JP2013074302A - Terminal device control system, control device, terminal device, control method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To properly control a terminal device according to an arbitrary utilization environment without excessively restricting usability of the terminal device.SOLUTION: A control device outputs encrypted control information acquired by encrypting control information corresponding to encryption condition information by using an encryption key corresponding to encryption key generation information including the encryption condition information. A terminal device acquires utilization environment information indicating its own utilization environment, and outputs decryption key generation information including the utilization environment information. A key management device generates a decryption key corresponding to the decryption key generation information, and outputs the decryption key. The terminal device performs decryption processing on the encrypted control information by using the generated decryption key, and when the control information is acquired, determines whether to permit execution of specific service in the terminal device by using the acquired control information.

Description

  The present invention relates to a control technology for a terminal device, and relates to a technology for remotely controlling a terminal device by a control device.

  Currently, various devices, applications, and contents are installed in mobile PC terminals and smartphone terminals, and various services using them can be provided. In addition to this, the mobile PC terminal device, the smart phone terminal device, and the like have mobility and constant availability so that the user can enjoy these services in various usage environments.

  On the other hand, since services and usage environments are diverse, there may be a problem when an appropriate service corresponding to the usage environment is not provided. For example, when a mobile PC terminal with applications and contents that should be used within the company is taken out of the company and used, or conversely, devices that should not be used within the company (camera devices, etc.) This is the case when a smartphone terminal device equipped with is brought into a company and used.

  For such a problem, there is an MDM (Mobile Device Management) service that prevents a business terminal device from being used in advance other than devices and applications used in business (for example, see Non-Patent Documents 1 and 2). ).

  In addition, there is a service that controls the use of content by using region-limited multicast using MLDv2 (Multicast Listener Discovery version 2), which is being considered for use by IP simulcast radio and the like. This service uses the identification items such as the service user's IP address system to determine the usage environment such as the "region" to which the service user belongs, and provides services based on that usage environment (for example, non-patented) Reference 3).

  Similarly, DRM is a technology that controls content usage. In an example of DRM, a server device that manages content provides encrypted content to playback / transfer software of a terminal device. After the server device authenticates the service user, the license information including the key used for content encryption and the license condition is provided to the reproduction / transfer software of the terminal device. The reproduction / transfer software decrypts and reproduces the encrypted content only when the usage environment of the terminal device satisfies the license condition included in the license information (see, for example, Non-Patent Document 4).

  Also, from the viewpoint of Web application control, there is a mechanism such as Security Assertion Markup Language (SAML) that realizes Single Sign On (SSO) (see, for example, Non-Patent Document 5). In the framework of SAML, after the authentication server device (SAML Authority) authenticates the service user, authentication information indicating the authentication result is sent to the authorization server device (Policy Decision Point (PDP)), and the authorization server device The attribute of the authenticated service user is acquired from the authentication server device (Attribute Authority), and this service user is authorized for the attribute. The service providing device (Service Provider (SP)) controls service resources (functions) to be provided to the service user by using the authorization information indicating the authorization contents.

"Smartphone remote control service", [online], NTT DoCoMo, Inc., [searched on September 2, 2011], Internet <http://www.docomo.biz/html/service/remotecontrol/ > “Smartphone Remote Control Service Service Guidelines”, [online], July 15, 2011, NTT DoCoMo, Inc., [Search September 2, 2011], Internet <http: // www. docomo.biz/pdf/html/service/remotecontrol/pdf_02.pdf> “About IP Radio Initiatives in Kansai“ IP Radio-RADIKO ””, [online], March 24, 2008, IP Radio Research Council, [searched September 2, 2011], Internet <http: / /www.iajapan.org/bukai/Net-Cast/event/2008/0324/20080324_koga.pdf> Noboru Takematsu, “Digital Rights Management Technology“ DRM ”Supporting Download Sales”, [online], Sakae IBE Co., Ltd., [searched September 2, 2011], Internet <http: // www. mpeg.co.jp/libraries/mpeg_labo/winPC_27.html#1> “Technical Overview of the OASIS Security Assertion Markup Language (SAML) V1.1”, [online], May 11, 2004, [searched September 2, 2011], Internet <http: //www.oasis -open.org/committees/download.php/6837/sstc-saml-tech-overview-1.1-cd.pdf>

  In the conventional method, the terminal device may not be flexibly controlled in accordance with an arbitrary usage environment with a small burden.

In the methods of Non-Patent Documents 1 and 2, devices and applications that can be used there are fixedly limited regardless of the usage environment of the terminal device. That is, in this method, the terminal device cannot be flexibly controlled according to an arbitrary usage environment.
In the method of Non-Patent Document 3, the usage environment of the terminal device (service conditions) based on the usage environment is fixed in the system, and the terminal device is controlled according to an arbitrary usage environment. It was difficult.
In the method of Non-Patent Document 4, since the permission condition included in the license information is provided to the terminal device, for example, processing such as tampering detection and encryption of the permission condition on the terminal device side occurs separately. It is necessary to securely store a secret key or the like for use in encryption of conditions so that it cannot be stolen by a third party, which increases the implementation cost and operation cost.
In the method of Non-Patent Document 5, since it is necessary to acquire the attribute of the service user who has been authenticated by the authorization server device from the authentication server device, the processing load on the authentication server device and the authorization server device associated therewith is large. That is, with the methods of Non-Patent Documents 4 and 5, the terminal device cannot be flexibly controlled according to an arbitrary usage environment with a small burden.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a technique capable of flexibly controlling a terminal device according to an arbitrary use environment with a small burden.

  Control information indicating whether or not an arbitrary terminal device is permitted to execute a specific service is associated with encryption condition information indicating the usage environment of the arbitrary terminal device. The control device outputs encryption control information obtained by encrypting the control information corresponding to the encryption condition information using the encryption key corresponding to the encryption key generation information including the encryption condition information. The terminal device receives input of encryption control information, obtains usage environment information representing its own usage environment, and outputs decryption key generation information including the usage environment information. The key management device receives input of decryption key generation information, generates a decryption key corresponding to the decryption key generation information, and outputs the decryption key. The terminal device accepts the input of the generated decryption key, performs decryption processing of the encryption control information using this decryption key, and when the control information is obtained thereby, the control information is used to identify the terminal device. Decide whether to allow the service to run. When the encryption key generation information and the decryption key generation information satisfy a predetermined relationship, the control information can be obtained by performing the decryption process of the encryption control information using the decryption key.

  According to the present invention, the terminal device can be flexibly controlled according to an arbitrary usage environment with a small burden.

FIG. 1 is a diagram for explaining a configuration of a terminal device control system according to an embodiment. 2A to 2C are diagrams for explaining the configuration of the terminal device control system according to the embodiment. 3A and 3B are diagrams illustrating a display screen of the terminal device according to the embodiment. FIG. 4 is a diagram for explaining the terminal control method according to the embodiment. FIG. 5 is a diagram for explaining the terminal control method according to the embodiment. 6A to 6D are diagrams for explaining the configuration of a terminal device control system according to a modification of the embodiment. FIG. 7 is a diagram for explaining control processing in a modification of the embodiment. FIG. 8 is a diagram for explaining a configuration of a terminal device according to a modification of the embodiment. 9A and 9B are diagrams illustrating a display screen of a terminal device according to a modification of the embodiment. FIG. 10 is a diagram for explaining a terminal control method according to a modification of the embodiment. FIG. 11 is a diagram for explaining a configuration of a terminal device control system according to a modification of the embodiment. 12A to 12D are diagrams for explaining the configuration of a terminal device control system according to a modification of the embodiment.

Embodiments of the present invention will be described below.
[Outline of Embodiment]
First, an outline of the embodiment will be described.
The terminal device control system according to the present embodiment includes, for example, a terminal device that controls the execution of a service, a control device that performs the control, and a key management device that manages keys necessary for the control.

  In this example, control information indicating whether or not an arbitrary terminal device is permitted to execute a specific service is associated with encryption condition information indicating the usage environment of the arbitrary terminal device. The control device outputs encryption control information obtained by encrypting the control information corresponding to the encryption condition information using the encryption key corresponding to the encryption key generation information including the encryption condition information.

  The terminal device receives the input of the encryption control information at the encryption control information input unit, obtains the usage environment information indicating its own usage environment at the usage environment acquisition unit, and decrypts the usage environment information at the decryption key generation information output unit Output key generation information.

