authentication device Steps,
A user terminal information receiving step for receiving user terminal identification information uniquely defining the user terminal from the user terminal via the computer network;
When authenticating the user terminal based on the user terminal identification information, the individual key that transmits the individual key via the computer network to the user terminal that has transmitted the user terminal identification information A key transmission step;
To the user terminal authentication device,
When the user terminal obtains the encrypted digital work and the decryption key storage unit obtained by encrypting the work decryption key with the individual key, the user terminal authenticating device transmits the User terminal authentication characterized in that the decryption key storage unit is decrypted using a personal key, and the digital work encrypted using the decrypted work decryption key is decrypted and played back program. The individual key transmission step includes:
When the user terminal is authenticated, the user terminal is requested to transmit the individual key held in the user terminal, and when the individual key held from the user terminal is received, the user terminal holds Requesting deletion of the individual key to be received, and receiving a personal key deletion completion notification from the user terminal, the personal key is sent to the user terminal that has transmitted the user terminal identification information. It transmits, The user terminal authentication program of any one of Claims 7 thru | or 10 characterized by the above-mentioned. The individual key transmission step includes:
12. The individual key is transmitted when the number of authentications of the user terminal is equal to or less than a key issuance limit number stored in the user terminal authentication device. The user terminal authentication program according to claim 1.

Images