JP2005277951A - System and method for authentication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system capable of preventing use of content illegally distributed from a portion of a plurality of right holders having the right for the one content. <P>SOLUTION: An authentication station 2 decides whether the entire right holders permit to use the content by referring to a use permission storage 24 (S47), and only when it is decided that the entire right holders permit the use of the content, the public key is read out from a right holder information storage 21 and transmitted to a content use apparatus 3 (S51). Thus, it becomes possible to prevent use of the content illegally distributed from the portion of the plurality of right holders, preventing the occurrence of right infringement among the right holders. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an authentication system and an authentication method capable of preventing content illegally distributed by a part of a plurality of right holders having one content right from being used.

  In recent years, with the development of so-called broadband distribution technology, high-quality digital content can be distributed quickly and widely, but the rights of the right holder can be infringed by unauthorized use of content. It is increasing.

In order to prevent such illegal use of content, for example, an approach using a copyright protection technique as disclosed in Patent Document 1 has been made.
JP-A-11-265317

  However, when there are a plurality of right holders having the right of one content, not only illegal use of the content as described above but also rights infringement between the right holders may occur.

  That is, some rights holders distribute content without obtaining permission from other rights holders, and the use of this content causes an illegal act such that some rights holders receive compensation.

  There is currently no countermeasure against this, and so there is no choice but to leave it to the legal response after fraud.

  In other words, unauthorized use of content by a person who is not the right holder is handled by copyright protection technology, but it is possible to deal with use of content illegally distributed by some of the right holders. Not done.

  The present invention has been made in view of the above circumstances, and an authentication system and an authentication method that can prevent content illegally distributed by a part of a plurality of right holders having one content right from being used. The purpose is to provide.

  In order to achieve the above object, the present invention as set forth in claim 1 is directed to a content use device that uses a content when there are a plurality of rights holders having the right of one content, and a public key of each rights holder. An authentication system connected via a communication line, wherein the content using device includes one certificate authority certificate for certifying the validity of the public keys of all of the plurality of right holders, and the Public key requesting means for requesting a public key for verifying the electronic signature to the certificate authority when using the content provided with the electronic signature obtained by encrypting the digest of the content with the private key of the right holder; An electronic signature verification unit that attempts to verify the electronic signature with a public key transmitted from a certificate authority; and a content use unit that uses content when the electronic signature is verified The certificate authority includes a key storage means for storing the public key of each right holder, and a certificate authority certificate issuance for generating the certificate authority certificate and transmitting it to the content right holder device corresponding to each right holder Means, storage means for storing whether each right holder permits the use of the content, and when the public key is requested from the content use device, refer to the use availability storage means. A use permission determining unit that determines whether or not all right holders permit the use of the content, and a public key from the key storage unit when it is determined that all right holders permit the use of the content. And a public key transmitting means for reading out the information and transmitting it to the content using apparatus.

  According to the present invention of claim 2, there is provided a communication line between a content use apparatus that uses the content when there are a plurality of right holders having the right of one content and a certificate authority that manages the public key of each right holder. Is an authentication method connected via an authentication system, wherein the public key of each right holder is stored in a key storage means provided in the certificate authority, and each right holder permits use of the content When the information on whether or not is stored in the availability determination unit provided in the certification authority, the content utilization device includes one certification authority certificate that proves the validity of all the public keys of the plurality of right holders, and When using content to which an electronic signature obtained by encrypting a digest of the content with a private key of a right holder is used, a public key for verifying the electronic signature is requested to the certificate authority, When the public key is requested, the certificate authority refers to the availability storage means to determine whether all right holders are permitted to use the content, and all right holders are allowed to use the content. If it is determined that permission is granted, the public key is read from the key storage means and transmitted to the content using device, and the content using device attempts to verify the electronic signature with the public key transmitted from the certificate authority. The solution is an authentication method characterized in that the content is used when the electronic signature can be verified.

  According to the third aspect of the present invention, each content right holder device corresponding to each of a plurality of right holders having one content right and a certificate authority that manages the public key of each right holder are connected via a communication line. In the connected authentication system, each content right holder device generates a key pair including a private key and a public key of a right holder corresponding to the content right owner device, and at least the public key is transmitted to the certificate authority. Corresponding to the key pair generating means to be transmitted, the use permission notifying means for notifying the certificate authority whether or not the right holder corresponding to the content right holder device permits the use of the content, and the content right holder device An electronic signature providing means for giving the content an electronic signature obtained by encrypting the content digest with the private key of the right holder, and the validity of the public keys of all of the plurality of right holders A certificate authority certificate granting means for granting one certificate authority certificate to the content, the certificate authority storing a public key transmitted from each content right holder device, and the authentication A certificate authority certificate issuance means for generating an authority certificate and transmitting it to each content right holder device; a use availability storage means for storing whether or not each right holder is permitted to use the content; and the electronic signature And the use permission storage means when a public key for verifying an electronic signature is requested from the content using device when the content provided with the certificate authority certificate is used in the content using device that uses the content. To determine whether all right holders are permitted to use the content, and to determine whether all right holders are permitted to use the content. If it is a constant, and solutions with the authentication system characterized in that it comprises a public key transmission unit that transmits to the content utilization apparatus reads the public key from the key storage unit.

