JP5143186B2 - Information communication method and server - Google Patents

Description

  The present invention relates to an information communication method and server for encrypting unique information of a communication terminal device when content is distributed via a network.

  Generally, a communication terminal device on the user side establishes an SSL (Secure Sockets Layer) session, for example, when it is desired to securely transmit and receive information to and from a portal server. SSL shares a key for data encryption between a communication terminal device and a server by key exchange using public key encryption, and encrypts a message for transmission / reception (Patent Document 1). This protocol is also defined as RFC (Request For Comment) 4346 “The Transport Layer Security Protocol Version 1.1”.

US Pat. No. 5,657,390

Here, as the communication terminal device on the user side, an image display device, for example, a digital broadcast receiving device (television receiver) can be considered. This digital broadcast receiving apparatus establishes an SSL session with the portal server and displays an image distributed from the portal server.
In the above-described technology, the portal server and the customer management server are often configured separately as the server-side configuration. As a result, when providing a unique service to a customer or a terminal device, it is necessary to authenticate the terminal device or the customer by inputting, for example, an ID or a password.

  In view of the above, an object of the present invention is to provide an information communication method and server capable of securely authenticating information of a communication terminal device without inputting an ID, a password, or the like.

An information communication method according to an aspect of the present invention includes a step in which a first server shares a first encryption key with a communication terminal device, and the first server receives a second from the communication terminal device. Receiving the identification information of the communication terminal device encrypted with the encryption key and the first encryption key; and the first server decrypting the identification information of the communication terminal device with a first decryption Decrypting with a key, a second server authenticating the communication terminal device receiving the identification information of the communication terminal device decrypted with the first server, and the second server, A step of decrypting the received identification information of the communication terminal device with a second decryption key; and the second server, based on the decrypted identification information of the communication terminal device, the communication terminal device a step of authenticating the second server But on the basis of the authentication, encrypting with said second encryption key identification information of the communication terminal identification information of the device and including a first server identification information the communication terminal device, the A first server receiving the authentication result; a first server distributing content to the communication terminal device based on the received authentication result; and the first server A step of encrypting the encrypted identification information of the communication terminal device with the first encryption key, and the first server identifying the encrypted identification information of the communication terminal device, And transmitting to the communication terminal device .

A server according to an aspect of the present invention encrypts a sharing unit that shares a first encryption key with a communication terminal device, a second encryption key from the communication terminal device, and the first encryption key. When the received identification information of the communication terminal apparatus is received, a first decryption unit that decrypts the identification information of the communication terminal apparatus with a first decryption key, and the decrypted communication terminal apparatus When receiving the authentication result of the communication terminal device from the first transmission unit that transmits the identification information to the second server and the second server, content is transmitted to the communication terminal device based on the authentication result. And when receiving the identification information of the communication terminal device encrypted with the second encryption key from the second server, the identification information of the communication terminal device is received as the first identification information. A first encryption unit for encrypting with the encryption key of A third transmission unit for transmitting identification information of the serial communication terminal apparatus to the communication terminal device, the first server having, when receiving the identification information of the communication terminal apparatus from said first server, A second decryption unit that decrypts the identification information of the communication terminal device with a second decryption key, and an authentication unit that authenticates the communication terminal device based on the decrypted identification information of the communication terminal device And a second encryption for encrypting the identification information of the communication terminal device including the identification information of the communication terminal device and the identification information of the first server based on the authentication with the second encryption key. And a second server having a second transmitting unit that transmits the authentication result and the encrypted identification information of the communication terminal device to the first server. And

  ADVANTAGE OF THE INVENTION According to this invention, the information communication method and server which can authenticate the information of a communication terminal device securely, without inputting ID, a password, etc. can be provided.

It is a conceptual diagram showing the structure of the information communication system which concerns on one Embodiment of this invention. It is a block diagram showing the structure of the communication terminal device which concerns on one Embodiment of this invention. It is a block diagram showing schematic structure of the portal server and customer management server which concern on one Embodiment of this invention. It is a figure showing the operation | movement sequence of the information communication system shown in FIG. 3 is a flowchart showing the operation of the browser shown in FIG. It is a figure showing the structure of the data produced | generated with the communication terminal device which concerns on 1st Embodiment. It is a figure showing the structure of the data produced | generated by the server which concerns on 1st Embodiment. It is a figure showing the structure of the data produced | generated with the communication terminal device which concerns on 2nd Embodiment. It is a figure showing the structure of the data produced | generated by the server which concerns on 2nd Embodiment. It is a figure showing the operation | movement sequence of the information communication system which concerns on 3rd Embodiment. It is a figure showing the structure of the data produced | generated by the server which concerns on 3rd Embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In this embodiment, a digital broadcast receiving apparatus will be described as an example of a communication terminal apparatus.