  The key management device receives input of decryption key generation information at the decryption key generation information input unit, generates a decryption key corresponding to the decryption key generation information at the decryption key generation unit, and outputs the decryption key at the decryption key output unit.

  The terminal device receives the input of the decryption key generated for the decryption key generation information at the decryption key input unit, and the control information acquisition unit performs the decryption process of the encryption control information using the decryption key. When control information is obtained by the control information acquisition unit, the control information application unit of the terminal device uses the control information to determine whether to allow the terminal device to execute a specific service.

In the present embodiment, when the encryption key generation information and the decryption key generation information satisfy a predetermined relationship, the control information is obtained by performing the decryption process of the encryption control information using the decryption key. Here, the encryption key generation information corresponds to the use environment of the terminal device that is set in the control device and permits the decryption of the encryption control information, and the use environment set in the control device is set in the control device. Corresponding to the predetermined control information. The decryption key generation information corresponds to the actual usage environment of the terminal device. In this case, only when the actual usage environment of the terminal device corresponds to the usage environment set by the control device, the terminal device can obtain the control information set by the control device. In other words, the terminal device suitable for applying the control information is identified by being able to decrypt the encryption control information. This makes it possible to flexibly control services that can be used by the terminal device according to the usage environment of the terminal device.
In addition, the control device can control the terminal device according to an arbitrary usage environment simply by changing the encryption condition information indicating the usage environment associated with the control information.
Furthermore, the control device does not send information (encryption condition information) corresponding to the usage environment of the terminal device, which is a permission condition regarding the service usage in the terminal device, to the terminal device or the key management device according to the usage environment. The terminal device can be controlled. For this reason, it is not necessary to detect falsification of encryption key generation information, encryption, and the like, and it is possible to reduce mounting costs and operation costs.
In addition, since the control device does not need to send the encryption condition information to the key management device, even if the permission condition regarding the service use in the terminal device is frequently changed, the control device and the key management device The communication processing load during this period does not increase.
Furthermore, what is provided to the terminal device is not the control information itself but encrypted control information obtained by encrypting it. Assuming that the terminal device cannot fake its own usage environment, a terminal device that is not in the usage environment set by the control device cannot obtain control information illegally.
Therefore, in this embodiment, the terminal device can be flexibly controlled according to an arbitrary usage environment with a small burden.

Preferably, the usage environment acquisition unit of the terminal device obtains new usage environment information every certain period, and the decryption key generation information output unit obtains new usage environment information every time new usage environment information is obtained. Output new decryption key generation information. The decryption key generation information input unit of the key management apparatus accepts input of new decryption key generation information, and the decryption key generation unit renews each time new decryption key generation information is input to the decryption key generation information input unit. A new decryption key corresponding to the new decryption key generation information is generated, and the decryption key output unit outputs a new decryption key each time a new decryption key is generated. The decryption key input unit of the terminal device accepts input of a new decryption key, and the control information acquisition unit performs encryption control using the new decryption key every time a new decryption key is input to the decryption key input unit. The information decoding process is performed, and the control information application unit permits the terminal device to execute a specific service using the newly obtained control information every time control information is newly obtained by the control information acquisition unit. Determine whether or not. When the encryption key generation information and the new decryption key generation information satisfy a predetermined relationship, the control information is obtained by performing the decryption process of the encryption control information using the new decryption key.
Accordingly, it is possible to control services that can be used in the terminal device according to the usage environment of the terminal device that dynamically changes.

  In this case, preferably, the control device generates new first additional information each time the control information corresponding to the encryption condition information is updated to new control information, and the encryption condition information and the new first information are generated. New encryption control information obtained by encrypting new control information using a new encryption key corresponding to new encryption key generation information including additional information is output. The new decryption key generation information further includes new second additional information having a specific correspondence with the new first additional information. The control information acquisition unit of the terminal device performs a decryption process of the new encryption control information using the new decryption key, and the control information application unit adds the new control information when the control information acquisition unit obtains new control information. Using the control information, it is determined whether or not to allow the terminal device to execute a specific service. When the new encryption key generation information and the new decryption key generation information satisfy a predetermined relationship, the new control information is decrypted by using the new decryption key to decrypt the new encryption control information. Is obtained.

In this case, each time the control information corresponding to the encryption condition information is updated to new control information, the control device responds to new encryption key generation information including the encryption condition information and the new first additional information. New encryption control information obtained by encrypting new control information using the new encryption key. In this case, every time the control information corresponding to the encryption condition information is updated to new control information, the encryption key for encrypting the new control information is also updated. In addition, since the new decryption key generation information further includes new second additional information having a specific correspondence with the new first additional information, each time the control information is updated to new control information, The decryption key for decrypting the correct encryption control information is also updated to a new decryption key.
Therefore, when the control information corresponding to the encryption condition information is updated to new control information, a terminal device having only an old decryption key cannot obtain new control information. In other words, when the control information is updated to new control information, the terminal device that cannot obtain new second additional information corresponding to the new first additional information generated at that time is the new control information. Can't get. On the other hand, assuming that the terminal device cannot hold the old decryption key, the terminal device that can obtain the new second additional information and obtain the new decryption key decrypts the new encryption control information. Even if it can, the old encryption control information that is retained cannot be decrypted. This makes it possible to perform various controls while suppressing user fraud.

  In addition, adjacent control information indicating whether or not an arbitrary terminal device is permitted to execute a specific service corresponds to adjacent encryption condition information indicating the usage environment of the arbitrary terminal device, and includes adjacent encryption condition information. There may be an adjacent control apparatus that outputs adjacent encryption control information obtained by encrypting adjacent control information corresponding to adjacent encryption condition information using an adjacent encryption key corresponding to adjacent encryption key generation information. . In that case, preferably, the encryption control information input unit of the terminal device further accepts the input of the adjacent encryption control information, and the control information acquisition unit further performs the decryption process of the adjacent encryption control information using the decryption key. When the control information acquisition unit obtains the control information and the adjacent control information, the control information application unit selects one control information or the adjacent control information from the control information and the adjacent control information, and selects the selected control information. Alternatively, the adjacent control information is used to determine whether or not to allow the terminal device to execute a specific service.

  Thereby, even if it belongs to both the control region by the control device and the control region by the adjacent control device, optimal control is executed according to a predetermined criterion. For example, when the control information application unit of the terminal device obtains the control information and the adjacent control information in the control information acquisition unit, the control information that rejects the execution of the most services among the control information and the adjacent control information or Adjacency control information may be selected. As a result, execution of a service that is permitted in one control area but not permitted in the other control area is restricted, and a situation in which the service is executed in the other control area that is inappropriate to execute can be prevented. Alternatively, for example, when the control information application unit of the terminal device obtains the control information and the adjacent control information in the control information acquisition unit, the control that permits the execution of the most services among the control information and the adjacent control information Information or adjacency control information may be selected. As a result, the execution of a service that should be executed in one control area but not permitted in the other control area is restricted in the one control area, and the service is not executed in the one control area. Can be suppressed.

Preferably, only the terminal device arranged in the specific area can communicate with the key management apparatus, and the decryption key is inputted only to the terminal apparatus arranged in the specific area. In this case, the control content can be changed depending on whether or not the terminal device exists in a specific area.
For example, when control information applicable to the terminal device cannot be obtained in the control information acquisition unit of the terminal device, the control information application unit of the terminal device identifies the terminal device according to predetermined default control information. Whether to allow the execution of the service. Thereby, depending on whether or not the terminal device exists in a specific area, control based on the control information corresponding to the actual usage environment of the terminal device is performed, or control based on the default control information is performed. .
The control device further outputs type information representing the type of usage environment represented by the encryption condition information, the encryption control information input unit of the terminal device further accepts the input of the type information, and the usage environment acquisition unit Alternatively, use environment information representing the use environment of the type represented by the type information may be obtained. In this case, the control device can easily change the type of use environment for controlling the use of the service.