  According to the present invention of claim 4, each content right holder device corresponding to each of a plurality of right holders having one content right and a certification authority that manages the public key of each right holder are connected via a communication line. An authentication method in a connected authentication system, wherein each content right holder device generates a key pair composed of a private key and a public key of a right holder corresponding to the content right owner device, and at least the public key is The certificate authority stores the public key transmitted from each content right holder device in the key storage means provided in the certificate authority, and the validity of the public keys of all of the plurality of right holders One certificate authority certificate that certifies the content right is generated and transmitted to each content right holder device, and each content right holder device has the right holder corresponding to the content right owner device The certificate authority stores whether or not each right holder permits the use of the content in a use availability storage means provided in the certificate authority. Then, each of the content right holder devices adds an electronic signature obtained by encrypting the content digest with the private key of the right holder corresponding to the content right owner device to the content, and uses the certificate authority certificate as the content. The certificate authority assigns a public key for verifying the electronic signature from the content using device when the content provided with the electronic signature and the certificate authority certificate is used in the content using device that uses the content. When requested, it is determined whether or not all right holders are permitted to use the content by referring to the availability storage means. When it is determined to be permitted, and solutions with the authentication method and transmits to the content utilization apparatus reads the public key from the key storage unit.

  The present invention of claim 5 manages each content right holder device corresponding to each of a plurality of right holders having one content right, a content use device that uses the content, and a public key of each right holder. Each content right holder device generates a key pair composed of a private key and a public key of the right holder corresponding to the content right owner device. A key pair generating means for transmitting at least the public key to the certificate authority, and a use permission notification for notifying the certificate authority whether or not the right holder corresponding to the content right holder apparatus permits the use of the content. And an electronic signature granting means for giving the content an electronic signature obtained by encrypting the content digest with the private key of the rights holder corresponding to the content rights holder device And certificate authority certificate granting means for granting to the content one certificate authority certificate that proves the validity of the public keys of all of the plurality of right holders, and the content using device includes the electronic signature and the certificate authority A public key requesting unit that requests the certificate authority for a public key for verifying the electronic signature when using the content to which the certificate is attached, and the public key transmitted from the certificate authority A digital signature verification unit that attempts verification; and a content use unit that uses content when the digital signature can be verified, wherein the certificate authority stores a public key transmitted from each content right holder device Storage means, certificate authority certificate issuing means for generating the certificate authority certificate and transmitting it to each content right holder device, and whether each right holder permits the use of the content Use / non-use storage means for storing, and use of determining whether or not all right holders are permitted to use the content by referring to the use / non-use storage means when a public key is requested from the content use device And a public key transmission unit that reads a public key from the key storage unit and transmits the public key to the content utilization device when it is determined that all right holders permit the use of the content. The authentication system to be used as a solution means.

  The present invention of claim 6 manages each content right holder device corresponding to each of a plurality of right holders having one right of content, a content use device that uses the content, and a public key of each right holder. An authentication method in an authentication system connected to a certification authority via a communication line, wherein each content right holder device is a key pair comprising a secret key and a public key of a right holder corresponding to the content right holder device And at least the public key is transmitted to the certificate authority, and the certificate authority stores the public key transmitted from each content right holder device in a key storage unit provided in the certificate authority, The content right holder apparatus notifies the certificate authority whether or not the right holder corresponding to the content right owner apparatus permits the use of the content, and the certificate authority One certificate authority certificate that stores whether or not the user is permitted to use the content in the availability storage means provided in the certificate authority, and proves the validity of the public keys of all of the plurality of right holders Is generated and transmitted to each content right holder device, and one of the content right owner devices adds an electronic signature obtained by encrypting the content digest with the private key of the right holder corresponding to the content right owner device to the content. And granting the certificate authority certificate to the content, and when the content using apparatus uses the content to which the electronic signature and the certificate authority certificate are used, a public key for verifying the electronic signature is provided. Requesting the certificate authority, and when the certificate authority is requested, the certificate authority refers to the availability determination unit to determine whether or not all right holders are permitted to use the content. The certificate authority reads the public key from the key storage unit and transmits the public key to the content utilization device when it is determined that all rights holders permit the use of the content, and the content utilization device An attempt is made to verify the electronic signature with the public key transmitted from the station, and the content using apparatus uses the content when the electronic signature can be verified as a resolution means.

  The authentication system according to any one of claims 1, 3, and 5, wherein the availability determination unit makes a determination with reference to the updated availability storage unit. Is the solution.