(First embodiment)
FIG. 1 is a conceptual diagram showing a configuration of an information communication system 1 according to an embodiment of the present invention.

  The information communication system 1 includes a communication terminal device 10, a portal server 20, and a customer management server 30. The communication terminal device 10 and the portal server 20 are connected by an Internet communication network 40 or the like. The portal server 20 and the customer management server 30 are connected by a dedicated line, a LAN 50, or the like.

  The communication terminal device 10 receives digital broadcast radio waves from an antenna (not shown). The communication terminal device 10 transmits the pay broadcast reception history to the portal server 20 of the service provider. The communication terminal device 10 acquires content from the portal server 20. The communication terminal device 10 includes a monitor (not shown) for displaying a content image, a speaker for generating content audio, a card slot for inserting an IC card 151 for limited reception described later, a remote controller (hereinafter referred to as “remote controller”). A remote control receiving unit for receiving an infrared signal from 110.

  FIG. 2 is a block diagram showing the configuration of the communication terminal apparatus 10 according to an embodiment of the present invention. The communication terminal device 10 includes a tuner unit 102, a descrambler 103, a TS decoding unit 104, a video / audio decoding unit 105, a display processing unit 106, a communication processing unit 107, a control unit 108, and a key input unit 109. A remote controller 110, an IC card I / F (interface) unit 111, a memory 112, a DRM processing unit 113, a browser 114, and an authentication processing unit 115.

FIG. 3 is a block diagram showing a schematic configuration of the portal server 20 and the customer management server 30 according to the embodiment of the present invention. The portal server 20 includes communication processing units 201 and 202, a decryption unit 203, a distribution unit 204, a database 205, and an encryption unit 206.
The customer management server 30 includes a communication processing unit 301, a decryption unit 302, an authentication unit 303, and an ID management database 304.

(Characteristics and operation of each part)
The tuner unit 102 selects a desired channel from the digital broadcast wave input to the communication terminal device 10. The tuner unit 102 outputs a transport stream (hereinafter referred to as TS) of the selected channel to the descrambler 103. The TS is scrambled for content protection.
The descrambler 103 descrambles the TS input from the tuner unit 102 or the communication processing unit 107 and outputs the descrambler to the TS decoding unit 104.

The TS decoding unit 104 separates necessary packets from the TS input from the descrambler 103. The TS decoding unit 104 further extracts broadcast program signals (video, audio), various multiplexed data (various SI (Service Information) data, ECM (Entitlement Control Massage), EMM (Entitlement Management Massage), etc.) from the separated packets. ). Further, the TS decoding unit 104 outputs the separated broadcast program signal (video, audio) to the video / audio decoding unit 105.
The video / audio decoding unit 105 decodes the broadcast program signal (video, audio) input from the TS decoding unit 104 and outputs the decoded signal to the display processing unit 106.

  The display processing unit 106 generates display image signals of various types of error information in order to perform an interface function with the user. The display processing unit 106 has a function of outputting the generated image signal instead of the broadcast program signal (video, audio) or synthesizing it with the broadcast program signal (video, audio). Further, the display processing unit 106 generates an EPG (Electronic Program Guide) image signal composed of the SI data separated by the TS decoding unit 104. The display processing unit 106 has a function of outputting the generated image signal instead of the broadcast program signal (video, audio) or synthesizing it with the broadcast program signal (video, audio).

The communication processing unit 107 is connected to a network line such as Ethernet (registered trademark), and transmits and receives data via the network. The communication processing unit 107 has functions of receiving content (VOD (Video on Demand) or IP (Internet Protocol) broadcasting) and license reception from the portal server 20 on the service provider side. The communication processing unit 107 functions as a receiving unit that receives a transmission request for a terminal ID (Identifier) that is identification information of the communication terminal device 10 and authentication information for authenticating the portal server 20.
The control unit 108 is a control unit that controls the entire communication terminal device 10. The control unit 108 controls the function of each block in the communication terminal device 10 connected by a bus connection or a serial communication connection.