Embodiment
Next, an embodiment of the present invention will be described.
In the present embodiment, it is assumed that a service user personally owns a smartphone terminal device that is brought into a company to which the service user belongs and is used as it is as a work terminal device in the company. As services to be controlled, contents, applications, devices, and the like can be assumed, but in this embodiment, applications (software) installed in a smartphone terminal device are controlled. When the smartphone terminal device is arranged outside the company, all applications can be used, and when the smartphone terminal apparatus is arranged inside the company, an application that is not suitable for the company's terminal usage policy is unavailable. In this embodiment, it is assumed that control information is encrypted using an ID-based encryption method. An example of an ID-based encryption scheme is, for example, Reference 1 “D. Boneh and M. franklin, Identity-based encryption from the Weil pairing, CRYPT'01, volume 2139 of LNCS, pages 213-229. Springer, 2001.” Is disclosed.

<Configuration>
As illustrated in FIG. 1, the terminal device control system 1 of this embodiment includes a control device 11, a terminal device 12, and a key management device 13.
The control device 11 exemplified in this embodiment is a company server device managed by a specific company. The control device 11 of this embodiment includes a control unit 111, a memory 112, a storage unit 113, a communication unit 114, an encryption control information generation unit 115, and a processing unit 116. Each of these functional units is configured, for example, by reading and executing a special program in a computer. The control device 11 executes each process under the control of the control unit 111, and data obtained in each process is stored in the memory 112 as necessary and used in other processes.

  The terminal device 12 illustrated in this embodiment is a smartphone terminal device that is personally held by a service user, and some applications are installed. The terminal device 12 of this embodiment includes a control unit 121, a memory 122, a communication unit 123a (encryption control information input unit), a communication unit 123b (decryption key input unit), a use environment acquisition unit 124, and a decryption key. The acquisition unit 125, the control information acquisition unit 126, the control information application unit 127, and the execution unit 128 are included. Each of these functional units is configured, for example, by reading and executing a special program in a computer. In particular, the decryption key acquisition unit 125 and the control information acquisition unit 126 of this embodiment are obtained by reading and executing a control application (control AP) on a computer. The terminal device 12 executes each process under the control of the control unit 121, and data obtained in each process is stored in the memory 122 as needed and used in other processes.

  The key management device 13 exemplified in this embodiment is a server device that manages an encryption key and a decryption key used for encryption and decryption. The key management device 13 may be managed by a company that manages the control device 11, or may be managed by another third party. The key management device 13 of this embodiment includes a control unit 131, a memory 132, a storage unit 133, a communication unit 134, a decryption key generation unit 135, and a master key generation unit 136. Each of these functional units is configured, for example, by reading and executing a special program in a computer. The key management device 13 executes each process under the control of the control unit 131, and data obtained in each process is stored in the memory 132 as necessary and used in other processes.

  The control device 11, the terminal device 12, and the key management device 13 are configured to be able to communicate through a network. However, as illustrated in FIGS. 2A to 2C, in this embodiment, only the terminal device 12 arranged in a specific company (in the specific area B of FIG. 2C) can communicate with the key management device 13 through the network. The decryption key can be acquired (FIG. 2B). The terminal device 12 arranged outside a specific company (area A in FIG. 2C) cannot communicate with the key management device 13 and cannot acquire a decryption key (FIG. 2A). The terminal device 12 can communicate with the control device 11 through a network regardless of whether or not the terminal device 12 is arranged in the specific company.

<Pre-processing>
As pre-processing, the master key generation unit 136 of the key management device 13 generates a master public key and a master secret key necessary for using the ID-based encryption method. For example, if the ID-based encryption method described in Reference 1 is used, the master key generation unit 136 is defined on a finite field using s∈Z _q ^* generated from a random number or the like as a master secret key. Let s · PεE for the point P on the elliptic curve E of order q be the master public key P _pub . The master secret key is stored in the storage unit 133, and the master public key and other public parameters are disclosed.

  Default control information is set in advance in the control information application unit 127 of the terminal device 12. The default control information is information indicating the control content applied when the control information acquisition unit 126 cannot obtain the control information. When the control information acquisition unit 126 cannot obtain the control information, the control information application unit 127 determines whether or not to allow the execution unit 128 to execute a specific application according to the default control information as described later. Examples of default control information include control information that allows the execution unit 128 to execute all applications installed in the terminal device 12, and control information that denies execution by the execution unit 128 of all applications installed in the terminal device 12. Alternatively, control information that permits the execution unit 128 to execute a predetermined application installed in the terminal device 12 but rejects the execution of another application. In the present embodiment, control information that permits the execution unit 128 to execute all applications installed in the terminal device 12 is set as default control information.

<Setting process>
As illustrated in FIG. 4, a specific company that manages the control device 11 generates control information that indicates whether or not to permit execution of a specific application installed in the terminal device 12. For example, “ON” indicating that “permission is allowed” is associated with an application to be used within the specific company, and “OFF” indicating “rejecting execution” is associated with an application that is not desired to be used. This information is used as control information. Only one piece of control information may be set, or a plurality of pieces of control information may be set. One control information is illustrated below (file name: control information 1.xml).

  The specific company that manages the control device 11 further sets which control information is applied when the terminal device 12 is in what usage environment, and the encryption condition information indicating the set usage environment of the terminal device 12 Is associated with the control information applied to the usage environment. The usage environment of the terminal device 12 means an environment in which the terminal device 12 is used. Examples of the usage environment of the terminal device 12 include the position (coordinates and area, etc.) where the terminal device 12 is arranged, the time (time, time zone, etc.) the terminal device 12 is used, and the terminal device 12 or installed therein Various attribute information such as the gender and affiliation of the user or owner of the application. Specific examples of the encryption condition information include location information of the terminal device 12 obtained by the GPS device, an SSID (Service Set ID) that is an access point ID of a wireless LAN that performs wireless communication with the terminal device 12, and the terminal device 12 is connected. A global address (IP address or the like) assigned to the local network, time information acquired from a time server device installed in the company, and the like. In this embodiment, the location where the terminal device 12 is arranged is used as an environment for use, and the SSID that is the access point ID of a wireless LAN that performs wireless communication with the terminal device 12 is used as encryption condition information.

What type of usage environment is set may be predetermined for each application or service, or a specific company that manages the control device 11 may be arbitrarily determined. When the type of usage environment to be set is arbitrarily determined, type information (ID, etc.) indicating the type (item) of the usage environment is set, and what type of usage is specified by specifying the type information It shall be specified whether to use the environment.
The set encryption condition information and the control information associated with the encryption condition information are stored in the storage unit 113 of the control device 11 (step S101).

  The master public key and other public parameters set by the key management device 13 are sent to the control device 11 and stored in the storage unit 113 (step S102).

The encryption control information generation unit 115 of the control device 11 reads the encryption condition information and control information and the master public key associated with each other from the storage unit 113. The encryption control information generation unit 115 uses the encryption key corresponding to the encryption key generation information including the encryption condition information, encrypts the control information corresponding to the encryption condition information, and generates the encryption control information To do. The encryption control information generation unit 115 according to the present embodiment generates an encryption key corresponding to the encryption key generation information using the master public key in accordance with the ID-based encryption method, and uses the encryption key to generate the control information. Is encrypted to generate encryption control information. For example, if the ID-based encryption method described in Reference 1 is used, the encryption control information is as follows.
(r ・ P, M (+) H (g _ID ^r ))
Where g _ID = e (MAP _ID , P _pub ), H is a hash function H that outputs a bit string, e is a bilinear mapping such as pairing, and MAP _ID is an elliptical key for encryption key generation information. This is a point mapped on the curve E, r∈Z _q ^* is a random number, M is a bit string representing control information, and (+) is an exclusive OR operator. Further, the encryption key generation information may be information consisting only of the encryption condition information. Further, the encryption control information generation unit 115 performs the ID unique to the terminal device 12 and the setting process each time a setting process is newly executed. The first additional information (random number, count value, etc.) newly generated may be included. It is assumed that what type of information the encryption key generation information is made is determined in advance in the system.

  The generated encryption control information is stored in the storage unit 113 so that it can be transmitted in response to a request from the terminal device 12. When the encryption key generation information includes first additional information such as a random number, new second additional information having a specific correspondence with the first additional information corresponding to the encryption control information is also stored in the storage unit 113. May be stored. In the present embodiment using the ID-based encryption method, the second additional information is equal to the first additional information. The same applies when the first additional information is updated. In addition, type information indicating the type of usage environment corresponding to the encryption key generation information may be stored in the storage unit 113. The encryption control information, the second additional information, the type information, and the like stored in the storage unit 113 may be disclosed on the network, and each terminal device 12 stores the encryption control information corresponding to itself using an index or the like. You may be able to acquire (step S103).