  The present invention according to claim 8 is characterized in that the certificate authority determines whether or not all right holders are permitted to use the content with reference to the updated availability determination unit. The authentication method according to any one of Items 2, 4, and 6 is used as a solving means.

  According to the authentication system and the authentication method of the present invention, it is determined whether or not all rights holders permit the use of content by referring to the availability storage means, and all rights holders permit the use of content. Only when it is determined that the public key is read from the key storage means and transmitted to the content use device, the content illegally distributed by a part of the right holder is used and the rights infringement occurs between the right holders. Can be prevented. Thereby, as a result, it is possible to improve the reliability between the right holder and the content user, and thus it is possible to promote the distribution of the content.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing a configuration of an authentication system according to an embodiment of the present invention. Here, the configuration and operation of one content C that is owned by a plurality of right holders will be described. However, since the content is managed by a content ID uniquely indicating this, the same configuration is applied to other content. It can be prepared and operated in the same way.

  1, each content right holder device 1, 1,..., 1 is a computer managed by each of a plurality of right holders (for example, content creators) who have the right of content C. Note that it is possible to process two or more right holders with one content right holder apparatus 1.

  The certificate authority 2 has a right holder ID that uniquely indicates each right holder, a key pair of the right holder, a certificate authority certificate CF that proves the validity of the public key of all right holders, and each right holder uses the content C. It is a computer that manages whether or not it is permitted.

  The content utilization device 3 is a device that uses the content transmitted from the content right holder device 1. For example, if the content is music data, the content utilization device 3 is a device that reproduces music from the music data.

  The authentication system of the present embodiment is configured by connecting each content right holder device 1, the certificate authority 2, and the content using device 3 via a network 4.

  FIG. 2 is a block diagram showing the configuration of each content right holder device 1.

  The content right holder device 1 generates a key pair composed of a content storage unit 11 for storing the content C and a secret key and a public key of the right owner who manages the content right owner device 1 and transmits the key pair to the certificate authority 2 The pair generation unit 12, the certificate authority certificate storage unit 13 that stores the certificate authority certificate CF transmitted from the certificate authority 2, and whether or not the right holder permits the use of the content to the certificate authority 2. A notification unit 14 for notifying availability, a right holder ID giving unit 15 for giving a right holder ID to the content C, and a digital signature giving unit 16 for giving a digital signature obtained by encrypting the digest of the content C with a secret key to the content C. And a certificate authority certificate grant unit 17 that grants the certificate authority certificate CF to the content C.

  FIG. 3 is a block diagram showing the configuration of the certificate authority 2.

  The certificate authority 2 includes a right holder information storage unit 21 that stores information called right holder information for each right holder of the content C. This right holder information includes a right holder ID of the right holder, a key pair, a right holder name, a right type (detailed copyright information), and the like.

  The certificate authority 2 generates a certificate authority certificate CF that proves the validity of the public keys of all right holders and transmits the certificate authority certificate CF to each content right holder apparatus 1; And a certificate authority certificate storage unit 23 for storing the certificate CF. In this way, the certificate authority 2 does not require a certificate authority certificate that proves the validity of each right holder's public key, so that complicated management is unnecessary, and the burden of management can be reduced. .

  Further, the certificate authority 2 associates each set of the content ID of the content C and each right holder ID and stores whether or not the right holder of the right holder ID permits the use of the content C. When the public key for verifying the electronic signature is requested from the content using device 3 when the content storage device 24, the certificate authority certificate CF, and the content C to which the electronic signature is attached are used in the content using device 3. When it is determined with reference to the availability storage unit 24 that the all right holder has permitted use of the content C, and the use permission determination unit 25 that determines whether all right holders have permitted use And a public key transmitting unit 26 that transmits a public key for verifying the electronic signature to the content using apparatus 3.

  The certificate authority 2 includes the content ID of the content C, the producer information (name, etc.) of the content C, the production related information (production date, production location, etc.) of the content CF, and the outline (title, etc.) of the content C. You may provide the content attribute information storage part 27 which memorize | stores the content attribute information which consists of other information (encoding method, size, etc.) of the content C.

  FIG. 4 is a block diagram illustrating a configuration of the content use device 3.

  The content utilization device 3 receives the content C transmitted from a content right holder device 1 or the like, to which the right holder ID, electronic signature, and certificate authority certificate CF of the right owner who manages the content right owner device 1 are attached. When the content storage unit 31 to be stored and the content C are reproduced, the content ID in the certificate authority certificate CF assigned to the content C and the right holder ID assigned to the content C are transmitted to the certificate authority 2 and are also assigned. The public key request unit 32 that requests a public key for verifying the electronic signature, the electronic signature verification unit 33 that tries to verify the electronic signature with the public key transmitted from the certificate authority 2, and the electronic signature can be verified. A content use unit 34 that sometimes uses the content. Each of these units can be realized by an application program dedicated to this embodiment.