  The key input unit 109 includes, for example, a keyboard for inputting information for receiving content distributed from the portal server 20 and information for viewing the content. Similarly, the remote controller 110 has a function of inputting information.

  In the broadcast signal, an ECM is sent to the IC card 151 connected via the IC card I / F unit 111 to obtain a scramble key. This scramble key is set in the descrambler 103 to perform descrambling. For content from communication, the key acquired from the portal server 20 by the DRM processing unit 113 or the key obtained by decrypting the ECM by the DRM processing unit 113 is set in the descrambler 103.

  Information regarding the terminal ID of the communication terminal device 10 is stored in the memory 112 at the time of shipment, for example. When the communication terminal device 10 accesses content, it is conceivable that the customer management server 30 acquires this terminal ID as means for specifying the communication terminal device 10.

FIG. 4 is a diagram showing an operation sequence of the information communication system 1 shown in FIG. The sequence for acquiring the terminal ID is performed via the browser 114 as shown in FIG.
When secure access from the browser 114 of the communication terminal device 10 to the portal server 20 is performed, encrypted communication is performed using an SSL session (defined in RFC 2246) or the like. In this SSL session, the browser 114 interprets the public key certificate (server certificate) signed by the certificate authority CA. Here, when the signature of the certificate authority CA is verified, a key exchange sequence for encrypted communication is executed as a correct server. The session key Ksec (first encryption key, first decryption key) is shared with the portal server 20. The browser 114 functions as a sharing unit that shares the first encryption key with the first server.

Under the SSL session, when the communication terminal apparatus 10 acquires a page including a script for acquiring a terminal ID, the browser 114 performs a terminal ID acquisition process according to the script.
FIG. 5 is a flowchart showing the operation of the browser 114. The browser 114 extracts a specific item of the server certificate acquired when the SSL session is established. For example, name information and domain information in the CN attribute are detected (step S401). In the present embodiment, domain information of the portal server 20 is used as authentication information for authenticating the portal server 20.

  Next, the browser 114 determines whether the detected domain information of the server certificate is domain information that is permitted as a portal server of the service provider (step S402). In this determination, a specific item (identification information: domain information) of the server certificate acquired in the SSL session shown in FIG. 3 is compared with a predetermined value. This predetermined value is domain information of at least one portal server from which the communication terminal device 10 requests content distribution. This predetermined value is a value set in advance by an agreement between the service provider and the user, and is stored in the memory 112 of the communication terminal device 10 in a list format, for example. Further, the service provider and the user use a common key (second encryption key, second decryption key) Kd to perform authentication using encrypted data between the customer management server 30 and the authentication processing unit 115. Share in advance. The common key Kd is stored in the memory 112, for example.

  If the specific item of the server certificate matches the predetermined value (Yes in step S402), the browser 114 proceeds to the next process (steps S403 and S404). When the specific item does not match the predetermined value in the authentication processing unit 115 (No in step S402), the browser 114 responds to the portal server 20 with authentication error data indicating that authentication is not possible (step S405). ). The browser 114 receives the certificate information of the first server acquired when sharing the first encryption key with the first server when receiving the transmission request of the identification information of the own device, and the own device. It compares with the verification information held in it and functions as an authentication unit that requests encryption of the identification information of the own device if they match.

(Processing when a specific item matches a predetermined value)
FIG. 6 is a diagram illustrating a configuration of data generated by the communication terminal device 10 according to the first embodiment. The browser 114 transmits a request for a terminal ID to the authentication processing unit 115.
In response to this request, the authentication processing unit 115 encrypts the terminal ID stored in the memory 112 or the terminal ID derived from the information stored in the memory 112 with a common rule Kd (for example, AES). The common key Kd is a key shared in advance by the customer management server 30 and the authentication processing unit 115, and is stored in the memory 112, for example. The authentication processing unit 115 generates transfer data by adding a header and a frame length to the terminal ID (encrypted data) encrypted with the common key Kd. The authentication processing unit 115 outputs the generated transfer data to the browser 114. The authentication processing unit 115 functions as an encryption unit that encrypts the identification information of the own device with the second encryption key based on the request.