A control AP including an address of an area in which encryption control information or the like corresponding to the terminal device 12 is stored is generated and uploaded to an arbitrary server device on the network. The communication unit 114 of the control device 11 transmits information on the URL of the area where the control AP is stored, and this information is received by the communication unit 123a of the terminal device 12. The control unit 121 of the control device 11 acquires the control AP using this URL and causes the control AP to be executed on the computer. In this embodiment, the decryption key acquisition unit 125 and the control information acquisition unit 126 are thereby configured in the terminal device 12 (step S104).
In addition, each process of said setting process (step S101-S103) is performed in the case of an initial setting, and whenever control information corresponding to new encryption condition information is set, encryption process information is set. Each time the corresponding control information is updated to new control information, it is newly executed. Moreover, although the example which performed the process of step S104 after the process of step S101-S104 was shown above, the process of step S104 and the process of step S101-S104 may be performed independently. For example, the process of step S104 may be executed before the process of steps S101 to S104, or the process of step S104 may be executed at the end of the process of steps S101 to S104.

<Control processing>
As illustrated in FIG. 5, the control information acquisition unit 126 transmits an encryption control information request from the communication unit 123 a every certain period (periodically or every necessary timing). The necessary timing is a case where decryption cannot be performed with a decryption key that has already been acquired in a decryption process described later (step S111). The transmitted encryption control information request is received by the communication unit 114 of the control device 11 through the network and sent to the processing unit 116. The processing unit 116 reads out the encryption control information corresponding to the terminal device 12 from the storage unit 113 and transmits (outputs) it from the communication unit 114. If the second additional information and type information corresponding to the encryption control information are stored in the storage unit 113, the second additional information and / or type information corresponding to the encryption control information is also transmitted ( Output). The transmitted information such as encryption control information is received by the communication unit 123a of the terminal device 12 through the network (accepts input) and sent to the control information acquisition unit 126. When the second additional information and the type information are received, these are sent to the decryption key acquisition unit 125. The control information acquisition unit 126 may store the sent encryption control information or the like in a tamper-resistant area or temporarily store it in the memory 122 or the like (step S112).

  On the other hand, the decryption key acquisition unit 125 requests the usage environment acquisition unit 124 to acquire usage environment information representing the usage environment of the terminal device 12 at regular intervals (periodically or at predetermined intervals) (step S113). . Upon receiving this request, the usage environment acquisition unit 124 acquires usage environment information representing its own usage environment using its own sensor device or the like. When the type of usage environment information to be acquired is predetermined for each application or service, the usage environment acquisition unit 124 tries to execute the application or the terminal device 12 installed in the terminal device 12. Acquire usage environment information of the type corresponding to the service to be performed. When the type information is transmitted together with the encryption control information in step S112, the usage environment acquisition unit 124 obtains usage environment information representing the usage environment of the type represented by the type information. In the example of this embodiment, the usage environment acquisition unit 124 acquires the SSID of a nearby wireless LAN access point as usage environment information. The acquired usage environment information of the terminal device 12 is sent to the decryption key acquisition unit 125 (step S114).

  When the terminal device 12 can communicate with the key management device 13 through the network, the decryption key acquisition unit 125 of the terminal device 12 and the decryption key generation unit 135 of the key management device 13 communicate with the terminal device through the communication units 123b and 134 and the network. 12 service user authentication processing is executed (step S115). If the terminal device 12 cannot communicate with the key management device 13 or if the authentication process has failed, the process proceeds to step S120.

  When the authentication process is successful, the decryption key acquisition unit 125 sends the decryption key generation information including the usage environment information together with the decryption key generation request to the communication unit 123b, and the communication unit 123b transmits the decryption key generation information and the decryption information through the network. A key generation request is transmitted (output) to the key management apparatus 13. It should be noted that what type of information the decryption key generation information comprises is determined in advance in the system, and its configuration corresponds to the above-described encryption key generation information. In the case of this embodiment using the ID-based encryption method, the decryption key generation information is set so that the decryption process is correctly performed when the encryption key generation information and the decryption key generation information are the same. That is, when the encryption key generation information is information consisting only of encryption condition information, the decryption key generation information is information consisting only of usage environment information. When the encryption key generation information is information including the encryption condition information and the first additional information, the decryption key generation information is information including the usage environment information and the second additional information. When the encryption key generation information further includes additional information such as an ID unique to the terminal device 12, the decryption key generation information further includes additional information such as an ID unique to the terminal device 12. The decryption key generation information and the decryption key generation request are received (input) by the communication unit 134 of the key management device 13 and sent to the decryption key generation unit 135 (step S116).

The decryption key generation unit 135 reads the master secret key from the storage unit 133 and generates a decryption key corresponding to the decryption key generation information. The decryption key generation unit 135 of this embodiment generates a decryption key corresponding to the decryption key generation information using the master secret key in accordance with the ID-based encryption method. For example, if the ID-based encryption method described in Reference 1 is used, the decryption key generation information is mapped to the point MAP _ID on the elliptic curve E, and is obtained by performing elliptic scalar multiplication on the elliptic curve E. The obtained result s · MAP _ID is set as a decryption key (step S117). The generated decryption key is transmitted from the communication unit 134, received (input) by the communication unit 123b of the terminal device via the network, and sent to the decryption key acquisition unit 125 (step S118).

  The decryption key is sent to the control information acquisition unit 126 and stored in the control information acquisition unit 126. At this time, the decryption key may be stored in a tamper-resistant area or temporarily stored in the memory 122 so that the decryption key is not misused (unintentional reuse or outflow to a third party).

The control information acquisition unit 126 attempts to decrypt the encryption control information using the decryption key. In this embodiment, the encryption control information is decrypted using the decryption key in accordance with the ID-based encryption method. For example, if the ID-based encryption method described in Reference 1 is used, the control information acquisition unit 126 attempts to acquire the control information M by performing the following decryption process.
M (+) H (g _ID ^r ) (+) H (e (s ・ MAP _ID , r ・ P))
When the encryption key generation information and the decryption key generation information satisfy a predetermined relationship, the control information is obtained by performing the decryption process of the encryption control information using the decryption key. In this embodiment using the ID-based encryption method, when the encryption key generation information and the decryption key generation information are the same, the control information is obtained by performing the decryption process of the encryption control information (step S119).
In addition, the process of step S115-S119 is newly performed for every certain period (regularly or every predetermined opportunity). For example, every time the processes of steps S111 and S112 are executed (every new encryption control information is obtained), the processes of steps S115 to S119 may be newly executed, or the processes of steps S113 and S114 may be executed. Each time it is executed (every time new usage environment information is obtained), the processing of steps S115 to S119 may be newly executed.

The control information application unit 127 requests control information from the control information acquisition unit 126 at regular intervals (periodically or at predetermined intervals) (step S120). For example, every time the processes of steps S <b> 115 to S <b> 119 are executed, the control information application unit 127 requests the control information acquisition unit 126 for control information.
If the control information has been obtained in the decoding process of step S119, the control information application unit 127 sends the obtained control information to the control information application unit 127. On the other hand, if the control information is not obtained in the decoding process of step S119, the control information application unit 127 sends information indicating that “control information was not obtained” to the control information application unit 127. Note that the case where the control information cannot be obtained by the decryption process in step S119 means that the terminal apparatus 12 cannot communicate with the key management apparatus 13 in step S115, in addition to the case where the decryption process in step S119 has not been correctly performed. A case where the authentication process has failed is also included (step S121).

  The control information application unit 127 holds the transmitted control information and information indicating that the control information has not been obtained. At this time, the control information is stored in a tamper-resistant area or the control information is temporarily stored in the memory 122 or the like so that the control information is not misused (unintentional reuse or leakage to a third party). May be.

  When control information is sent from the control information acquisition unit 126 to the control information application unit 127, the control information application unit 127 uses the sent control information to execute a specific application installed in the terminal device 12. Decide whether to allow or not. For example, the control information application unit 127 permits the execution by the execution unit 128 of the applications installed in the terminal device 12 that are designated as “ON” in the control information or the default control information. Although specified, execution by the execution unit 128 is rejected.