  Next, the operation of the authentication system according to the present embodiment will be described.

  FIG. 5 is a sequence diagram of the authentication system according to the present embodiment.

  First, when the completed content C is stored in the content storage unit 11 of each content right holder device 1, the key pair generation unit 12 includes a key composed of the secret key and the public key of the right holder having the content right holder device 1. A pair is generated (S1). The content right holder device 1 transmits the key pair, the right holder ID of the right holder, the right holder name and right type (detailed copyright information) of the right holder to the certification authority 2 (S3). The right holder information is generated for each right holder from these pieces of information transmitted from each content right holder apparatus 1 and stored in the right holder information storage unit 21 (S5).

  If the secret key is managed by the content creator (right holder), the possibility of losing the secret key increases. However, as in this embodiment, the secret key is centralized by the certificate authority. Such problems can be solved by management.

  Further, in the management of the secret key in the certificate authority, it is possible to prevent the leakage of the secret key by providing a mechanism such as providing a plurality of administrators so that the management authority is not concentrated on one administrator. The reliability and security can be improved.

  Next, the certificate authority certificate issuing unit 22 of the certificate authority 2 includes the content ID in the certificate authority certificate that proves the validity of the public key of all right holders by using digital watermark technology or the like, thereby enabling the certificate authority certificate. A CF is generated and transmitted to each content right holder device 1 (S7). Further, the certificate authority certificate CF is stored in the certificate authority certificate storage unit 23 (S9).

  Next, each content right holder device 1 stores the transmitted CA certificate CF in the CA certificate storage unit 13 (S11).

  Next, by the operation of the right holder who manages each content right holder device 1, the use permission notification unit 14 of the content right holder device 1 determines whether or not the right holder permits the use of the content C. 2 is notified (S21). At this time, the content ID of the content C, the right holder ID of the right holder, and binary information indicating whether the right holder permits the use of the content C are transmitted to the certification authority 2 (S21).

  The certificate authority 2 stores whether or not the right holder of the right holder ID permits the use of the content C in association with the transmitted set of the content ID and the right holder ID in the availability storage unit 24. (S23).

  The use permission storage unit 24 stores, as an initial value, that all right holders do not permit the use of the content C, and a notification is received from the content right holder device 1 of the right holder who permits the use. The right holder may be allowed to use it.

  Next, the content right holder device 1 operated by a certain right holder A (the right owner who manages the content right holder device 1 that has notified the certificate authority 2 that the use of the content C is permitted) The content C is read from the unit 11 (S31), and the right holder ID granting unit 15 assigns the right holder ID of the right holder A to the read content C (S33). Further, the electronic signature giving unit 16 generates a digest (hash value) of the content C, encrypts it with the private key of the right holder A (generates an electronic signature), and gives this electronic signature to the content C (S35). ). The right holder ID and the electronic signature can be attached to the header of the content C or the like.

  Then, the certificate authority certificate assigning unit 17 reads the certificate authority certificate CF from the certificate authority certificate storage unit 13 and assigns it to the content C (S37).

  Thus, the content C to which the right holder ID, the electronic signature, and the certificate authority certificate CF are assigned is temporarily stored in a content server (not shown) in the network 4, for example, and is sent to the content usage device 3 by a request from the content usage device 3. It is transmitted (downloaded) (S39).

  In the content use device 3, the content storage unit 31 stores the content C transmitted with the right holder ID, the electronic signature, and the certificate authority certificate CF (S41).

  Next, the public key request unit 32 extracts the content ID from the certificate authority certificate CF (S43), and transmits the extracted content ID and the right holder ID assigned to the content C to the certificate authority 2, and also assigns them. A public key for verifying the digital signature is requested (S45).

  The use permission determination unit 25 of the certificate authority 2 determines whether or not the use permission storage unit 24 stores that all the combinations of the transmitted content ID and right holder ID are permitted to be used. judge. That is, it is determined whether or not all right holders of the content C are permitted to use (S47).

  Here, if it is determined that at least one right holder does not permit the use, the subsequent processing is not performed, and the content C is not used. Therefore, it is possible to prevent content C that is not permitted to be used by at least one right holder from being used. The prevention of unauthorized use of the content C also has an effect of preventing virus infection when a computer virus is included in the content C.

  On the other hand, when it is determined that all right holders of the content C are permitted to use, the public key transmission unit 26 receives the key stored in the right holder information from the right holder information storage unit 21 together with the transmitted right holder ID. The public key constituting the pair is read (S49), and this public key is transmitted to the content using device 3 (S51).

  The electronic signature verification unit 33 of the content utilization device 3 tries to verify the electronic signature with the transmitted public key (S53), and the content utilization unit 34 uses the content C only when the verification is successful (S55). . Therefore, it is possible to prevent the use of content to which an electronic signature of a person who is not the right holder is attached.