  The browser 114 encrypts the input transfer data with the session key Ksec shared with the portal server 20 by SSL, and generates encrypted transfer data (step S403). Next, the communication processing unit 107 transmits the generated encrypted transfer data to the portal server 20. The browser 114 and the communication processing unit 107 transmit the identification information of the own device encrypted with the second encryption key with the first encryption key and transmit the encrypted identification information to the first server. Function as.

  FIG. 7 is a diagram illustrating a configuration of data generated by the servers 20 and 30 according to the first embodiment. Among these servers, in the portal server 20, the communication processing unit 201 receives encrypted transfer data from the communication terminal device 10. Next, the decryption unit 203 decrypts the encrypted transfer data with the session key Ksec into a terminal ID (encrypted data) to which a header and a frame length are added. The communication processing unit 202 transmits this encrypted data to the customer management server 30. The communication processing unit 201 functions as a receiving unit that receives the transmitted identification information of the communication terminal device. The decryption unit 203 functions as a decryption unit that decrypts the received identification information of the communication terminal device with the first decryption key.

  In the customer management server 30, the communication processing unit 301 receives the encrypted data to which the header and the frame length are added from the portal server 20. Next, the decryption unit 302 decrypts the encrypted data with the common key Kd to obtain terminal ID data. On the server side, the portal server 20 decrypts the terminal ID with the session key Ksec, and the customer management server 30 decrypts the decrypted terminal ID with the common key Kd. As a result, this terminal ID can be acquired securely. The communication processing unit 301 functions as a receiving unit that receives the identification information of the communication terminal device decrypted by the first server. The decryption unit 302 functions as a decryption unit that decrypts the received identification information of the communication terminal device with a second decryption key.

  The authentication unit 303 compares the acquired terminal ID with a predetermined value. The predetermined value is a terminal ID of at least one communication terminal device that is permitted to distribute contents. This predetermined value is stored in advance in a list format in the ID management database 304, for example. The authentication unit 303 functions as an authentication unit that authenticates the communication terminal device based on the decrypted identification information of the communication terminal device.

  Here, when the acquired terminal ID matches a predetermined value, the authentication unit 303 outputs authentication data indicating that authentication has been performed to the communication processing unit 301. The communication processing unit 301 transmits this authentication data to the portal server 20. If the acquired terminal ID does not match the predetermined value, the authentication unit 303 outputs unauthenticated data indicating that the authentication could not be performed to the portal server 20.

  In the portal server 20, when the authentication data is received by the communication processing unit 202, the distribution unit 204 generates list information for content distribution. The information in this list is encrypted by the encryption unit 206 and transmitted from the communication processing unit 201 to the communication terminal device 10. When specific content is designated by the communication terminal device 10, the encrypted content is transmitted from the portal server 20 to the communication terminal device 10. The communication processing unit 202 functions as a receiving unit that receives the authentication result of the second server. The distribution unit 204 functions as a distribution unit that distributes content to the communication terminal device based on the received authentication result.

  As described above, in the information communication system according to the present embodiment, the information (terminal ID) is encrypted with the common key Kd and then encrypted with the session key Ksec, so that it is double-encrypted and transmitted from the communication terminal apparatus to the server. Send to. For this reason, the information related to the terminal ID is securely transmitted and received only by the customer management server and the communication terminal device, and the portal server is not involved in the contents at all, so that the information management can be separated.

(Second Embodiment)
In the embodiment of the present invention, in addition to the method of sharing the common key Kd in advance, a method of easily sharing the encryption key using public key encryption such as RSA or elliptical encryption may be used. The public key method has a key pair (Kp, Ks), and is an encryption method having a property that data encrypted with the key Kp can be decrypted only with the key Ks.
In the information communication system according to the second embodiment, for example, the customer management server 30 and the communication terminal device 10 each have this key pair (Kp, Ks).

  FIG. 8 is a diagram illustrating a configuration of data generated by the communication terminal device according to the second embodiment. The configuration of the communication terminal device is the same as that shown in the block diagram of FIG. In the communication terminal device 10, the authentication processing unit 115 generates a key Kd used for data encryption with a random number in response to a request for a terminal ID. Next, the authentication processing unit 115 encrypts the terminal ID stored in the memory 112 or the terminal ID derived from the information stored in the memory 112 using a predetermined rule with the generated key Kd. Further, the authentication processing unit 115 encrypts the generated key Kd with the key Ks. The authentication processing unit 115 generates transfer data by adding a header and a frame length to the terminal ID (encrypted data) encrypted with the key Kd and the key Kd encrypted with the key Ks. The authentication processing unit 115 outputs the generated transfer data to the browser 114. The memory 112 functions as a holding unit that holds one of the key pairs in public key cryptography as a third key in advance. The authentication processing unit 115 functions as a generation unit that generates a random number.