The execution unit 128 controls the execution of the application according to the determination of the control information application unit 127, and controls the use of the service by the user. FIG. 3A is an example of a display screen of the terminal device 12 when execution of all applications (AP1 to AP9) installed in the terminal device 12 is permitted. In this example, the icons of all the applications (AP1 to AP9) are displayed on the display screen, and all the applications (AP1 to AP9) can be used. FIG. 3B is an example of a display screen of the terminal device 12 when execution of the applications (AP7 to AP9) is permitted but execution of the applications (AP1 to AP6) is denied. In this example, only the icons of the applications (AP7 to AP9) are displayed on the display screen, and only these applications (AP7 to AP9) can be used.
After application of control information, this information is deleted so that the encryption control information, control information, decryption key, etc. that were stored until then are not misused (unintentional reuse or leakage to third parties). Also good.

  On the other hand, when information indicating that “control information was not obtained” is sent from the control information acquisition unit 126 to the control information application unit 127, the control information application unit 127 is installed in the terminal device 12 according to the default control information described above. The execution unit 128 determines whether to allow the execution unit 128 to execute the specified application, and controls the execution of the application according to the determination. For example, if default control information that allows the execution unit 128 to execute all applications installed in the terminal device 12 is set, the terminal device 12 is placed in a home where a corporate SSID is not acquired. All applications can be used, and when the terminal device 12 is arranged in a company where the company's SSID is acquired, it is possible to control only applications that comply with the company policy. (Step S122).

[Modification 1 of Embodiment]
In the above-described embodiment, the description has been made on the assumption that the service user personally holds the terminal device 12 in the company to which the service user belongs and uses the terminal device 12 as it is as a work terminal device in the company. However, this does not limit the invention. For example, if a movie theater is assumed instead of a company, applications that generate sound such as ringtones are forcibly turned off. If a train or bus is assumed instead of a company, applications that can make calls are set to “OFF”. It is possible to protect manners.

[Modification 2 of the embodiment]
Implementation of the above-mentioned service for bringing the smartphone terminal device personally owned by the service user into a store that provides books such as manga cafes, and allowing the content of the book or the like to be viewed on the smartphone terminal device only within the store The form can also be diverted. Below, it demonstrates centering on difference with the above-mentioned embodiment. Other matters are as described in the above embodiment.

  In this case, “company” in the above-described embodiment is replaced with “store”. Only the terminal device 12 arranged in a specific store can communicate with the control device 11 and the key management device 13 through the network, and can acquire the encryption control information and the decryption key (FIG. 6B). The terminal device 12 arranged outside a specific store cannot communicate with the control device 11 and the key management device 13, and cannot obtain the encryption control information and the decryption key (FIG. 6A).

  A dedicated viewer application (application) for content such as a book installed in advance on the terminal device 12 which is a smartphone terminal device is set as a control target. It is assumed that contents such as books handled in this store are stored in a dedicated format that cannot be viewed unless this viewer application is used, and these contents are stored in the server device of the store. Further, when the terminal device 12 is placed outside the store, the viewer application cannot be used, and when the terminal device 12 is placed in the store, the viewer application can be used. Information is set.

  For example, an encryption key including encryption condition information (such as an SSID in the store) that sets control information for turning on execution of the viewer application as control information to be encrypted and that indicates an area in a specific store It is assumed that encrypted control information is obtained by encrypting the control information using an encryption key corresponding to the generated information. In addition, information for setting the execution of the viewer application to “OFF” is set as the default control information described above. Thereby, when the terminal device 12 is arranged at a home where the SSID in the store cannot be acquired, the terminal device 12 cannot execute the viewer application, and the terminal device 12 is in a specific store where the SSID in the store can be acquired. Is placed on the terminal device 12, a viewer application can be started to browse books and the like stored in the store server device.

[Modification 3 of the embodiment]
The above-described embodiment is a service that allows a service user to personally own a smartphone terminal device into a store that provides food and drink such as an izakaya, and allows contents such as menus to be viewed on the smartphone terminal device only within the store. Can be diverted. Below, it demonstrates centering on difference with the above-mentioned embodiment. Other matters are as described in the above embodiment.

  In this case, “company” in the above-described embodiment is replaced with “store”. Only the terminal device 12 arranged in a specific store can communicate with the control device 11 and the key management device 13 through the network, and can acquire the encryption control information and the decryption key (FIG. 6B). The terminal device 12 arranged outside a specific store cannot communicate with the control device 11 and the key management device 13, and cannot obtain the encryption control information and the decryption key (FIG. 6A).

  A dedicated viewer application (application) for content such as a menu installed in advance in the terminal device 12 which is a smartphone terminal device is set as a control target. It is assumed that menus and the like handled in this store are stored in a dedicated format that cannot be viewed without using this viewer application, and contents such as menus are stored in the server device of the store. When the terminal device 12 is arranged outside the store, the viewer application cannot be used, and when the terminal device 12 is arranged in the store, there is control information that enables the viewer application to be used. Is set.

  For example, an encryption key including encryption condition information (such as an SSID in the store) that sets control information for turning on execution of the viewer application as control information to be encrypted and that indicates an area in a specific store It is assumed that encrypted control information is obtained by encrypting the control information using an encryption key corresponding to the generated information. In addition, information for setting the execution of the viewer application to “OFF” is set as the default control information described above. Thereby, when the terminal device 12 is arranged in another store where the SSID or the like in a specific store that is executing a campaign or the like cannot be acquired, the terminal device 12 cannot execute the viewer application. Or, as default control information, if you set control information to turn off viewer application execution for specific campaign-compatible content, another store that cannot acquire the SSID in the specific store that is running the campaign In the case where the terminal device 12 is arranged, the terminal device 12 can execute the viewer application but cannot use the campaign-compatible content. On the other hand, the terminal device 12 arranged in a specific store that is carrying out a campaign or the like can acquire the SSID, can execute a viewer application, and can view campaign-compatible content and the like.

  In addition, when a plurality of terminal devices 12 exist in a store, the plurality of terminal devices 12 present in the store may be connected to each other via a P2P network so that control information held by each of them can be transmitted and received. When control information is obtained by any of the terminal devices 12, the obtained control information is transmitted to the other terminal devices 12 through the P2P network. Thereby, the control information obtained by any one of the terminal devices 12 can be used by other terminal devices 12. At this time, if only a plurality of terminal devices 12 arranged in a specific store are connected by the P2P network, control information is transmitted to the terminal device 12 arranged outside the specific store, and the specific information It is possible to prevent the viewer application from being executed on the terminal device 12 arranged outside the store.

[Modification 4 of the embodiment]
A service that enables a service user to bring a personally owned smartphone terminal device to the library and use it in the same way as a work terminal device in a company when working remotely at the library The above-described embodiment can also be diverted. Below, it demonstrates centering on difference with the above-mentioned embodiment. Other matters are as described in the above embodiment.

  A terminal device 12 that is not arranged in a specific company or a specific library can communicate with the control device 11 managed by the company through a network, and can acquire encryption control information (FIG. 6C). The terminal device 12 arranged in a specific company can communicate with the control device 11 and the key management device 13 through the network, and can acquire the encryption control information and the decryption key (FIG. 6B). The terminal device 12 arranged in a specific library can communicate with the key management device 13 through the network and can acquire the decryption key, but cannot communicate with the control device 11 and cannot acquire the encryption control information (see FIG. 6D).

  The application previously installed in the terminal device 12 which is a smart phone terminal device is set as a control target. When the terminal device 12 is located outside a specific company, all these applications can be used. When the terminal device 12 is located within a specific company or a specific library, it is suitable for the terminal usage policy of the company. Control information that makes it impossible to use any application is set.

  For example, control information that sets “ON” to execute an application that is permitted to be used in the company and “OFF” to execute an application that is denied to be used in the company is set as control information to be encrypted. In addition, information for setting the execution of the viewer application to “OFF” is set as the default control information described above. Encryption control information obtained by encrypting the control information using an encryption key corresponding to encryption key generation information including encryption condition information (such as SSID in the company) representing an area in a specific company; Encryption control information obtained by encrypting the control information using the encryption key corresponding to the encryption key generation information including the encryption condition information (SSID etc. in the library) representing the area in the specific library Is transmitted from the control device 11 to the terminal device 12. The timing at which the terminal device 12 acquires the encryption control information from the control device 11 may be the same as in the above-described embodiment. For example, the terminal device 12 is connected to the control device 11 before the terminal device 12 is placed in the library. Such as timing.