  The certificate authority 2 returns control to step S47 again after a preset time has elapsed.

  Therefore, in the meantime, when the availability storage unit 24 is updated and the availability storage unit 24 stores that all right holders are permitted to use the content C, step S45 is performed. Even if not, Steps S49 to 53 are performed, and if the digital signature can be verified in Step S53, the content C is used in Step S55.

  As described above, according to the present embodiment, the content using apparatus 3 that uses the content C when there are a plurality of right holders having the right of one content C, and the public key of each right holder are used. An authentication system in which a certificate authority 2 to be managed is connected via a communication line (network 4), and the content use device 3 has one certificate authority certificate that proves the validity of all public keys of a plurality of right holders. Public key that requests the certificate authority 2 for a public key for verifying the electronic signature when using the content C to which the digital signature obtained by encrypting the digest of the certificate CF and the content C with the private key of the right holder is used A request unit (32), an electronic signature verification unit (33) that attempts to verify the electronic signature with the public key transmitted from the certificate authority 2, and a code that uses the content C when the electronic signature is verified. The certificate authority 2 includes a key storage means (21) for storing the public key of each right holder, and a content right holder corresponding to each right holder by generating the certificate authority certificate CF. A certificate authority certificate issuance means (23) to be transmitted to the apparatus 1; an availability determination means (24) for storing whether or not each right holder is permitted to use the content C; and a public key from the content utilization apparatus 3 , The availability determination unit (25) for determining whether or not all rights holders are permitted to use the content C with reference to the availability storage unit (24), An authentication system comprising: a public key transmission unit that reads a public key from the key storage unit (21) and transmits the public key to the content utilization device 3 when it is determined that the use of the content C is permitted can do.

  In this authentication system, when there are a plurality of right holders having the right of one content C, the content use device 3 that uses the content C and the certificate authority 2 that manages the public key of each right holder communicate with each other. An authentication method in an authentication system connected via a line (network 4), wherein a public key of each right holder is stored in a key storage means (21) provided in the certificate authority 2, and each right holder When the use permission storage means (24) provided in the certification authority 2 stores whether or not the use of C is permitted, the content use device 3 determines whether the public keys of all right holders are valid. When using content C to which one certificate authority certificate CF for proving authenticity and content C's digest obtained by encrypting the digest of content C with the private key of the right holder are used, the digital signature is verified. The certificate authority 2 is requested of the public key for performing the operation (S45), and the certificate authority 2 refers to the availability storage means (24) when the public key is requested, and all right holders use the content C. Is determined (S47), and when it is determined that all right holders permit the use of the content C, the public key is read from the key storage means (21) and transmitted to the content utilization device 3. (S51), the content use device 3 attempts to verify the electronic signature with the public key transmitted from the certificate authority 2 (S53), and uses the content C when the electronic signature is verified (S55). An authentication method can be executed.

  Further, according to the present embodiment, each content right holder device 1 corresponding to each of a plurality of right holders having the right of one content C and the certificate authority 2 that manages the public key of each right holder are provided. In the authentication system connected via a communication line (network 4), each content right holder device 1 generates a key pair composed of a private key and a public key of the right holder corresponding to the content right owner device 1. At least the key pair generating means (12) for transmitting the public key to the certificate authority 2 and whether or not the right holder corresponding to the content right holder device 1 permits the use of the content C to the certificate authority 2 An electronic signature that gives the content C an electronic signature obtained by encrypting the digest of the content C with the secret key of the right holder corresponding to the content right holder device 1 A certificate authority certificate granting means (17), and a certificate authority certificate granting means (17) for granting to the content C one certificate authority certificate CF that proves the validity of the public keys of all of the plurality of right holders. The key storage means (21) for storing the public key transmitted from each content right holder device 1 and the certificate authority certificate issuing means (23) for generating the certificate authority certificate CF and transmitting it to each content right holder device 1 ), Use permission storage means (24) for storing whether each right holder permits the use of the content C, and the content C to which the electronic signature and the certificate authority certificate CF are assigned use the content C. When the content use device 3 requests the public key for verifying the electronic signature when the content use device 3 uses the content use device 3, the right / left storage means (24) is referred to, Available / unavailable determination means (25) for determining whether or not the use of C is permitted, and released from the key storage means (21) when it is determined that all right holders are permitted to use the content C An authentication system including a public key transmission unit that reads a key and transmits the key to the content utilization device 3 can be configured.