  The browser 114 encrypts this input transfer data with the session key Ksec shared with the portal server 20 by SSL, and generates encrypted transfer data. Next, the communication processing unit 107 transmits the generated encrypted transfer data to the portal server 20.

  FIG. 9 is a diagram illustrating a configuration of data generated by the servers 20 and 30 according to the second embodiment. The configurations of the servers 20 and 30 are the same as the block diagram of FIG. In the portal server 20, the communication processing unit 201 performs the same decryption operation as in the first embodiment, and the communication processing unit 202 transmits the encrypted data to the customer management server 30.

  In the customer management server 30, the communication processing unit 301 receives the encrypted data with the header and frame length added from the portal server 20, and the encryption key. Next, the decryption unit 302 decrypts the encryption key with the key Kp to generate a key Kd. Further, the decryption unit 302 decrypts the encrypted data with the decrypted key Kd to obtain terminal ID data. On the server side, the portal server 20 decrypts the terminal ID with the session key Ksec, the customer management server 30 decrypts the key Kd with the key Kp, and further decrypts the decrypted terminal ID with the decrypted key Kd. To do. As a result, this terminal ID can be acquired more securely.

  As described above, in the information communication system according to the second embodiment, only the server having the key Kp can acquire the key Kd and decrypt the terminal ID. As a result, the encryption of the information is further maintained, and the confidentiality of the information can be ensured.

(Third embodiment)
In the embodiment of the present invention, the terminal ID is described as only terminal-specific information. However, for example, it is possible to make the terminal ID unique for each service (portal server).

  In the case of the third embodiment, for example, the terminal ID is in the form of terminal unique ID + variable area. The terminal unique ID is the terminal ID shown in the first and second embodiments. The variable area is an area in which identification information for identifying a service (portal server) is stored, for example.

  FIG. 10 is a diagram illustrating an operation sequence of the information communication system according to the third embodiment. FIG. 11 is a diagram illustrating a configuration of data generated by the communication terminal device according to the third embodiment. The configuration of the communication terminal device is the same as that shown in the block diagram of FIG. Since the identification information of the portal server 20 is not set, the authentication processing unit 115 of the communication terminal apparatus 10 has a terminal unique ID for identifying the communication terminal apparatus 10 and an initial value in the variable area, for example, NULL (initial value = 0). Is a terminal ID. The authentication processing unit 115 encrypts this terminal ID with the common key Kd. The authentication processing unit 115 generates transfer data by adding a header and a frame length to the terminal ID (encrypted data) encrypted with the common key Kd. The authentication processing unit 115 outputs the generated transfer data to the browser 114. The authentication processing unit 115 functions as an identification information generation unit that generates first identification information corresponding to the authenticated first server.

  FIG. 11 is a diagram illustrating a configuration of data generated by the servers 20 and 30 according to the third embodiment. The configuration of the portal server 20 is the same as that of the block diagram of FIG. 3, but the configuration of the customer management server 30 is a configuration in which an encryption unit 305 indicated by a dotted line is added to the block diagram of FIG. The portal server 20 operates in the same manner as in the first embodiment, and decrypts the encrypted transfer data into the terminal ID (encrypted data) to which the header and the frame length are added using the session key Ksec. Next, the customer management server 30 operates in the same manner as in the first embodiment, and decrypts this encrypted data with the common key Kd to obtain terminal ID data.

  Here, when the identification information transmitted from the communication terminal device 10 is not registered, the variable area is not set. For this reason, the encryption unit 305 of the customer management server 30 encrypts the identification information of the portal server 20 set in this variable area by the same processing as the authentication processing unit 115 of the communication terminal device 10. That is, the encryption unit 305 encrypts the terminal ID having the terminal unique ID and the identification information of the portal server 20 with the common key Kd. Next, the encryption unit 305 generates transfer data by adding a header and a frame length to the terminal ID. The encryption unit 206 of the portal server 20 encrypts this transfer data with the session key Ksec to generate encrypted transfer data.