  Even if the terminal device 12 cannot communicate with the control device 11, the terminal device 12 attempts to decrypt the encryption control information acquired in advance, and if the control information is obtained by any decryption process, the control information obtained The control based on the default control information is performed when the control information is not obtained by any decoding process. Thereby, when the terminal device 12 is arranged at a home where a SSID of a specific company or library is not acquired, all applications installed in the terminal device 12 can be used, and the specific company D or When the terminal device 12 is arranged in the company or the library where the SSID of the library is acquired, it is possible to perform control such that only applications complying with the in-house policy can be used.

[Modification 5 of the embodiment]
In the above-described embodiment, an application installed in the terminal device 12 personally owned by the service user is a control target, and when the terminal device 12 is arranged outside the company, all these applications are used. In the case where the application is permitted and the application is not arranged in the company, the application that is not suitable for the terminal usage policy of the company is exemplified. In addition, the attendance management application suitable for the company's terminal usage policy is installed in the terminal device 12, and the terminal device 12 uses the attendance management application only when the terminal device 12 is arranged in the company. Control may be performed to allow In other words, the attendance management application may be included as one of the applications to be controlled, and control may be performed such that the attendance management application can be used only when the terminal device 12 is disposed in the company. It is assumed that the attendance management information handled by the company is stored in a dedicated format that cannot be updated and viewed without using the attendance management application, and the attendance management information is stored in the company server apparatus.

  Such processing can be executed in the same manner as in the above-described embodiment. However, in the following, an example is shown in which control information that specifies permission or denial of use by a blacklist tag, a whitelist tag, or an append tag is used. Below, it demonstrates centering on difference with the above-mentioned embodiment. Other matters are as described in the above embodiment.

  The control information that designates permission or denial of use by the black list tag is a list indicating applications that can be installed in the terminal device 12, and only those applications that are not desired to be used within the company among those applications are black risk. A list in which tags are associated. The control information that designates permission or denial of use by the white list tag is a list indicating applications that can be installed in the terminal device 12, and the white risk tag is applied only to applications that are desired to be used in the company among those applications. Is an associated list. The control information that designates permission or denial of use by the append tag is a list indicating applications that can be installed in the terminal device 12, and the append tag corresponds only to applications that are desired to be used within the company. It is an attached list. Not only control information associated with only one of the whitelist tag, blacklist tag, and append tag, but also control information associated with a plurality of types of tags among the whitelist tag, blacklist tag, and append tag Is also acceptable.

  When using control information that specifies permission or denial of use only by a blacklist tag, the control information application unit 127 rejects execution of an application associated with a blacklist tag and is not associated with a blacklist tag. By permitting the execution of the application, the company that creates the control information explicitly designates the application that is not permitted to be used in the company without knowing all the applications installed on the terminal device 12 by each user. Can be used.

  When using control information that designates permission or denial of use only by a white list tag, the control information application unit 127 permits execution of an application associated with the white list tag, and is not associated with the white list tag. By rejecting the execution of the application, the company that creates the control information explicitly designates the application that is not permitted to be used in the company without knowing all the applications installed on the terminal device 12 by each user. Can be used.

  When using control information that designates permission or denial of use only by an append tag, the control information application unit 127 permits execution of an application associated with the append tag, and executes an application not associated with the append tag. Do not change permission or refusal.

  When using control information in which a blacklist tag and a whitelist tag coexist, for example, when both the blacklist tag and the whitelist tag are associated with the same application, the whitelist tag is used instead of the blacklist tag. By setting priorities such as giving priority to control based on the control information, various control information can be set. In addition, by setting priorities such as making the append tag higher in priority than the black list tag and the white list tag, it is possible to set various control information.

The control method based on such control information is illustrated using FIG.
In the case of the control method illustrated in FIG. 7, the control information application unit 127 acquires all the control target applications in the terminal device, and each control target application (APx) among them is listed in the append list tag. (Step S210). If the application (APx) is listed in the append list tag, the execution of the application (APx) is permitted (step S206).

  When the application (APx) is not listed in the append list tag, the control information application unit 127 determines whether a white list tag exists in the control information (step S202). When the white list tag exists in the control information, the control information application unit 127 determines whether the application (APx) is listed in the white list tag (step S204). The control information application unit 127 permits execution of the application (APx) when the application (APx) is listed in the white list tag (step S206), and executes the application (APx) when the application (APx) is not listed. Rejected (step S207).

  If no white list tag exists in the control information, the control information application unit 127 determines whether a black list tag exists in the control information (step S203). When the black list tag does not exist in the control information, the control information application unit 127 permits execution of the application (APx) (step S206). When a black list tag exists in the control information, the control information application unit 127 determines whether the application (APx) is listed in the black list tag (step S205). The control information application unit 127 rejects execution of the application (APx) when the application (APx) is listed in the black list tag (step S207), and executes the application (APx) when the application (APx) is not listed. Allow (step S206).

この制御情報の場合、アプリケーション（ＡＰ１，ＡＰ２）の実行が拒否され、その他のアプリケーション（ＡＰ３〜ＡＰ９）の実行が許可される。 Hereinafter, the control method illustrated in FIG. 7 will be described using specific control information as an example.
The following is an example of control information that specifies permission or denial of execution by a blacklist tag.

In the case of this control information, the execution of the applications (AP1, AP2) is rejected, and the execution of the other applications (AP3 to AP9) is permitted.

この制御情報の場合、アプリケーション（ＡＰ１，ＡＰ２）の実行が許可され、その他のアプリケーション（ＡＰ３〜ＡＰ９）の実行が拒否される。 The following is an example of control information that specifies permission or denial of execution using a whitelist tag.

In the case of this control information, execution of the applications (AP1, AP2) is permitted, and execution of the other applications (AP3 to AP9) is rejected.

この制御情報の場合、アペンドリストタグによって指定されたアプリケーション（ＡＰ４）の実行が許可され、それ以外のアプリケーション（ＡＰ１〜ＡＰ３，ＡＰ５〜ＡＰ９）についてはホワイトリストタグに対応する制御が有効となる。結果として、アプリケーション（ＡＰ１，ＡＰ２，ＡＰ４）の実行が許可され、その他のアプリケーション（ＡＰ３，ＡＰ５〜ＡＰ９）の実行が拒否される。 The following is an example of control information that specifies permission or denial of execution by means of an append list tag.

In the case of this control information, execution of the application (AP4) specified by the append list tag is permitted, and control corresponding to the white list tag is valid for the other applications (AP1 to AP3, AP5 to AP9). As a result, execution of the applications (AP1, AP2, AP4) is permitted, and execution of the other applications (AP3, AP5 to AP9) is rejected.

この制御情報の場合、アペンドリストタグによって指定されたアプリケーション（ＡＰ２）の実行が許可され、それ以外のアプリケーション（ＡＰ１，ＡＰ３〜ＡＰ９）についてはブラックリストタグに対応する制御が有効となる。結果として、アプリケーション（ＡＰ１）の実行が拒否され、その他のアプリケーション（ＡＰ２〜ＡＰ９）の実行が許可される。 The following are examples of other control information that designates permission or denial of execution by the append list tag.

In the case of this control information, the execution of the application (AP2) specified by the append list tag is permitted, and the control corresponding to the black list tag is effective for the other applications (AP1, AP3 to AP9). As a result, execution of the application (AP1) is rejected, and execution of other applications (AP2 to AP9) is permitted.

この制御情報の場合、ホワイトリストタグに対応する効果のみが有効となり、ブラックリストタグに対応する効果は無効化される。結果として、アプリケーション（ＡＰ１，ＡＰ２）の実行が許可され、その他のアプリケーション（ＡＰ３〜ＡＰ９）の実行が拒否される。 The following is an example of control information that specifies permission or denial of execution by a blacklist tag and a whitelist tag.

In the case of this control information, only the effect corresponding to the white list tag is valid, and the effect corresponding to the black list tag is invalidated. As a result, the execution of the applications (AP1, AP2) is permitted, and the execution of the other applications (AP3 to AP9) is rejected.

[Modification 6 of the embodiment]
In the above-described embodiment, the decryption key acquisition unit 125 and the control information acquisition unit 126 are obtained by reading the control AP into the computer, and the execution of each application installed in the terminal device 12 is controlled. However, instead of using the control AP, the application itself installed in the terminal device 12 has the function of the control AP (control application internal application / control AP built-in AP), and the control AP built-in AP is read into the computer, A decryption key acquisition unit 125, a control information acquisition unit 126, a control information application unit 127, and an execution unit 128 may be configured. In this case, each application itself monitors ON / OFF of its own activation. Below, it demonstrates centering on difference with the above-mentioned embodiment. Other matters are as described in the above embodiment.