  In this authentication system, each content right holder device 1 corresponding to each of a plurality of right holders having the right of one content C and a certificate authority 2 that manages the public key of each right holder are connected to a communication line (network 4). The content right holder device 1 generates a key pair composed of a private key and a public key of the right holder corresponding to the content right owner device 1, and at least The public key is transmitted to the certificate authority 2 (S3), and the certificate authority 2 stores the public key transmitted from each content right holder device 1 in the key storage means (21) provided in the certificate authority 2 ( S5) Generate one certificate authority certificate CF that proves the validity of the public keys of all of the plurality of right holders, and send it to each content right holder device 1 (S7). The Whether or not the right holder corresponding to the content right holder apparatus 1 permits the use of the content C is notified to the certification authority 2 (S21), and the certification authority 2 permits the use of the content C by each right holder. Is stored in the availability storage means (24) provided in the certification authority 2 (S23), and one of the content right holder apparatuses 1 is the right holder corresponding to the content right holder apparatus 1. An electronic signature obtained by encrypting the digest of the content C with a private key is assigned to the content C (S35), a certificate authority certificate CF is assigned to the content C (S37), and the certificate authority 2 uses the electronic signature and the certificate authority certificate. When the content C to which the CF is assigned is used by the content usage device 3 that uses the content C, the public key for verifying the electronic signature is requested from the content usage device 3 Referring to the availability storage means (24), it is determined whether or not all right holders are permitted to use the content C (S47), and it is determined that all right holders are permitted to use the content C. In this case, it is possible to execute an authentication method characterized in that the public key is read from the key storage means (21) and transmitted to the content use device 3 (S51).

  In addition, according to the present embodiment, each content right holder device 1 corresponding to each of a plurality of right holders having the right of one content C, the content using device 3 that uses the content C, and each right Each of the content right holder devices 1 of the right holder corresponding to the content right holder device 1 is an authentication system connected to a certificate authority 2 that manages the public key of the right holder via a communication line (network 4). A key pair generating means (12) for generating a key pair composed of a secret key and a public key and transmitting at least the public key to the certificate authority 2, and a right holder corresponding to the content right holder device 1 using the content C The use permission notifying means (14) for notifying the certificate authority 2 whether or not it is permitted, and the digest of the content C with the private key of the right holder corresponding to the content right holder device 1 An electronic signature giving means (16) for giving the encrypted electronic signature to the content C, and a certification authority certificate for giving the content C one certification authority certificate CF for certifying the validity of the public keys of all the right holders A certificate granting means (17), and when the content using apparatus 3 uses the content C to which the digital signature and the certificate authority certificate CF are assigned, the certificate authority 2 uses a public key for verifying the digital signature. Public key requesting means (32) for requesting the electronic signature, electronic signature verification means (33) for trying to verify the electronic signature with the public key transmitted from the certificate authority 2, and the content C when the electronic signature can be verified. Content authority means (34), and the certificate authority 2 generates a certificate authority certificate CF by generating a certificate authority certificate CF and a key storage means (21) for storing the public key transmitted from each content right holder device 1 Certificate authority certificate issuing means (23) to be transmitted to the user apparatus 1, use permission storage means (24) for storing whether or not each right holder permits the use of the content C, and disclosure from the content use apparatus 3 When the key is requested, referring to the availability determination means (24), the availability permission means for determining whether or not all rights holders permit the use of the content C; An authentication system comprising: a public key transmitting unit that reads a public key from the key storage unit (21) and transmits the public key to the content using device 3 when it is determined that the use is permitted. it can.

  In this authentication system, each content right holder device 1 corresponding to each of a plurality of right holders having the right of one content C, the content using device 3 that uses the content C, and the public key of each right holder are used. An authentication method in an authentication system in which a certificate authority 2 to be managed is connected via a communication line (network 4), wherein each content right holder device 1 has a secret key of a right holder corresponding to the content right owner device 1 And at least the public key is transmitted to the certificate authority 2 (S3), and the certificate authority 2 provides the public key transmitted from each content right holder device 1 in the certificate authority 2 Stored in the stored key storage means (21) (S5), each content right holder device 1 permits the right holder corresponding to the content right owner device 1 to use the content C. (S21), the certification authority 2 indicates whether or not each right holder permits the use of the content C, and whether or not the use permission storage means (24 ) (S23), and generates one certificate authority certificate CF that proves the validity of the public keys of all of the plurality of right holders and transmits it to each content right holder device 1 (S7). One of the devices 1 gives an electronic signature obtained by encrypting the digest of the content C with the private key of the right holder corresponding to the content right device 1 to the content C (S35), and assigns the certificate authority certificate CF to the content C. (S37), the content use device 3 requests the certificate authority 2 for a public key for verifying the digital signature when using the content C with the digital signature and the certificate authority certificate CF. (S45), Certificate Authority 2, when a public key is requested, it is determined whether or not all right holders are permitted to use the content C by referring to the availability storage means (24) (S 47). When it is determined that all right holders are permitted to use the content C, the public key is read from the key storage means (21) and transmitted to the content using device 3 (S51), and the content using device 3 authenticates. An attempt is made to verify the electronic signature with the public key transmitted from the station 2 (S53), and the content using apparatus 3 uses the content C when the electronic signature is verified (S55). Can be executed.