  The communication terminal device 10 stores the received terminal unique ID and identification information together in the memory 112 as a terminal ID. Then, the communication terminal device 10 transmits the encrypted transfer data including the terminal ID to the portal server 20. The customer management server 30 authenticates the communication terminal device 10 based on the terminal ID that is a combination of the terminal unique ID and the identification information.

  Thus, in the information communication system according to the third embodiment, the terminal ID including the terminal unique ID for identifying the communication terminal device 10 and the identification information for identifying the portal server 20 is encrypted and transmitted. As a result, a different terminal ID can be set for each service (portal server), and independence can be maintained for each service.

(Other embodiments)
Embodiments of the present invention are not limited to the above-described embodiments, and can be expanded and modified. The expanded and modified embodiments are also included in the technical scope of the present invention.

  DESCRIPTION OF SYMBOLS 1 ... Information communication system, 10 ... Communication terminal device, 20 ... Portal server, 30 ... Customer management server, 40 ... Communication network, 102 ... Tuner part, 103 ... Descrambler, 104 ... Decoding part, 105 ... Video / audio decoding part, 106: Display processing unit, 107: Communication processing unit, 108 ... Control unit, 109 ... Key input unit, 110 ... Remote control, 111 ... IC card I / F unit, 112 ... Memory, 113 ... DRM processing unit, 114 ... Browser, DESCRIPTION OF SYMBOLS 115 ... Authentication processing part, 151 ... IC card, 201, 202, 301 ... Communication processing part, 203, 302 ... Decryption part, 204 ... Distribution part, 205 ... Database, 206, 305 ... Encryption part, 303 ... Authentication part 304, management database, Kd, Kp, Ks, key, Ksec, session key.

Claims (4)

A first server sharing a first encryption key with a communication terminal device;
The first server receiving the second encryption key from the communication terminal device and the identification information of the communication terminal device encrypted with the first encryption key;
The first server decrypting the identification information of the communication terminal device with a first decryption key;
A second server that authenticates the communication terminal device receives the identification information of the communication terminal device decrypted by the first server;
The second server decrypting the received identification information of the communication terminal device with a second decryption key;
The second server authenticating the communication terminal device based on the decrypted identification information of the communication terminal device;
The second server encrypts the communication terminal device identification information including the communication terminal device identification information and the first server identification information with the second encryption key based on the authentication. And steps to
The first server receiving the authentication result;
The first server delivering content to the communication terminal device based on the received authentication result;
The first server encrypting the encrypted identification information of the communication terminal device with the first encryption key;
The first server transmitting the encrypted identification information of the communication terminal device to the communication terminal device;
An information communication method comprising:   The step of decrypting with the second decryption key, wherein the second decryption key has the same content as the second encryption key of the communication terminal device. Information communication method. Holding one of the key pairs in public key cryptography as the third key and the fourth key in advance in the communication terminal device and the other in the second server, respectively;
Further including
In the step of decrypting with the second decryption key, the second server decrypts the second encryption key encrypted with the third key with the fourth key, and the decrypted second encryption key as the second decryption key, the method of the information communication according to claim 1, wherein decoding the identification information of the received communication terminal device. A sharing unit that shares the first encryption key with the communication terminal device, a second encryption key from the communication terminal device, and identification information of the communication terminal device encrypted with the first encryption key. When received, the communication terminal device identification information is decrypted with a first decryption key, and the decrypted communication terminal device identification information is transmitted to the second server. A first transmitting unit that receives the authentication result of the communication terminal device from a second server, a distribution unit that distributes content to the communication terminal device based on the authentication result, and the second When the identification information of the communication terminal apparatus encrypted with the second encryption key is received from the first server, the identification information of the communication terminal apparatus is encrypted with the first encryption key. And the encrypted identification information of the communication terminal device. A third transmission section for transmitting to the communication terminal device, the first server having,
A second decryption unit that decrypts the identification information of the communication terminal device with a second decryption key when receiving the identification information of the communication terminal device from the first server; An authentication unit that authenticates the communication terminal device based on the identification information of the communication terminal device, and the communication terminal including identification information of the communication terminal device and identification information of the first server based on the authentication A second encryption unit that encrypts the identification information of the apparatus with the second encryption key; and a second encryption unit that transmits the authentication result and the encrypted identification information of the communication terminal apparatus to the first server. A second server having two transmission units;
A server comprising:

Images