  In this modification, the terminal device 12 of the terminal device control system 1 of the above-described embodiment is replaced with the terminal device 12 'illustrated in FIG. Several APs with built-in control APs are installed in the terminal device 12 'in this example. The terminal device 12 ′ includes a control unit 121, a memory 122, a communication unit 123a (encryption control information input unit), a communication unit 123b (decryption key input unit), a use environment acquisition unit 124, and a decryption key acquisition unit. 125, a control information acquisition unit 126, a control information application unit 127, and an execution unit 128. Each of these functional units is configured, for example, by reading and executing a special program in a computer. In particular, the decryption key acquisition unit 125, the control information acquisition unit 126, the control information application unit 127, and the execution unit 128 are obtained by reading and executing the control AP built-in AP in the computer.

  The pre-processing and setting processing of this modification are the same as in the above-described embodiment. The control process of this modification is as shown in FIG. That is, each step executed by the decryption key acquisition unit 125, the control information acquisition unit 126, the control information application unit 127, and the execution unit 128 of the terminal device 12 is obtained by reading the control AP built-in AP into the computer. The decryption key acquisition unit 125, the control information acquisition unit 126, the control information application unit 127, and the execution unit 128 execute “. Others are the same as described in the above embodiment.

  9A and 9B show the terminal device 12 in the case where one application (AP3) among the applications (AP1 to AP9) installed in the terminal device 12 ′ is an AP with built-in control AP that monitors its own ON / OFF. 'An example of a display screen. Other applications are always executable. In the example of FIG. 9A, execution of the application (AP3), which is the AP with a built-in control AP, is permitted and the application (AP3) is activated, and the icons of all the applications (AP1 to AP9) are displayed on the display screen. Applications (AP1 to AP9) can be used. In the example of FIG. 9B, the execution of the application (AP3) that is the control AP built-in AP is rejected, the application (AP3) that is the control AP built-in AP is not activated, and the icon is not displayed on the display screen. Icons of other applications (AP1, AP2, AP4 to AP9) are displayed on the display screen. In the above modification, the activation state and display state of the control AP built-in AP have been described. However, the modification is not limited to the activation state and the display state. For example, a method of controlling the operation behavior of the control AP built-in AP, such as terminating the application itself, displaying a message in a pop-up, or sending a mail, may exist as the embodiment.

[Modification 7 of the embodiment]
It is assumed that there are a plurality of control devices 11 and the processing of the first embodiment is executed by communicating with the terminal device 12 by wireless communication or the like. In addition, it is assumed that areas where each control device 11 can be connected to the terminal device 12 are defined, but these areas partially overlap.

  For example, as illustrated in FIG. 11, it is assumed that there is a control device 11 and a control device 11 ′ (adjacent control device) configured similarly to the control device 11. The terminal device 12 arranged in the area A cannot be connected to any of the control devices 11 and 11 'and cannot acquire the encryption control information (FIG. 12A). The terminal device 12 arranged in the area B can be connected to the control device 11 and can obtain the encryption control information transmitted from the control device 11, but the encryption control information (adjacent encryption) transmitted from the control device 11 ′. Control information) cannot be acquired (FIG. 12B). The terminal device 12 arranged in the area C can be connected to the control device 11 ′ and can acquire the encryption control information transmitted from the control device 11 ′, but can acquire the encryption control information transmitted from the control device 11. Not possible (FIG. 12C). The terminal device 12 arranged in the area D can be connected to both the control devices 11 and 11 ′, and the encryption control information transmitted from the control device 11 and the encryption control information transmitted from the control device 11 ′ are received. You can get it. Further, the terminal device 12 arranged in the area A cannot connect to the key management apparatus 13 and cannot acquire the decryption key (FIG. 12A), and the terminal apparatus 12 arranged in the areas B to D connects to the key management apparatus 13. And the decryption key can be acquired (FIGS. 12B to 12D).

  In such a case, the terminal device 12 arranged in the region B controls the use of the application based on the control information set by the control device 11, and the terminal device 12 arranged in the region C is controlled by the control device 11 ′. The use of the application is controlled based on the control information (adjacent control information) set in (1), and the terminal device 12 arranged in the area A controls the use of the application based on the default control information. On the other hand, the control information acquisition unit 126 of the terminal device 12 arranged in the region D can acquire both the control information set by the control device 11 and the control information set by the control device 11 ′. In such a case, the control information application unit 127 selects one control information from the control information according to a predetermined priority order, and uses the selected control information to execute a specific application to the execution unit 128. Decide whether to allow.

For example, the control information application unit 127 selects control information (control information with as many “OFF” as possible) that rejects execution of the largest number of applications from the obtained control information. Alternatively, selection of control information that permits execution of the largest number of applications (control information that has “ON” as much as possible) among the obtained control information may be selected. Alternatively, when there is only one application to be controlled, the control information application unit 127 selects control information that rejects execution of the application (control information having “OFF”) from the obtained control information. . Control information may be selected based on other priorities.
This modification can also be applied when there are three or more control devices.

<Features of the embodiment>
The service provider can use the service (content, application, device) provided by the terminal device in an appropriately controlled state according to the usage environment of the terminal device of the service user.

  When the service provider controls the use of the service provided by the terminal device according to the usage environment of the terminal device of the service user, the service provider sends a permission condition corresponding to the terminal device to the service provider. There is no need to do. This eliminates the need for protection of information indicating permission conditions and management of a secret key associated therewith.

  When the service provider controls the use of the service provided by the terminal device according to the usage environment of the terminal device of the service user, the transmission of encryption control information transmitted from the control device to the terminal device Can be performed independently of the user's authentication. Accordingly, there is no need for linkage processing between a device that transmits information for controlling the use of the service and a device that executes authentication processing, and system construction and operation are facilitated.

  Since the identification information for controlling the usage environment of the service user is included in the encryption and decryption algorithms, it is not necessary to transmit the permission condition to the terminal device of the service user.

  Since the control device encrypts the control information and transmits it to the terminal device, the contents of the control information are not leaked to a third party or used.

  When the terminal device acquires the encryption control information from the control device, it is not necessary to perform special processing between the key management device (authentication server device) and the control device (authorization server). Even when the control information and usage conditions are updated, it is not necessary to perform special processing between the key management device (authentication server device) and the control device (authorization server).

[Other variations, etc.]
The present invention is not limited to the above-described embodiment. For example, although the case where the service to be controlled is an application has been illustrated in the above-described embodiment and the modification thereof, a service executed by a device, content, or other terminal device may be a control target. Moreover, although the case where a terminal device was a smart phone terminal was illustrated in the above-mentioned embodiment etc., it is good also considering a mobile phone, a portable information terminal, a personal computer, etc. as a terminal device.

  In the above embodiment and its modifications, the control information is encrypted according to the ID-based encryption method, but the predicate encryption method (reference document 2 “Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products,” with Amit Sahai and Brent Waters One of 4 papers from Eurocrypt 2008 invited to the Journal of Cryptology, Reference 3, “Allison Lewko, Tatsuaki Okamoto, Amit Sahai, Katsuyuki Takashima and Brent Waters,” Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption, “Advances in Cryptology-EUROCRYPT 2010, LNCS, 2010, Volume 6110/2010, 62-91” etc.) and functional cryptography (Ref. General Relations from the Decisional Linear Assumption, “Advances in Cryptology-CRYPTO 2010, LNCS, 2010, Volume 6223/2010, 191-208” etc.) Control information is encrypted according to other encryption methods It may be. When the ID-based encryption method is used, when the encryption key generation information and the decryption key generation information are equal, the control information is obtained by performing the decryption process of the encryption control information using the decryption key. On the other hand, when the predicate encryption method is used, for example, the encryption key generation information and the decryption key generation information are respectively vectors, and control information is obtained when the inner product thereof is 0 (reference documents 2, 3, etc.). ). When the functional encryption method is used, for example, the encryption key generation information and the decryption key generation information are each a set of vectors, and from a specific hierarchical secret sharing value corresponding to a set of vectors whose inner product is 0 Control information is obtained when the secret value is restored (reference document 4 etc.). The same applies when the encryption key generation information and the decryption key generation information are updated to new encryption key generation information and decryption key generation information.