  Further, according to the present embodiment, it is possible to configure an authentication system in which the availability determination unit (25) makes a determination with reference to the updated availability storage unit (24).

  According to the present embodiment, the certificate authority 2 determines whether or not all right holders are permitted to use the content C with reference to the updated use availability storage means (24). An authentication method can be executed.

  The computer program that causes the content right holder device 1, the certificate authority 2, and the content utilization device 3 to execute processing is stored in a computer-readable recording medium such as a semiconductor memory, a magnetic disk, an optical disk, a magneto-optical disk, or a magnetic tape. Or can be distributed through a communication network such as the Internet.

It is a figure which shows the structure of the authentication system which concerns on embodiment of this invention. 3 is a block diagram showing a configuration of each content owner device 1. FIG. 2 is a block diagram showing a configuration of a certificate authority 2. FIG. 3 is a block diagram showing a configuration of a content utilization device 3. FIG. It is a sequence diagram of the authentication system which concerns on this Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Content right holder apparatus 2 ... Certificate authority 3 ... Content utilization apparatus 4 ... Network 11 ... Content memory | storage part 12 ... Key pair production | generation part 13 ... Certificate authority certificate memory | storage part 14 ... Usage permission notification part 15 ... Rights holder ID provision part DESCRIPTION OF SYMBOLS 16 ... Digital signature provision part 17 ... Certificate authority certificate provision part 21 ... Rights holder information storage part 22 ... Certificate authority certificate issue part 23 ... Certificate authority certificate storage part 24 ... Use permission storage part 25 ... Use permission determination part 26 ... Public key transmission unit 31 ... Content storage unit 32 ... Public key request unit 33 ... Digital signature verification unit 34 ... Content use unit

Claims (8)