  In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. For example, instead of executing steps S113 and S114 after steps S111 and S112, steps S111 and S112 may be executed after steps S113 and S114. Needless to say, other modifications are possible without departing from the spirit of the present invention.

Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.
The program describing the processing contents can be recorded on a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium are a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads the program stored in its own recording device and executes the process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

DESCRIPTION OF SYMBOLS 1 Terminal device control system 11 Control device 12 Terminal device 13 Key management device

Claims (15)

An encryption key in which control information indicating whether or not an arbitrary terminal device is permitted to execute a specific service corresponds to encryption condition information indicating a use environment of the arbitrary terminal device and includes the encryption condition information A control device that outputs encryption control information obtained by encrypting the control information corresponding to the encryption condition information using an encryption key corresponding to the generation information;
An execution unit that executes a service, an encryption control information input unit that receives input of the encryption control information, a use environment acquisition unit that obtains use environment information representing its own use environment, and a decryption key including the use environment information A decryption key generation information output unit that outputs generation information; a decryption key input unit that receives an input of a decryption key generated for the decryption key generation information; and a decryption process of the encryption control information using the decryption key And a control information application unit that uses the control information when the control information acquisition unit obtains the control information and determines whether to allow the execution unit to execute a specific service. A terminal device including:
A key including a decryption key generation information input unit that receives input of the decryption key generation information, a decryption key generation unit that generates the decryption key corresponding to the decryption key generation information, and a decryption key output unit that outputs the decryption key A management device;
Have
When the encryption key generation information and the decryption key generation information satisfy a predetermined relationship, the control information is obtained by performing a decryption process of the encryption control information using the decryption key. Device control system. The terminal device control system according to claim 1,
The usage environment acquisition unit obtains new usage environment information every certain period,
The decryption key generation information output unit outputs new decryption key generation information including the new use environment information every time the new use environment information is obtained,
The decryption key generation information input unit accepts input of the new decryption key generation information,
The decryption key generation unit generates a new decryption key corresponding to the new decryption key generation information each time the new decryption key generation information is input to the decryption key generation information input unit,
The decryption key output unit outputs the new decryption key each time the new decryption key is generated,
The decryption key input unit accepts an input of the new decryption key,
The control information acquisition unit performs the decryption process of the encryption control information using the new decryption key every time the new decryption key is input to the decryption key input unit,
Whether the control information application unit permits the execution unit to execute a specific service each time the control information acquisition unit newly obtains the control information, using the newly obtained control information. Decide
When the encryption key generation information and the new decryption key generation information satisfy a predetermined relationship, the control information is obtained by performing a decryption process of the encryption control information using the new decryption key. Obtained terminal device control system. The terminal device control system according to claim 2,
The control device generates new first additional information every time the control information corresponding to the encryption condition information is updated to new control information, and generates the encryption condition information and the new first addition information. Outputting new encryption control information obtained by encrypting the new control information using a new encryption key corresponding to new encryption key generation information including information,
The new decryption key generation information further includes new second additional information having a specific correspondence with the new first additional information,
The control information acquisition unit performs a decryption process of the new encryption control information using the new decryption key,
The control information application unit determines whether to allow the execution unit to execute a specific service using the new control information when the new control information is obtained by the control information acquisition unit,
When the new encryption key generation information and the new decryption key generation information satisfy a predetermined relationship, the new encryption control information is decrypted using the new decryption key. A terminal device control system from which the new control information can be obtained. The terminal device control system according to any one of claims 1 to 3,
Adjacency control information indicating whether or not an arbitrary terminal device is permitted to execute a specific service corresponds to adjacent encryption condition information indicating a use environment of the arbitrary terminal device, and includes the adjacent encryption condition information. It further includes an adjacency control device that outputs adjacency control information obtained by encrypting the adjacency control information corresponding to the adjacency encryption condition information using an adjacency encryption key corresponding to the adjacency encryption key generation information. ,
The encryption control information input unit further accepts input of the adjacent encryption control information,
The control information acquisition unit further performs a decryption process of the adjacent encryption control information using the decryption key,
The control information application unit selects and selects one control information or adjacent control information from the control information and the adjacent control information when the control information and the adjacent control information are obtained by the control information acquisition unit. A terminal device control system that uses the control information or the adjacency control information, and determines whether or not to allow the execution unit to execute a specific service. The terminal device control system according to claim 4,
When the control information acquisition unit obtains the control information and the adjacency control information, the control information application unit rejects the execution of the most services among the control information and the adjacency control information, or the adjacency information A terminal device control system that selects control information, or selects control information or adjacency control information that permits execution of the largest number of services among the control information and adjacency control information. The terminal device control system according to any one of claims 1 to 5,
A terminal device control system in which only the terminal device arranged in a specific region can communicate with the key management device, and the decryption key is inputted only to the terminal device arranged in the specific region. The terminal device control system according to any one of claims 1 to 6,
The control information application unit determines whether to allow the execution unit to execute a specific service according to predetermined default control information when the control information acquisition unit cannot obtain the control information. , Terminal device control system. The terminal device control system according to any one of claims 1 to 6,
The control device further outputs type information indicating the type of usage environment represented by the encryption condition information,
The encryption control information input unit further accepts input of the type information,
The terminal environment control system, wherein the usage environment acquisition unit obtains the usage environment information representing the usage environment of the type represented by the type information.   An encryption key in which control information indicating whether or not an arbitrary terminal device is permitted to execute a specific service corresponds to encryption condition information indicating a use environment of the arbitrary terminal device and includes the encryption condition information A control device that outputs encryption control information obtained by encrypting the control information corresponding to the encryption condition information using an encryption key corresponding to the generation information. An execution unit for executing the service;
An encryption control information input unit for receiving input of the encryption control information;
A usage environment acquisition unit that obtains usage environment information representing its own usage environment;
A decryption key generation information output unit for outputting decryption key generation information including the use environment information;
A decryption key input unit for receiving an input of a decryption key generated for the decryption key generation information;
A control information acquisition unit that performs decryption processing of the encryption control information using the decryption key;
A control information application unit that determines whether or not to allow the execution unit to execute a specific service when the control information is obtained by the control information acquisition unit;
A terminal device. The control information indicating whether or not to permit the execution of a specific service to an arbitrary terminal device corresponds to the encryption condition information indicating the usage environment of the arbitrary terminal device. Outputting encryption control information obtained by encrypting the control information corresponding to the encryption condition information using an encryption key corresponding to the included encryption key generation information;
Receiving input of the encryption control information in a terminal device;
Obtaining usage environment information representing a usage environment of the terminal device in the terminal device;
Outputting decryption key generation information including the usage environment information in the terminal device;
Accepting input of the decryption key generation information in a key management device;
Generating the decryption key corresponding to the decryption key generation information in the key management device;
Outputting the decryption key in the key management device;
Receiving the input of the decryption key at the terminal device;
Performing decryption processing of the encryption control information using the decryption key in the terminal device;
When the control information is obtained, determining whether to allow the terminal device to execute a specific service using the control information in the terminal device;
Have
Control in which the control information is obtained by performing a decryption process of the encryption control information using the decryption key when the encryption key generation information and the decryption key generation information satisfy a predetermined relationship. Method.   The control information indicating whether or not to permit the execution of a specific service to an arbitrary terminal device corresponds to the encryption condition information indicating the usage environment of the arbitrary terminal device. A control method for outputting encryption control information obtained by encrypting the control information corresponding to the encryption condition information using an encryption key corresponding to the included encryption key generation information. Receiving the input of the encryption control information in the encryption control information input unit of the terminal device;
In the usage environment acquisition unit of the terminal device, obtaining usage environment information representing the usage environment of itself,
Outputting decryption key generation information including the use environment information at a decryption key generation information output unit of the terminal device;
Receiving the input of the decryption key generated for the decryption key generation information in the decryption key input unit of the terminal device;
A step of decrypting the encryption control information using the decryption key in the control information acquisition unit of the terminal device;
When the control information acquisition unit of the terminal device obtains the control information, the control information application unit uses the control information to determine whether to permit the terminal device to execute a specific service; ,
A control method.   A program for causing a computer to function as the control device according to claim 9.   The program for functioning a computer as a terminal device of Claim 10.

Images