An authentication system in which a content utilization device that uses a content when there are a plurality of rights holders having the right of one content and a certificate authority that manages the public key of each rights holder are connected via a communication line Because
The content using device is:
When using one certificate authority certificate that proves the validity of the public keys of all of the plurality of right holders and the content given the electronic signature obtained by encrypting the digest of the contents with the right key of the right holder, Public key requesting means for requesting the public key for verifying the electronic signature to the certificate authority;
An electronic signature verification means that attempts to verify the electronic signature with the public key transmitted from the certificate authority;
Content use means for using content when the electronic signature can be verified, and the certificate authority,
Key storage means for storing the public key of each right holder;
A certificate authority certificate issuing means for generating the certificate authority certificate and transmitting it to the content right holder device corresponding to each right holder;
Use permission storage means for storing whether or not each right holder permits the use of content;
When a public key is requested from the content use device, a use permission determination unit that refers to the use permission storage unit and determines whether or not all right holders are permitted to use the content;
An authentication system comprising: a public key transmission unit that reads a public key from the key storage unit and transmits the public key to the content utilization device when it is determined that all right holders permit the use of the content. An authentication system in which a content utilization device that uses a content when there are a plurality of rights holders having the right of one content and a certificate authority that manages the public key of each rights holder are connected via a communication line An authentication method in
The public key of each right holder is stored in a key storage means provided in the certificate authority, and whether or not each right holder permits the use of content is stored in the availability storage means provided in the certificate authority. When remembered
The content using apparatus is configured to receive one certificate authority certificate that proves the validity of the public keys of all of the plurality of right holders and a content provided with an electronic signature obtained by encrypting a digest of the content with the right key of the right holder. When using, request the public key for verifying the electronic signature from the certificate authority,
When the public key is requested, the certificate authority refers to the availability storage unit to determine whether or not all right holders are permitted to use the content, and all right holders use the content. If it is determined that it is permitted, the public key is read from the key storage means and transmitted to the content using device,
The content use apparatus attempts to verify the electronic signature with the public key transmitted from the certificate authority, and uses the content when the electronic signature is verified. An authentication system in which each content right holder device corresponding to each of a plurality of right holders having one content right and a certificate authority that manages the public key of each right holder are connected via a communication line. ,
Each content right holder device is:
A key pair generating means for generating a key pair composed of a private key and a public key of a right holder corresponding to the content right holder device, and transmitting at least the public key to the certificate authority;
Use permission notifying means for notifying the certificate authority whether or not the right holder corresponding to the content right holder device permits the use of the content;
An electronic signature giving means for giving the content an electronic signature obtained by encrypting the digest of the content with the private key of the right holder corresponding to the content right device;
Certificate authority certificate granting means for granting to the content one certificate authority certificate that proves the validity of the public keys of all of the plurality of right holders;
The certificate authority
Key storage means for storing a public key transmitted from each content right holder device;
Certificate authority certificate issuing means for generating the certificate authority certificate and transmitting it to each content right holder device;
Use permission storage means for storing whether or not each right holder permits the use of content;
When the content with the electronic signature and the certificate authority certificate is used by the content use device that uses the content, when the public key for verifying the electronic signature is requested from the content use device, the use With reference to the availability storage means, availability determination means for determining whether all right holders permit the use of the content,
An authentication system comprising: a public key transmission unit that reads a public key from the key storage unit and transmits the public key to the content utilization device when it is determined that all right holders permit the use of the content. Authentication method in an authentication system in which each content right holder device corresponding to each of a plurality of right holders having one content right and a certificate authority that manages the public key of each right holder are connected via a communication line Because
Each content right holder device generates a key pair consisting of a private key and a public key of a right holder corresponding to the content right owner device, and transmits at least the public key to the certificate authority.
The certificate authority stores the public key transmitted from each content right holder device in a key storage means provided in the certificate authority, and performs one authentication to prove the validity of the public keys of the plurality of right holders. Generate a station certificate and send it to each content rights holder device.
Each content right holder device notifies the certificate authority whether or not the right holder corresponding to the content right owner device permits the use of the content;
The certificate authority stores in the availability storage means provided in the certificate authority whether each right holder permits the use of the content,
One of each of the content right holder devices assigns an electronic signature obtained by encrypting the content digest with the private key of the right holder corresponding to the content right owner device to the content, and assigns the certificate authority certificate to the content. ,
The certificate authority is requested by the content using device for a public key for verifying the electronic signature when the content provided with the electronic signature and the certificate authority certificate is used in the content using device that uses the content. When it is determined that all rights holders permit the use of content with reference to the availability storage means, and it is determined that all rights holders permit the use of content, A public key is read from the key storage means and transmitted to the content use device. Each content right holder device corresponding to each of a plurality of right holders having one content right, a content using device that uses the content, and a certificate authority that manages the public key of each right holder establish a communication line. An authentication system connected via
Each content right holder device is:
A key pair generating means for generating a key pair composed of a private key and a public key of a right holder corresponding to the content right holder device, and transmitting at least the public key to the certificate authority;
Use permission notifying means for notifying the certificate authority whether or not the right holder corresponding to the content right holder device permits the use of the content;
An electronic signature giving means for giving the content an electronic signature obtained by encrypting the digest of the content with the private key of the right holder corresponding to the content right device;
Certificate authority certificate granting means for granting to the content one certificate authority certificate that proves the validity of the public keys of all of the plurality of right holders;
The content using device is:
Public key requesting means for requesting a public key for verifying the electronic signature to the certificate authority when using the content to which the electronic signature and the certificate authority certificate are attached;
An electronic signature verification means that attempts to verify the electronic signature with the public key transmitted from the certificate authority;
Content use means for using content when the electronic signature can be verified, and the certificate authority,
Key storage means for storing a public key transmitted from each content right holder device;
Certificate authority certificate issuing means for generating the certificate authority certificate and transmitting it to each content right holder device;
Use permission storage means for storing whether or not each right holder permits the use of content;
A use permission / non-permission unit for determining whether all right holders are permitted to use the content by referring to the use permission / non-permission storage unit when a public key is requested from the content use device;
An authentication system comprising: a public key transmission unit that reads a public key from the key storage unit and transmits the public key to the content utilization device when it is determined that all right holders permit the use of the content. Each content right holder device corresponding to each of a plurality of right holders having one content right, a content using device that uses the content, and a certificate authority that manages the public key of each right holder establish a communication line. Each of the content right holder devices generates a key pair consisting of a private key and a public key of the right holder corresponding to the content right owner device, and at least the public key To the certificate authority,
The certificate authority stores the public key transmitted from each content right holder device in a key storage means provided in the certificate authority,
Each content right holder device notifies the certificate authority whether or not the right holder corresponding to the content right owner device permits the use of the content;
The certificate authority stores in the availability storage means provided in the certificate authority whether each right holder permits the use of the content, and proves the validity of the public keys of all of the plurality of right holders One certificate authority certificate to be generated and transmitted to each content right holder device,
Each of the content right holder devices assigns an electronic signature obtained by encrypting the content digest with the private key of the right holder corresponding to the content right owner device to the content, and assigns the certificate authority certificate to the content. ,
The content using device, when using the content provided with the electronic signature and the certificate authority certificate, requests the certificate authority for a public key for verifying the electronic signature,
When the certificate authority is requested for a public key, the certificate authority refers to the availability determination unit to determine whether all right holders are permitted to use the content,
When it is determined that all right holders are permitted to use the content, the certificate authority reads the public key from the key storage unit and transmits the public key to the content usage device.
The content using device tries to verify the electronic signature with the public key transmitted from the certificate authority,
An authentication method, wherein the content using device uses the content when the electronic signature can be verified.   6. The authentication system according to claim 1, wherein the availability determination unit makes a determination with reference to the updated availability storage unit. 7. The certificate authority according to claim 2, wherein the certificate authority determines whether or not all right holders are permitted to use the content with reference to the updated availability storage unit. The authentication method according to the above.

Images